Function at 0x40cf40
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
lea ebp, [esp - 0x604]
sub esp, 0x604
push 0xffffffffffffffff
push 0x4201a0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x43f7ac]
xor eax, ebp
mov dword [ebp + 0x600], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 0x60c]
mov dword [ebp - 0x20], esi
xor edi, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], edi
cmp byte [esi + 0x798], 0
je 0x40cfd4
push 0x200
lea eax, [ebp + 0x200]
push eax
lea ecx, [esi + 0x3530]
push ecx
call fcn.0040e270
push eax
push str.CLSID_s
lea edx, [ebp + 0x400]
push edx
call fcn.00410020
lea eax, [ebp + 0x400]
push eax
push SysReAllocStringLen
call fcn.0040e4e0
add esp, 0x20
mov dword [esi + 0x3428], 0x80000002
mov ecx, str.SOFTWAREClassesCLSIDCB8DE863_0561_4ffd_9B86_5BA2E941BA52
lea edx, [esi + 0x342c]
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x40cff0
push str.SOFTWAREClassesCLSIDCB8DE863_0561_4ffd_9B86_5BA2E941BA52
push SysReAllocStringLen
call fcn.0040e4e0
push 0x200
lea ecx, [ebp + 0x200]
push ecx
push 0x434cd8
call fcn.0040e270
push eax
push str.CLSID_s
lea edx, [ebp + 0x400]
push edx
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
call esi
lea eax, [ebp + 0x400]
push eax
push SysReAllocStringLen
call fcn.00405100
push 0x200
lea ecx, [ebp + 0x200]
push ecx
push 0x434dd0
call fcn.0040e270
push eax
push str.CLSID_s
lea edx, [ebp + 0x400]
push edx
call esi
add esp, 0x40
lea eax, [ebp + 0x400]
push eax
push SysReAllocStringLen
call fcn.00405100
add esp, 8
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x14]
push edx
push edi
push 0xf003f
push edi
push edi
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionexplorerShellExecuteHooks
push SysReAllocStringLen
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call esi
test eax, eax
jne 0x40d0dd
push 0x200
lea eax, [ebp]
push eax
push 0x434cd8
call fcn.0040e270
add esp, 0xc
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
call edi
mov edx, dword [ebp - 0x14]
push edx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
jmp 0x40d0e9
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x434ce8
push SysReAllocStringLen
call esi
test eax, eax
jne 0x40d131
push 0x200
lea edx, [ebp]
push edx
push 0x434cd8
call fcn.0040e270
add esp, 0xc
push eax
mov eax, dword [ebp - 0x14]
push eax
call edi
mov ecx, dword [ebp - 0x14]
push ecx
call ebx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x14]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x434de0
push SysReAllocStringLen
call esi
test eax, eax
jne 0x40d167
push str.WebCheckStub
mov ecx, dword [ebp - 0x14]
push ecx
call edi
mov edx, dword [ebp - 0x14]
push edx
call ebx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
push SysReAllocStringLen
call esi
test eax, eax
jne 0x40d1ad
mov edx, dword [ebp - 0x20]
add edx, 0x3540
push edx
mov eax, dword [ebp - 0x14]
push eax
call edi
push str.WebExtLocation
mov ecx, dword [ebp - 0x14]
push ecx
call edi
mov edx, dword [ebp - 0x14]
push edx
call ebx
mov eax, dword [ebp - 0x20]
push eax
call fcn.0040c260
add esp, 4
mov dword [ebp - 0x1c], 1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x600]
xor ecx, ebp
call fcn.0040fe67
add ebp, 0x604
mov esp, ebp
pop ebp
ret