Function at 0x10042750
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101e7840
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1025e344]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
push edi
push ecx
mov ebx, esp
mov dword [ebp + 8], esp
mov dword [ebp - 0x10], ebx
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x10042b63
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov dword [ebp - 4], 0
mov ecx, ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
call fcn.10004060
test al, al
jne 0x100427c3
push 0x2d
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov ecx, ebx
call fcn.10006ab0
mov dword [ebp - 4], 1
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10041820
push edi
push ecx
mov ebx, esp
mov dword [ebp + 8], esp
mov dword [ebp - 0x10], ebx
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x10042b6d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov dword [ebp - 4], 2
mov ecx, ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
call fcn.10004060
test al, al
jne 0x10042825
push 0x31
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
mov ecx, ebx
call fcn.10006ab0
mov dword [ebp - 4], 3
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10041820
push edi
push ecx
mov ebx, esp
mov dword [ebp + 8], esp
mov dword [ebp - 0x10], ebx
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x10042b77
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov dword [ebp - 4], 4
mov ecx, ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
call fcn.10004060
test al, al
jne 0x10042887
push 0x33
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
mov ecx, ebx
call fcn.10006ab0
mov dword [ebp - 4], 5
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10041820
push edi
push ecx
mov ebx, esp
mov dword [ebp + 8], esp
mov dword [ebp - 0x10], ebx
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x10042b81
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov dword [ebp - 4], 6
mov ecx, ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServicesOnce
call fcn.10004060
test al, al
jne 0x100428e9
push 0x39
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServicesOnce
mov ecx, ebx
call fcn.10006ab0
mov dword [ebp - 4], 7
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10041820
push edi
push ecx
mov ebx, esp
mov dword [ebp + 8], esp
mov dword [ebp - 0x10], ebx
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x10042b8b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov dword [ebp - 4], 8
mov ecx, ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun
call fcn.10004060
test al, al
jne 0x1004294b
push 0x3f
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun
mov ecx, ebx
call fcn.10006ab0
mov dword [ebp - 4], 9
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10041820
push edi
push ecx
mov ebx, esp
mov dword [ebp + 8], esp
mov dword [ebp - 0x10], ebx
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x10042b95
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov dword [ebp - 4], 0xa
mov ecx, ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
call fcn.10004060
test al, al
jne 0x100429ad
push 0x2d
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov ecx, ebx
call fcn.10006ab0
mov dword [ebp - 4], 0xb
push SysReAllocString
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10041820
push edi
push ecx
mov ebx, esp
mov dword [ebp + 8], esp
mov dword [ebp - 0x10], ebx
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x10042b9f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov dword [ebp - 4], 0xc
mov ecx, ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
call fcn.10004060
test al, al
jne 0x10042a0f
push 0x31
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
mov ecx, ebx
call fcn.10006ab0
mov dword [ebp - 4], 0xd
push SysReAllocString
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10041820
push edi
push ecx
mov ebx, esp
mov dword [ebp + 8], esp
mov dword [ebp - 0x10], ebx
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x10042ba9
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov dword [ebp - 4], 0xe
mov ecx, ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
call fcn.10004060
test al, al
jne 0x10042a71
push 0x33
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
mov ecx, ebx
call fcn.10006ab0
mov dword [ebp - 4], 0xf
push SysReAllocString
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10041820
push edi
push ecx
mov ebx, esp
mov dword [ebp + 8], esp
mov dword [ebp - 0x10], ebx
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x10042bb3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov dword [ebp - 4], 0x10
mov ecx, ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServicesOnce
call fcn.10004060
test al, al
jne 0x10042ad3
push 0x39
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServicesOnce
mov ecx, ebx
call fcn.10006ab0
mov dword [ebp - 4], 0x11
push SysReAllocString
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10041820
push edi
push ecx
mov edi, esp
mov dword [ebp + 8], esp
mov dword [ebp - 0x10], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x10042bbd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0x12
mov ecx, edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun
call fcn.10004060
test al, al
jne 0x10042b35
push 0x3f
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun
mov ecx, edi
call fcn.10006ab0
mov dword [ebp - 4], 0x13
push SysReAllocString
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10041820
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
int3