Function at 0x40b700
Capabilities:
Delete registry key
Delete registry value
Persist via windows service
Set registry value

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
lea ebx, [edi + 2]
push 0x20006
push ebx
call fcn.0040b440
mov esi, eax
add esp, 8
test esi, esi
jne 0x40b725
pop edi
lea eax, [esi + 1]
pop esi
pop ebx
ret
lea eax, [edi + 0x18416]
push eax
push str.Application
push esi
call fcn.0040af10
add esp, 0xc
test eax, eax
je 0x40b75e
push str.SYSTEMCurrentControlSetServices_sParameters
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 2
pop ebx
ret
lea ecx, [edi + 0x28414]
push ecx
push str.AppParameters
push esi
call fcn.0040af10
add esp, 0xc
test eax, eax
je 0x40b797
push str.SYSTEMCurrentControlSetServices_sParameters
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 3
pop ebx
ret
lea edx, [edi + 0x30412]
push edx
push str.AppDirectory
push esi
call fcn.0040af10
add esp, 0xc
test eax, eax
je 0x40b7d0
push str.SYSTEMCurrentControlSetServices_sParameters
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 4
pop ebx
ret
mov eax, dword [edi + 0x4041c]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, 0x20
je 0x40b7f3
push eax
push str.AppPriority
push esi
call fcn.0040af30
add esp, 0xc
jmp 0x40b802
cmp byte [esp + 0x18], 0
je 0x40b802
push str.AppPriority
push esi
call ebp
mov eax, dword [edi + 0x40400]
mov ecx, dword [edi + 0x40404]
mov edx, eax
or edx, ecx
je 0x40b8c1
lea edx, [esp + 0x14]
push edx
push ecx
push eax
call fcn.0040c610
add esp, 0xc
test eax, eax
jne 0x40b8a7
mov edx, dword [esp + 0x14]
mov eax, edx
lea ebp, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b834
sub eax, ebp
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push edx
push 1
push 0
push str.AppAffinity
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40b8a1
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004052c0
add esp, 4
push eax
push str.AppAffinity
push 0xc00003fb
push 1
call fcn.00405400
mov ecx, dword [esp + 0x28]
add esp, 0x14
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop ebp
pop edi
pop esi
mov eax, 5
pop ebx
ret
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40b8d0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x40b8d0
cmp byte [esp + 0x18], 0
je 0x40b8d0
push str.AppAffinity
push esi
call ebp
mov eax, dword [edi + 0x70484]
not eax
test eax, eax
je 0x40b8ed
push eax
push str.AppStopMethodSkip
push esi
call fcn.0040af30
add esp, 0xc
jmp 0x40b8fc
cmp byte [esp + 0x18], 0
je 0x40b8fc
push str.AppStopMethodSkip
push esi
call ebp
mov eax, dword [edi + 0x70478]
cmp eax, 4
jae 0x40b91d
mov edx, dword [esp + 0x18]
mov eax, dword [eax*4 + section..data]
push edx
push eax
push ebx
call fcn.0040a9c0
add esp, 0xc
mov eax, dword [edi + 0x7047c]
test eax, eax
je 0x40b938
push eax
push str.AppRestartDelay
push esi
call fcn.0040af30
add esp, 0xc
jmp 0x40b947
cmp byte [esp + 0x18], 0
je 0x40b947
push str.AppRestartDelay
push esi
call ebp
mov eax, dword [edi + 0x70480]
cmp eax, 0x5dc
je 0x40b965
push eax
push str.AppThrottle
push esi
call fcn.0040af30
add esp, 0xc
jmp 0x40b974
cmp byte [esp + 0x18], 0
je 0x40b974
push str.AppThrottle
push esi
call ebp
mov eax, dword [edi + 0x70488]
cmp eax, 0x5dc
je 0x40b992
push eax
push str.AppStopMethodConsole
push esi
call fcn.0040af30
add esp, 0xc
jmp 0x40b9a1
cmp byte [esp + 0x18], 0
je 0x40b9a1
push str.AppStopMethodConsole
push esi
call ebp
mov eax, dword [edi + 0x7048c]
cmp eax, 0x5dc
je 0x40b9bf
push eax
push str.AppStopMethodWindow
push esi
call fcn.0040af30
add esp, 0xc
jmp 0x40b9ce
cmp byte [esp + 0x18], 0
je 0x40b9ce
push str.AppStopMethodWindow
push esi
call ebp
mov eax, dword [edi + 0x70490]
cmp eax, 0x5dc
je 0x40b9ec
push eax
push str.AppStopMethodThreads
push esi
call fcn.0040af30
add esp, 0xc
jmp 0x40b9fb
cmp byte [esp + 0x18], 0
je 0x40b9fb
push str.AppStopMethodThreads
push esi
call ebp
movzx eax, word [edi + 0x40424]
lea ecx, [edi + 0x40424]
test ax, ax
jne 0x40ba1c
cmp byte [esp + 0x18], al
je 0x40baef
test ax, ax
je 0x40ba2d
push ecx
push str.AppStdin
push esi
call fcn.0040af10
add esp, 0xc
jmp 0x40ba3c
cmp byte [esp + 0x18], 0
je 0x40ba3c
push str.AppStdin
push esi
call ebp
mov eax, dword [edi + 0x50424]
cmp eax, 2
je 0x40ba5d
push eax
push str.ShareMode
push str.AppStdin
push esi
call fcn.00408750
add esp, 0x10
jmp 0x40ba77
cmp byte [esp + 0x18], 0
je 0x40ba77
push str.ShareMode
push str.AppStdin
push esi
call fcn.004087e0
add esp, 0xc
mov eax, dword [edi + 0x50428]
cmp eax, 3
je 0x40ba98
push eax
push str.CreationDisposition
push str.AppStdin
push esi
call fcn.00408750
add esp, 0x10
jmp 0x40bab2
cmp byte [esp + 0x18], 0
je 0x40bab2
push str.CreationDisposition
push str.AppStdin
push esi
call fcn.004087e0
add esp, 0xc
mov eax, dword [edi + 0x5042c]
cmp eax, 0x80
je 0x40bad5
push eax
push str.FlagsAndAttributes
push str.AppStdin
push esi
call fcn.00408750
add esp, 0x10
jmp 0x40baef
cmp byte [esp + 0x18], 0
je 0x40baef
push str.FlagsAndAttributes
push str.AppStdin
push esi
call fcn.004087e0
add esp, 0xc
movzx eax, word [edi + 0x50430]
lea ecx, [edi + 0x50430]
test ax, ax
jne 0x40bb10
cmp byte [esp + 0x18], al
je 0x40bbe3
test ax, ax
je 0x40bb21
push ecx
push str.AppStdout
push esi
call fcn.0040af10
add esp, 0xc
jmp 0x40bb30
cmp byte [esp + 0x18], 0
je 0x40bb30
push str.AppStdout
push esi
call ebp
mov eax, dword [edi + 0x60430]
cmp eax, 3
je 0x40bb51
push eax
push str.ShareMode
push str.AppStdout
push esi
call fcn.00408750
add esp, 0x10
jmp 0x40bb6b
cmp byte [esp + 0x18], 0
je 0x40bb6b
push str.ShareMode
push str.AppStdout
push esi
call fcn.004087e0
add esp, 0xc
mov eax, dword [edi + 0x60434]
cmp eax, 4
je 0x40bb8c
push eax
push str.CreationDisposition
push str.AppStdout
push esi
call fcn.00408750
add esp, 0x10
jmp 0x40bba6
cmp byte [esp + 0x18], 0
je 0x40bba6
push str.CreationDisposition
push str.AppStdout
push esi
call fcn.004087e0
add esp, 0xc
mov eax, dword [edi + 0x60438]
cmp eax, 0x80
je 0x40bbc9
push eax
push str.FlagsAndAttributes
push str.AppStdout
push esi
call fcn.00408750
add esp, 0x10
jmp 0x40bbe3
cmp byte [esp + 0x18], 0
je 0x40bbe3
push str.FlagsAndAttributes
push str.AppStdout
push esi
call fcn.004087e0
add esp, 0xc
movzx eax, word [edi + 0x60448]
lea ecx, [edi + 0x60448]
test ax, ax
jne 0x40bc04
cmp byte [esp + 0x18], al
je 0x40bcd7
test ax, ax
je 0x40bc15
push ecx
push str.AppStderr
push esi
call fcn.0040af10
add esp, 0xc
jmp 0x40bc24
cmp byte [esp + 0x18], 0
je 0x40bc24
push str.AppStderr
push esi
call ebp
mov eax, dword [edi + 0x70448]
cmp eax, 3
je 0x40bc45
push eax
push str.ShareMode
push str.AppStderr
push esi
call fcn.00408750
add esp, 0x10
jmp 0x40bc5f
cmp byte [esp + 0x18], 0
je 0x40bc5f
push str.ShareMode
push str.AppStderr
push esi
call fcn.004087e0
add esp, 0xc
mov eax, dword [edi + 0x7044c]
cmp eax, 4
je 0x40bc80
push eax
push str.CreationDisposition
push str.AppStderr
push esi
call fcn.00408750
add esp, 0x10
jmp 0x40bc9a
cmp byte [esp + 0x18], 0
je 0x40bc9a
push str.CreationDisposition
push str.AppStderr
push esi
call fcn.004087e0
add esp, 0xc
mov eax, dword [edi + 0x70450]
cmp eax, 0x80
je 0x40bcbd
push eax
push str.FlagsAndAttributes
push str.AppStderr
push esi
call fcn.00408750
add esp, 0x10
jmp 0x40bcd7
cmp byte [esp + 0x18], 0
je 0x40bcd7
push str.FlagsAndAttributes
push str.AppStderr
push esi
call fcn.004087e0
add esp, 0xc
cmp byte [edi + 0x70460], 0
je 0x40bcf2
push 1
push str.AppRotateFiles
push esi
call fcn.0040af30
add esp, 0xc
jmp 0x40bd01
cmp byte [esp + 0x18], 0
je 0x40bd01
push str.AppRotateFiles
push esi
call ebp
cmp dword [edi + 0x70464], 0
je 0x40bd1c
push 1
push str.AppRotateOnline
push esi
call fcn.0040af30
add esp, 0xc
jmp 0x40bd2b
cmp byte [esp + 0x18], 0
je 0x40bd2b
push str.AppRotateOnline
push esi
call ebp
mov eax, dword [edi + 0x7046c]
test eax, eax
je 0x40bd46
push eax
push str.AppRotateSeconds
push esi
call fcn.0040af30
add esp, 0xc
jmp 0x40bd55
cmp byte [esp + 0x18], 0
je 0x40bd55
push str.AppRotateSeconds
push esi
call ebp
mov eax, dword [edi + 0x70470]
test eax, eax
je 0x40bd70
push eax
push str.AppRotateBytes
push esi
call fcn.0040af30
add esp, 0xc
jmp 0x40bd7f
cmp byte [esp + 0x18], 0
je 0x40bd7f
push str.AppRotateBytes
push esi
call ebp
mov eax, dword [edi + 0x70474]
test eax, eax
je 0x40bd9a
push eax
push str.AppRotateBytesHigh
push esi
call fcn.0040af30
add esp, 0xc
jmp 0x40bda9
cmp byte [esp + 0x18], 0
je 0x40bda9
push str.AppRotateBytesHigh
push esi
call ebp
cmp dword [edi + 0x40420], 0
je 0x40bdc4
push 1
push str.AppNoConsole
push esi
call fcn.0040af30
add esp, 0xc
jmp 0x40bdd3
cmp byte [esp + 0x18], 0
je 0x40bdd3
push str.AppNoConsole
push esi
call ebp
mov eax, dword [edi + 0x403f8]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40be25
mov ecx, dword [edi + 0x40410]
add ecx, ecx
push ecx
push eax
push 7
push 0
push str.AppEnvironment
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40be38
push 0
call ebp
push eax
call fcn.004052c0
add esp, 4
push eax
push str.AppEnvironment
push 0xc00003fb
push 1
call fcn.00405400
add esp, 0x14
jmp 0x40be38
cmp byte [esp + 0x18], 0
je 0x40be38
push str.AppEnvironment
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [edi + 0x40414]
test eax, eax
je 0x40be90
mov edx, dword [edi + 0x40418]
add edx, edx
push edx
push eax
push 7
push 0
push str.AppEnvironmentExtra
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40bea3
push 0
call ebp
push eax
call fcn.004052c0
add esp, 4
push eax
push str.AppEnvironmentExtra
push 0xc00003fb
push 1
call fcn.00405400
add esp, 0x14
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
ret
cmp byte [esp + 0x18], 0
je 0x40bea3
push str.AppEnvironmentExtra
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
ret