Function at 0x432861
Capabilities:
Persist via run registry key

Disassembly:
push 0x20
mov eax, 0x4731a9
call fcn.004550bc
mov edi, ecx
mov dword [ebp - 0x10], edi
lea ecx, [ebp - 0x2c]
call fcn.00435c47
mov esi, SysReAllocStringLen
xor ebx, ebx
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedMRUs
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x4328ba
lea ecx, [ebp - 0x2c]
call fcn.00435b7b
lea ecx, [ebp - 0x2c]
call fcn.00435a64
push esi
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSaveMRU
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x4328f0
lea ecx, [ebp - 0x2c]
call fcn.00435b7b
lea ecx, [ebp - 0x2c]
call fcn.00435a64
push esi
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedMRU
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x432926
lea ecx, [ebp - 0x2c]
call fcn.00435b7b
lea ecx, [ebp - 0x2c]
call fcn.00435a64
push esi
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerStreamMRU
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x43295c
lea ecx, [ebp - 0x2c]
call fcn.00435b7b
lea ecx, [ebp - 0x2c]
call fcn.00435a64
push esi
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist75048700_EF1F_11D0_9888_006097DEACF9Count
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x432992
lea ecx, [ebp - 0x2c]
call fcn.00435b7b
lea ecx, [ebp - 0x2c]
call fcn.00435a64
push esi
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist5E6AB780_7743_11CF_A12B_00AA004AE837Count
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x4329c8
lea ecx, [ebp - 0x2c]
call fcn.00435b7b
lea ecx, [ebp - 0x2c]
call fcn.00435a64
push esi
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareMicrosoftInternet_Explorer
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x432a06
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Download_Directory
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435c7b
push esi
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareMicrosoftInternet_ExplorerMain
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x432a44
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Save_Directory
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435c7b
push esi
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareMicrosoftWindowsShellNoRoamMUICache
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x432a72
lea ecx, [ebp - 0x2c]
call fcn.00435a64
push 0xffffffffffffffff
lea ecx, [edi + 0x1450]
push ebx
call fcn.0044a148
add edi, 0x144c
push 0x477979
mov ecx, edi
call fcn.00401759
push esi
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x432b42
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x477979
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.Recent
mov byte [ebp - 4], 1
call fcn.00401c93
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call fcn.00436249
push eax
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.0040170c
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.004010af
mov eax, dword [edi]
cmp dword [eax - 0xc], ebx
je 0x432b42
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 0x1458]
add ecx, 0x1450
push edi
push eax
call fcn.0044a503
mov esi, dword [ebp - 0x10]
lea ecx, [esi + 0x147c]
push 0x48d768
call fcn.00401759
push 3
mov ecx, esi
call fcn.0041f334
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00435c67
call fcn.0045515b
ret