Function at 0x406570
Capabilities:
Delete registry key
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44fb0b
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x460adc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor esi, esi
mov dword [ebp - 0xa8], edi
mov ebx, 7
cmp dword [edi + 0x10], esi
je 0x40660d
push 6
xor eax, eax
push 0x4568dc
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x8c], esi
mov word [ebp - 0x9c], ax
call fcn.00403280
mov dword [ebp - 4], esi
mov ecx, dword [edi + 0x10]
mov edx, dword [ecx]
mov edx, dword [edx]
push 0x64
lea eax, [ebp - 0x9c]
push eax
call edx
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x88], 8
jb 0x40660d
mov eax, dword [ebp - 0x9c]
push eax
call fcn.004204e8
add esp, 4
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
push 0x34
mov word [ebp - 0x80], cx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x70], esi
call fcn.00403280
push 0x26
push str.EEF43100_2CCC_4E69_9A50_435C82804A4A
lea ecx, [ebp - 0x80]
mov dword [ebp - 4], 1
call fcn.00402950
cmp dword [ebp - 0x6c], 8
mov eax, dword [ebp - 0x80]
jae 0x406655
lea eax, [ebp - 0x80]
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push eax
push SysReAllocString
call edi
push 0xc
xor edx, edx
push str.SoftwareSta
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x54], esi
mov word [ebp - 0x64], dx
call fcn.00403280
mov byte [ebp - 4], 2
cmp dword [ebp - 0x50], 8
mov eax, dword [ebp - 0x64]
jae 0x40668e
lea eax, [ebp - 0x64]
push eax
push SysReAllocString
call edi
push 0x2e
xor eax, eax
push str.SoftwareMicrosoftWindowsCurrentVersionRun_
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], esi
mov word [ebp - 0x48], ax
call fcn.00403280
mov byte [ebp - 4], 3
xor ecx, ecx
push 4
mov word [ebp - 0x2c], cx
push str.tttq
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], esi
call fcn.00403280
mov edi, 8
mov byte [ebp - 4], 4
cmp dword [ebp - 0x18], edi
jb 0x4066e9
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0xa4], edx
jmp 0x4066f2
lea eax, [ebp - 0x2c]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x34], edi
jae 0x4066fd
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0xa0]
push ecx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x406735
mov edx, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xa0]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 0xa0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xa8]
cmp dword [eax + 0x10], esi
je 0x40674a
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
cmp dword [ebp - 0x18], edi
jb 0x40675b
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.004204e8
add esp, 4
xor edx, edx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], esi
mov word [ebp - 0x2c], dx
cmp dword [ebp - 0x34], edi
jb 0x406778
mov eax, dword [ebp - 0x48]
push eax
call fcn.004204e8
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], esi
mov word [ebp - 0x48], cx
cmp dword [ebp - 0x50], edi
jb 0x406795
mov edx, dword [ebp - 0x64]
push edx
call fcn.004204e8
add esp, 4
xor eax, eax
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x54], esi
mov word [ebp - 0x64], ax
cmp dword [ebp - 0x6c], edi
jb 0x4067b2
mov ecx, dword [ebp - 0x80]
push ecx
call fcn.004204e8
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004204f3
mov esp, ebp
pop ebp
ret