Function at 0x401000
Capabilities:
Check os version
Delete registry key
Delete registry value
Get common file path
Persist via run registry key

Disassembly:
sub esp, 0x68
push ebx
push ebp
push esi
push edi
push 0x40ac28
xor ebp, ebp
call fcn.00403645
mov eax, dword [esp + 0x88]
add esp, 4
test eax, eax
je 0x401038
push 0x40ac24
push eax
call fcn.004035be
add esp, 8
test eax, eax
jne 0x401038
mov ebp, 1
mov esi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0x104
push 0x40
call esi
mov edi, eax
push 0x104
push edi
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x94
push 0x40
call esi
mov ebx, eax
push ebx
mov dword [esp + 0x18], ebx
mov dword [ebx], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebx + 0x10]
cmp eax, 2
jne 0x4010a6
cmp dword [ebx + 4], 5
jne 0x4010a6
push 0x40ac14
call fcn.00403645
push 8
call fcn.004035b0
add esp, 8
test eax, eax
je 0x4010e4
mov dword [eax], 0x40914c
mov dword [eax + 4], ebp
jmp 0x4010e6
cmp eax, 1
jne 0x401389
mov eax, dword [ebx + 8]
test eax, eax
jbe 0x401389
push 0x40ac00
call fcn.00403645
push 0xc
call fcn.004035b0
add esp, 8
test eax, eax
je 0x4010e4
mov dword [eax + 4], ebp
mov dword [eax], 0x409140
mov dword [eax + 8], 0x40abf4
jmp 0x4010e6
xor eax, eax
mov esi, eax
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 8]
mov edx, dword [esi]
mov ecx, esi
call dword [edx]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x84]
push eax
push 0xf003f
push 0
push 0x40abc4
push 0x80000002
mov dword [esp + 0x30], 0x40ab68
mov dword [esp + 0x34], 0x40ab0c
mov dword [esp + 0x38], 0x40aab0
mov dword [esp + 0x3c], 0x40aa54
mov dword [esp + 0x40], 0x40a9f8
mov dword [esp + 0x44], 0x40a99c
mov dword [esp + 0x48], 0x40a940
mov dword [esp + 0x4c], 0x40a8e4
mov dword [esp + 0x50], 0x40a888
mov dword [esp + 0x54], 0x40a82c
mov dword [esp + 0x58], 0x40a7d0
mov dword [esp + 0x5c], 0x40a774
mov dword [esp + 0x60], 0x40a718
mov dword [esp + 0x64], 0x40a6bc
mov dword [esp + 0x68], 0x40a660
mov dword [esp + 0x6c], 0x40a604
mov dword [esp + 0x70], 0x40a5a8
mov dword [esp + 0x74], 0x40a54c
mov dword [esp + 0x78], 0x40a4f0
mov dword [esp + 0x7c], 0x40a494
mov dword [esp + 0x80], 0x40a438
mov dword [esp + 0x84], 0x40a3dc
mov dword [esp + 0x88], 0x40a380
call edi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x401304
mov ecx, dword [esp + 0x84]
push 0x40a378
push ecx
call ebp
push 0x40a368
mov edx, dword [esp + 0x88]
push edx
call ebp
mov eax, dword [esp + 0x84]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x40a334
mov ecx, esi
call fcn.00401740
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0x40a2d8
push 0x80000002
call edi
push 0x40a27c
push 0x80000002
call edi
push 0x40a220
push 0x80000002
call edi
push 0x40a1c4
push 0x80000002
call edi
push 0x40a168
push 0x80000002
call edi
push 0x40a15c
push 0x40a150
mov ecx, esi
call fcn.004015a0
push 0x40a144
push 0x40a150
mov ecx, esi
call fcn.004015a0
push 0x40a138
push 0x40a150
mov ecx, esi
call fcn.004015a0
push 0x40a15c
push 0x40a100
mov ecx, esi
call fcn.004015a0
push 0x40a144
push 0x40a100
mov ecx, esi
call fcn.004015a0
push 0x40a138
push 0x40a100
mov ecx, esi
call fcn.004015a0
push 0x40d9ac
push 0x40a0d0
mov ecx, esi
call fcn.004015a0
lea ebx, [esp + 0x1c]
mov dword [esp + 0x10], 0x18
mov ecx, dword [ebx]
push ecx
push 0x80000002
call edi
add ebx, 4
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
jne 0x4012e2
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, dword [esp + 0x14]
lea edx, [esp + 0x84]
push edx
push 0xf003f
push 0
push 0x40a098
push 0x80000002
call edi
test eax, eax
jne 0x40137c
mov eax, dword [esp + 0x84]
push 0x40a090
push eax
call ebp
mov ecx, dword [esp + 0x84]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x84]
push edx
push 0xf003f
push 0
push 0x40a048
push 0x80000002
call edi
test eax, eax
jne 0x40137c
mov eax, dword [esp + 0x84]
push 0x40a090
push eax
call ebp
mov ecx, dword [esp + 0x84]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, esi
call fcn.00401950
mov edi, dword [esp + 0x18]
jmp 0x401396
push 0x40a030
call fcn.00403645
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
call esi
push ebx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x68
ret 0x10