Function at 0x10047300
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10078880
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x1009e034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], 0
call fcn.100700a0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun
push 0x80000002
lea ecx, [ebp - 0x54]
call fcn.1005c350
push eax
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.10047c40
mov byte [ebp - 4], 0
cmp dword [ebp - 0x20], 8
mov esi, dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
jb 0x10047374
push dword [ebp - 0x34]
call esi
add esp, 4
xor eax, eax
cmp dword [ebp - 0x3c], 8
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x24], 0
mov word [ebp - 0x34], ax
jb 0x10047396
push dword [ebp - 0x50]
call esi
add esp, 4
call fcn.100700a0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServicesOnce
push 0x80000002
lea ecx, [ebp - 0x54]
call fcn.1005c350
push eax
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.10047c40
mov byte [ebp - 4], 0
cmp dword [ebp - 0x20], 8
jb 0x100473cd
push dword [ebp - 0x34]
call esi
add esp, 4
xor eax, eax
cmp dword [ebp - 0x3c], 8
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x24], 0
mov word [ebp - 0x34], ax
jb 0x100473ef
push dword [ebp - 0x50]
call esi
add esp, 4
call fcn.100700a0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
push 0x80000002
lea ecx, [ebp - 0x54]
call fcn.1005c350
push eax
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.10047c40
mov byte [ebp - 4], 0
cmp dword [ebp - 0x20], 8
jb 0x10047426
push dword [ebp - 0x34]
call esi
add esp, 4
xor eax, eax
cmp dword [ebp - 0x3c], 8
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x24], 0
mov word [ebp - 0x34], ax
jb 0x10047448
push dword [ebp - 0x50]
call esi
add esp, 4
call fcn.100700a0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
push 0x80000002
lea ecx, [ebp - 0x54]
call fcn.1005c350
push eax
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.10047c40
mov byte [ebp - 4], 0
cmp dword [ebp - 0x20], 8
jb 0x1004747f
push dword [ebp - 0x34]
call esi
add esp, 4
xor eax, eax
cmp dword [ebp - 0x3c], 8
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x24], 0
mov word [ebp - 0x34], ax
jb 0x100474a1
push dword [ebp - 0x50]
call esi
add esp, 4
call fcn.100700a0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceSetup
push 0x80000002
lea ecx, [ebp - 0x54]
call fcn.1005c350
push eax
mov ecx, edi
mov byte [ebp - 4], 5
call fcn.10047c40
mov byte [ebp - 4], 0
cmp dword [ebp - 0x20], 8
jb 0x100474d8
push dword [ebp - 0x34]
call esi
add esp, 4
xor eax, eax
cmp dword [ebp - 0x3c], 8
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x24], 0
mov word [ebp - 0x34], ax
jb 0x100474fa
push dword [ebp - 0x50]
call esi
add esp, 4
call fcn.100700a0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
lea ecx, [ebp - 0x54]
call fcn.1005c350
push eax
mov ecx, edi
mov byte [ebp - 4], 6
call fcn.10047c40
mov byte [ebp - 4], 0
cmp dword [ebp - 0x20], 8
jb 0x10047531
push dword [ebp - 0x34]
call esi
add esp, 4
xor eax, eax
cmp dword [ebp - 0x3c], 8
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x24], 0
mov word [ebp - 0x34], ax
jb 0x10047553
push dword [ebp - 0x50]
call esi
add esp, 4
call fcn.100700a0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunEx
push 0x80000002
lea ecx, [ebp - 0x54]
call fcn.1005c350
push eax
mov ecx, edi
mov byte [ebp - 4], 7
call fcn.10047c40
mov byte [ebp - 4], 0
cmp dword [ebp - 0x20], 8
jb 0x1004758a
push dword [ebp - 0x34]
call esi
add esp, 4
xor eax, eax
cmp dword [ebp - 0x3c], 8
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x24], 0
mov word [ebp - 0x34], ax
jb 0x100475ac
push dword [ebp - 0x50]
call esi
add esp, 4
call fcn.100700a0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
lea ecx, [ebp - 0x54]
call fcn.1005c350
push eax
mov ecx, edi
mov byte [ebp - 4], 8
call fcn.10047c40
mov byte [ebp - 4], 0
cmp dword [ebp - 0x20], 8
jb 0x100475e3
push dword [ebp - 0x34]
call esi
add esp, 4
xor eax, eax
cmp dword [ebp - 0x3c], 8
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x24], 0
mov word [ebp - 0x34], ax
jb 0x10047605
push dword [ebp - 0x50]
call esi
add esp, 4
call fcn.100700a0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun
push 0x80000001
lea ecx, [ebp - 0x54]
call fcn.1005c350
push eax
mov ecx, edi
mov byte [ebp - 4], 9
call fcn.10047c40
mov byte [ebp - 4], 0
cmp dword [ebp - 0x20], 8
jb 0x1004763c
push dword [ebp - 0x34]
call esi
add esp, 4
xor eax, eax
cmp dword [ebp - 0x3c], 8
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x24], 0
mov word [ebp - 0x34], ax
jb 0x1004765e
push dword [ebp - 0x50]
call esi
add esp, 4
call fcn.100700a0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServicesOnce
push 0x80000001
lea ecx, [ebp - 0x54]
call fcn.1005c350
push eax
mov ecx, edi
mov byte [ebp - 4], 0xa
call fcn.10047c40
mov byte [ebp - 4], 0
cmp dword [ebp - 0x20], 8
jb 0x10047695
push dword [ebp - 0x34]
call esi
add esp, 4
xor eax, eax
cmp dword [ebp - 0x3c], 8
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x24], 0
mov word [ebp - 0x34], ax
jb 0x100476b7
push dword [ebp - 0x50]
call esi
add esp, 4
call fcn.100700a0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
push 0x80000001
lea ecx, [ebp - 0x54]
call fcn.1005c350
push eax
mov ecx, edi
mov byte [ebp - 4], 0xb
call fcn.10047c40
mov byte [ebp - 4], 0
cmp dword [ebp - 0x20], 8
jb 0x100476ee
push dword [ebp - 0x34]
call esi
add esp, 4
xor eax, eax
cmp dword [ebp - 0x3c], 8
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x24], 0
mov word [ebp - 0x34], ax
jb 0x10047710
push dword [ebp - 0x50]
call esi
add esp, 4
call fcn.100700a0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
push 0x80000001
lea ecx, [ebp - 0x54]
call fcn.1005c350
push eax
mov ecx, edi
mov byte [ebp - 4], 0xc
call fcn.10047c40
mov byte [ebp - 4], 0
cmp dword [ebp - 0x20], 8
jb 0x10047747
push dword [ebp - 0x34]
call esi
add esp, 4
xor eax, eax
cmp dword [ebp - 0x3c], 8
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x24], 0
mov word [ebp - 0x34], ax
jb 0x10047769
push dword [ebp - 0x50]
call esi
add esp, 4
call fcn.100700a0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceSetup
push 0x80000001
lea ecx, [ebp - 0x54]
call fcn.1005c350
push eax
mov ecx, edi
mov byte [ebp - 4], 0xd
call fcn.10047c40
mov byte [ebp - 4], 0
cmp dword [ebp - 0x20], 8
jb 0x100477a0
push dword [ebp - 0x34]
call esi
add esp, 4
xor eax, eax
cmp dword [ebp - 0x3c], 8
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x24], 0
mov word [ebp - 0x34], ax
jb 0x100477c2
push dword [ebp - 0x50]
call esi
add esp, 4
call fcn.100700a0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000001
lea ecx, [ebp - 0x54]
call fcn.1005c350
push eax
mov ecx, edi
mov byte [ebp - 4], 0xe
call fcn.10047c40
mov byte [ebp - 4], 0
cmp dword [ebp - 0x20], 8
jb 0x100477f9
push dword [ebp - 0x34]
call esi
add esp, 4
xor eax, eax
cmp dword [ebp - 0x3c], 8
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x24], 0
mov word [ebp - 0x34], ax
jb 0x1004781b
push dword [ebp - 0x50]
call esi
add esp, 4
call fcn.100700a0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunEx
push 0x80000001
lea ecx, [ebp - 0x54]
call fcn.1005c350
push eax
mov ecx, edi
mov byte [ebp - 4], 0xf
call fcn.10047c40
mov byte [ebp - 4], 0
cmp dword [ebp - 0x20], 8
jb 0x10047852
push dword [ebp - 0x34]
call esi
add esp, 4
xor eax, eax
cmp dword [ebp - 0x3c], 8
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x24], 0
mov word [ebp - 0x34], ax
jb 0x10047874
push dword [ebp - 0x50]
call esi
add esp, 4
call fcn.100700a0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000001
lea ecx, [ebp - 0x54]
call fcn.1005c350
push eax
mov ecx, edi
mov byte [ebp - 4], 0x10
call fcn.10047c40
mov byte [ebp - 4], 0
cmp dword [ebp - 0x20], 8
jb 0x100478ab
push dword [ebp - 0x34]
call esi
add esp, 4
xor eax, eax
cmp dword [ebp - 0x3c], 8
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x24], 0
mov word [ebp - 0x34], ax
jb 0x100478cd
push dword [ebp - 0x50]
call esi
add esp, 4
call fcn.1005ebf0
test al, al
je 0x10047be6
call fcn.100700a0
push 1
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun
push 0x80000002
lea ecx, [ebp - 0x54]
call fcn.1005c350
push eax
mov ecx, edi
mov byte [ebp - 4], 0x11
call fcn.10047c40
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.10007a50
call fcn.100700a0
push 1
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServicesOnce
push 0x80000002
lea ecx, [ebp - 0x54]
call fcn.1005c350
push eax
mov ecx, edi
mov byte [ebp - 4], 0x12
call fcn.10047c40
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.10007a50
call fcn.100700a0
push 1
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
push 0x80000002
lea ecx, [ebp - 0x54]
call fcn.1005c350
push eax
mov ecx, edi
mov byte [ebp - 4], 0x13
call fcn.10047c40
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.10007a50
call fcn.100700a0
push 1
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
push 0x80000002
lea ecx, [ebp - 0x54]
call fcn.1005c350
push eax
mov ecx, edi
mov byte [ebp - 4], 0x14
call fcn.10047c40
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.10007a50
call fcn.100700a0
push 1
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceSetup
push 0x80000002
lea ecx, [ebp - 0x54]
call fcn.1005c350
push eax
mov ecx, edi
mov byte [ebp - 4], 0x15
call fcn.10047c40
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.10007a50
call fcn.100700a0
push 1
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
lea ecx, [ebp - 0x54]
call fcn.1005c350
push eax
mov ecx, edi
mov byte [ebp - 4], 0x16
call fcn.10047c40
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.10007a50
call fcn.100700a0
push 1
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunEx
push 0x80000002
lea ecx, [ebp - 0x54]
call fcn.1005c350
push eax
mov ecx, edi
mov byte [ebp - 4], 0x17
call fcn.10047c40
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.10007a50
call fcn.100700a0
push 1
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
lea ecx, [ebp - 0x54]
call fcn.1005c350
push eax
mov ecx, edi
mov byte [ebp - 4], 0x18
call fcn.10047c40
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.10007a50
call fcn.100700a0
push 1
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun
push 0x80000001
lea ecx, [ebp - 0x54]
call fcn.1005c350
push eax
mov ecx, edi
mov byte [ebp - 4], 0x19
call fcn.10047c40
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.10007a50
call fcn.100700a0
push 1
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServicesOnce
push 0x80000001
lea ecx, [ebp - 0x54]
call fcn.1005c350
push eax
mov ecx, edi
mov byte [ebp - 4], 0x1a
call fcn.10047c40
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.10007a50
call fcn.100700a0
push 1
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
push 0x80000001
lea ecx, [ebp - 0x54]
call fcn.1005c350
push eax
mov ecx, edi
mov byte [ebp - 4], 0x1b
call fcn.10047c40
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.10007a50
call fcn.100700a0
push 1
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
push 0x80000001
lea ecx, [ebp - 0x54]
call fcn.1005c350
mov byte [ebp - 4], 0x1c
push eax
mov ecx, edi
call fcn.10047c40
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.10007a50
call fcn.100700a0
push 1
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceSetup
push 0x80000001
lea ecx, [ebp - 0x54]
call fcn.1005c350
push eax
mov ecx, edi
mov byte [ebp - 4], 0x1d
call fcn.10047c40
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.10007a50
call fcn.100700a0
push 1
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000001
lea ecx, [ebp - 0x54]
call fcn.1005c350
push eax
mov ecx, edi
mov byte [ebp - 4], 0x1e
call fcn.10047c40
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.10007a50
call fcn.100700a0
push 1
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunEx
push 0x80000001
lea ecx, [ebp - 0x54]
call fcn.1005c350
push eax
mov ecx, edi
mov byte [ebp - 4], 0x1f
call fcn.10047c40
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.10007a50
call fcn.100700a0
push 1
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000001
lea ecx, [ebp - 0x54]
call fcn.1005c350
push eax
mov ecx, edi
mov byte [ebp - 4], 0x20
call fcn.10047c40
lea ecx, [ebp - 0x54]
call fcn.10007a50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret