Function at 0x401514
Capabilities:
Check if file exists
Delete registry value
Get file attributes
Persist via run registry key
Set registry value

Disassembly:
push 0x814
mov eax, 0x40b6e9
call fcn.0040a715
mov esi, ecx
mov edi, 0x20006
call fcn.00401918
test eax, eax
je 0x401538
mov edi, 0x20206
lea eax, [ebp - 0x81c]
push eax
push edi
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4017dc
push str.qintao
push dword [ebp - 0x81c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x80e]
push eax
call fcn.004025c0
add esp, 0xc
mov ebx, 0x400
test esi, esi
je 0x4015be
mov edi, str.path
push edi
push esi
call fcn.00402557
pop ecx
pop ecx
cmp eax, esi
jne 0x4015be
push edi
call fcn.0040250e
lea esi, [esi + eax*2]
push esi
lea eax, [ebp - 0x810]
push ebx
push eax
call fcn.00402775
add esp, 0x10
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x810]
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test eax, eax
je 0x4015e4
lea eax, [ebp - 0x810]
push eax
call esi
test al, 0x10
je 0x401630
push ebx
lea eax, [ebp - 0x810]
push eax
push dword [0x411c68]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x810]
push 0x5c
push eax
call fcn.00402529
mov ecx, eax
lea edx, [ebp - 0x810]
sub ecx, edx
sar ecx, 1
push 0x40e300
sub ebx, ecx
push ebx
push eax
call fcn.00402775
add esp, 0x14
lea eax, [ebp - 0x810]
push eax
call edi
test eax, eax
je 0x4017d0
lea eax, [ebp - 0x810]
push eax
call esi
test al, 0x10
jne 0x4017d0
mov eax, dword [section..data]
mov esi, section..data
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x814], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x810]
test eax, 0xffff0000
jne 0x40168d
movzx eax, ax
push eax
lea eax, [ebp - 0x814]
push eax
call fcn.00401b28
jmp 0x4016a8
push eax
call fcn.0040250e
pop ecx
lea ecx, [ebp - 0x810]
mov ebx, eax
push ecx
lea eax, [ebp - 0x814]
call fcn.00401c56
mov dword [ebp - 4], 1
mov ebx, dword [ebp - 0x814]
mov eax, dword [ebx - 0xc]
test eax, eax
je 0x40176a
jns 0x4016cc
push 0x80070057
call fcn.00401000
cmp word [ebx], 0x22
je 0x40176a
lea eax, [ebp - 0x820]
push eax
lea ecx, [ebp - 0x814]
call fcn.004019fe
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x818]
push ecx
mov edi, eax
call fcn.004019a8
pop ecx
pop ecx
mov byte [ebp - 4], 3
mov ecx, dword [eax]
lea eax, [ecx - 0x10]
lea edi, [ebx - 0x10]
cmp eax, edi
je 0x401746
cmp dword [edi + 0xc], 0
jl 0x401731
mov edx, dword [eax]
cmp edx, dword [edi]
jne 0x401731
call fcn.00401d22
mov ebx, eax
mov eax, edi
call fcn.004010aa
add ebx, 0x10
mov dword [ebp - 0x814], ebx
jmp 0x401746
mov ebx, dword [ecx - 0xc]
push ecx
lea eax, [ebp - 0x814]
call fcn.00401c56
mov ebx, dword [ebp - 0x814]
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x818]
add eax, 0xfffffff0
call fcn.004010aa
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x820]
add eax, 0xfffffff0
call fcn.004010aa
mov eax, dword [section..data]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x818], eax
mov byte [ebp - 4], 7
push ebx
push 0x40e324
lea eax, [ebp - 0x818]
call fcn.00401e69
mov edi, dword [ebp - 0x818]
mov eax, dword [edi - 0xc]
pop ecx
pop ecx
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push 0
push str.qintao
push dword [ebp - 0x81c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [ebp - 4], 1
lea eax, [edi - 0x10]
call fcn.004010aa
or dword [ebp - 4], 0xffffffff
lea eax, [ebx - 0x10]
call fcn.004010aa
push dword [ebp - 0x81c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0040a75f
ret