Function at 0x401ab5
Capabilities:
Delete registry value
Persist via run registry key
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x2001f
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000001
call sym._RegOpenKeyExA_20
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x401ccb
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0x104
mov dword [ebp - 0x18], 0x104
mov eax, dword [ebp - 0xc]
lea edx, [eax + 1]
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0x18]
mov dword [esp + 0x1c], ecx
lea ecx, [ebp - 0x224]
mov dword [esp + 0x18], ecx
lea ecx, [ebp - 0x1c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], 0
lea ecx, [ebp - 0x14]
mov dword [esp + 0xc], ecx
lea ecx, [ebp - 0x328]
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], edx
call sym._RegEnumValueA_32
sub esp, 0x20
cmp eax, 0x103
setne al
test al, al
je 0x401cbb
mov eax, dword [ebp - 0x1c]
cmp eax, 1
jne 0x401c1e
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x120]
mov dword [esp + 4], eax
lea eax, [ebp - 0x224]
mov dword [esp], eax
call sym._ExpandEnvironmentStringsA_12
sub esp, 0xc
test eax, eax
setne al
test al, al
je 0x401c1e
lea eax, [ebp - 0x120]
mov dword [esp], eax
mov eax, dword [sym.imp.SHLWAPI.DLL_PathIsDirectoryA]
call eax
sub esp, 4
test eax, eax
jne 0x401bd0
lea eax, [ebp - 0x120]
mov dword [esp], eax
mov eax, dword [sym.imp.SHLWAPI.DLL_PathIsDirectoryEmptyA]
call eax
sub esp, 4
test eax, eax
je 0x401bd7
mov eax, 1
jmp 0x401bdc
mov eax, 0
test al, al
je 0x401c1e
mov dword [esp + 4], str.Skipping_system_file:
mov dword [esp], sym.imp.libstdc_6.dll_std::cout
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov edx, eax
lea eax, [ebp - 0x328]
mov dword [esp + 4], eax
mov dword [esp], edx
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov dword [esp], sym.std::basic_ostream_char__std::char_traits_char____std::endl_char__std::char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call sym.std::ostream::operator___std::ostream____std::ostream__
sub esp, 4
jmp 0x401b0e
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x328]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._RegDeleteValueA_8
sub esp, 8
test eax, eax
sete al
test al, al
je 0x401c7d
mov dword [esp + 4], str.Disabled_Autostart_entry:
mov dword [esp], sym.imp.libstdc_6.dll_std::cout
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov edx, eax
lea eax, [ebp - 0x328]
mov dword [esp + 4], eax
mov dword [esp], edx
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov dword [esp], sym.std::basic_ostream_char__std::char_traits_char____std::endl_char__std::char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call sym.std::ostream::operator___std::ostream____std::ostream__
sub esp, 4
jmp 0x401b0e
mov dword [esp + 4], str.Failed_to_disable_Autostart_entry:
mov dword [esp], sym.imp.libstdc_6.dll_std::cerr
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov edx, eax
lea eax, [ebp - 0x328]
mov dword [esp + 4], eax
mov dword [esp], edx
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov dword [esp], sym.std::basic_ostream_char__std::char_traits_char____std::endl_char__std::char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call sym.std::ostream::operator___std::ostream____std::ostream__
sub esp, 4
jmp 0x401b0e
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
jmp 0x401cf0
mov dword [esp + 4], str.Failed_to_open_Autostart_registry_key.
mov dword [esp], sym.imp.libstdc_6.dll_std::cerr
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov dword [esp], sym.std::basic_ostream_char__std::char_traits_char____std::endl_char__std::char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call sym.std::ostream::operator___std::ostream____std::ostream__
sub esp, 4
nop
leave
ret