Function at 0x401587
Capabilities:
Create process on windows
Delete registry key
Delete registry value
Persist via run registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x18b8
call fcn.004105c0
push ebx
push esi
lea eax, [ebp - 0x24]
push edi
push eax
xor esi, esi
push str.Netscape_6.x
push str.SOFTWARENetscapeNetscape_6
mov dword [ebp - 0x24], esi
call fcn.00401193
lea eax, [ebp - 0x24]
push eax
push str.Netscape_7.x
push str.SOFTWARENetscapeNetscape
call fcn.00401193
lea eax, [ebp - 0x24]
push eax
push str.Mozilla
push str.SOFTWAREmozilla.orgMozilla
call fcn.00401193
push esi
push str.firefox
call fcn.004013a0
mov edi, str.Opera
push 1
push edi
call fcn.004013a0
push esi
push str.mozilla
call fcn.004013a0
push esi
push str.NETSCP
call fcn.004013a0
add esp, 0x44
push esi
push str.MozillaFirebird
call fcn.004013a0
pop ecx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
pop ecx
lea eax, [ebp - 4]
push eax
push 0xf003f
push esi
push str.SoftwareOpera_Software
push 0x80000001
call ebx
test eax, eax
jne 0x40183a
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x208
push eax
lea eax, [ebp - 0x270]
push eax
push esi
push esi
push str.Last_Directory
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4016e2
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x208
push eax
lea eax, [ebp - 0x270]
push eax
push esi
push esi
push str.Last_CommandLine
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4016b8
lea eax, [ebp - 0x270]
push 0x414bac
push eax
call sub.MSVCRT.dll_wcsstr
pop ecx
test eax, eax
pop ecx
je 0x4016b8
lea eax, [ebp - 0x270]
push 0x5c
push eax
call sub.MSVCRT.dll_wcsrchr
pop ecx
cmp eax, esi
pop ecx
je 0x4016e2
mov word [eax + 2], si
jmp 0x4016e2
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x208
push eax
lea eax, [ebp - 0x270]
push eax
push esi
push esi
push str.Last_Directory2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40183a
lea eax, [ebp - 0x270]
mov dword [ebp - 8], esi
push eax
call sub.MSVCRT.dll_wcslen
cmp word [ebp + eax*2 - 0x272], 0x5c
pop ecx
je 0x401710
lea eax, [ebp - 0x270]
push 0x4140b8
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [ebp - 0x270]
push str.ProgramPlugins_
push eax
call sub.MSVCRT.dll_wcscat
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x888]
push eax
call sub.MSVCRT.dll_wcscpy
lea eax, [ebp - 0x888]
push str.NPIDMan1.dll
push eax
call sub.MSVCRT.dll_wcscat
add esp, 0x18
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x888]
push 0x41b968
push eax
call fcn.004059d7
cmp dword [ebp - 8], esi
je 0x4017af
mov eax, dword [0x41bbc8]
cmp eax, esi
jne 0x401771
mov eax, 0x41bbcc
lea ecx, [ebp - 0x888]
push ecx
push edi
push eax
lea eax, [ebp - 0x10a0]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [0x41ba68]
add esp, 0x10
cmp eax, esi
jne 0x401798
mov eax, 0x41ba6c
push 0x10030
push eax
lea eax, [ebp - 0x10a0]
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 8], esi
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x888]
push eax
call sub.MSVCRT.dll_wcscpy
lea eax, [ebp - 0x888]
push str.NPIDMan2.dll
push eax
call sub.MSVCRT.dll_wcscat
add esp, 0x10
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x888]
push 0x41b968
push eax
call fcn.004059d7
cmp dword [ebp - 8], esi
je 0x40183a
mov eax, dword [0x41bbc8]
cmp eax, esi
jne 0x4017ff
mov eax, 0x41bbcc
lea ecx, [ebp - 0x888]
push ecx
push edi
push eax
lea eax, [ebp - 0x10a0]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [0x41ba68]
add esp, 0x10
cmp eax, esi
jne 0x401826
mov eax, 0x41ba6c
push 0x10030
push eax
lea eax, [ebp - 0x10a0]
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [ebp - 4]
push esi
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x401876
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.IDMan
push dword [ebp - 4]
call edi
push 0x414b1c
push dword [ebp - 4]
call edi
lea eax, [ebp - 0x18]
mov edi, 0x80000002
push eax
push 0x20019
push esi
push str.SOFTWAREFullCircleTalkBack
push edi
call ebx
test eax, eax
jne 0x401ae9
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x2c]
push esi
push eax
lea eax, [ebp - 0x28]
push eax
push esi
push esi
push esi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x401ae0
cmp dword [ebp - 0x28], esi
je 0x401ae0
mov dword [ebp - 0x14], esi
lea eax, [ebp - 0x680]
push 0x104
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, esi
mov dword [ebp - 0x20], eax
jne 0x401ad4
lea eax, [ebp - 0x680]
push eax
lea eax, [ebp - 0xea0]
push str.SOFTWAREFullCircleTalkBack_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
push 0x20019
lea eax, [ebp - 0xea0]
push esi
push eax
push edi
call ebx
test eax, eax
jne 0x401ad4
lea eax, [ebp - 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
lea eax, [ebp - 0x680]
push eax
push esi
push esi
push str.Mozilla.exe
push dword [ebp - 0x1c]
mov dword [ebp - 0x10], 0x208
call edi
test eax, eax
je 0x40196c
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x208
push eax
lea eax, [ebp - 0x680]
push eax
push esi
push esi
push str.MozillaFirebird.exe
push dword [ebp - 0x1c]
call edi
test eax, eax
jne 0x401ac6
lea eax, [ebp - 0x680]
push 0x5c
push eax
call sub.MSVCRT.dll_wcsrchr
pop ecx
cmp eax, esi
pop ecx
je 0x401984
mov word [eax + 2], si
lea eax, [ebp - 0x680]
push str.Plugins_
push eax
lea eax, [ebp - 0xa90]
push 0x4146e4
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0xa90]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 0x478]
push eax
call sub.MSVCRT.dll_wcscpy
lea eax, [ebp - 0x478]
push str.NPIDMan1.dll
push eax
call sub.MSVCRT.dll_wcscat
add esp, 0x10
lea eax, [ebp - 8]
mov edi, 0x41b968
push esi
push eax
lea eax, [ebp - 0x478]
push edi
push eax
call fcn.004059d7
cmp dword [ebp - 8], esi
je 0x401a3b
mov eax, dword [0x41bbc8]
cmp eax, esi
jne 0x4019f9
mov eax, 0x41bbcc
lea ecx, [ebp - 0x478]
push ecx
push str.Mozilla
push eax
lea eax, [ebp - 0x18b8]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [0x41ba68]
add esp, 0x10
cmp eax, esi
jne 0x401a24
mov eax, 0x41ba6c
push 0x10030
push eax
lea eax, [ebp - 0x18b8]
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 8], esi
lea eax, [ebp - 0xa90]
push eax
lea eax, [ebp - 0x478]
push eax
call sub.MSVCRT.dll_wcscpy
lea eax, [ebp - 0x478]
push str.NPIDMan2.dll
push eax
call sub.MSVCRT.dll_wcscat
add esp, 0x10
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x478]
push edi
push eax
call fcn.004059d7
cmp dword [ebp - 8], esi
je 0x401ac6
mov eax, dword [0x41bbc8]
cmp eax, esi
jne 0x401a87
mov eax, 0x41bbcc
lea ecx, [ebp - 0x478]
push ecx
push str.Mozilla
push eax
lea eax, [ebp - 0x14a8]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [0x41ba68]
add esp, 0x10
cmp eax, esi
jne 0x401ab2
mov eax, 0x41ba6c
push 0x10030
push eax
lea eax, [ebp - 0x14a8]
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, 0x80000002
inc dword [ebp - 0x14]
cmp dword [ebp - 0x20], esi
je 0x4018c3
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004021e1
push esi
call fcn.004036d8
pop ecx
lea eax, [ebp - 4]
push eax
push 0xf003f
push esi
push str.SOFTWAREInternet_Download_Manager
push edi
call ebx
test eax, eax
jne 0x401b38
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.AdvIntDriverEnabled
push dword [ebp - 4]
call edi
push str.AdvIntDriverEnabled2
push dword [ebp - 4]
call edi
push str.AdvIntDriver
push dword [ebp - 4]
call edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
mov word [ebp - 0xc98], si
push eax
push 0xf003f
push esi
push str.SoftwareDownloadManager_
push 0x80000001
call ebx
test eax, eax
jne 0x401bc2
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x208
push eax
lea eax, [ebp - 0xc98]
push eax
push esi
push esi
push str.ExePath
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401bab
lea eax, [ebp - 0xc98]
push 0x5c
push eax
call sub.MSVCRT.dll_wcsrchr
mov edi, eax
pop ecx
cmp edi, esi
pop ecx
je 0x401bab
lea eax, [edi + 2]
push str.IDMan.exe
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x401bab
mov word [edi], si
push str.lastintres
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
call fcn.00403037
test eax, eax
je 0x401c65
cmp word [ebp - 0xc98], si
je 0x401bfd
lea eax, [ebp - 0xc98]
push eax
lea eax, [ebp - 0x14b0]
push str._u__s___sIDMShellExt64.dll_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x401c11
lea eax, [ebp - 0x14b0]
push str._u__s_IDMShellExt64.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
pop ecx
pop ecx
push 0x3c
lea eax, [ebp - 0x68]
pop edi
push edi
push esi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x64], 0x40
mov dword [ebp - 0x5c], str.open
mov dword [ebp - 0x58], str.regsvr32.exe
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], 3
mov dword [ebp - 0x48], esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x14b0]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp 0x401ccc
cmp word [ebp - 0xc98], si
je 0x401c8c
lea eax, [ebp - 0xc98]
push eax
lea eax, [ebp - 0xa90]
push str._sIDMShellExt.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x401ca0
lea eax, [ebp - 0xa90]
push str.IDMShellExt.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
pop ecx
pop ecx
lea eax, [ebp - 0xa90]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, esi
je 0x401ccc
push str.DllUnregisterServer
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x401cc5
call eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call dword [sym.imp.ole32.dll_CoUninitialize]
lea eax, [ebp - 4]
push esi
push eax
push esi
push 0xf003f
mov ebx, 0x41b124
push esi
push ebx
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
push esi
push edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x401d11
push str.0055C089_8582_441B_A0BF_17B458C2A3A8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00403037
test eax, eax
je 0x401d4f
lea eax, [ebp - 4]
push esi
push eax
push esi
push 0xf013f
push esi
push ebx
push esi
push edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x401d4f
push str.0055C089_8582_441B_A0BF_17B458C2A3A8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x41ccd0], esi
pop edi
pop esi
pop ebx
je 0x401d64
call fcn.00402805
call fcn.004028b6
leave
ret