Function at 0x40298e
Capabilities:
Delete file
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xb90]
sub esp, 0xc10
mov eax, dword [0x44de90]
push ebx
push esi
push edi
push 0xa
pop ecx
mov esi, str.SoftwareMicrosoftWindowsCurrentVersion
lea edi, [ebp + 0x78c]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp + 0xb8c], eax
movsw word es:[edi], word [esi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor eax, eax
mov ecx, 0xf5
lea edi, [ebp + 0x7b6]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x78]
push eax
push 0x2001f
xor ebx, ebx
push ebx
lea eax, [ebp + 0x78c]
push eax
push 0x80000002
mov dword [ebp - 0x78], ebx
call esi
test eax, eax
jne 0x402bcc
mov byte [ebp - 0x74], bl
mov ecx, 0x1ff
lea edi, [ebp - 0x73]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push str.ProgramFilesDir
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x80], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402bcc
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x74]
push str.XPSecurityCenter
push eax
call fcn.00425610
lea eax, [ebp - 0x74]
push eax
push str.Removing__s_folder..
call fcn.00419ab0
lea eax, [ebp - 0x74]
push 1
push eax
call fcn.00419889
add esp, 0x18
test al, al
je 0x402a77
push str._OK._n
jmp 0x402a7c
push str._Failed._n
call fcn.00419ab0
pop ecx
lea eax, [ebp + 0x78c]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push eax
mov dword [ebp - 0x78], ebx
call fcn.00425600
pop ecx
pop ecx
lea eax, [ebp - 0x78]
push eax
mov edi, 0x2001f
push edi
push ebx
lea eax, [ebp + 0x78c]
push eax
push 0x80000002
call esi
test eax, eax
jne 0x402bcc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push str.Common_Desktop
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], ebx
mov byte [ebp - 0x74], bl
mov dword [ebp - 0x80], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402bcc
lea eax, [ebp - 0x74]
push str.XPSecurityCenter.lnk
push eax
call fcn.00425610
push str.Removing_XPSecurityCenter_Desktop_shortcut..
call fcn.00419ab0
add esp, 0xc
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x402b19
push str._OK._n
jmp 0x402b1e
push str._Failed._n
call fcn.00419ab0
pop ecx
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0x78c]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push eax
mov dword [ebp - 0x78], ebx
call fcn.00425600
pop ecx
pop ecx
lea eax, [ebp - 0x78]
push eax
push edi
push ebx
lea eax, [ebp + 0x78c]
push eax
push 0x80000002
call esi
test eax, eax
jne 0x402bcc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push str.Common_Programs
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], ebx
mov byte [ebp - 0x74], bl
mov dword [ebp - 0x80], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402bcc
lea eax, [ebp - 0x74]
push str.XPSecurityCenter
push eax
call fcn.00425610
push str.Removing_XPSecurityCenter_StartMenu_Programs_item..
call fcn.00419ab0
lea eax, [ebp - 0x74]
push 1
push eax
call fcn.00419889
add esp, 0x14
test al, al
je 0x402bb8
push str._OK._n
jmp 0x402bbd
push str._Failed._n
call fcn.00419ab0
pop ecx
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0xb8c]
pop edi
pop esi
xor eax, eax
pop ebx
call fcn.00425221
add ebp, 0xb90
leave
ret