Function at 0x40f7c0
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47ddd0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4ac084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0040f0c0
test eax, eax
je 0x40fac8
call fcn.00403450
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x40f811
push 0x80004005
call fcn.004039a0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x10]
mov dword [ebp - 4], 0
mov ecx, str.29650533_2E1B_4517_9D0C_B7243F12DF94
call fcn.00446db0
test eax, eax
jne 0x40f843
lea edx, [ebp - 0x10]
mov ecx, str.299FFF17_0FDF_47F4_A894_1DADF0D98007
call fcn.00446db0
mov edi, dword [ebp - 0x10]
or ebx, 0xffffffff
cmp dword [edi - 0xc], 0
je 0x40f8c2
lea eax, [ebp - 0x10]
mov edx, 0x491ea8
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040fae0
push str.PCKeeper.exe___autorun
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00409520
add esp, 8
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00402e10
mov byte [ebp - 4], 1
mov eax, ebx
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40f8a1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, ebx
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40f8bf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x10]
call fcn.00403450
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x40f8de
push 0x80004005
call fcn.004039a0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x14]
mov byte [ebp - 4], 3
mov ecx, str.6D62ECA7_CC77_47AF_AA5C_FE6B72350139
call fcn.00446db0
test eax, eax
jne 0x40f90d
lea edx, [ebp - 0x14]
mov ecx, str.FE88A67B_BBC2_49A8_B12F_3504144E1044
call fcn.00446db0
mov esi, dword [ebp - 0x14]
cmp dword [esi - 0xc], 0
je 0x40f989
lea eax, [ebp - 0x14]
mov edx, 0x491ea8
push eax
lea ecx, [ebp - 0x20]
call fcn.0040fae0
push str.PCKAV.exe___autorun
mov edx, eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1c]
call fcn.00409520
add esp, 8
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 5
call fcn.00402e10
mov byte [ebp - 4], 4
mov eax, ebx
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40f968
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 3
mov eax, ebx
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40f986
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push 0x10103
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40fa91
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x40fa91
push str.PCKeeper2
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x40f9e8
push 0
push 0
push 0
push 0
push str.PCKeeperLive
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40fa2b
mov eax, dword [edi - 0xc]
add eax, eax
push eax
push edi
push 1
push 0
push str.PCKeeperLive
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push eax
push str.Updating_PCK_autorun_registry_key_result:__d
push 1
push 3
push 0xb6
push str.CAutoruner::UpdateObsoleteRunRecord
push str.Autoruner.cpp
lea ecx, [ebp - 0x2c]
call fcn.00457220
push eax
call fcn.004573f0
add esp, 0x14
push 0
push 0
push 0
push 0
push 0x4920b4
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40fa88
mov eax, dword [esi - 0xc]
add eax, eax
push eax
push esi
push 1
push 0
push 0x4920b4
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push eax
push str.Updating_AV_autorun_registry_key_result:__d
push 1
push 3
push 0xbc
push str.CAutoruner::UpdateObsoleteRunRecord
push str.Autoruner.cpp
lea ecx, [ebp - 0x2c]
call fcn.00457220
push eax
call fcn.004573f0
add esp, 0x14
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40faac
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x40fac8
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret