Function at 0x4025f6
Capabilities:
Check os version
Delete registry key
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x164
mov eax, dword [0x41513c]
xor eax, esp
mov dword [esp + 0x160], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 0x24]
push eax
call fcn.00402f3c
lea eax, [esp + 0x24]
call fcn.00402fbc
lea eax, [esp + 0x24]
call fcn.00402fe5
push 0x4128f4
lea eax, [esp + 0x18]
push eax
mov edi, 0x4128f8
call fcn.00402f3c
push eax
push 0x4128fc
lea eax, [esp + 0x50]
push eax
mov edi, 0x412900
call fcn.00402f3c
push eax
mov ebx, 0x412904
push ebx
lea eax, [esp + 0x54]
push eax
mov edi, ebx
call fcn.00402f3c
push eax
mov esi, 0x412908
push esi
lea eax, [esp + 0x2c]
push eax
mov edi, 0x41290c
call fcn.00402f3c
push eax
push esi
lea eax, [esp + 0x3c]
push eax
mov edi, 0x412900
call fcn.00402f3c
lea ecx, [esp + 0x44]
push ecx
mov ecx, eax
call fcn.004030d5
pop ecx
pop ecx
lea ecx, [esp + 0x58]
push ecx
mov ecx, eax
call fcn.00403084
pop ecx
pop ecx
lea ecx, [esp + 0x38]
push ecx
mov ecx, eax
call fcn.004030d5
pop ecx
pop ecx
lea ecx, [esp + 0x40]
push ecx
mov ecx, eax
call fcn.00403084
pop ecx
pop ecx
lea ecx, [esp + 0x48]
push ecx
mov ecx, eax
call fcn.004030d5
pop ecx
pop ecx
lea ecx, [esp + 0x4c]
push ecx
mov ecx, eax
call fcn.00403084
pop ecx
pop ecx
lea ecx, [esp + 0x38]
push ecx
mov ecx, eax
call fcn.004030d5
pop ecx
pop ecx
lea ecx, [esp + 0x38]
push ecx
mov ecx, eax
call fcn.00403084
pop ecx
pop ecx
lea ecx, [esp + 0x4c]
push ecx
mov ecx, eax
call fcn.004030d5
pop ecx
pop ecx
lea eax, [esp + 0x30]
call fcn.004031c1
lea eax, [esp + 0x2c]
call fcn.004031c1
lea eax, [esp + 0x3c]
call fcn.004031c1
lea eax, [esp + 0x34]
call fcn.004031c1
lea eax, [esp + 0x28]
call fcn.004031c1
lea eax, [esp + 0x1c]
call fcn.004031c1
lea eax, [esp + 0x38]
call fcn.004031c1
lea eax, [esp + 0x20]
call fcn.004031c1
lea eax, [esp + 0x18]
call fcn.004031c1
lea eax, [esp + 0x10]
call fcn.004031c1
lea eax, [esp + 0x40]
call fcn.004031c1
lea eax, [esp + 0x44]
call fcn.004031c1
lea eax, [esp + 0x14]
call fcn.004031c1
push ebx
lea eax, [esp + 0x14]
push eax
mov edi, 0x412910
call fcn.00402f3c
push eax
push esi
lea eax, [esp + 0x24]
push eax
mov edi, 0x4128f4
call fcn.00402f3c
push eax
push 0x4128fc
lea eax, [esp + 0x34]
push eax
mov edi, 0x41290c
call fcn.00402f3c
push eax
push 0x412914
lea eax, [esp + 0x54]
push eax
mov edi, 0x412900
call fcn.00402f3c
push eax
push esi
lea eax, [esp + 0x40]
push eax
mov edi, 0x412918
call fcn.00402f3c
lea ecx, [esp + 0x4c]
push ecx
mov ecx, eax
call fcn.004030d5
pop ecx
pop ecx
lea ecx, [esp + 0x54]
push ecx
mov ecx, eax
call fcn.00403084
pop ecx
pop ecx
lea ecx, [esp + 0x58]
push ecx
mov ecx, eax
call fcn.004030d5
pop ecx
pop ecx
lea ecx, [esp + 0x44]
push ecx
mov ecx, eax
call fcn.00403084
pop ecx
pop ecx
lea ecx, [esp + 0x44]
push ecx
mov ecx, eax
call fcn.004030d5
pop ecx
pop ecx
lea ecx, [esp + 0x50]
push ecx
mov ecx, eax
call fcn.00403084
pop ecx
pop ecx
lea ecx, [esp + 0x50]
push ecx
mov ecx, eax
call fcn.004030d5
pop ecx
pop ecx
lea ecx, [esp + 0x1c]
push ecx
mov ecx, eax
call fcn.00403084
pop ecx
pop ecx
lea ecx, [esp + 0x50]
push ecx
mov ecx, eax
call fcn.004030d5
pop ecx
pop ecx
lea eax, [esp + 0x14]
call fcn.004031c1
lea eax, [esp + 0x44]
call fcn.004031c1
lea eax, [esp + 0x40]
call fcn.004031c1
lea eax, [esp + 0x30]
call fcn.004031c1
lea eax, [esp + 0x2c]
call fcn.004031c1
lea eax, [esp + 0x3c]
call fcn.004031c1
lea eax, [esp + 0x34]
call fcn.004031c1
lea eax, [esp + 0x28]
call fcn.004031c1
lea eax, [esp + 0x1c]
call fcn.004031c1
lea eax, [esp + 0x38]
call fcn.004031c1
lea eax, [esp + 0x20]
call fcn.004031c1
lea eax, [esp + 0x18]
call fcn.004031c1
lea eax, [esp + 0x10]
call fcn.004031c1
mov eax, dword [esp + 0x24]
xor edi, edi
cmp dword [eax - 0xc], edi
je 0x40290a
push dword [esp + 0x4c]
lea esi, [esp + 0x28]
call fcn.00402f91
test eax, eax
jl 0x40290a
call fcn.00401dee
call fcn.0040177d
jmp 0x402be7
mov eax, dword [esp + 0x24]
cmp dword [eax - 0xc], edi
je 0x402924
push dword [esp + 0x48]
lea esi, [esp + 0x28]
call fcn.00402f91
test eax, eax
jge 0x4028fb
mov esi, 0x114
push esi
lea eax, [esp + 0x54]
push edi
push eax
call fcn.00404860
add esp, 0xc
lea eax, [esp + 0x50]
push eax
mov dword [esp + 0x54], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ebx, dword [esp + 0x54]
mov dword [esp + 0x1c], ebx
call fcn.00401dee
call fcn.0040177d
call fcn.00401fe8
call fcn.0040223a
call fcn.004022cf
call sub.ASEng.dll_Ordinal_29
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
mov esi, 0x41291c
push eax
mov edi, esi
call fcn.00402f3c
call fcn.00402462
pop ecx
lea eax, [esp + 0x30]
push eax
mov edi, str.Systweak
call fcn.00402f3c
lea eax, [esp + 0x2c]
push eax
mov edi, str.ASO3
call fcn.00402f3c
push str.BM_TASKS
lea eax, [esp + 0x30]
push eax
push str.lairtesnyv
lea eax, [esp + 0x4c]
push str.Software_
push eax
lea ecx, [esp + 0x44]
call fcn.0040312d
pop ecx
pop ecx
lea ecx, [esp + 0x50]
push ecx
mov ecx, eax
call fcn.004030d5
pop ecx
pop ecx
lea ecx, [esp + 0x1c]
push ecx
mov ecx, eax
call fcn.00403084
pop ecx
pop ecx
lea ecx, [esp + 0x40]
push ecx
mov ecx, eax
call fcn.004030d5
pop ecx
pop ecx
lea eax, [esp + 0x14]
call fcn.004031c1
lea eax, [esp + 0x44]
call fcn.004031c1
lea eax, [esp + 0x40]
call fcn.004031c1
push ebx
push ecx
lea eax, [esp + 0x44]
mov ebx, esp
mov dword [esp + 0x1c], esp
call fcn.00402edc
call fcn.00402c1b
pop ecx
pop ecx
lea eax, [esp + 0x34]
push eax
mov edi, str.Systweak
call fcn.00402f3c
lea eax, [esp + 0x28]
push eax
mov edi, str.Disk_Tools
call fcn.00402f3c
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x18]
push 0x4129b0
push eax
lea ecx, [esp + 0x40]
call fcn.004030d5
pop ecx
pop ecx
lea ecx, [esp + 0x24]
push ecx
mov ecx, eax
call fcn.00403084
pop ecx
pop ecx
lea eax, [esp + 0x14]
call fcn.004031c1
lea eax, [esp + 0x18]
push eax
mov edi, 0x4129b4
call fcn.00402f3c
cmp dword [esp + 0x1c], 6
jge 0x402af6
lea eax, [esp + 0x10]
push eax
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionRun
call fcn.00402f3c
push dword [esp + 0x20]
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push dword [esp + 0x14]
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push dword [esp + 0x20]
mov ebx, SysReAllocString
push dword [esp + 0x14]
push ebx
call edi
push esi
push dword [esp + 0x14]
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push esi
push dword [esp + 0x14]
push ebx
call edi
push dword [esp + 0x18]
push dword [esp + 0x14]
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push dword [esp + 0x18]
push dword [esp + 0x14]
push ebx
call edi
lea eax, [esp + 0x10]
jmp 0x402ba3
push ecx
lea eax, [esp + 0x24]
mov ebx, esp
mov dword [esp + 0x18], esp
call fcn.00402edc
call fcn.00402462
mov eax, esp
mov dword [esp + 0x18], esp
push eax
mov edi, str.Start_System_Protector
call fcn.00402f3c
call fcn.00402462
lea eax, [esp + 0x1c]
mov ebx, esp
mov dword [esp + 0x18], esp
call fcn.00402edc
call fcn.00402462
mov dword [esp], str.ASO3_JUMP_LIST
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea eax, [esp + 0x1c]
push eax
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
call fcn.00402f3c
lea eax, [esp + 0x38]
push eax
mov edi, str.Advanced_System_Optimizer__
call fcn.00402f3c
lea eax, [esp + 0x10]
push str.SecureDeleteShellExt_extension
push eax
lea ecx, [esp + 0x40]
call fcn.004030d5
pop ecx
pop ecx
push dword [esp + 0x10]
push dword [esp + 0x20]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
lea eax, [esp + 0x10]
call fcn.004031c1
lea eax, [esp + 0x38]
call fcn.004031c1
lea eax, [esp + 0x1c]
call fcn.004031c1
lea eax, [esp + 0x18]
call fcn.004031c1
lea eax, [esp + 0x20]
call fcn.004031c1
lea eax, [esp + 0x28]
call fcn.004031c1
lea eax, [esp + 0x34]
call fcn.004031c1
lea eax, [esp + 0x3c]
call fcn.004031c1
lea eax, [esp + 0x2c]
call fcn.004031c1
lea eax, [esp + 0x30]
call fcn.004031c1
lea eax, [esp + 0x4c]
call fcn.004031c1
lea eax, [esp + 0x48]
call fcn.004031c1
lea eax, [esp + 0x24]
call fcn.004031c1
mov ecx, dword [esp + 0x16c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00403b8f
mov esp, ebp
pop ebp
ret 0x10