Function at 0x421236
Capabilities:
Persist via run registry key

Disassembly:
push 0x20
mov eax, 0x471176
call fcn.004550bc
mov ebx, ecx
lea ecx, [ebp - 0x2c]
call fcn.00435c47
and dword [ebp - 4], 0
call fcn.00442144
push eax
lea ecx, [ebp - 0x10]
call fcn.0040132d
push 0x80000001
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00435a09
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
test eax, eax
mov esi, 0x477979
je 0x421329
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.Start_Menu
mov byte [ebp - 4], 2
call fcn.00401c93
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00436249
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.0040170c
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.004010af
push 0x489f7c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0040177e
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.0040170c
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.004010af
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x1c], esp
mov ecx, esp
push eax
call fcn.00401464
mov ecx, ebx
call fcn.0041b734
mov edi, 0x80000002
push edi
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SoftwareMicrosoftWindowsCurrentVersionexplorerShell_Folders
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
test eax, eax
je 0x4213ec
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push esi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.Common_Start_Menu
mov byte [ebp - 4], 5
call fcn.00401c93
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00436249
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
call fcn.0040170c
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.004010af
push 0x489f14
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0040177e
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 7
call fcn.0040170c
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.004010af
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x1c], esp
mov ecx, esp
push eax
call fcn.00401464
mov ecx, ebx
call fcn.0041b734
push edi
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
mov edi, str.SOFTWARE3721
push edi
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
test eax, eax
je 0x4214b0
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push esi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.alpath
mov byte [ebp - 4], 8
call fcn.00401c93
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00436249
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 9
call fcn.0040170c
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.004010af
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x1c], esp
mov ecx, esp
push eax
call fcn.00401464
lea eax, [ebp - 0x14]
push eax
mov ecx, ebx
call fcn.0041ac45
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xa
call fcn.0040170c
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.004010af
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x1c], esp
mov ecx, esp
push eax
call fcn.00401464
mov ecx, ebx
call fcn.0041b734
push 0x80000000
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SCLSID1B0E7716_898E_48CC_9690_4E338E8DE1D3
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SCLSID6d8f256b_6ab8_4398_8f86_1e56207db77a
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SCLSID6231d512_e4a4_4df2_be62_5b8f0ee348ef
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SCLSIDd157330a_9ef3_49f8_9a67_4141ac41add4
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SCLSIDe5e4e352_6947_44ee_a420_db84efd3fe93
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SCLSID7ca83cf1_3aea_42d0_a4e3_1594fc6e48b2
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SoftwareMicrosoftInternet_ExplorerMenuExt
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SoftwareMicrosoftInternet_ExplorerURLSearchHooksBB936323_19FA_4521_BA29_ECA6A121BC78
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SoftwareMicrosoftWindowsCurrentVersionExtStats0005A87D_D626_4B3A_84F9_1D9571695F55
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push 0x80000001
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push edi
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
xor ebx, ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREMicrosoftInternet_ExplorerMain
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x421669
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.CNSAutoUpdate
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435c7b
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.CNSEnable
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435c7b
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.CNSHint
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435c7b
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.CNSList
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435c7b
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.CNSMenu
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435c7b
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.CNSReset
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435c7b
push 0x80000002
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push edi
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWARESandai_Technologies_Inc.
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesAssist.EasyAssist
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesAssist.EasyAssist.1
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClasses_autolive.live
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClasses_autolive.live.1
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesCnsHelper.CH
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesCnsHelper.CH.1
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassescnsminhk.cnshook
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassescnsminhk.cnshook.1
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesCoolBar.CoolBarObj
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesCoolBar.CoolBarObj.1
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
mov edi, str.SOFTWAREClassesCLSID_fflash.flashobjectinterface
push edi
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
mov esi, str.SOFTWAREClassesCLSID_fflash.flashobjectinterface.1
push esi
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesCLSID0005A87D_D626_4B3A_84F9_1D9571695F55
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesCLSID141A5E19_BDCB_4E27_A3D7_9E16503BC05B
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesCLSID1B0E7716_898E_48CC_9690_4E338E8DE1D3
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesCLSID6231d512_e4a4_4df2_be62_5b8f0ee348ef
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesCLSID7C7C028B_263F_471B_8254_A2F4C739AB71
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesCLSID7CA83CF1_3AEA_42D0_A4E3_1594FC6E48B2
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesCLSID9EB2B422_C9EE_46C4_A471_1E79C7517B1D
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesCLSIDABEC6103_F6AC_43A3_834F_FB03FBA339A2
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesCLSIDBB936323_19FA_4521_BA29_ECA6A121BC78
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesCLSIDb835c273_3522_4cc6_92ec_75cc86678da4
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesCLSIDB83FC273_3522_4CC6_92EC_75CC86678DA4
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesCLSIDc202b524_bc8a_4610_bd2c_6bd3e28155d0
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesCLSIDd157330a_9ef3_49f8_9a67_4141ac41add4
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesCLSIDe5e4e352_6947_44ee_a420_db84efd3fe93
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesCLSIDCnsHelper.CH
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesCLSIDCnsHelper.CH.1
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesCLSIDcnsminhk.cnshook
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesCLSIDcnsminhk.cnshook.1
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesCLSIDCoolBar.CoolBarObj
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesCLSIDCoolBar.CoolBarObj.1
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push edi
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push esi
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesXunleibho.CatchRightClick
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesXunleibho.CatchRightClick.1
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesCLSIDXunleibho.CatchRightClick
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesCLSIDXunleibho.CatchRightClick.1
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesInterface1bb0abbe_2d95_4847_b9d8_6f90de3714c1
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesInterface48E688C8_609F_4B08_944E_3C7FAB99CD08
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesInterface924F5B3A_7A27_484A_B873_E855C9708667
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesInterfaceBE08F6BC_C3E6_4149_BEB1_CB449E1B372E
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesInterfacec320f7f8_8862_496a_b8a4_25d4140b7dbc
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesInterfaceDF692509_D9EF_48A0_9CD0_3AA5B81F6F68
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesTypeLib19069804_2CF0_4357_B696_BA6E9AAD99EF
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesTypeLib4158DB95_DE71_41FF_BEA1_2C3D1C679DF1
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesTypeLib7354662f_caa3_448b_bc01_04f55a2dca35
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesTypeLiba5adeae7_a8b4_4f94_9128_bf8d8db5e927
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesTypeLibAAB6BCE3_1DF6_4930_9B14_9CA79DC8C267
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREClassesTypeLibf9ad9d67_efa8_480e_8291_0163f3960de7
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects0005A87D_D626_4B3A_84F9_1D9571695F55
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_ObjectsBB936323_19FA_4521_BA29_ECA6A121BC78
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects6231d512_e4a4_4df2_be62_5b8f0ee348ef
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects1B0E7716_898E_48CC_9690_4E338E8DE1D3
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objectsc202b524_bc8a_4610_bd2c_6bd3e28155d0
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objectsd157330a_9ef3_49f8_9a67_4141ac41add4
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objectse5e4e352_6947_44ee_a420_db84efd3fe93
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorer_shellexecutehooksd157330a_9ef3_49f8_9a67_4141ac41add4
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREMicrosoftInternet_Explorerextensions00000000_0000_0001_0001_596baedd1289
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREMicrosoftInternet_Explorerextensions0f7de07d_bd74_4991_9d5f_ecbb8391875d
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREMicrosoftInternet_Explorer_searchosearchassistant
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREMicrosoftInternet_ExplorerAdvancedOptions_CNS
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREMicrosoftInternet_ExplorerToolbarBB936323_19FA_4521_BA29_ECA6A121BC78
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREMicrosoftCode_Store_DatabaseDistribution_UnitsD109E2A0_C9C3_11D6_9A69_0050BAECFFD7
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREMicrosoftInternet_Explorer_search
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x421ce9
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.CustomizeSearch
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435c7b
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SearchAssistant
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435c7b
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x421d66
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.assistse
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435c7b
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.CnsMin
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435c7b
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.dl_accel
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435c7b
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.helper.dll
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435c7b
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x421d8b
lea ecx, [ebp - 0x2c]
call fcn.00435a64
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallYDownloader
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallCnsMin
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall1B0E7716_898E_48cc_9690_4E338E8DE1D3
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SYSTEMControlSet001EnumRootLEGACY_CDFS
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SYSTEMControlSet001EnumRootLEGACY_CNSMINKP
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SYSTEMControlSet001ServicesCnsMinKP
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SYSTEMControlSet002EnumRootLEGACY_CDFS
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SYSTEMControlSet002EnumRootLEGACY_CNSMINKP
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SYSTEMControlSet002ServicesCnsMinKP
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SYSTEMCurrentControlSetEnumRootLEGACY_CDFS
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SYSTEMCurrentControlSetEnumRootLEGACY_CNSMINKP
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SYSTEMCurrentControlSetServicesCnsMinKP
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004010af
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00435c67
call fcn.0045515b
ret