Function at 0x403b40
Capabilities:
Create process on windows
Delete registry key
Delete registry value
Get common file path
Persist via run registry key
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x41a1e8
mov eax, dword fs:[0]
push eax
mov eax, 0x3348
call fcn.0040b4f0
mov eax, dword [0x4243c8]
xor eax, esp
mov dword [esp + 0x3344], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4243c8]
xor eax, esp
push eax
lea eax, [esp + 0x335c]
mov dword fs:[0], eax
xor edi, edi
mov dword [esp + 0x3364], edi
call dword [0x42430c]
push 0x618
lea eax, [esp + 0x2342]
push edi
push eax
mov dword [esp + 0x2c], edi
mov word [esp + 0x2348], di
call fcn.0040b3b0
push 0x618
lea ecx, [esp + 0x932]
push edi
push ecx
mov word [esp + 0x938], di
call fcn.0040b3b0
push 0x618
lea edx, [esp + 0x322]
push edi
push edx
mov word [esp + 0x328], di
call fcn.0040b3b0
push 0x1fe
lea eax, [esp + 0x12e]
push edi
push eax
mov dword [esp + 0x44], edi
mov word [esp + 0x134], di
call fcn.0040b3b0
push 0x7fe
lea ecx, [esp + 0x1b72]
push edi
push ecx
mov word [esp + 0x1b78], di
call fcn.0040b3b0
push 0x9fe
lea edx, [esp + 0x299a]
push edi
mov ebx, 0x400
push edx
mov dword [esp + 0x6c], ebx
mov word [esp + 0x29a0], di
call fcn.0040b3b0
add esp, 0x48
push 0x7fe
lea eax, [esp + 0x1342]
push edi
push eax
xor esi, esi
mov word [esp + 0x1348], di
call fcn.0040b3b0
add esp, 0xc
lea ecx, [esp + 0x20]
push ecx
push 0x20019
push edi
push str.SoftwareMicrosoftShared_ToolsATUVP
mov dword [esp + 0x2c], ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call ebx
test eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyW]
jne 0x403d5d
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x14]
push edx
push 0x20019
push edi
push str.Components
push eax
call ebx
test eax, eax
jne 0x403d52
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x18]
push edi
push edi
push edi
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x1350]
push eax
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x403d47
lea ebx, [esp + 0x2958]
lea esp, [esp]
lea edx, [esp + 0x133c]
push edx
push ebx
call ebp
push 0x800
lea eax, [esp + 0x1340]
push edi
push eax
mov dword [esp + 0x28], 0x400
call fcn.0040b3b0
add esp, 0xc
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x18]
push edi
push edi
push edi
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x1350]
push eax
add esi, 1
push esi
push ecx
add ebx, 0x50
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x403cf0
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00401a30
push 0x40
lea ecx, [esi + esi*4]
lea eax, [esp + 0x88]
shl ecx, 4
push eax
lea edx, [esp + ecx + 0x2960]
push 0x41c894
mov dword [esp + 0x24], edx
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea ecx, [esp + 0x84]
push ecx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, eax
cmp ebx, edi
jne 0x403da6
push 0x8007000e
call fcn.00401030
mov edx, dword [esp + 0x18]
push ebx
push edx
call ebp
push ebx
add esi, 1
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0x40
lea eax, [esi + esi*4]
lea edx, [esp + 0x88]
shl eax, 4
push edx
lea ecx, [esp + eax + 0x2960]
push 0x41c884
mov dword [esp + 0x24], ecx
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea eax, [esp + 0x84]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, eax
cmp ebx, edi
jne 0x403dfc
push 0x8007000e
call fcn.00401030
mov ecx, dword [esp + 0x18]
push ebx
push ecx
call ebp
push ebx
add esi, 1
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp esi, edi
jle 0x403eed
lea ebx, [esp + 0x2958]
mov dword [esp + 0x18], esi
push str.CLSID_
lea edx, [esp + 0x108]
push edx
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push ebx
lea eax, [esp + 0x108]
push eax
call esi
push str.InprocServer32
lea ecx, [esp + 0x108]
push ecx
call esi
lea edx, [esp + 0x14]
push edx
push 0x20019
push edi
lea eax, [esp + 0x110]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403eac
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x1b40]
push edx
push edi
push edi
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x403ea1
lea ecx, [esp + 0x1b3c]
push ecx
call fcn.004034b0
add esp, 4
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x200
lea eax, [esp + 0x108]
push edi
push eax
call fcn.0040b3b0
push 0x800
lea ecx, [esp + 0x1b4c]
push edi
push ecx
call fcn.0040b3b0
add esp, 0x18
add ebx, 0x50
sub dword [esp + 0x18], 1
mov dword [esp + 0x24], 0x400
jne 0x403e21
jmp 0x403ef3
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x30d
lea edx, [esp + 0x2340]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 0x233c]
push eax
lea ecx, [esp + 0x924]
push ecx
call ebp
push str._regsvr32.exe
lea edx, [esp + 0x924]
push edx
call esi
mov esi, dword [esp + 0x336c]
push esi
lea eax, [esp + 0x924]
push eax
lea ecx, [esp + 0x30c]
push str.__s___s__u___s_rdp.dll_
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x44
lea edx, [esp + 0x54]
push edi
push edx
call fcn.0040b3b0
add esp, 0x1c
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x44]
push ecx
push edi
push edi
push 0x20
push edi
push edi
push edi
lea edx, [esp + 0x324]
push edx
lea eax, [esp + 0x944]
push eax
mov dword [esp + 0x68], 0x44
mov dword [esp + 0x94], 0x80
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x403fc1
push 0x4ff
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x3c]
push ecx
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov edx, dword [esp + 0x34]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call ebx
mov eax, dword [esp + 0x30]
push eax
call ebx
push 0x3fe
lea ecx, [esp + 0xf42]
push edi
push ecx
mov word [esp + 0xf48], di
call fcn.0040b3b0
push esi
lea edx, [esp + 0xf4c]
push str._sdtor.exe
push edx
call fcn.0040b451
add esp, 0x18
push edi
push 0x41c8a4
push str._unregserver
lea eax, [esp + 0xf48]
push eax
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [esp + 0x14]
push ecx
push 2
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x404112
push 0x61a
lea edx, [esp + 0x308]
push edi
push edx
call fcn.0040b3b0
push esi
lea eax, [esp + 0x314]
push str.cmd__c__regsvr32__s__u__sShellService.dll_
push eax
call fcn.0040b451
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x18
lea ecx, [esp + 0x304]
push ecx
call ebx
mov ecx, dword [esp + 0x14]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea edx, [eax + eax + 2]
push edx
lea eax, [esp + 0x308]
push eax
push 1
push edi
push str.remove31
push ecx
call ebp
push 0x61a
lea edx, [esp + 0x308]
push edi
push edx
call fcn.0040b3b0
push esi
lea eax, [esp + 0x314]
push str.cmd__c__rmdir__s__q___s__
push eax
call fcn.0040b451
add esp, 0x18
lea ecx, [esp + 0x304]
push ecx
call ebx
mov ecx, dword [esp + 0x14]
lea edx, [eax + eax + 2]
push edx
lea eax, [esp + 0x308]
push eax
push 1
push edi
push str.remove31dir
push ecx
call ebp
push str.cmd__c__regsvr32__s_Urlmon.dllregsvr32__s_Actxprxy.dllregsvr32__s_Oleaut32.dllregsvr32__s_Shell32.dll_
call ebx
lea edx, [eax + eax + 2]
mov eax, dword [esp + 0x14]
push edx
push str.cmd__c__regsvr32__s_Urlmon.dllregsvr32__s_Actxprxy.dllregsvr32__s_Oleaut32.dllregsvr32__s_Shell32.dll_
push 1
push edi
push str.rereg
push eax
call ebp
mov ecx, dword [esp + 0x14]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call ebp
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
jmp 0x404118
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004014b0
test al, al
lea edx, [esp + 0x14]
push edx
push 2
push edi
je 0x404140
push str.SOFTWAREMicrosoftWindowsCurrentVersionexplorerSharedTaskScheduler
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x404167
push str.8FB2D6CA_E258_48CF_9DAB_EEFB735E225C
jmp 0x404155
push str.SOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x404167
push str.shellservice
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [esp + 0x14]
push ecx
call ebp
push str.SoftwareMicrosoftShared_ToolsAT
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
add esi, 0xfffffff0
mov dword [esp + 0x3364], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x40419e
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov ecx, dword [esp + 0x335c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3344]
xor ecx, esp
call fcn.0040b399
add esp, 0x3354
ret