Function at 0x401000
Capabilities:
Delete registry value
Get common file path
Set registry value

Disassembly:
push 0x68
push 0
push 0x407d70
call sub.CRTDLL.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x407d74], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.DLL_HeapCreate
mov dword [0x407d70], eax
call fcn.00406068
call fcn.0040592b
call fcn.00404492
call fcn.004038a7
call fcn.004037f0
call fcn.004030f0
push 1
push 0x407dd0
push 0
mov edx, dword [0x407dd0]
call 0x40a000
mov eax, 0x100000
push 1
call 0x40a020
push dword [0x407fa4]
push 0x100
call fcn.004033d0
lea ecx, [0x407da8]
pop edx
call fcn.00403000
push dword [0x407da8]
push 0x100
call sub.KERNEL32.DLL_GetTempPathA
mov dword [0x407db4], eax
push dword [0x407fa4]
push dword [0x407db4]
push dword [0x407da8]
call fcn.00401d2a
lea ecx, [0x407da0]
pop edx
call fcn.00403000
push dword [0x407fa4]
push 0x100
call fcn.004033d0
lea ecx, [0x407da8]
pop edx
call fcn.00403000
push 0x100
push dword [0x407da8]
call sub.KERNEL32.DLL_GetWindowsDirectoryA
mov dword [0x407db4], eax
push dword [0x407fa4]
push dword [0x407db4]
push dword [0x407da8]
call fcn.00401d2a
lea ecx, [0x407da4]
pop edx
call fcn.00403000
push dword [0x407fa4]
push 0x100
call fcn.004033d0
lea ecx, [0x407da8]
pop edx
call fcn.00403000
push 0x100
push dword [0x407da8]
call sub.KERNEL32.DLL_GetSystemDirectoryA
mov dword [0x407db4], eax
push dword [0x407fa4]
push dword [0x407db4]
push dword [0x407da8]
call fcn.00401d2a
lea ecx, [0x407d9c]
pop edx
call fcn.00403000
push dword [0x407fa4]
call fcn.0040258f
lea ecx, [0x407d98]
pop edx
call fcn.00403000
push dword [0x407fa4]
call fcn.00401bce
lea ecx, [0x407da8]
pop edx
call fcn.00403000
push dword [0x407fa4]
push dword [0x407da8]
call fcn.00401dd8
lea ecx, [0x407d94]
pop edx
call fcn.00403000
call fcn.004027c7
push dword [0x407da8]
push 0xffffffff
call fcn.00405a7c
mov dword [0x407d7c], eax
push dword [0x407d7c]
call fcn.00405ab0
mov dword [0x407d88], eax
mov ebx, dword [0x407db4]
and ebx, ebx
je 0x40187e
mov ebx, dword [0x407d88]
add ebx, 0xfffffffb
mov eax, ebx
cdq
push edx
push eax
push dword [0x407d7c]
call fcn.00405b40
push dword [0x407fa4]
push 3
call fcn.004033d0
lea ecx, [0x407da8]
pop edx
call fcn.00403000
push 3
mov eax, dword [0x407da8]
push eax
push dword [0x407d7c]
call fcn.00405b90
mov dword [0x407db4], eax
push dword [0x407fa4]
push 3
push dword [0x407da8]
call fcn.00403420
inc dword [0x407fa4]
mov edx, 0x40700c
pop ecx
mov dword [0x407fa4], ecx
add ecx, dword [0x407150]
call 0x40a120
je 0x40187a
call fcn.00402883
mov dword [0x407db4], eax
call fcn.00402883
mov dword [0x407db8], eax
mov ebx, dword [0x407db4]
sal ebx, 8
add ebx, dword [0x407db8]
mov dword [0x407db4], ebx
mov eax, dword [0x407db4]
cdq
push edx
push eax
push dword [0x407d7c]
call fcn.00405b40
push 3
mov eax, dword [0x407da8]
push eax
push dword [0x407d7c]
call fcn.00405b90
mov ebx, eax
cmp ebx, 3
jne 0x401876
push dword [0x407fa4]
push 3
push dword [0x407da8]
call fcn.00403420
inc dword [0x407fa4]
mov edx, 0x40700c
pop ecx
mov dword [0x407fa4], ecx
add ecx, dword [0x407150]
call 0x40a120
je 0x401872
push dword [0x407d7c]
call fcn.00405bf0
mov dword [0x407d8c], eax
mov ebx, dword [0x407d88]
add ebx, 0xfffffff9
mov dword [0x407d90], ebx
push 0xbf800000
call fcn.004018d2
push dword [0x407d7c]
call fcn.00405bf0
mov ebx, eax
mov edi, edx
mov eax, dword [0x407d88]
cdq
push edx
push eax
add dword [esp], 0xfffffff9
adc dword [esp + 4], 0xffffffff
pop eax
pop edx
cmp edi, edx
jl 0x40137d
jg 0x401379
cmp ebx, eax
jl 0x40137d
xor eax, eax
jmp 0x401382
mov eax, 1
or eax, eax
je 0x401870
call fcn.00402883
mov dword [0x407db8], eax
call fcn.00402883
mov dword [0x407db4], eax
call fcn.00402883
mov dword [0x407dbc], eax
mov ebx, dword [0x407db4]
sal ebx, 8
add ebx, dword [0x407dbc]
mov dword [0x407dbc], ebx
mov ebx, dword [0x407db8]
and ebx, 0xf0
mov eax, ebx
mov ebx, 0x10
cdq
idiv ebx
mov ebx, eax
mov dword [0x407db4], ebx
mov ebx, dword [0x407db4]
cmp ebx, 7
jle 0x40141c
mov ebx, dword [0x407db0]
and ebx, ebx
je 0x401405
push dword [0x407db0]
call sub.ADVAPI32.dll_RegCloseKey
mov dword [0x407db0], 0
mov ebx, dword [0x407db8]
and ebx, 0xf
add ebx, 0x80000000
mov dword [0x407db8], ebx
jmp 0x401446
mov ebx, dword [0x407db8]
and ebx, 0xf
sal ebx, 0x10
add ebx, dword [0x407dbc]
mov dword [0x407dbc], ebx
mov ebx, dword [0x407db4]
cmp ebx, 2
jne 0x401446
add dword [0x407dbc], 2
mov ebx, dword [0x407db4]
cmp ebx, 8
jge 0x401582
mov dword [0x407dc0], 0
mov ebx, dword [0x407dbc]
dec ebx
cmp ebx, dword [0x407dc0]
jl 0x40148d
call fcn.00402883
push eax
mov ebx, dword [0x407dc0]
mov ebp, dword [0x407dd0]
pop eax
mov byte [ebp + ebx], al
inc dword [0x407dc0]
jmp 0x40145f
mov edx, 0x407010
lea ecx, [0x407da8]
call fcn.00403054
mov ebx, dword [0x407db4]
cmp ebx, 2
jne 0x401515
push 2
call fcn.004022be
mov dword [0x407dc0], eax
mov dword [0x407dc4], 2
mov ebx, dword [0x407dc0]
dec ebx
cmp ebx, dword [0x407dc4]
jl 0x401513
mov edx, dword [0x407da8]
push dword [0x407fa4]
call fcn.00403140
push dword [0x407fa4]
mov ebx, dword [0x407dc4]
mov ebp, dword [0x407dd0]
movsx eax, byte [ebp + ebx]
push eax
call fcn.004034b0
pop eax
lea ecx, [0x407da8]
pop edx
call fcn.00403000
inc dword [0x407dc4]
jmp 0x4014c1
jmp 0x401580
push 0
call fcn.004022be
mov dword [0x407dc0], eax
mov dword [0x407dc4], 0
mov ebx, dword [0x407dc0]
dec ebx
cmp ebx, dword [0x407dc4]
jl 0x401580
mov edx, dword [0x407da8]
push dword [0x407fa4]
call fcn.00403140
push dword [0x407fa4]
mov ebx, dword [0x407dc4]
mov ebp, dword [0x407dd0]
movsx eax, byte [ebp + ebx]
push eax
call fcn.004034b0
pop eax
lea ecx, [0x407da8]
pop edx
call fcn.00403000
inc dword [0x407dc4]
jmp 0x40152e
jmp 0x4015c5
push dword [0x407fa4]
push dword [0x407dbc]
call fcn.004033d0
lea ecx, [0x407da8]
pop edx
call fcn.00403000
push dword [0x407dbc]
mov eax, dword [0x407da8]
push eax
push dword [0x407d7c]
call fcn.00405b90
mov ebx, eax
cmp ebx, dword [0x407dbc]
je 0x4015c5
jmp 0x401897
mov ebx, dword [0x407db4]
and ebx, ebx
jne 0x4015ef
mov ebx, dword [0x407db0]
and ebx, ebx
je 0x4015ea
mov eax, dword [0x407da8]
push eax
push dword [0x407db0]
call sub.ADVAPI32.dll_RegDeleteValueA
jmp 0x40183b
mov ebx, dword [0x407db4]
cmp ebx, 5
jge 0x40172b
mov ebx, dword [0x407db0]
and ebx, ebx
je 0x401726
mov ebx, dword [0x407db4]
cmp ebx, 2
jne 0x401630
mov ebp, dword [0x407dd0]
movsx ebx, byte [ebp]
sal ebx, 8
movsx eax, byte [ebp + 1]
add ebx, eax
mov dword [0x407db4], ebx
push str.reg2exepath
push dword [0x407dbc]
mov ebx, dword [0x407dc0]
inc ebx
push ebx
push dword [0x407d94]
call fcn.004022fa
mov dword [0x407dbc], eax
push str.reg2exewinpath
push dword [0x407dbc]
mov ebx, dword [0x407dc0]
inc ebx
push ebx
push dword [0x407da4]
call fcn.004022fa
mov dword [0x407dbc], eax
push str.reg2exesyspath
push dword [0x407dbc]
mov ebx, dword [0x407dc0]
inc ebx
push ebx
push dword [0x407d9c]
call fcn.004022fa
mov dword [0x407dbc], eax
push str.reg2exetemppath
push dword [0x407dbc]
mov ebx, dword [0x407dc0]
inc ebx
push ebx
push dword [0x407da0]
call fcn.004022fa
mov dword [0x407dbc], eax
push str.reg2exeprogspath
push dword [0x407dbc]
mov ebx, dword [0x407dc0]
inc ebx
push ebx
push dword [0x407d98]
call fcn.004022fa
mov dword [0x407dbc], eax
mov ebx, dword [0x407dbc]
mov ebp, dword [0x407dd0]
mov byte [ebp + ebx], 0
mov ebx, dword [0x407dbc]
sub ebx, dword [0x407dc0]
dec ebx
push ebx
mov ebx, dword [0x407dc0]
inc ebx
lea eax, [ebp + ebx]
push eax
push dword [0x407db4]
push 0
mov eax, dword [0x407da8]
push eax
push dword [0x407db0]
call sub.ADVAPI32.dll_RegSetValueExA
jmp 0x40183b
mov ebx, dword [0x407db4]
cmp ebx, 8
jne 0x40177f
push 0x407dc4
push 0x407db0
push 0
push 0xf003f
push 0
push 0
push 0
mov eax, dword [0x407da8]
push eax
push dword [0x407db8]
call sub.ADVAPI32.dll_RegCreateKeyExA
mov ebx, eax
and ebx, ebx
je 0x40177a
mov dword [0x407db0], 0
jmp 0x40183b
mov ebx, dword [0x407db4]
cmp ebx, 9
je 0x401797
mov ebx, dword [0x407db4]
cmp ebx, 0xc
je 0x401797
jmp 0x40179e
mov eax, 1
jmp 0x4017a0
xor eax, eax
and eax, eax
je 0x4017ee
push 0x407db0
push 0xf003f
push 0
mov eax, dword [0x407da8]
push eax
push dword [0x407db8]
call sub.ADVAPI32.dll_RegOpenKeyExA
mov ebx, eax
and ebx, ebx
je 0x4017d6
mov dword [0x407db0], 0
jmp 0x4017ec
mov ebx, dword [0x407db4]
cmp ebx, 0xc
jne 0x4017ec
push dword [0x407db0]
call fcn.004020a2
jmp 0x40183b
mov ebx, dword [0x407db4]
cmp ebx, 0xa
jne 0x401811
push 0
push dword [0x407da8]
push dword [0x407db8]
call fcn.0040217f
jmp 0x40183b
mov ebx, dword [0x407db4]
cmp ebx, 0xb
jne 0x401839
push 1
push dword [0x407da8]
push dword [0x407db8]
call fcn.0040217f
mov dword [0x407db0], eax
jmp 0x40183b
jmp 0x401897
push dword [0x407d7c]
call fcn.00405bf0
mov dword [esp - 4], eax
fild dword [esp - 4]
fisub dword [0x407d8c]
fadd dword [0x407134]
fidiv dword [0x407d90]
sub esp, 4
fstp dword [esp]
call fcn.004018d2
jmp 0x40134d
jmp 0x401874
jmp 0x401897
jmp 0x401878
jmp 0x401897
jmp 0x40187c
jmp 0x401897
jmp 0x401880
jmp 0x401897
mov ebx, dword [0x407db0]
and ebx, ebx
je 0x401895
push dword [0x407db0]
call sub.ADVAPI32.dll_RegCloseKey
jmp 0x4018a3
push 0xc0000000
call fcn.004018d2
jmp 0x401880
push 0
call 0x4018bd
push dword [0x407d70]
call sub.KERNEL32.DLL_HeapDestroy
call sub.KERNEL32.DLL_ExitProcess
call fcn.00403804
call fcn.00404464
call fcn.004058fd
call fcn.0040607c
ret