Function at 0x404c01
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
push ebx
push esi
push edi
lea eax, [ebp - 0x260]
push str.Software
push eax
call sub.MSVCRT.dll_strcpy
mov esi, 0x40c0e0
lea eax, [ebp - 0x260]
push esi
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x260]
push str.Microsoft
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x260]
push esi
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x260]
push str.Windows
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x260]
push 0x40c238
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x260]
push 0x40c234
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x260]
push esi
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x40
lea eax, [ebp - 0x260]
push str.Current
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x260]
push str.Version
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x260]
push esi
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x260]
push 0x40c220
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x260]
push str.logon
push eax
call sub.MSVCRT.dll_strcat
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 0x28
lea eax, [ebp - 4]
mov edi, 0x20006
push eax
xor esi, esi
push edi
lea eax, [ebp - 0x260]
push esi
push eax
push 0x80000002
call ebx
test eax, eax
jne 0x404d84
cmp dword [ebp + 0x10], esi
lea eax, [ebp - 8]
jne 0x404d42
push eax
push edi
push esi
push str.Notify
push dword [ebp - 4]
call ebx
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp edi, esi
sete al
jmp 0x404f9d
push esi
push eax
push esi
push edi
push esi
push esi
push esi
push str.Notify
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push dword [ebp - 4]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0x10], eax
call ebx
cmp dword [ebp + 0x10], esi
jne 0x404d84
lea eax, [ebp - 4]
push esi
push eax
push esi
push edi
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x404d8b
xor eax, eax
jmp 0x404f9d
push dword [ebp - 8]
call ebx
push dword [ebp + 8]
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 8]
push 1
push esi
push str.DllName
push dword [ebp - 4]
call ebx
push 4
lea eax, [ebp - 0xc]
pop edi
mov dword [ebp - 0xc], esi
push edi
push eax
push edi
push esi
push str.Asynchronous
push dword [ebp - 4]
call ebx
lea eax, [ebp - 0xc]
push edi
push eax
push edi
push esi
push str.Impersonate
push dword [ebp - 4]
call ebx
mov esi, str.Lock
lea edi, [ebp - 0x9c]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor eax, eax
lea edi, [ebp - 0x97]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
mov esi, str.Logoff
lea edi, [ebp - 0x8a]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
xor eax, eax
lea edi, [ebp - 0x83]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov esi, str.Logon
lea edi, [ebp - 0x78]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
lea edi, [ebp - 0x72]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov esi, str.Shutdown
lea edi, [ebp - 0x66]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor eax, eax
lea edi, [ebp - 0x5d]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
mov esi, str.StartScreenSaver
lea edi, [ebp - 0x54]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor eax, eax
lea edi, [ebp - 0x43]
mov esi, str.StopScreenSaver
stosb byte es:[edi], al
mov eax, dword [str.Startup]
lea edi, [ebp - 0x3a]
mov dword [ebp - 0x42], eax
mov eax, dword [0x40c1a0]
mov dword [ebp - 0x3e], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edi, [ebp - 0x30]
xor eax, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x20]
mov esi, str.Unlock
stosw word es:[edi], ax
lea edi, [ebp - 0x1e]
push 5
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x17]
mov esi, str.WLEvtLock
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [ebp - 0x15c]
xor eax, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x152]
mov esi, str.WLEvtLogoff
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edi, [ebp - 0x144]
xor eax, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x138]
mov esi, str.WLEvtLogon
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea edi, [ebp - 0x12c]
xor eax, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x121]
mov esi, str.WLEvtShutdown
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
lea edi, [ebp - 0x114]
xor eax, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x106]
pop ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, str.WLEvtStartScreenSaver
lea edi, [ebp - 0xfc]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
lea edi, [ebp - 0xe6]
mov esi, str.WLEvtStartup
stosw word es:[edi], ax
lea edi, [ebp - 0xe4]
push 5
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xd7]
pop ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov esi, str.WLEvtStopScreenSaver
lea edi, [ebp - 0xcc]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor eax, eax
lea edi, [ebp - 0xb7]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov esi, str.WLEvtUnlock
lea edi, [ebp - 0xb4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor eax, eax
lea edi, [ebp - 0xa8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea edi, [ebp - 0x9c]
lea esi, [ebp - 0x15c]
mov dword [ebp + 0xc], 8
push esi
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
push esi
push 1
push 0
push edi
push dword [ebp - 4]
call ebx
add esi, 0x18
add edi, 0x12
dec dword [ebp + 0xc]
jne 0x404f72
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc