Function at 0x42ee10
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5d7298
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x669404]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push esi
push edi
mov eax, dword [0x669404]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov esi, 7
xor ebx, ebx
xor eax, eax
mov edi, ecx
mov dword [esp + 0x60], esi
mov dword [esp + 0x5c], ebx
mov word [esp + 0x4c], ax
mov dword [esp + 0x78], ebx
xor ecx, ecx
push 0xd
mov word [esp + 0x34], cx
push str.SearchProtect
lea ecx, [esp + 0x38]
mov dword [esp + 0x4c], esi
mov dword [esp + 0x48], ebx
call fcn.00406180
mov byte [esp + 0x78], 1
push 0x2d
xor edx, edx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], dx
call fcn.00406180
mov byte [esp + 0x78], 2
lea eax, [esp + 0x4c]
push eax
push SysReAllocString
lea edx, [esp + 0x38]
lea ecx, [esp + 0x1c]
call fcn.00502800
add esp, 8
mov byte [esp + 0x13], al
mov byte [esp + 0x78], 1
cmp dword [esp + 0x28], 8
jb 0x42eee3
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor edx, edx
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], ebx
mov word [esp + 0x14], dx
mov byte [esp + 0x78], bl
cmp dword [esp + 0x44], 8
jb 0x42ef0b
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor ecx, ecx
mov dword [esp + 0x44], esi
mov dword [esp + 0x40], ebx
mov word [esp + 0x30], cx
cmp byte [esp + 0x13], bl
je 0x42ef43
lea edx, [esp + 0x4c]
push edx
lea ecx, [esp + 0x17]
mov byte [esp + 0x17], bl
call fcn.00409f50
add esp, 4
test al, al
je 0x42ef43
cmp byte [esp + 0x13], bl
jne 0x42eff7
push 0xd
xor eax, eax
push str.SearchProtect
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], ax
call fcn.00406180
mov byte [esp + 0x78], 3
xor ecx, ecx
push 0x2d
mov word [esp + 0x34], cx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
lea ecx, [esp + 0x38]
mov dword [esp + 0x4c], esi
mov dword [esp + 0x48], ebx
call fcn.00406180
mov byte [esp + 0x78], 4
push edi
push SysReAllocString
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x38]
call fcn.00502000
add esp, 8
mov byte [esp + 0x78], 3
mov edi, 8
cmp dword [esp + 0x44], edi
jb 0x42efbf
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov dword [esp + 0x44], esi
mov dword [esp + 0x40], ebx
mov word [esp + 0x30], ax
mov byte [esp + 0x78], bl
cmp dword [esp + 0x28], edi
jb 0x42efe6
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor edx, edx
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], ebx
mov word [esp + 0x14], dx
jmp 0x42effc
mov edi, 8
mov dword [esp + 0x78], 0xffffffff
cmp dword [esp + 0x60], edi
jb 0x42f018
mov eax, dword [esp + 0x4c]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor ecx, ecx
mov dword [esp + 0x60], esi
mov dword [esp + 0x5c], ebx
mov word [esp + 0x4c], cx
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.00546bdc
mov esp, ebp
pop ebp
ret