Function at 0x4dd598
Capabilities:
Persist via run registry key

Disassembly:
push 4
mov eax, 0x5da05d
call fcn.00506dc7
mov edi, ecx
xor ebx, ebx
mov esi, reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x4dd8c2
cmp dword [edi + 0x4c], ebx
jne 0x4dd94f
push ebx
push ecx
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
call fcn.00413f09
push esi
mov ecx, edi
call fcn.004dc794
call fcn.00430f47
test eax, eax
je 0x4dd5f8
push 1
push ecx
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
call fcn.00413f09
push esi
mov ecx, edi
call fcn.004dc794
call fcn.00472ad9
cmp dword [0x683574], ebx
jne 0x4dd94f
push ebx
push ecx
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
call fcn.00413f09
push SysReAllocString
mov ecx, edi
call fcn.004dc794
call fcn.00472ad9
cmp dword [0x683574], ebx
jne 0x4dd94f
push ebx
push ecx
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
call fcn.00413f09
push esi
mov ecx, edi
call fcn.004dc794
call fcn.00472ad9
cmp dword [0x683574], ebx
jne 0x4dd94f
call fcn.00430f47
test eax, eax
je 0x4dd67b
push 1
push ecx
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
call fcn.00413f09
push esi
mov ecx, edi
call fcn.004dc794
call fcn.00472ad9
cmp dword [0x683574], ebx
jne 0x4dd94f
push ebx
push ecx
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
call fcn.00413f09
push SysReAllocString
mov ecx, edi
call fcn.004dc794
cmp dword [edi + 0x4c], ebx
jne 0x4dd94f
call fcn.00472ad9
cmp dword [0x683574], ebx
jne 0x4dd94f
mov ebx, dword [ebp + 8]
push ecx
mov esi, esp
mov dword [ebp + 0xc], esp
add ebx, 0xfffffff0
mov dword [ebp - 0x10], esi
push ebx
call fcn.00412393
add eax, 0x10
pop ecx
mov dword [esi], eax
push 0
push ecx
mov ecx, esp
mov byte [ebp - 4], 1
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths
call fcn.00413f09
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.004de7c2
call fcn.00430f47
test eax, eax
je 0x4dd73f
push ecx
mov esi, esp
mov dword [ebp + 0xc], esp
push ebx
mov dword [ebp - 0x10], esi
call fcn.00412393
add eax, 0x10
pop ecx
mov dword [esi], eax
push 1
push ecx
mov ecx, esp
mov byte [ebp - 4], 2
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths
call fcn.00413f09
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.004de7c2
cmp dword [edi + 0x4c], 0
jne 0x4dd94f
call fcn.00472ad9
cmp dword [0x683574], 0
jne 0x4dd94f
mov ebx, dword [ebp + 8]
push ecx
mov esi, esp
mov dword [ebp + 0xc], esp
add ebx, 0xfffffff0
mov dword [ebp - 0x10], esi
push ebx
call fcn.00412393
add eax, 0x10
pop ecx
mov dword [esi], eax
push 0
push ecx
mov ecx, esp
mov byte [ebp - 4], 3
push str.SOFTWARE
call fcn.00413f09
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.004df025
call fcn.00430f47
test eax, eax
je 0x4dd7da
push ecx
mov esi, esp
mov dword [ebp + 0xc], esp
push ebx
mov dword [ebp - 0x10], esi
call fcn.00412393
add eax, 0x10
pop ecx
mov dword [esi], eax
push 1
push ecx
mov ecx, esp
mov byte [ebp - 4], 4
push str.SOFTWARE
call fcn.00413f09
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.004df025
push ecx
mov esi, esp
mov dword [ebp + 0xc], esp
push ebx
mov dword [ebp - 0x10], esi
call fcn.00412393
add eax, 0x10
pop ecx
mov dword [esi], eax
xor ebx, ebx
mov byte [ebp - 4], 5
push ebx
push ecx
mov ecx, esp
push str.SOFTWARE
call fcn.00413f09
push SysReAllocString
mov ecx, edi
mov byte [ebp - 4], bl
call fcn.004df025
cmp dword [edi + 0x4c], ebx
jne 0x4dd94f
call fcn.00472ad9
cmp dword [0x683574], ebx
jne 0x4dd94f
mov ebx, dword [ebp + 8]
push ecx
mov esi, esp
mov dword [ebp + 0xc], esp
add ebx, 0xfffffff0
mov dword [ebp - 0x10], esi
push ebx
call fcn.00412393
add eax, 0x10
pop ecx
mov dword [esi], eax
push 0
push ecx
mov ecx, esp
mov byte [ebp - 4], 6
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
call fcn.00413f09
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.004df53b
call fcn.00430f47
test eax, eax
je 0x4dd8ae
push ecx
mov esi, esp
mov dword [ebp + 0xc], esp
push ebx
mov dword [ebp - 0x10], esi
call fcn.00412393
add eax, 0x10
pop ecx
mov dword [esi], eax
push 1
push ecx
mov ecx, esp
mov byte [ebp - 4], 7
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
call fcn.00413f09
xor ebx, ebx
mov ecx, edi
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], bl
call fcn.004df53b
jmp 0x4dd8b0
xor ebx, ebx
call fcn.00472ad9
cmp dword [0x683574], 0
jne 0x4dd94f
cmp dword [edi + 0x4c], ebx
jne 0x4dd94f
mov ebx, dword [ebp + 8]
push ecx
mov esi, esp
mov dword [ebp + 0xc], esp
add ebx, 0xfffffff0
mov dword [ebp - 0x10], esi
push ebx
call fcn.00412393
add eax, 0x10
pop ecx
mov dword [esi], eax
push 0
push ecx
mov ecx, esp
mov byte [ebp - 4], 8
push str.SOFTWAREClasses
call fcn.00413f09
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.004deb27
call fcn.00430f47
test eax, eax
je 0x4dd94a
push ecx
mov esi, esp
mov dword [ebp + 0xc], esp
push ebx
mov dword [ebp - 0x10], esi
call fcn.00412393
add eax, 0x10
pop ecx
mov dword [esi], eax
push 1
push ecx
mov ecx, esp
mov byte [ebp - 4], 9
push str.SOFTWAREClasses
call fcn.00413f09
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.004deb27
call fcn.00472ad9
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
call fcn.00506d90
ret 8