Function at 0x4549b0
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5175cc
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x56e6c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x1c], edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x4549fd
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp dword [ebp + 8], ebx
je 0x454d63
push eax
lea ecx, [ebp - 0x10]
call fcn.00407fd0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 0
mov ecx, dword [eax - 0xc]
cmp ecx, 1
jl 0x454a3e
test ecx, ecx
js 0x454e34
cmp word [eax], 0x22
jne 0x454a3e
push 1
push 0
lea ecx, [ebp - 0x10]
call fcn.00454770
mov eax, dword [ebp - 0x10]
mov edx, dword [eax - 0xc]
cmp edx, 1
jl 0x454a6b
lea ecx, [edx - 1]
test ecx, ecx
js 0x454e34
cmp ecx, edx
jg 0x454e34
cmp word [eax + ecx*2], 0x22
jne 0x454a6b
push 1
push ecx
lea ecx, [ebp - 0x10]
call fcn.00454770
call fcn.0040ab00
mov ecx, eax
test ecx, ecx
je 0x454e3e
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x34], esi
call fcn.0040ab00
mov ecx, eax
test ecx, ecx
je 0x454e48
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x30], eax
call fcn.0040ab00
mov ecx, eax
test ecx, ecx
je 0x454e52
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2c], eax
call fcn.0040ab00
mov ecx, eax
test ecx, ecx
je 0x454e5c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 1
call fcn.0040ab00
mov ecx, eax
test ecx, ecx
je 0x454e66
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 2
push 0x52dc38
push eax
call fcn.00408880
mov eax, dword [ebp - 0x18]
add esi, 0xfffffff0
add esp, 0xc
or edi, 0xffffffff
lea edx, [eax - 0x10]
mov dword [ebp - 0x20], edx
cmp edx, esi
je 0x454b61
cmp dword [esi + 0xc], 0
jl 0x454b55
mov ecx, dword [edx]
cmp ecx, dword [esi]
jne 0x454b55
push edx
call fcn.0040c660
add esp, 4
mov dword [ebp + 8], eax
mov ecx, edi
lea edx, [esi + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x454b4d
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp + 8]
add eax, 0x10
mov dword [ebp - 0x34], eax
jmp 0x454b61
push dword [eax - 0xc]
lea ecx, [ebp - 0x34]
push eax
call fcn.00409f50
push 0x14
push 0x52fb24
lea ecx, [ebp - 0x2c]
call fcn.00409f50
mov edx, dword [ebp + 0x14]
test edx, edx
jne 0x454b99
lea eax, [ebp + 8]
push eax
lea ecx, [ebp + 0xb]
call fcn.00453090
mov edx, dword [eax]
mov ebx, 1
mov byte [ebp - 4], 3
mov dword [ebp - 0x14], ebx
test edx, edx
jne 0x454b99
xor ecx, ecx
jmp 0x454baf
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x454ba0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00409f50
mov dword [ebp - 4], 2
test bl, 1
je 0x454be5
mov edx, dword [ebp + 8]
and ebx, 0xfffffffe
mov dword [ebp - 0x14], ebx
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x454be5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
test esi, esi
je 0x454bf6
mov eax, esi
jmp 0x454c0e
lea eax, [ebp + 8]
push eax
lea ecx, [ebp + 0x13]
call fcn.00452e20
mov eax, dword [eax]
or ebx, 2
mov byte [ebp - 4], 4
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x34]
push ecx
mov ecx, dword [ebp - 0x1c]
push eax
call fcn.00453470
mov dword [ebp - 4], 2
mov edx, eax
mov dword [ebp + 0x10], edx
test bl, 2
je 0x454c54
mov ecx, dword [ebp + 8]
and ebx, 0xfffffffd
add ecx, 0xfffffff0
mov dword [ebp - 0x14], ebx
mov dword [ebp + 0x14], ecx
mov eax, edi
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x454c54
mov ecx, dword [ecx]
push dword [ebp + 0x14]
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x454c6b
mov eax, dword [ebp + 0xc]
push eax
push str.Add_auto_run_task_schedule_success___s
call fcn.00442c30
mov esi, dword [ebp + 0x10]
jmp 0x454cca
test esi, esi
jne 0x454c87
lea eax, [ebp + 0x10]
push eax
lea ecx, [ebp + 0x13]
call fcn.004531c0
mov esi, dword [eax]
or ebx, 4
mov byte [ebp - 4], 5
mov dword [ebp - 0x14], ebx
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x34]
push eax
push esi
call fcn.00453290
mov dword [ebp - 4], 2
mov esi, eax
test bl, 4
je 0x454cbc
mov edx, dword [ebp + 0x10]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x454cbc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 0xc]
push eax
push str.Add_auto_run_register___s
call fcn.00442c30
mov edx, dword [ebp - 0x20]
add esp, 8
mov byte [ebp - 4], 1
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x454ce8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x28]
mov eax, edi
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x454d06
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x2c]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x454d20
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x30]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x454d3a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x34]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x454d54
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
jmp 0x454e09
mov esi, dword [ebp + 0x10]
mov dword [ebp + 0x10], esi
test esi, esi
je 0x454d71
mov eax, esi
jmp 0x454d8e
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp + 0xf]
call fcn.00452fc0
mov eax, dword [eax]
mov ebx, 8
mov dword [ebp - 4], 6
mov dword [ebp - 0x14], ebx
push eax
mov ecx, edi
call fcn.00454520
or edi, 0xffffffff
mov dword [ebp - 4], 0xffffffff
test bl, 8
je 0x454dc2
mov edx, dword [ebp + 0xc]
and ebx, 0xfffffff7
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x454dc2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
jne 0x454dda
lea eax, [ebp + 8]
push eax
lea ecx, [ebp + 0xf]
call fcn.00452ef0
or ebx, 0x10
mov esi, dword [eax]
mov dword [ebp + 0x10], esi
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call esi
push dword [ebp + 0x10]
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov esi, 1
test bl, 0x10
je 0x454e1e
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x454e1e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push 0x80070057
call fcn.00408720
push 0x80004005
call fcn.00408720
push 0x80004005
call fcn.00408720
push 0x80004005
call fcn.00408720
push 0x80004005
call fcn.00408720
push 0x80004005
call fcn.00408720
int3