Function at 0x421720
Capabilities:
Check if file exists
Delete registry value
Get file attributes
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x4d3fb8], ebx
je 0x421804
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push 0xf003f
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerStartupApprovedRun32
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x421771
push str.K7TSStart
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call edi
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push 0xf013f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerStartupApprovedRun32
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4217a2
push str.K7TSStart
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call edi
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerStartupApprovedRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4217d3
push str.K7TSStart
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call edi
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push 0xf013f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerStartupApprovedRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x421804
push str.K7TSStart
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call edi
push 0x800
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x421921
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [esi], bl
call fcn.0045e060
mov dword [ebp - 4], eax
test eax, eax
je 0x421852
push 0x104
push esi
push str.K7TSStart
push eax
call fcn.0045e550
push dword [ebp - 4]
call edi
cmp byte [esi], bl
je 0x421866
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x42190c
push 0
push str.SoftwareK7_ComputingK7TotalSecurity
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [esi + 0x400], bl
call fcn.0045e060
mov ecx, eax
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x4218a2
push 0x104
lea eax, [esi + 0x400]
push eax
push str.DirProductBase
push ecx
call fcn.0045e550
push dword [ebp - 4]
call edi
push str.K7TSecurity.exe
lea eax, [esi + 0x400]
push eax
push 0x4c0e3c
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x421911
push str.K7TSecurity.exe
lea eax, [esi + 0x400]
mov byte [esi], bl
push eax
push str.__s_s_
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0045e320
mov ebx, eax
test ebx, ebx
je 0x42190c
push esi
push str.K7TSStart
push ebx
call fcn.0045e7c0
push ebx
call edi
mov ebx, 1
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret