Function at 0x4051db
Capabilities:
Check if file exists
Delete file
Delete registry value
Enumerate files on windows
Get file attributes
Move file
Persist via run registry key
Query environment variable
Query or enumerate registry value
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68c
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x103
push esi
lea eax, [ebp - 0x337]
push ebx
push eax
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x338], bl
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0x22f]
push ebx
push eax
mov byte [ebp - 0x230], bl
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0x547]
push ebx
push eax
mov byte [ebp - 0x548], bl
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0x127]
push ebx
push eax
mov byte [ebp - 0x128], bl
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0x43f]
push ebx
push eax
mov byte [ebp - 0x440], bl
call sub.MSVCRT.dll_memset
add esp, 0x3c
push 0x104
lea eax, [ebp - 0x440]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x548]
push str._s.exe
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x688]
push eax
lea eax, [ebp - 0x548]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x65c]
push eax
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x128]
push 0x407984
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4053d7
cmp byte [ebp + 0xc], bl
je 0x4053d4
push 0x20
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405318
push 4
push ebx
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov dword [ebp - 4], ebx
xor eax, eax
cmp dword [ebp - 4], ebx
lea ecx, [ebp - 0x10]
push ecx
setne al
push 0xf003f
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4053c7
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x338]
push eax
mov dword [ebp - 0xc], ebx
push ebx
jmp 0x4053b8
cmp dword [ebp - 0x1c], 1
jne 0x405397
lea eax, [ebp - 0x65c]
push eax
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
pop ecx
test eax, eax
je 0x405397
lea eax, [ebp - 0x338]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
inc dword [ebp - 0xc]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x338]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
mov dword [ebp - 8], esi
mov dword [ebp - 0x14], esi
call edi
test eax, eax
je 0x405367
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x40531b
inc dword [ebp - 0x18]
lea eax, [ebp - 0x688]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4052a6
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
leave
ret