Function at 0x40b5f5
Capabilities:
Delete file
Delete registry key
Delete registry value
Get common file path
Query or enumerate registry value
Set registry value
Write file on windows

Disassembly:
push 0x1a4
push 0x4170a0
call fcn.00409e13
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov esi, ebx
mov dword [ebp - 0x38], esi
mov edi, ebx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x40], ebx
push 0x403878
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x48], eax
test eax, eax
je 0x40b646
push 0x403888
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x40], eax
push 0x104
lea eax, [ebp - 0x1b4]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x403898
lea eax, [ebp - 0x1b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x40386c
lea eax, [ebp - 0x1b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x44]
push eax
call fcn.0040a657
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x30]
push eax
push ebx
push 0x1020119
push 4
push ebx
push ebx
push 0x4038a8
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x34]
push eax
push ebx
push 0x1020119
push 4
push ebx
push ebx
push 0x40391c
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push 0x102011f
push 4
push ebx
push ebx
push 0x4037f8
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x28]
push eax
push ebx
push 0x102011f
push 4
push ebx
push ebx
mov eax, 0x403950
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push 0xf000000f
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_GetKernelObjectSecurity]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x40b74a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40b74a
push dword [ebp - 0x1c]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
mov dword [ebp - 0x3c], edi
test edi, edi
je 0x40b774
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
push edi
push 0xf000000f
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_GetKernelObjectSecurity]
test eax, eax
jne 0x40b774
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, ebx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push 0xf000000f
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_GetKernelObjectSecurity]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x40b7ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40b7ad
push dword [ebp - 0x1c]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
mov dword [ebp - 0x38], esi
test esi, esi
je 0x40b7d7
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
push esi
push 0xf000000f
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_GetKernelObjectSecurity]
test eax, eax
jne 0x40b7d7
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, ebx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x1c], 0x5f
mov byte [ebp - 0xb0], bl
mov eax, dword [ebp - 0x24]
cmp dword [ebp + 8], 0
cmove eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0xb0]
push ecx
lea ecx, [ebp - 0x50]
push ecx
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x28]
cmp dword [ebp + 8], 0
cmove eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
push 0x4039ac
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x4039ac
push 1
push ebx
push ebx
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test esi, esi
je 0x40b858
mov eax, dword [ebp - 0x24]
cmp dword [ebp + 8], 0
cmove eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
push esi
push 0xf000000f
push eax
call dword [sym.imp.ADVAPI32.dll_SetKernelObjectSecurity]
mov dword [ebp - 0x2c], eax
test edi, edi
je 0x40b87a
mov eax, dword [ebp - 0x28]
cmp dword [ebp + 8], 0
cmove eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
push edi
push 0xf000000f
push eax
call dword [sym.imp.ADVAPI32.dll_SetKernelObjectSecurity]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 1
or dword [ebp - 4], 0xffffffff
jmp 0x40b89a
cmp dword [ebp - 0x30], 0
je 0x40b8a9
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x34], 0
je 0x40b8b8
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x24], 0
je 0x40b8c7
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x28], 0
je 0x40b8d6
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x40b8e1
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
test edi, edi
je 0x40b8ec
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x2c], 0
je 0x40b935
mov esi, dword [ebp - 0x40]
mov eax, 0x403950
mov ecx, 0x4037f8
test esi, esi
je 0x40b922
push ebx
push 0x100
cmp dword [ebp + 8], 0
cmovne eax, ecx
push eax
push closesocket
mov ecx, esi
call dword [0x4193a0]
call esi
jmp 0x40b935
cmp dword [ebp + 8], 0
cmovne eax, ecx
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea eax, [ebp - 0x44]
push eax
call fcn.0040a657
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x20]
push eax
push 0x2011f
push ebx
push 0x4039c0
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x4c]
push eax
push 0x403794
call fcn.0040b33d
lea eax, [ebp - 0x1b4]
cmp dword [ebp + 8], 0
je 0x40b9eb
push ebx
push 0x20
push 2
push ebx
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40b9c6
call fcn.0040b2fc
push ebx
lea ecx, [ebp - 0x40]
push ecx
mov ecx, 0xc00
mov edx, 0xe00
test eax, eax
cmovne ecx, edx
push ecx
mov ecx, 0x401d40
mov edx, 0x401140
cmove ecx, edx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1c], 0xa
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x40ba13
push 4
lea ecx, [ebp - 0x1c]
push ecx
push 4
push ebx
push 0x403a2c
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x40ba05
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x40ba13
push 0x403a2c
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x40ba13
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x40ba21
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x4c]
push eax
push 0x4037b4
call fcn.0040b33d
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 4