Function at 0x471b80
Capabilities:
Persist via run registry key

Disassembly:
cmp dword [esp + 4], 1
push esi
jne 0x471dae
push 0x2010f
sub esp, 0x18
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun
call fcn.00407630
push SysReAllocString
call fcn.00471fa0
push 0x2010f
sub esp, 0x18
mov esi, eax
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServicesOnce
call fcn.00407630
push SysReAllocString
call fcn.00471fa0
push 0x2010f
sub esp, 0x18
add esi, eax
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
call fcn.00407630
push SysReAllocString
call fcn.00471fa0
push 0x2010f
sub esp, 0x18
add esi, eax
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
call fcn.00407630
push SysReAllocString
call fcn.00471fa0
push 0x2010f
sub esp, 0x18
add esi, eax
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceSetup
call fcn.00407630
push SysReAllocString
call fcn.00471fa0
push 0x2010f
sub esp, 0x18
add esi, eax
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
call fcn.00407630
push SysReAllocString
call fcn.00471fa0
push 0x2010f
sub esp, 0x18
add esi, eax
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunEx
call fcn.00407630
push SysReAllocString
call fcn.00471fa0
push 0x2010f
sub esp, 0x18
add esi, eax
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
call fcn.00407630
push SysReAllocString
call fcn.00471fa0
push 0x109
sub esp, 0x18
add esi, eax
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun
call fcn.00407630
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00471fa0
push 0x109
sub esp, 0x18
add esi, eax
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServicesOnce
call fcn.00407630
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00471fa0
add esi, eax
push 0x109
sub esp, 0x18
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
call fcn.00407630
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00471fa0
push 0x109
sub esp, 0x18
add esi, eax
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
call fcn.00407630
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00471fa0
push 0x109
sub esp, 0x18
add esi, eax
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceSetup
call fcn.00407630
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00471fa0
push 0x109
sub esp, 0x18
add esi, eax
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
call fcn.00407630
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00471fa0
push 0x109
sub esp, 0x18
add esi, eax
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunEx
call fcn.00407630
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00471fa0
push 0x109
sub esp, 0x18
add esi, eax
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
call fcn.00407630
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00471fa0
push 0x2000f
sub esp, 0x18
add esi, eax
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun
call fcn.00407630
push SysReAllocString
call fcn.00471fa0
add esi, eax
jmp 0x471dce
push 0x2000f
sub esp, 0x18
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun
call fcn.00407630
push SysReAllocString
call fcn.00471fa0
mov esi, eax
push 0x2000f
sub esp, 0x18
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServicesOnce
call fcn.00407630
push SysReAllocString
call fcn.00471fa0
push 0x2000f
sub esp, 0x18
add esi, eax
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
call fcn.00407630
push SysReAllocString
call fcn.00471fa0
push 0x2000f
sub esp, 0x18
add esi, eax
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
call fcn.00407630
push SysReAllocString
call fcn.00471fa0
push 0x2000f
sub esp, 0x18
add esi, eax
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceSetup
call fcn.00407630
push SysReAllocString
call fcn.00471fa0
push 0x2000f
sub esp, 0x18
add esi, eax
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
call fcn.00407630
push SysReAllocString
call fcn.00471fa0
push 0x2000f
sub esp, 0x18
add esi, eax
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunEx
call fcn.00407630
push SysReAllocString
call fcn.00471fa0
push 0x2000f
sub esp, 0x18
add esi, eax
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
call fcn.00407630
push SysReAllocString
call fcn.00471fa0
push 9
sub esp, 0x18
add esi, eax
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun
call fcn.00407630
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00471fa0
push 9
sub esp, 0x18
add esi, eax
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServicesOnce
call fcn.00407630
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00471fa0
push 9
sub esp, 0x18
add esi, eax
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
call fcn.00407630
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00471fa0
push 9
sub esp, 0x18
mov ecx, esp
add esi, eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
call fcn.00407630
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00471fa0
push 9
sub esp, 0x18
add esi, eax
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceSetup
call fcn.00407630
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00471fa0
push 9
sub esp, 0x18
add esi, eax
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
call fcn.00407630
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00471fa0
push 9
sub esp, 0x18
add esi, eax
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunEx
call fcn.00407630
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00471fa0
push 9
sub esp, 0x18
add esi, eax
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
call fcn.00407630
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00471fa0
add eax, esi
pop esi
ret 4