Function at 0x41d4f0
Capabilities:
Delete registry key
Persist via com hijack
Query environment variable
Set registry value

Disassembly:
sub esp, 0xa44
mov eax, dword [0x7fa2d0]
xor eax, esp
mov dword [esp + 0xa40], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
mov edi, ecx
push eax
lea ecx, [esp + 0x2e]
push ecx
xor ebx, ebx
mov word [esp + 0x30], ax
call fcn.0045d280
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x44a]
push eax
mov word [esp + 0x44c], dx
call fcn.0045d280
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x24e]
push edx
mov word [esp + 0x250], cx
call fcn.0045d280
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x66a]
push ecx
mov word [esp + 0x66c], ax
call fcn.0045d280
add esp, 0x30
push 0x104
lea edx, [esp + 0x640]
push edx
push str.2_XTV_VGGSVCV2KDzvec_rc
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [esp + 0x22c]
lea edx, [esp + 0x63c]
mov ecx, eax
mov esi, 0x104
sub edx, ecx
jmp 0x41d5b0
lea ecx, [esi + 0x7ffffefa]
test ecx, ecx
je 0x41d5ce
movzx ecx, word [edx + eax]
test cx, cx
je 0x41d5ce
mov word [eax], cx
add eax, 2
dec esi
jne 0x41d5b0
jmp 0x41d5d2
test esi, esi
jne 0x41d5d5
sub eax, 2
xor edx, edx
mov word [eax], dx
add edi, 0x10
push edi
lea eax, [esp + 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0x24]
mov edx, 0x104
mov ecx, eax
cmp dword [esp + 0xa54], ebx
je 0x41d76b
mov esi, 0x7cb090
sub esi, ecx
jmp 0x41d610
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x41d62e
movzx ecx, word [esi + eax]
test cx, cx
je 0x41d62e
mov word [eax], cx
add eax, 2
dec edx
jne 0x41d610
jmp 0x41d632
test edx, edx
jne 0x41d635
sub eax, 2
xor edx, edx
mov word [eax], dx
lea eax, [esp + 0x844]
mov esi, str.Default
mov ecx, eax
mov edx, 0x104
sub esi, ecx
nop
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x41d669
movzx ecx, word [esi + eax]
test cx, cx
je 0x41d669
add eax, 2
dec edx
jne 0x41d650
lea eax, [esp + 0x434]
mov esi, str.ThreadingModel
mov ecx, eax
mov edx, 0x104
sub esi, ecx
mov edi, edi
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x41d69e
movzx ecx, word [esi + eax]
test cx, cx
je 0x41d69e
mov word [eax], cx
add eax, 2
dec edx
jne 0x41d680
jmp 0x41d6a2
test edx, edx
jne 0x41d6a5
sub eax, 2
xor edx, edx
push edx
mov word [eax], dx
lea eax, [esp + 0x10]
push eax
push edx
push 0x20006
push edx
push edx
push edx
lea ecx, [esp + 0x40]
push ecx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41d7cf
lea eax, [esp + 0x22c]
lea edx, [eax + 2]
jmp 0x41d6e0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41d6e0
mov ecx, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
push edx
lea eax, [esp + 0x230]
push eax
push 1
push 0
push 0
push ecx
call esi
mov ecx, dword [0x7cb164]
mov edx, dword [0x7cb15c]
mov eax, dword [0x7cb160]
push 0x14
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], edx
mov edx, dword [0x7cb168]
push 1
mov dword [esp + 0x20], eax
mov eax, dword [0x7cb16c]
mov dword [esp + 0x28], edx
push 0
lea edx, [esp + 0x444]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x1c]
push edx
push eax
call esi
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x41d7d1
mov esi, str.SoftwareClassesCLSID934D4698_6A59_48f8_9F29_9FB30670320E
sub esi, ecx
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x41d790
movzx ecx, word [esi + eax]
test cx, cx
je 0x41d790
mov word [eax], cx
add eax, 2
dec edx
jne 0x41d772
jmp 0x41d794
test edx, edx
jne 0x41d797
sub eax, 2
xor edx, edx
mov word [eax], dx
lea eax, [esp + 0xc]
push eax
push 2
push edx
lea ecx, [esp + 0x30]
push ecx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41d7cf
mov edx, dword [esp + 0xc]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [esp + 0xa4c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0045a5ed
add esp, 0xa44
ret 4