Function at 0x403d50
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x310
mov eax, dword [0x411ce4]
xor eax, esp
mov dword [esp + 0x30c], eax
push 0x200
lea eax, [esp + 0x10]
push eax
push 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.__start
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp]
push edx
push 3
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x403de9
lea eax, [esp]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x403de9
xor eax, eax
mov ecx, dword [esp + 0x30c]
xor ecx, esp
call fcn.0040c056
add esp, 0x310
ret
push esi
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 0x294]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push str.FTSafeNetRockey4NDService
push ecx
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov esi, dword [esp + 0x318]
jne 0x403f48
lea edx, [esp + 0x10]
lea ecx, [esp + 0x290]
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x403e58
test al, al
je 0x403e54
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x403e58
add ecx, 2
add edx, 2
test al, al
jne 0x403e38
xor eax, eax
jmp 0x403e5d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x403eb6
test esi, esi
jne 0x403e87
mov edx, dword [esp + 4]
push str.FTSafeNetRockey4NDService
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x403f4c
mov ecx, dword [esp + 4]
push ecx
jmp 0x403fb0
cmp esi, 1
jne 0x403f48
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
mov ecx, dword [esp + 0x30c]
xor ecx, esp
call fcn.0040c056
add esp, 0x310
ret
test esi, esi
jne 0x403ef8
mov eax, dword [esp + 4]
push str.FTSafeNetRockey4NDService
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x403fab
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
mov ecx, dword [esp + 0x30c]
xor ecx, esp
call fcn.0040c056
add esp, 0x310
ret
cmp esi, 1
jne 0x403f48
mov eax, dword [esp + 4]
push str.FTSafeNetRockey4NDService
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x403e7d
push 0x80
lea edx, [esp + 0x14]
push edx
push esi
push eax
mov eax, dword [esp + 0x14]
push str.FTSafeNetRockey4NDService
push eax
mov dword [esp + 0x20], 0x80
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x403e90
mov ecx, dword [esp + 4]
push ecx
jmp 0x403fb0
test esi, esi
jne 0x403f72
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
mov ecx, dword [esp + 0x30c]
xor ecx, esp
call fcn.0040c056
add esp, 0x310
ret
cmp esi, 1
jne 0x403fab
mov edx, dword [esp + 4]
push 0x80
lea ecx, [esp + 0x14]
push ecx
push esi
push 0
push str.FTSafeNetRockey4NDService
push edx
mov dword [esp + 0x20], 0x80
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x403ed2
mov eax, dword [esp + 4]
push eax
jmp 0x403fb0
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x310]
pop esi
xor ecx, esp
xor eax, eax
call fcn.0040c056
add esp, 0x310
ret