Function at 0x40158c
Capabilities:
Create process on windows
Delete registry key
Delete registry value
Persist via run registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x18bc
call fcn.00410ef0
push ebx
push esi
lea eax, [ebp - 0x1c]
push edi
push eax
xor ebx, ebx
push str.Netscape_6.x
push str.SOFTWARENetscapeNetscape_6
mov dword [ebp - 0x1c], ebx
call fcn.00401198
lea eax, [ebp - 0x1c]
push eax
push str.Netscape_7.x
push str.SOFTWARENetscapeNetscape
call fcn.00401198
lea eax, [ebp - 0x1c]
push eax
push str.Mozilla
push str.SOFTWAREmozilla.orgMozilla
call fcn.00401198
push ebx
push str.firefox
call fcn.004013a5
mov esi, str.Opera
push 1
push esi
call fcn.004013a5
push ebx
push str.mozilla
call fcn.004013a5
push ebx
push str.NETSCP
call fcn.004013a5
add esp, 0x44
push ebx
push str.MozillaFirebird
call fcn.004013a5
pop ecx
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
pop ecx
lea eax, [ebp - 4]
push eax
push 0xf003f
push ebx
push str.SoftwareOpera_Software
push 0x80000001
call edi
test eax, eax
jne 0x40183f
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x208
push eax
lea eax, [ebp - 0x47c]
push eax
push ebx
push ebx
push str.Last_Directory
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4016e7
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x208
push eax
lea eax, [ebp - 0x47c]
push eax
push ebx
push ebx
push str.Last_CommandLine
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4016bd
lea eax, [ebp - 0x47c]
push 0x415c6c
push eax
call sub.MSVCRT.dll_wcsstr
pop ecx
test eax, eax
pop ecx
je 0x4016bd
lea eax, [ebp - 0x47c]
push 0x5c
push eax
call sub.MSVCRT.dll_wcsrchr
pop ecx
cmp eax, ebx
pop ecx
je 0x4016e7
mov word [eax + 2], bx
jmp 0x4016e7
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x208
push eax
lea eax, [ebp - 0x47c]
push eax
push ebx
push ebx
push str.Last_Directory2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40183f
lea eax, [ebp - 0x47c]
mov dword [ebp - 8], ebx
push eax
call sub.MSVCRT.dll_wcslen
cmp word [ebp + eax*2 - 0x47e], 0x5c
pop ecx
je 0x401715
lea eax, [ebp - 0x47c]
push 0x4150b8
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [ebp - 0x47c]
push str.ProgramPlugins_
push eax
call sub.MSVCRT.dll_wcscat
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0xa94]
push eax
call sub.MSVCRT.dll_wcscpy
lea eax, [ebp - 0xa94]
push str.NPIDMan1.dll
push eax
call sub.MSVCRT.dll_wcscat
add esp, 0x18
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0xa94]
push 0x41cd38
push eax
call fcn.00405ef6
cmp dword [ebp - 8], ebx
je 0x4017b4
mov eax, dword [0x41cf98]
cmp eax, ebx
jne 0x401776
mov eax, 0x41cf9c
lea ecx, [ebp - 0xa94]
push ecx
push esi
push eax
lea eax, [ebp - 0x14b4]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [0x41ce38]
add esp, 0x10
cmp eax, ebx
jne 0x40179d
mov eax, 0x41ce3c
push 0x10030
push eax
lea eax, [ebp - 0x14b4]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 8], ebx
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0xa94]
push eax
call sub.MSVCRT.dll_wcscpy
lea eax, [ebp - 0xa94]
push str.NPIDMan2.dll
push eax
call sub.MSVCRT.dll_wcscat
add esp, 0x10
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0xa94]
push 0x41cd38
push eax
call fcn.00405ef6
cmp dword [ebp - 8], ebx
je 0x40183f
mov eax, dword [0x41cf98]
cmp eax, ebx
jne 0x401804
mov eax, 0x41cf9c
lea ecx, [ebp - 0xa94]
push ecx
push esi
push eax
lea eax, [ebp - 0x14b4]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [0x41ce38]
add esp, 0x10
cmp eax, ebx
jne 0x40182b
mov eax, 0x41ce3c
push 0x10030
push eax
lea eax, [ebp - 0x14b4]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [ebp - 4]
push ebx
push eax
mov esi, 0xf003f
push ebx
push esi
push ebx
push ebx
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40187e
push str.IDMan
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x415bdc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea eax, [ebp - 0x20]
push eax
push 0x20019
push ebx
push str.SOFTWAREFullCircleTalkBack
push 0x80000002
call edi
test eax, eax
jne 0x401aef
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x30]
push ebx
push eax
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x401ae6
cmp dword [ebp - 0x2c], ebx
je 0x401ae6
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x88c]
push 0x104
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, ebx
mov dword [ebp - 0x18], eax
jne 0x401ad5
lea eax, [ebp - 0x88c]
push eax
lea eax, [ebp - 0x12b4]
push str.SOFTWAREFullCircleTalkBack_s
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
push 0x20019
lea eax, [ebp - 0x12b4]
push ebx
push eax
push 0x80000002
call edi
test eax, eax
jne 0x401ad5
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x208
push eax
lea eax, [ebp - 0x88c]
push eax
push ebx
push ebx
push str.Mozilla.exe
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40197b
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x208
push eax
lea eax, [ebp - 0x88c]
push eax
push ebx
push ebx
push str.MozillaFirebird.exe
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401acc
lea eax, [ebp - 0x88c]
push 0x5c
push eax
call sub.MSVCRT.dll_wcsrchr
pop ecx
cmp eax, ebx
pop ecx
je 0x401993
mov word [eax + 2], bx
lea eax, [ebp - 0x88c]
push str.Plugins_
push eax
lea eax, [ebp - 0xc9c]
push 0x4156e4
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0xc9c]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 0x274]
push eax
call sub.MSVCRT.dll_wcscpy
lea eax, [ebp - 0x274]
push str.NPIDMan1.dll
push eax
call sub.MSVCRT.dll_wcscat
add esp, 0x10
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x274]
push 0x41cd38
push eax
call fcn.00405ef6
cmp dword [ebp - 8], ebx
je 0x401a41
mov eax, dword [0x41cf98]
cmp eax, ebx
jne 0x401a03
mov eax, 0x41cf9c
lea ecx, [ebp - 0x274]
push ecx
push str.Mozilla
push eax
lea eax, [ebp - 0x18bc]
push eax
call esi
mov eax, dword [0x41ce38]
add esp, 0x10
cmp eax, ebx
jne 0x401a2a
mov eax, 0x41ce3c
push 0x10030
push eax
lea eax, [ebp - 0x18bc]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 8], ebx
lea eax, [ebp - 0xc9c]
push eax
lea eax, [ebp - 0x274]
push eax
call sub.MSVCRT.dll_wcscpy
lea eax, [ebp - 0x274]
push str.NPIDMan2.dll
push eax
call sub.MSVCRT.dll_wcscat
add esp, 0x10
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x274]
push 0x41cd38
push eax
call fcn.00405ef6
cmp dword [ebp - 8], ebx
je 0x401acc
mov eax, dword [0x41cf98]
cmp eax, ebx
jne 0x401a91
mov eax, 0x41cf9c
lea ecx, [ebp - 0x274]
push ecx
push str.Mozilla
push eax
lea eax, [ebp - 0x10a4]
push eax
call esi
mov eax, dword [0x41ce38]
add esp, 0x10
cmp eax, ebx
jne 0x401ab8
mov eax, 0x41ce3c
push 0x10030
push eax
lea eax, [ebp - 0x10a4]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x18], ebx
je 0x4018d0
mov esi, 0xf003f
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004022ba
push ebx
call fcn.004039d1
pop ecx
lea eax, [ebp - 4]
push eax
push esi
push ebx
push str.SOFTWAREInternet_Download_Manager
push 0x80000002
call edi
test eax, eax
jne 0x401b44
push str.AdvIntDriverEnabled
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.AdvIntDriverEnabled2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.AdvIntDriver
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
mov word [ebp - 0x684], bx
push eax
push esi
push ebx
push str.SoftwareDownloadManager_
push 0x80000001
call edi
test eax, eax
jne 0x401bca
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x208
push eax
lea eax, [ebp - 0x684]
push eax
push ebx
push ebx
push str.ExePath
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401bb3
lea eax, [ebp - 0x684]
push 0x5c
push eax
call sub.MSVCRT.dll_wcsrchr
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
je 0x401bb3
lea eax, [esi + 2]
push str.IDMan.exe
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x401bb3
mov word [esi], bx
push str.lastintres
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.ole32.dll_CoInitialize]
push ebx
call esi
call fcn.00403110
test eax, eax
je 0x401d3e
cmp dword [0x41de60], ebx
je 0x401c16
cmp word [ebp - 0x684], bx
je 0x401c0f
lea eax, [ebp - 0x684]
push eax
push str._u__s___sIDMShellExtAA.dll_
lea eax, [ebp - 0x10ac]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x401c41
push str._u__s_IDMShellExtAA.dll
jmp 0x401c32
cmp word [ebp - 0x684], bx
je 0x401c2d
lea eax, [ebp - 0x684]
push eax
push str._u__s___sIDMShellExt64.dll_
jmp 0x401bfd
push str._u__s_IDMShellExt64.dll
lea eax, [ebp - 0x10ac]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
pop ecx
pop ecx
cmp dword [0x41de60], ebx
mov byte [ebp - 9], bl
je 0x401cda
push str.shell32
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x401cda
push str.SHGetFolderPathW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, ebx
je 0x401cd1
push ebx
call esi
lea eax, [ebp - 0x274]
push eax
push ebx
push ebx
push 0x24
push ebx
call edi
test eax, eax
jne 0x401ccb
lea eax, [ebp - 0x274]
push eax
call sub.MSVCRT.dll_wcslen
cmp word [ebp + eax*2 - 0x276], 0x5c
pop ecx
je 0x401cb4
lea eax, [ebp - 0x274]
push 0x4150b8
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [ebp - 0x274]
push str.Sysnative_regsvr32.exe
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
mov byte [ebp - 9], 1
pop ecx
call dword [sym.imp.ole32.dll_CoUninitialize]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x3c
lea eax, [ebp - 0x6c]
pop esi
push esi
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
cmp byte [ebp - 9], bl
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0x40
mov dword [ebp - 0x60], str.open
je 0x401d0c
lea eax, [ebp - 0x274]
mov dword [ebp - 0x5c], eax
jmp 0x401d13
mov dword [ebp - 0x5c], str.regsvr32.exe
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], 3
mov dword [ebp - 0x4c], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x10ac]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp 0x401da5
cmp word [ebp - 0x684], bx
je 0x401d65
lea eax, [ebp - 0x684]
push eax
lea eax, [ebp - 0xc9c]
push str._sIDMShellExt.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x401d79
lea eax, [ebp - 0xc9c]
push str.IDMShellExt.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
pop ecx
pop ecx
lea eax, [ebp - 0xc9c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, ebx
je 0x401da5
push str.DllUnregisterServer
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x401d9e
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call dword [sym.imp.ole32.dll_CoUninitialize]
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0xf003f
mov edi, 0x41c4f4
push ebx
push edi
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
push ebx
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x401dea
push str.0055C089_8582_441B_A0BF_17B458C2A3A8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00403110
test eax, eax
je 0x401e28
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0xf013f
push ebx
push edi
push ebx
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x401e28
push str.0055C089_8582_441B_A0BF_17B458C2A3A8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x41e0a0], ebx
pop edi
pop esi
pop ebx
je 0x401e3d
call fcn.004028de
call fcn.0040298f
leave
ret