Function at 0x44daa7
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push ebx
mov ebx, ecx
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x21c], ebx
cmp dword [0x574bac], eax
jne 0x44dcc1
cmp dword [ebx + 0x124], eax
je 0x44db14
lea eax, [ebp - 0x218]
push eax
call fcn.0044e0ff
mov dword [ebp - 0x214], 1
push dword [eax]
call fcn.0041505c
pop ecx
pop ecx
test eax, eax
je 0x44db0e
xor eax, eax
mov byte [ebp - 0x20d], 1
inc eax
jmp 0x44db1b
mov eax, dword [ebp - 0x214]
mov byte [ebp - 0x20d], 0
test al, 1
je 0x44db2d
mov ecx, dword [ebp - 0x218]
lea ecx, [ecx - 0x10]
call fcn.004042e9
cmp byte [ebp - 0x20d], 0
push esi
push edi
je 0x44dbbf
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, str._SystemRoot__system32cmd.exe__d__q__c__SystemRoot__system32ieudinit.exe__ResetFileAttributes
push edi
call esi
add eax, eax
push eax
push edi
push 2
push str.IERESETATTRIB
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
call fcn.0044efd6
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_memset
push dword [ebx + 0xa8]
lea eax, [ebp - 0x20c]
push str._s__passive
push 0x104
push eax
call fcn.004329e6
add esp, 0x34
lea eax, [ebp - 0x20c]
push eax
call esi
add eax, eax
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push str.Installing_ie8
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push edi
call fcn.0044efd6
add esp, 0x18
lea esi, [ebx + 0x12c]
test esi, esi
je 0x44dbd0
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebx + 0xd0]
mov eax, dword [ebx + 0xcc]
mov edi, dword [ebx + 0xd4]
mov dword [ebp - 0x214], ecx
mov ecx, dword [ebx + 0xc8]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x220], edi
mov dword [ebp - 0x224], ecx
test esi, esi
je 0x44dc11
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x44dc54
mov ecx, dword [ebx + 0x28]
mov edi, ecx
push ecx
push 1
mov ebx, ecx
mov eax, dword [ecx]
call dword [eax + 0x80]
push eax
mov eax, dword [edi]
push ecx
push esp
mov ecx, edi
call dword [eax + 0x50]
mov eax, dword [ebx]
push ecx
push esp
mov ecx, ebx
call dword [eax + 0x70]
push dword [ebp - 0x214]
call fcn.004dbd51
mov ebx, dword [ebp - 0x21c]
add esp, 0x18
mov edi, dword [ebp - 0x220]
cmp edi, 0xffffffff
je 0x44dc62
mov ecx, dword [ebx + 0x28]
push edi
mov eax, dword [ecx]
call dword [eax + 0x1c]
test esi, esi
je 0x44dc6d
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [ebx + 0x108]
test esi, esi
je 0x44dc7e
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push 0
test edi, edi
je 0x44dc90
lea ecx, [ebx + 0x20]
mov eax, dword [ecx]
call dword [eax + 0x14]
jmp 0x44dcbf
mov ecx, dword [ebx + 0x28]
push dword [ebp - 0x224]
mov eax, dword [ecx]
call dword [eax + 0xc]
test esi, esi
je 0x44dca9
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ecx, [ebx + 0x104]
call fcn.0044f3e6
test esi, esi
je 0x44dcbf
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00522d04
leave
ret