Function at 0x4a2be0
Capabilities:
Get number of processors
Get process heap flags
Get process heap force flags
Persist via appinit_dlls registry key
Persist via run registry key
Persist via winlogon helper dll registry key

Disassembly:
push 0xffffffffffffffff
push 0x4f2742
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x53fa2c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x28]
lea eax, [esi + 0x14]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.SoftwareMicrosoftWindowsCurrentVersionRunServicesOnce
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x24], 0
mov edi, dword [esp + 0x2c]
push reloc.OLEAUT32.dll_SysReAllocString
or ebx, 0xffffffff
push edi
mov dword [esp + 0x2c], ebx
call fcn.004a2090
add esp, 0x10
lea ecx, [esi + 0x28]
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.SoftwareMicrosoftWindowsCurrentVersionRunServicesOnce
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x24], 1
push bind
push edi
mov dword [esp + 0x2c], ebx
call fcn.004a2090
add esp, 0x10
lea edx, [esi + 0x3c]
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x24], 2
push reloc.OLEAUT32.dll_SysReAllocString
push edi
mov dword [esp + 0x2c], ebx
call fcn.004a2090
add esp, 0x10
lea eax, [esi + 0x50]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x24], 3
push bind
push edi
mov dword [esp + 0x2c], ebx
call fcn.004a2090
add esp, 0x10
lea ecx, [esi + 0x64]
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogonNotify
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x24], 4
push reloc.OLEAUT32.dll_SysReAllocString
push edi
mov dword [esp + 0x2c], ebx
call fcn.004a1e00
add esp, 0x10
lea edx, [esi + 0x78]
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.Userinit
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x24], 5
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x28], 6
push reloc.OLEAUT32.dll_SysReAllocString
push edi
mov dword [esp + 0x30], ebx
call fcn.004a2410
add esp, 0x14
lea eax, [esi + 0x8c]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.Shell
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x24], 7
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x28], 8
push reloc.OLEAUT32.dll_SysReAllocString
push edi
mov dword [esp + 0x30], ebx
call fcn.004a2410
add esp, 0x14
lea ecx, [esi + 0xa0]
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.Shell
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x24], 9
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x28], 0xa
push bind
push edi
mov dword [esp + 0x30], ebx
call fcn.004a2410
add esp, 0x14
lea edx, [esi + 0xb4]
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x24], 0xb
push reloc.OLEAUT32.dll_SysReAllocString
push edi
mov dword [esp + 0x2c], ebx
call fcn.004a2090
add esp, 0x10
lea eax, [esi + 0xc8]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x24], 0xc
push bind
push edi
mov dword [esp + 0x2c], ebx
call fcn.004a2090
add esp, 0x10
lea ecx, [esi + 0xdc]
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnceEx
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x24], 0xd
push reloc.OLEAUT32.dll_SysReAllocString
push edi
mov dword [esp + 0x2c], ebx
call fcn.004a2090
add esp, 0x10
lea edx, [esi + 0xf0]
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.SoftwareMicrosoftWindowsCurrentVersionRun
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x24], 0xe
push reloc.OLEAUT32.dll_SysReAllocString
push edi
mov dword [esp + 0x2c], ebx
call fcn.004a2090
add esp, 0x10
lea eax, [esi + 0x104]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.SoftwareMicrosoftWindowsCurrentVersionRun
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x24], 0xf
push bind
push edi
mov dword [esp + 0x2c], ebx
call fcn.004a2090
lea ecx, [esi + 0x118]
push ecx
push 0x18
push edi
call fcn.004a2ae0
lea edx, [esi + 0x12c]
push edx
push 7
push edi
call fcn.004a2ae0
add esp, 0x28
lea eax, [esi + 0x140]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x24], 0x10
push reloc.OLEAUT32.dll_SysReAllocString
push edi
mov dword [esp + 0x2c], ebx
call fcn.004a2090
add esp, 0x10
lea ecx, [esi + 0x154]
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x24], 0x11
push bind
push edi
mov dword [esp + 0x2c], ebx
call fcn.004a2090
add esp, 0x10
lea edx, [esi + 0x168]
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.load
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x24], 0x12
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x28], 0x13
push bind
push edi
mov dword [esp + 0x30], ebx
call fcn.004a2410
add esp, 0x14
lea eax, [esi + 0x17c]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x51ac18
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x24], 0x14
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x28], 0x15
push bind
push edi
mov dword [esp + 0x30], ebx
call fcn.004a2410
add esp, 0x14
lea ecx, [esi + 0x190]
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.AppInit_DLLs
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x24], 0x16
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x28], 0x17
push reloc.OLEAUT32.dll_SysReAllocString
push edi
mov dword [esp + 0x30], ebx
call fcn.004a2410
add esp, 0x14
lea edx, [esi + 0x1a4]
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.SoftwareMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x24], 0x18
push reloc.OLEAUT32.dll_SysReAllocString
push edi
mov dword [esp + 0x2c], ebx
call fcn.004a1e00
add esp, 0x10
lea eax, [esi + 0x1b8]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x24], 0x19
push reloc.OLEAUT32.dll_SysReAllocString
push edi
mov dword [esp + 0x2c], ebx
call fcn.004a1e00
add esp, 0x10
lea ecx, [esi + 0x1cc]
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.SCRNSAVE.EXE
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x24], 0x1a
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Control_PanelDesktop
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x28], 0x1b
push bind
push edi
mov dword [esp + 0x30], ebx
call fcn.004a2410
add esp, 0x14
lea edx, [esi + 0x1e0]
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.AutoRun
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x24], 0x1c
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.SoftwareMicrosoftCommand_Processor
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x28], 0x1d
push bind
push edi
mov dword [esp + 0x30], ebx
call fcn.004a2410
add esp, 0x14
lea eax, [esi + 0x1f4]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x504df0
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x24], 0x1e
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x28], 0x1f
push reloc.OLEAUT32.dll_SysReAllocString
push edi
mov dword [esp + 0x30], ebx
call fcn.004a2410
add esp, 0x14
lea ecx, [esi + 0x208]
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x504df0
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x24], 0x20
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x28], 0x21
push bind
push edi
mov dword [esp + 0x30], ebx
call fcn.004a2410
lea edx, [esi + 0x21c]
push edx
push edi
call fcn.00443ad0
add esi, 0x230
push esi
push 0x8888
push edi
call fcn.004a2ae0
add esp, 0x28
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret