Function at 0x411ad4
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
cmp byte [0x643648], 0
mov dword [ebp - 4], ebx
mov esi, str.CAutoRunItemsRegLoader::LoadItems
je 0x411b10
mov eax, dword [0x643644]
cmp eax, edi
je 0x411b10
push str.LoadItems_autoruns_started
push 0x167
push esi
push edi
push eax
call fcn.004026b0
add esp, 0x14
mov ecx, ebx
call fcn.004104ad
test eax, eax
je 0x411b77
cmp byte [0x643648], 0
je 0x411b42
mov eax, dword [0x643644]
cmp eax, edi
je 0x411b42
push str.LoadItems_SaveDisabled
push 0x16b
push esi
push edi
push eax
call fcn.004026b0
add esp, 0x14
mov ecx, ebx
call fcn.00410c2f
cmp byte [0x643648], 0
je 0x411b70
mov eax, dword [0x643644]
cmp eax, edi
je 0x411b70
push str.LoadItems_ClearItems
push 0x16e
push esi
push edi
push eax
call fcn.004026b0
add esp, 0x14
mov ecx, ebx
call fcn.00410be7
cmp byte [0x643648], 0
je 0x411b9e
mov eax, dword [0x643644]
cmp eax, edi
je 0x411b9e
push str.LoadItems_autoruns_from_registry
push 0x172
push esi
push edi
push eax
call fcn.004026b0
add esp, 0x14
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0xc], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
call fcn.00408c50
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
mov ecx, ebx
call fcn.00411708
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0xc], esp
mov ebx, str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce_
push ebx
call fcn.00408c50
mov ecx, dword [ebp - 4]
push edi
call fcn.00411708
push 2
push ecx
mov ecx, esp
mov dword [ebp - 0xc], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
call fcn.00408c50
mov ecx, dword [ebp - 4]
dec edi
push edi
call fcn.00411708
push 3
push ecx
mov ecx, esp
mov dword [ebp - 0xc], esp
push ebx
call fcn.00408c50
mov ebx, dword [ebp - 4]
push edi
mov ecx, ebx
call fcn.00411708
push 2
xor edi, edi
push edi
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jl 0x411c5f
cmp byte [0x643648], 0
je 0x411c43
mov eax, dword [0x643644]
cmp eax, edi
je 0x411c43
push str.LoadItems_autoruns_from_start_menus
push 0x17c
push esi
push edi
push eax
call fcn.004026b0
add esp, 0x14
push 4
push 0x18
mov ecx, ebx
call fcn.004117f4
push 5
push 7
mov ecx, ebx
call fcn.004117f4
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp byte [0x643648], 0
je 0x411c86
mov eax, dword [0x643644]
cmp eax, edi
je 0x411c86
push str.LoadItems_save_disabled
push 0x186
push esi
push edi
push eax
call fcn.00402740
add esp, 0x14
mov ecx, ebx
call fcn.004112ca
cmp byte [0x643648], 0
je 0x411cb4
mov eax, dword [0x643644]
cmp eax, edi
je 0x411cb4
push str.LoadItems_DetermineItemsStatus
push 0x18c
push esi
push edi
push eax
call fcn.00402740
add esp, 0x14
mov ecx, ebx
call fcn.0041104a
cmp byte [0x643648], 0
je 0x411ce2
mov eax, dword [0x643644]
cmp eax, edi
je 0x411ce2
push str.LoadItems_sort
push 0x192
push esi
push edi
push eax
call fcn.00402740
add esp, 0x14
push ebx
push dword [ebx + 0x10]
lea ecx, [ebp - 0x10]
call fcn.00414522
push ebx
push dword [ebx + 0xc]
lea ecx, [ebp - 8]
call fcn.00414522
push 0x4106c6
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00410f5a
add esp, 0x14
cmp byte [0x643648], 0
je 0x411d3a
mov eax, dword [0x643644]
cmp eax, edi
je 0x411d3a
push str.LoadItems_end
push 0x196
push esi
push edi
push eax
call fcn.00402740
add esp, 0x14
pop edi
pop esi
pop ebx
leave
ret