Function at 0x40255f
Capabilities:
Check os version
Delete registry key
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x164
mov eax, dword [0x41513c]
xor eax, esp
mov dword [esp + 0x160], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 0x24]
push eax
call fcn.00402ea5
lea eax, [esp + 0x24]
call fcn.00402f25
lea eax, [esp + 0x24]
call fcn.00402f4e
push 0x4129b4
lea eax, [esp + 0x18]
push eax
mov edi, 0x4129b8
call fcn.00402ea5
push eax
push 0x4129bc
lea eax, [esp + 0x50]
push eax
mov edi, 0x4129c0
call fcn.00402ea5
push eax
mov ebx, 0x4129c4
push ebx
lea eax, [esp + 0x54]
push eax
mov edi, ebx
call fcn.00402ea5
push eax
mov esi, 0x4129c8
push esi
lea eax, [esp + 0x2c]
push eax
mov edi, 0x4129cc
call fcn.00402ea5
push eax
push esi
lea eax, [esp + 0x3c]
push eax
mov edi, 0x4129c0
call fcn.00402ea5
lea ecx, [esp + 0x44]
push ecx
mov ecx, eax
call fcn.0040303e
pop ecx
pop ecx
lea ecx, [esp + 0x58]
push ecx
mov ecx, eax
call fcn.00402fed
pop ecx
pop ecx
lea ecx, [esp + 0x38]
push ecx
mov ecx, eax
call fcn.0040303e
pop ecx
pop ecx
lea ecx, [esp + 0x40]
push ecx
mov ecx, eax
call fcn.00402fed
pop ecx
pop ecx
lea ecx, [esp + 0x48]
push ecx
mov ecx, eax
call fcn.0040303e
pop ecx
pop ecx
lea ecx, [esp + 0x4c]
push ecx
mov ecx, eax
call fcn.00402fed
pop ecx
pop ecx
lea ecx, [esp + 0x38]
push ecx
mov ecx, eax
call fcn.0040303e
pop ecx
pop ecx
lea ecx, [esp + 0x38]
push ecx
mov ecx, eax
call fcn.00402fed
pop ecx
pop ecx
lea ecx, [esp + 0x4c]
push ecx
mov ecx, eax
call fcn.0040303e
pop ecx
pop ecx
lea eax, [esp + 0x30]
call fcn.0040312a
lea eax, [esp + 0x2c]
call fcn.0040312a
lea eax, [esp + 0x3c]
call fcn.0040312a
lea eax, [esp + 0x34]
call fcn.0040312a
lea eax, [esp + 0x28]
call fcn.0040312a
lea eax, [esp + 0x1c]
call fcn.0040312a
lea eax, [esp + 0x38]
call fcn.0040312a
lea eax, [esp + 0x20]
call fcn.0040312a
lea eax, [esp + 0x18]
call fcn.0040312a
lea eax, [esp + 0x10]
call fcn.0040312a
lea eax, [esp + 0x40]
call fcn.0040312a
lea eax, [esp + 0x44]
call fcn.0040312a
lea eax, [esp + 0x14]
call fcn.0040312a
push ebx
lea eax, [esp + 0x14]
push eax
mov edi, 0x4129d0
call fcn.00402ea5
push eax
push esi
lea eax, [esp + 0x24]
push eax
mov edi, 0x4129b4
call fcn.00402ea5
push eax
push 0x4129bc
lea eax, [esp + 0x34]
push eax
mov edi, 0x4129cc
call fcn.00402ea5
push eax
push 0x4129d4
lea eax, [esp + 0x54]
push eax
mov edi, 0x4129c0
call fcn.00402ea5
push eax
push esi
lea eax, [esp + 0x40]
push eax
mov edi, 0x4129d8
call fcn.00402ea5
lea ecx, [esp + 0x4c]
push ecx
mov ecx, eax
call fcn.0040303e
pop ecx
pop ecx
lea ecx, [esp + 0x54]
push ecx
mov ecx, eax
call fcn.00402fed
pop ecx
pop ecx
lea ecx, [esp + 0x58]
push ecx
mov ecx, eax
call fcn.0040303e
pop ecx
pop ecx
lea ecx, [esp + 0x44]
push ecx
mov ecx, eax
call fcn.00402fed
pop ecx
pop ecx
lea ecx, [esp + 0x44]
push ecx
mov ecx, eax
call fcn.0040303e
pop ecx
pop ecx
lea ecx, [esp + 0x50]
push ecx
mov ecx, eax
call fcn.00402fed
pop ecx
pop ecx
lea ecx, [esp + 0x50]
push ecx
mov ecx, eax
call fcn.0040303e
pop ecx
pop ecx
lea ecx, [esp + 0x1c]
push ecx
mov ecx, eax
call fcn.00402fed
pop ecx
pop ecx
lea ecx, [esp + 0x50]
push ecx
mov ecx, eax
call fcn.0040303e
pop ecx
pop ecx
lea eax, [esp + 0x14]
call fcn.0040312a
lea eax, [esp + 0x44]
call fcn.0040312a
lea eax, [esp + 0x40]
call fcn.0040312a
lea eax, [esp + 0x30]
call fcn.0040312a
lea eax, [esp + 0x2c]
call fcn.0040312a
lea eax, [esp + 0x3c]
call fcn.0040312a
lea eax, [esp + 0x34]
call fcn.0040312a
lea eax, [esp + 0x28]
call fcn.0040312a
lea eax, [esp + 0x1c]
call fcn.0040312a
lea eax, [esp + 0x38]
call fcn.0040312a
lea eax, [esp + 0x20]
call fcn.0040312a
lea eax, [esp + 0x18]
call fcn.0040312a
lea eax, [esp + 0x10]
call fcn.0040312a
mov eax, dword [esp + 0x24]
xor edi, edi
cmp dword [eax - 0xc], edi
je 0x402873
push dword [esp + 0x4c]
lea esi, [esp + 0x28]
call fcn.00402efa
test eax, eax
jl 0x402873
call fcn.00401dd9
call fcn.0040177d
jmp 0x402b50
mov eax, dword [esp + 0x24]
cmp dword [eax - 0xc], edi
je 0x40288d
push dword [esp + 0x48]
lea esi, [esp + 0x28]
call fcn.00402efa
test eax, eax
jge 0x402864
mov esi, 0x114
push esi
lea eax, [esp + 0x54]
push edi
push eax
call fcn.004047c0
add esp, 0xc
lea eax, [esp + 0x50]
push eax
mov dword [esp + 0x54], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ebx, dword [esp + 0x54]
mov dword [esp + 0x1c], ebx
call fcn.00401dd9
call fcn.0040177d
call fcn.00401fd3
call fcn.004021a3
call fcn.00402238
call sub.ASEng.dll_Ordinal_29
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
mov esi, 0x4129dc
push eax
mov edi, esi
call fcn.00402ea5
call fcn.004023cb
pop ecx
lea eax, [esp + 0x30]
push eax
mov edi, 0x4129fc
call fcn.00402ea5
lea eax, [esp + 0x2c]
push eax
mov edi, str.K9PCU
call fcn.00402ea5
push str.BM_TASKS
lea eax, [esp + 0x30]
push eax
push str.lairtesnyv
lea eax, [esp + 0x4c]
push str.Software_
push eax
lea ecx, [esp + 0x44]
call fcn.00403096
pop ecx
pop ecx
lea ecx, [esp + 0x50]
push ecx
mov ecx, eax
call fcn.0040303e
pop ecx
pop ecx
lea ecx, [esp + 0x1c]
push ecx
mov ecx, eax
call fcn.00402fed
pop ecx
pop ecx
lea ecx, [esp + 0x40]
push ecx
mov ecx, eax
call fcn.0040303e
pop ecx
pop ecx
lea eax, [esp + 0x14]
call fcn.0040312a
lea eax, [esp + 0x44]
call fcn.0040312a
lea eax, [esp + 0x40]
call fcn.0040312a
push ebx
push ecx
lea eax, [esp + 0x44]
mov ebx, esp
mov dword [esp + 0x1c], esp
call fcn.00402e45
call fcn.00402b84
pop ecx
pop ecx
lea eax, [esp + 0x34]
push eax
mov edi, 0x4129fc
call fcn.00402ea5
lea eax, [esp + 0x28]
push eax
mov edi, str.Disk_Tools
call fcn.00402ea5
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x18]
push 0x412a58
push eax
lea ecx, [esp + 0x40]
call fcn.0040303e
pop ecx
pop ecx
lea ecx, [esp + 0x24]
push ecx
mov ecx, eax
call fcn.00402fed
pop ecx
pop ecx
lea eax, [esp + 0x14]
call fcn.0040312a
lea eax, [esp + 0x18]
push eax
mov edi, 0x412a5c
call fcn.00402ea5
cmp dword [esp + 0x1c], 6
jge 0x402a5f
lea eax, [esp + 0x10]
push eax
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionRun
call fcn.00402ea5
push dword [esp + 0x20]
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push dword [esp + 0x14]
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push dword [esp + 0x20]
mov ebx, SysReAllocString
push dword [esp + 0x14]
push ebx
call edi
push esi
push dword [esp + 0x14]
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push esi
push dword [esp + 0x14]
push ebx
call edi
push dword [esp + 0x18]
push dword [esp + 0x14]
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push dword [esp + 0x18]
push dword [esp + 0x14]
push ebx
call edi
lea eax, [esp + 0x10]
jmp 0x402b0c
push ecx
lea eax, [esp + 0x24]
mov ebx, esp
mov dword [esp + 0x18], esp
call fcn.00402e45
call fcn.004023cb
mov eax, esp
mov dword [esp + 0x18], esp
push eax
mov edi, str.Start_System_Protector
call fcn.00402ea5
call fcn.004023cb
lea eax, [esp + 0x1c]
mov ebx, esp
mov dword [esp + 0x18], esp
call fcn.00402e45
call fcn.004023cb
mov dword [esp], str.K9PCU_JUMP_LIST
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea eax, [esp + 0x1c]
push eax
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
call fcn.00402ea5
lea eax, [esp + 0x38]
push eax
mov edi, str.K9_PCUtilities__
call fcn.00402ea5
lea eax, [esp + 0x10]
push str.SecureDeleteShellExt_extension
push eax
lea ecx, [esp + 0x40]
call fcn.0040303e
pop ecx
pop ecx
push dword [esp + 0x10]
push dword [esp + 0x20]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
lea eax, [esp + 0x10]
call fcn.0040312a
lea eax, [esp + 0x38]
call fcn.0040312a
lea eax, [esp + 0x1c]
call fcn.0040312a
lea eax, [esp + 0x18]
call fcn.0040312a
lea eax, [esp + 0x20]
call fcn.0040312a
lea eax, [esp + 0x28]
call fcn.0040312a
lea eax, [esp + 0x34]
call fcn.0040312a
lea eax, [esp + 0x3c]
call fcn.0040312a
lea eax, [esp + 0x2c]
call fcn.0040312a
lea eax, [esp + 0x30]
call fcn.0040312a
lea eax, [esp + 0x4c]
call fcn.0040312a
lea eax, [esp + 0x48]
call fcn.0040312a
lea eax, [esp + 0x24]
call fcn.0040312a
mov ecx, dword [esp + 0x16c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00403af7
mov esp, ebp
pop ebp
ret 0x10