Function at 0x4018a0
Capabilities:
Delete registry key
Delete registry value
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x10c
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x70]
test eax, eax
je 0x40195e
lea eax, [esp + 8]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x401ad3
mov eax, dword [esp + 0x118]
test eax, eax
je 0x401926
mov ecx, dword [esi + 0x7c]
push str._play
push 0x4040f8
push str.CTEaxSpl.EXE
push ecx
lea edx, [esp + 0x24]
push str._s_s_s_s
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov ecx, dword [esp + 0x20]
add esp, 0x18
lea eax, [esp + 0x14]
push 0xff
push eax
push 1
push 0
push str.CTStartup
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x401ad3
mov eax, dword [esp + 8]
push 0
lea edx, [esp + 0x14]
push 0
push edx
push 0
push str.CTStartup
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401ad3
mov ecx, dword [esp + 8]
push str.CTStartup
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x401ad3
mov eax, dword [esi + 0x74]
test eax, eax
je 0x401a23
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea edx, [esp + 8]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000001
call edi
test eax, eax
jne 0x401ad3
mov eax, dword [esp + 0x118]
test eax, eax
lea eax, [esp + 0xc]
push eax
je 0x4019f5
mov ecx, dword [esp + 0xc]
push str.CTStartup
push ecx
call edi
test eax, eax
jne 0x401ad3
mov edx, dword [esi + 0x7c]
push str._play
push 0x4040f8
push str.CTEaxSpl.EXE
push edx
lea eax, [esp + 0x24]
push str.__s_s__s_s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
mov edx, dword [esp + 0x24]
add esp, 0x18
lea ecx, [esp + 0x14]
push 0xff
push ecx
push 1
push 0
push str.CTStartup
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x401ad3
mov ecx, dword [esp + 0xc]
push 0xf003f
push 0
push str.CTStartup
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401ad3
mov edx, dword [esp + 8]
push str.CTStartup
push edx
jmp 0x401acd
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea eax, [esp + 8]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnceEx
push 0x80000002
call edi
test eax, eax
jne 0x401ad3
mov eax, dword [esp + 0x118]
lea ecx, [esp + 0xc]
test eax, eax
push ecx
je 0x401aa8
mov edx, dword [esp + 0xc]
push str.CTStartup
push edx
call edi
test eax, eax
jne 0x401ad3
mov eax, dword [esi + 0x7c]
push str._play
push 0x4040f8
push str.CTEaxSpl.EXE
push eax
lea ecx, [esp + 0x24]
push str.__s_s__s_s
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov eax, dword [esp + 0x24]
add esp, 0x18
lea edx, [esp + 0x14]
push 0xff
push edx
push 1
push 0
push str.CTStartup
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x401ad3
mov edx, dword [esp + 0xc]
push 0xf003f
push 0
push str.CTStartup
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401ad3
mov eax, dword [esp + 8]
push str.CTStartup
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call esi
mov edx, dword [esp + 8]
push edx
call esi
pop edi
pop esi
add esp, 0x10c
ret 4