Function at 0x401990
Capabilities:
Delete registry key
Delete registry value
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47bc07
mov eax, dword fs:[0]
push eax
sub esp, 0x530
mov eax, dword [0x49b0c8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x530]
push eax
push 0xf003f
push 0
push 0x492c68
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x52c], 1
mov dword [ebp - 0x528], 0xff
mov byte [ebp - 0x110], 0
push 0xfe
push 0
lea ecx, [ebp - 0x10f]
push ecx
call fcn.004597c0
add esp, 0xc
lea edx, [ebp - 0x528]
push edx
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x52c]
push ecx
push 0
push 0x492cc4
mov edx, dword [ebp - 0x530]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x53c], eax
cmp dword [ebp - 0x53c], 0
je 0x401a52
cmp dword [ebp + 8], 0
jne 0x401a52
jmp 0x401cfd
cmp dword [ebp - 0x53c], 0
je 0x401b59
cmp dword [ebp + 8], 0
je 0x401b59
xor eax, eax
mov word [ebp - 0x310], ax
push 0x1fe
push 0
lea ecx, [ebp - 0x30e]
push ecx
call fcn.004597c0
add esp, 0xc
push 0x100
lea edx, [ebp - 0x310]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 4
lea ecx, [ebp - 0x518]
call fcn.004017e0
lea eax, [ebp - 0x310]
push eax
lea ecx, [ebp - 0x518]
call fcn.004020b0
mov dword [ebp - 4], 0
push 4
lea ecx, [ebp - 0x520]
call fcn.004017e0
push 0x492cf8
lea ecx, [ebp - 0x520]
call fcn.004020b0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x534]
push ecx
lea ecx, [ebp - 0x520]
call fcn.004021c0
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
lea ecx, [ebp - 0x518]
call fcn.004021a0
shl eax, 1
push eax
push 0
lea ecx, [ebp - 0x518]
call fcn.004048f0
push eax
push 1
push 0
push 0x492d54
mov edx, dword [ebp - 0x534]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x520]
call fcn.00402090
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x518]
call fcn.00402090
jmp 0x401cfd
cmp dword [ebp - 0x53c], 0
jne 0x401b8c
cmp dword [ebp + 8], 0
jne 0x401b8c
push 0x492d74
mov eax, dword [ebp - 0x530]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 0x530]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x401cfd
push 4
lea ecx, [ebp - 0x51c]
call fcn.004017e0
lea ecx, [ebp - 0x51c]
call fcn.00402150
mov dword [ebp - 4], 2
lea edx, [ebp - 0x110]
push edx
push 0x492d94
lea eax, [ebp - 0x51c]
push eax
call fcn.004029a0
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x510], cx
push 0x1fe
push 0
lea edx, [ebp - 0x50e]
push edx
call fcn.004597c0
add esp, 0xc
push 0x100
lea eax, [ebp - 0x510]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 4
lea ecx, [ebp - 0x514]
call fcn.004017e0
lea ecx, [ebp - 0x510]
push ecx
lea ecx, [ebp - 0x514]
call fcn.004020b0
mov byte [ebp - 4], 3
lea edx, [ebp - 0x51c]
push edx
lea eax, [ebp - 0x514]
push eax
call fcn.00401f80
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x401ccf
push 0x492d9c
mov edx, dword [ebp - 0x530]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push 4
lea ecx, [ebp - 0x524]
call fcn.004017e0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
lea ecx, [ebp - 0x524]
call fcn.004020b0
mov byte [ebp - 4], 4
lea eax, [ebp - 0x538]
push eax
lea ecx, [ebp - 0x524]
call fcn.004021c0
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
lea ecx, [ebp - 0x514]
call fcn.004021a0
shl eax, 1
push eax
push 0
lea ecx, [ebp - 0x514]
call fcn.004048f0
push eax
push 1
push 0
push 0x492e1c
mov ecx, dword [ebp - 0x538]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x524]
call fcn.00402090
mov edx, dword [ebp - 0x530]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x514]
call fcn.00402090
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x51c]
call fcn.00402090
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00456b9f
mov esp, ebp
pop ebp
ret