Function at 0x401670
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
xor esi, esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x4576a8]
lea ecx, [ebp - 8]
push ecx
push 0xf023f
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
call edi
cmp eax, esi
jne 0x4016c6
mov eax, dword [ebp - 8]
push ebx
push eax
mov dword [ebp - 0x20], eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x20]
cmp eax, esi
je 0x4016c6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
add eax, 4
mov dword [ebp - 4], eax
cmp eax, 8
jb 0x401684
xor ebx, ebx
mov edx, dword [ebx + 0x457690]
lea eax, [ebp - 8]
push eax
push 0xf023f
push esi
push str.SOFTWAREMicrosoftInternet_ExplorerToolbar
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], edx
mov dword [ebp - 8], esi
call edi
cmp eax, esi
jne 0x40171b
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
push ecx
push eax
mov dword [ebp - 0x20], eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x20]
cmp eax, esi
je 0x40171b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebx + 0x457690]
lea eax, [ebp - 8]
push eax
push 0xf003f
push esi
push str.SOFTWAREMicrosoftInternet_ExplorerToolbar
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], edx
mov dword [ebp - 8], esi
call edi
cmp eax, esi
jne 0x401760
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
push ecx
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x14]
cmp eax, esi
je 0x401760
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 4
cmp ebx, 8
jb 0x4016d6
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], esi
jmp 0x401780
mov edx, dword [ebp - 4]
mov ebx, dword [edx + 0x457690]
lea eax, [ebp - 8]
push eax
push 0xf023f
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionexplorerBrowser_Helper_Objects
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], esi
call edi
cmp eax, esi
jne 0x4017cf
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], 0x200
call fcn.00405ed0
mov eax, dword [ebp - 8]
cmp eax, esi
je 0x4017cf
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], esi
mov edx, dword [ebp - 4]
mov ebx, dword [edx + 0x457690]
lea eax, [ebp - 8]
push eax
push 0xf003f
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionexplorerBrowser_Helper_Objects
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 8], esi
call edi
cmp eax, esi
jne 0x40181a
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], ecx
call fcn.00405ed0
mov eax, dword [ebp - 8]
cmp eax, esi
je 0x40181a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 4]
add eax, 4
mov dword [ebp - 4], eax
cmp eax, 8
jb 0x401780
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret