Function at 0x40e46f
Capabilities:
Delete file
Delete registry key
Enumerate files on windows
Persist via run registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x431d60
call fcn.0042f9d0
sub esp, 0x768
mov eax, dword [0x449748]
push ebx
push esi
push edi
lea ecx, [ebp - 0x774]
mov dword [ebp - 0x10], eax
call fcn.0042376d
push 0x24
push 0x43f654
xor esi, esi
push 0x43f5c8
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x40e8ea
lea eax, [ebp - 0x150]
push eax
mov edi, str..RSC
mov dword [ebp - 0x76c], esi
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push edi
call esi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40e5d4
test byte [ebp - 0x150], 0x10
jne 0x40e4eb
inc dword [ebp - 0x76c]
lea eax, [ebp - 0x150]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40e4dc
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x76c]
test eax, eax
jbe 0x40e5d4
shl eax, 2
push eax
call fcn.0042629a
mov ebx, eax
test ebx, ebx
pop ecx
je 0x40e5d4
and dword [ebp - 0x76c], 0
lea eax, [ebp - 0x150]
push eax
push edi
call esi
mov edi, eax
cmp edi, 0xffffffff
je 0x40e57c
test byte [ebp - 0x150], 0x10
jne 0x40e563
lea eax, [ebp - 0x124]
push eax
call fcn.0042f33d
pop ecx
mov ecx, dword [ebp - 0x76c]
inc dword [ebp - 0x76c]
mov dword [ebx + ecx*4], eax
lea eax, [ebp - 0x150]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40e53e
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [ebp - 0x76c]
and dword [ebp - 0x770], 0
test edi, edi
jbe 0x40e5cd
mov eax, dword [ebp - 0x770]
mov eax, dword [ebx + eax*4]
test eax, eax
je 0x40e5bf
push eax
call fcn.0040e448
mov eax, dword [ebp - 0x770]
mov eax, dword [ebx + eax*4]
test eax, eax
pop ecx
je 0x40e5bf
push eax
call fcn.004262e0
mov eax, dword [ebp - 0x770]
and dword [ebx + eax*4], 0
pop ecx
inc dword [ebp - 0x770]
cmp dword [ebp - 0x770], edi
jb 0x40e58d
push ebx
call fcn.004262e0
pop ecx
lea eax, [ebp - 0x150]
push eax
mov ebx, str..RSS
push ebx
xor edi, edi
call esi
cmp eax, 0xffffffff
mov dword [ebp - 0x76c], eax
je 0x40e6ed
test byte [ebp - 0x150], 0x10
jne 0x40e5fe
inc edi
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x76c]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40e5f4
push dword [ebp - 0x76c]
call dword [sym.imp.KERNEL32.dll_FindClose]
test edi, edi
jbe 0x40e6ed
mov eax, edi
shl eax, 2
push eax
call fcn.0042629a
mov edi, eax
test edi, edi
pop ecx
je 0x40e6ed
and dword [ebp - 0x76c], 0
lea eax, [ebp - 0x150]
push eax
push ebx
call esi
mov esi, eax
cmp esi, 0xffffffff
je 0x40e695
test byte [ebp - 0x150], 0x10
jne 0x40e67c
lea eax, [ebp - 0x124]
push eax
call fcn.0042f33d
pop ecx
mov ecx, dword [ebp - 0x76c]
inc dword [ebp - 0x76c]
mov dword [edi + ecx*4], eax
lea eax, [ebp - 0x150]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40e657
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [ebp - 0x76c]
and dword [ebp - 0x770], 0
test esi, esi
jbe 0x40e6e6
mov eax, dword [ebp - 0x770]
mov eax, dword [edi + eax*4]
test eax, eax
je 0x40e6d8
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x770]
mov eax, dword [edi + eax*4]
test eax, eax
je 0x40e6d8
push eax
call fcn.004262e0
mov eax, dword [ebp - 0x770]
and dword [edi + eax*4], 0
pop ecx
inc dword [ebp - 0x770]
cmp dword [ebp - 0x770], esi
jb 0x40e6a6
push edi
call fcn.004262e0
pop ecx
push 1
mov edi, str.SoftwareInaSoftAns
push edi
mov ebx, connect
push ebx
lea ecx, [ebp - 0x774]
call fcn.00424c76
test al, al
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
je 0x40e75d
push 0x43f598
lea ecx, [ebp - 0x774]
call fcn.00424c2d
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
lea ecx, [ebp - 0x770]
push ecx
push eax
push eax
push eax
lea ecx, [ebp - 0x774]
call fcn.00423773
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
lea ecx, [ebp - 0x774]
call fcn.00423c52
cmp dword [ebp - 0x770], 0
jne 0x40e75d
push edi
push ebx
call esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallRnsf7
mov edi, CreateStatusWindowA
push edi
call esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x358]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x40e8d6
push 1
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push edi
lea ecx, [ebp - 0x774]
call fcn.00424c76
test al, al
je 0x40e8d6
push esi
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x358]
push eax
call fcn.004258f3
add esp, 0xc
push str..TXT
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x358]
push eax
call fcn.0042583f
add esp, 0xc
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
cmp edi, 4
jl 0x40e81b
lea eax, [edi - 2]
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.00424e83
test eax, eax
pop ecx
pop ecx
jne 0x40e81b
lea eax, [ebp + edi - 0x255]
cmp byte [eax], 0x5c
jne 0x40e81b
mov byte [eax], 0
cmp word [0x44c958], 0
mov ebx, str.COMMAND.COM
mov eax, str.CMD.EXE
jne 0x40e831
mov eax, ebx
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [ebp - 0x358]
push ecx
lea ecx, [ebp - 0x45c]
push ecx
push eax
lea eax, [ebp - 0x768]
push str._s__C_IF_NOT_EXIST___s__DEL___s_
push eax
call esi
add esp, 0x14
push 3
lea eax, [ebp - 0x768]
push eax
push str.Rnsf7UninstallP1
lea ecx, [ebp - 0x774]
call fcn.00424bf5
cmp edi, 4
jl 0x40e8bd
cmp word [0x44c958], 0
je 0x40e884
mov ebx, str.CMD.EXE
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x45c]
push eax
push ebx
lea eax, [ebp - 0x768]
push str._s__C_IF_NOT_EXIST___s__RD___s_
push eax
call esi
add esp, 0x14
push 3
lea eax, [ebp - 0x768]
push eax
push str.Rnsf7UninstallP2
lea ecx, [ebp - 0x774]
call fcn.00424bf5
lea ecx, [ebp - 0x774]
call fcn.00423c52
push 0x40
push 0x43f654
push 0x43f380
jmp 0x40e8e2
push 0x40
push 0x43f654
push 0x43f2e8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x774]
call fcn.00424888
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
xor al, al
pop ebx
call fcn.00428306
leave
ret