Function at 0x413520
Capabilities:
Check os version
Parse pe header
Query or enumerate registry value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x45c9d0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov eax, dword [0x473354]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call fcn.00404740
mov ebp, eax
or ebx, 0xffffffff
cmp byte [0x474ea5], 0
mov dword [esp + 0x14], ebp
je 0x413575
push str.Entry_Location_Entry_Enabled_Description_Publisher_Image_Path_Launch_String_MD5_SHA_1_SHA_256_n
call fcn.0043263b
add esp, 4
jmp 0x4135c8
cmp byte [0x474ea6], 0
je 0x4135c8
call fcn.004312c5
mov esi, eax
add esi, 0x20
add dword [esi + 4], ebx
js 0x413596
mov eax, dword [esi]
mov byte [eax], 0x3c
inc dword [esi]
jmp 0x4135a1
push esi
push 0x3c
call fcn.0043147a
add esp, 8
push str.autoruns
push esi
call fcn.00404430
add esp, 8
add dword [esi + 4], ebx
js 0x4135bd
mov ecx, dword [esi]
mov byte [ecx], 0x3e
inc dword [esi]
jmp 0x4135c8
push esi
push 0x3e
call fcn.0043147a
add esp, 8
test dword [esp + 0x3c], 0x100
mov esi, dword [sym.imp.KERNEL32.dll_GetVersion]
je 0x413669
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push str.BootExecute
push str.SystemCurrentControlSetControlSession_Manager
push edx
push 0
call fcn.00416880
mov eax, dword [reloc.OLEAUT32.dll_SysReAllocString]
push str.SetupExecute
push str.SystemCurrentControlSetControlSession_Manager
push eax
push 0
call fcn.00416880
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push str.Execute
push str.SystemCurrentControlSetControlSession_Manager
push ecx
push 0
call fcn.00416880
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push str.S0InitialCommand
push str.SystemCurrentControlSetControlSession_Manager
push edx
push 0
call fcn.00416880
add esp, 0x40
call esi
cmp al, 6
jb 0x413669
call esi
shr eax, 8
cmp al, 1
jb 0x413669
mov eax, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 0x20
push str.ServiceControlManagerExtension
push str.SystemCurrentControlSetControl
push eax
push 0
call fcn.00411bb0
add esp, 0x14
test dword [esp + 0x3c], 0x20000
je 0x41367d
push 0
call fcn.00426230
add esp, 4
test dword [esp + 0x3c], 0x200
mov edi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
je 0x41383d
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 1
push str.SoftwareMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
push ecx
push 0
call fcn.0041d4b0
add esp, 0x10
test ebp, ebp
je 0x4136fa
mov eax, dword [0x474eac]
test eax, eax
je 0x4136c8
push 1
call eax
mov edx, dword [0x4746a8]
push 0x200
push edx
call edi
mov eax, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 1
push str.SoftwareWow6432NodeMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
push eax
push 0
call fcn.0041d4b0
mov eax, dword [0x474eac]
add esp, 0x10
test eax, eax
je 0x4136fa
push 0
call eax
mov ecx, dword [0x4746a8]
push 0x100
push ecx
call edi
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 0x2c
push str.Autorun
push str.SoftwareMicrosoftCommand_Processor
push edx
push 0
call fcn.00411bb0
add esp, 0x14
test ebp, ebp
je 0x41376d
mov eax, dword [0x474eac]
test eax, eax
je 0x413735
push 1
call eax
mov eax, dword [0x4746a8]
push 0x200
push eax
call edi
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 0x2c
push str.Autorun
push str.SoftwareWow6432NodeMicrosoftCommand_Processor
push ecx
push 0
call fcn.00411bb0
mov eax, dword [0x474eac]
add esp, 0x14
test eax, eax
je 0x41376d
push 0
call eax
mov edx, dword [0x4746a8]
push 0x100
push edx
call edi
mov eax, dword [0x473118]
push 0x2c
push str.Autorun
push str.SoftwareMicrosoftCommand_Processor
push eax
push 0
call fcn.00411bb0
push str.SOFTWAREClassesExefileShellOpenCommand
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x34], esi
mov edx, dword [0x473118]
lea ecx, [esp + 0x34]
push ecx
push edx
push 0
mov dword [esp + 0x58], 0
call fcn.00412380
push esi
call fcn.0042f4d9
push str.SOFTWAREClassesExefileShellOpenCommand
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x48], esi
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea eax, [esp + 0x48]
push eax
push ecx
push 0
mov dword [esp + 0x6c], 1
call fcn.00412380
push esi
mov dword [esp + 0x70], ebx
call fcn.0042f4d9
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push str.SoftwareClasses.exe
push edx
push 0
call fcn.0041c260
mov eax, dword [0x473118]
add esp, 0x48
push str.SoftwareClasses.exe
push eax
push 0
call fcn.0041c260
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push str.SoftwareClasses.cmd
push ecx
push 0
call fcn.0041c260
mov edx, dword [0x473118]
push str.SoftwareClasses.cmd
push edx
push 0
call fcn.0041c260
add esp, 0x24
mov esi, dword [esp + 0x3c]
and esi, 0x1000
je 0x413889
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jae 0x413889
mov eax, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 0x20
push str.ServiceControllerStart
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push eax
push 0
call fcn.00411bb0
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 0x20
push str.LsaStart
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push ecx
push 0
call fcn.00411bb0
add esp, 0x28
test byte [esp + 0x3c], 0x20
je 0x4138a6
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push str.SystemCurrentControlSetServices
push edx
push 0
call fcn.004200d0
add esp, 0xc
test byte [esp + 0x3c], 0x40
je 0x4138c2
mov eax, dword [reloc.OLEAUT32.dll_SysReAllocString]
push str.SystemCurrentControlSetServices
push eax
push 0
call fcn.00417290
add esp, 0xc
mov ebp, 4
test esi, esi
je 0x413a7c
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 0x2c
push str.System
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push ecx
push 0
call fcn.00411bb0
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 0x2c
push str.UIHost
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push edx
push 0
call fcn.00411bb0
add esp, 0x28
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x4139a5
push str.SOFTWAREMicrosoftWindowsCurrentVersionAuthenticationCredential_Providers
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x20], esi
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea eax, [esp + 0x20]
push eax
push ecx
push 0
mov dword [esp + 0x44], 2
call fcn.0040fa30
push esi
call fcn.0042f4d9
push str.SOFTWAREMicrosoftWindowsCurrentVersionAuthenticationCredential_Provider_Filters
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x34], esi
mov eax, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea edx, [esp + 0x34]
push edx
push eax
push 0
mov dword [esp + 0x58], 3
call fcn.0040fa30
push esi
call fcn.0042f4d9
push str.SOFTWAREMicrosoftWindowsCurrentVersionAuthenticationPLAP_Providers
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x48], esi
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea ecx, [esp + 0x48]
push ecx
push edx
push 0
mov dword [esp + 0x6c], ebp
call fcn.0040fa30
push esi
call fcn.0042f4d9
add esp, 0x3c
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogonNotify
call fcn.0042f484
mov dword [esp + 0x1c], eax
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea eax, [esp + 0x1c]
push eax
push ecx
push 0
mov dword [esp + 0x44], 5
call fcn.0042bc40
mov edx, dword [esp + 0x28]
push edx
mov dword [esp + 0x48], ebx
call fcn.0042f4d9
mov eax, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 0x2c
push str.GinaDLL
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push eax
push 0
call fcn.00411bb0
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 0x2c
push str.Taskman
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push ecx
push 0
call fcn.00411bb0
mov edx, dword [0x473118]
push 0x2c
push str.Scrnsave.exe
push str.SOFTWAREPoliciesMicrosoftWindowsControl_PanelDesktop
push edx
push 0
call fcn.00411bb0
mov eax, dword [0x473118]
add esp, 0x50
push 0x2c
push str.Scrnsave.exe
push str.Control_PanelDesktop
push eax
push 0
call fcn.00411bb0
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 0x2c
push str.ImagePath
push str.SystemCurrentControlSetControlBootVerificationProgram
push ecx
push 0
call fcn.00411bb0
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 0x20
push str.SaveDumpStart
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push edx
push 0
call fcn.00411bb0
add esp, 0x3c
test dword [esp + 0x3c], 0x4000
je 0x413ac0
push str.SYSTEMCurrentControlSetControlPrintMonitors
call fcn.0042f484
mov dword [esp + 0x1c], eax
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea eax, [esp + 0x1c]
push eax
push ecx
push 0
mov dword [esp + 0x44], 6
call fcn.0041fe40
mov edx, dword [esp + 0x28]
push edx
mov dword [esp + 0x48], ebx
call fcn.0042f4d9
add esp, 0x14
test dword [esp + 0x3c], 0x8000
je 0x413b8d
mov eax, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 0x2c
push str.SecurityProviders
push str.SYSTEMCurrentControlSetControlSecurityProviders
push eax
push 0
call fcn.00411bb0
add esp, 0x14
cmp dword [esp + 0x14], 0
je 0x413b43
mov eax, dword [0x474eac]
test eax, eax
je 0x413b0c
push 1
call eax
mov ecx, dword [0x4746a8]
push 0x200
push ecx
call edi
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 0x2c
push str.SecurityProviders
push str.SYSTEMCurrentControlSetControlSecurityProviders
push edx
push 0
call fcn.00411bb0
mov eax, dword [0x474eac]
add esp, 0x14
test eax, eax
je 0x413b43
push 0
call eax
mov eax, dword [0x4746a8]
push 0x100
push eax
call edi
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push str.Authentication_Packages
push str.SYSTEMCurrentControlSetControlLsa
push ecx
push 0
call fcn.0041ea10
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push str.Notification_Packages
push str.SYSTEMCurrentControlSetControlLsa
push edx
push 0
call fcn.0041ea10
mov eax, dword [reloc.OLEAUT32.dll_SysReAllocString]
push str.Security_Packages
push str.SYSTEMCurrentControlSetControlLsa
push eax
push 0
call fcn.0041ea10
add esp, 0x30
test dword [esp + 0x3c], 0x10000
je 0x413bd1
push str.SYSTEMCurrentControlSetControlNetworkProviderOrder
call fcn.0042f484
mov dword [esp + 0x1c], eax
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea ecx, [esp + 0x1c]
push ecx
push edx
push 0
mov dword [esp + 0x44], 7
call fcn.0041f590
mov eax, dword [esp + 0x28]
push eax
mov dword [esp + 0x48], ebx
call fcn.0042f4d9
add esp, 0x14
test dword [esp + 0x3c], 0x2000
je 0x413c64
push ecx
mov dword [esp + 0x2c], esp
mov esi, esp
push str.SystemCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
call fcn.0042f484
add esp, 4
push 0
mov dword [esi], eax
call fcn.0042d340
add esp, 4
mov dword [esp + 0x2c], esp
mov esi, esp
push str.SystemCurrentControlSetServicesWinSock2ParametersNameSpace_Catalog5Catalog_Entries
call fcn.0042f484
add esp, 4
push 0
mov dword [esi], eax
call fcn.0042ca40
add esp, 8
cmp dword [esp + 0x14], 0
je 0x413c64
push ecx
mov dword [esp + 0x2c], esp
mov esi, esp
push str.SystemCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries64
call fcn.0042f484
add esp, 4
push 0
mov dword [esi], eax
call fcn.0042d340
add esp, 4
mov dword [esp + 0x2c], esp
mov esi, esp
push str.SystemCurrentControlSetServicesWinSock2ParametersNameSpace_Catalog5Catalog_Entries64
call fcn.0042f484
add esp, 4
push 0
mov dword [esi], eax
call fcn.0042ca40
add esp, 8
mov esi, dword [esp + 0x3c]
and esi, 2
mov dword [esp + 0x18], esi
je 0x413cb1
call fcn.0040a890
test eax, eax
je 0x413cb1
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 0x2c
push str.StartupPrograms
push str.SystemCurrentControlSetControlTerminal_ServerWds_rdpwd
push ecx
push 0
call fcn.00411bb0
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 0x2c
push str.AppSetup
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push edx
push 0
call fcn.00411bb0
add esp, 0x28
test esi, esi
je 0x413ef8
push str.SoftwarePoliciesMicrosoftWindowsSystemScriptsStartup
call fcn.0042f484
mov dword [esp + 0x20], eax
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 1
lea eax, [esp + 0x24]
push eax
push ecx
push 0
mov dword [esp + 0x48], 8
call fcn.004196f0
mov edx, dword [esp + 0x30]
push edx
call fcn.0042f4d9
push str.SoftwarePoliciesMicrosoftWindowsSystemScriptsLogon
call fcn.0042f484
mov dword [esp + 0x38], eax
mov ecx, dword [0x473118]
push 1
lea eax, [esp + 0x3c]
push eax
push ecx
push 0
mov dword [esp + 0x60], 9
call fcn.004196f0
mov edx, dword [esp + 0x48]
push edx
call fcn.0042f4d9
push str.SoftwarePoliciesMicrosoftWindowsSystemScriptsLogon
call fcn.0042f484
mov dword [esp + 0x50], eax
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 1
lea eax, [esp + 0x54]
push eax
push ecx
push 0
mov dword [esp + 0x78], 0xa
call fcn.004196f0
mov edx, dword [esp + 0x60]
add esp, 0x44
push edx
mov dword [esp + 0x38], ebx
call fcn.0042f4d9
mov eax, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 0x2c
push str.Userinit
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push eax
push 0
call fcn.00411bb0
push str.SoftwarePoliciesMicrosoftWindowsSystemScriptsShutdown
call fcn.0042f484
mov dword [esp + 0x38], eax
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 1
lea ecx, [esp + 0x3c]
push ecx
push edx
push 0
mov dword [esp + 0x60], 0xb
call fcn.004196f0
mov eax, dword [esp + 0x48]
push eax
call fcn.0042f4d9
push str.SoftwarePoliciesMicrosoftWindowsSystemScriptsLogoff
call fcn.0042f484
mov dword [esp + 0x50], eax
mov edx, dword [0x473118]
push 1
lea ecx, [esp + 0x54]
push ecx
push edx
push 0
mov dword [esp + 0x78], 0xc
call fcn.004196f0
mov eax, dword [esp + 0x60]
add esp, 0x44
push eax
call fcn.0042f4d9
push str.SoftwarePoliciesMicrosoftWindowsSystemScriptsLogoff
call fcn.0042f484
mov dword [esp + 0x24], eax
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 1
lea ecx, [esp + 0x28]
push ecx
push edx
push 0
mov dword [esp + 0x4c], 0xd
call fcn.004196f0
mov eax, dword [esp + 0x34]
push eax
call fcn.0042f4d9
push str.SoftwareMicrosoftWindowsCurrentVersionGroup_PolicyScriptsStartup
call fcn.0042f484
mov dword [esp + 0x3c], eax
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 1
lea ecx, [esp + 0x40]
push ecx
push edx
push 0
mov dword [esp + 0x64], 0xe
call fcn.004196f0
mov eax, dword [esp + 0x4c]
push eax
call fcn.0042f4d9
push str.SoftwareMicrosoftWindowsCurrentVersionGroup_PolicyScriptsStartup
call fcn.0042f484
mov dword [esp + 0x54], eax
mov edx, dword [0x473118]
push 1
lea ecx, [esp + 0x58]
push ecx
push edx
push 0
mov dword [esp + 0x7c], 0xf
call fcn.004196f0
mov eax, dword [esp + 0x64]
add esp, 0x48
push eax
call fcn.0042f4d9
push str.SoftwareMicrosoftWindowsCurrentVersionGroup_PolicyScriptsShutdown
call fcn.0042f484
mov dword [esp + 0x24], eax
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 1
lea ecx, [esp + 0x28]
push ecx
push edx
push 0
mov dword [esp + 0x4c], 0x10
call fcn.004196f0
mov eax, dword [esp + 0x34]
push eax
call fcn.0042f4d9
push str.SoftwareMicrosoftWindowsCurrentVersionGroup_PolicyScriptsShutdown
call fcn.0042f484
mov dword [esp + 0x3c], eax
mov edx, dword [0x473118]
push 1
lea ecx, [esp + 0x40]
push ecx
push edx
push 0
mov dword [esp + 0x64], 0x11
call fcn.004196f0
mov eax, dword [esp + 0x4c]
push eax
mov dword [esp + 0x68], ebx
call fcn.0042f4d9
add esp, 0x34
test dword [esp + 0x3c], 0x400
je 0x413fc0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
call fcn.0042f484
mov dword [esp + 0x20], eax
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push str.Appinit_Dlls
lea ecx, [esp + 0x24]
push ecx
push edx
push 0
mov dword [esp + 0x48], 0x12
call fcn.00403970
mov eax, dword [esp + 0x30]
push eax
mov dword [esp + 0x4c], ebx
call fcn.0042f4d9
add esp, 0x18
cmp dword [esp + 0x14], 0
je 0x413fc0
mov eax, dword [0x474eac]
test eax, eax
je 0x413f67
push 1
call eax
mov ecx, dword [0x4746a8]
push 0x200
push ecx
call edi
push str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionWindows
call fcn.0042f484
mov dword [esp + 0x20], eax
mov eax, dword [reloc.OLEAUT32.dll_SysReAllocString]
push str.Appinit_Dlls
lea edx, [esp + 0x24]
push edx
push eax
push 0
mov dword [esp + 0x48], 0x13
call fcn.00403970
mov ecx, dword [esp + 0x30]
push ecx
mov dword [esp + 0x4c], ebx
call fcn.0042f4d9
mov eax, dword [0x474eac]
add esp, 0x18
test eax, eax
je 0x413fc0
push 0
call eax
mov edx, dword [0x4746a8]
push 0x100
push edx
call edi
test dword [esp + 0x3c], 0x800
je 0x414009
push str.SystemCurrentControlSetControlSession_ManagerKnownDlls
call fcn.0042f484
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push eax
lea ecx, [esp + 0x24]
push ecx
push edx
push 0
mov dword [esp + 0x48], 0x14
call fcn.0041e130
mov eax, dword [esp + 0x30]
push eax
mov dword [esp + 0x4c], ebx
call fcn.0042f4d9
add esp, 0x18
test esi, esi
je 0x4144c1
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x4140ff
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x20], esi
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 0
push 1
lea ecx, [esp + 0x28]
push ecx
push edx
push 0
mov dword [esp + 0x4c], 0x15
call fcn.00413450
push esi
call fcn.0042f4d9
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServicesOnce
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x3c], esi
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 0
push 1
lea eax, [esp + 0x44]
push eax
push ecx
push 0
mov dword [esp + 0x68], 0x16
call fcn.00413450
push esi
call fcn.0042f4d9
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x58], esi
mov eax, dword [0x473118]
push 0
push 1
lea edx, [esp + 0x60]
push edx
push eax
push 0
mov dword [esp + 0x84], 0x17
call fcn.00413450
add esp, 0x50
push esi
call fcn.0042f4d9
push str.SoftwareMicrosoftWindowsCurrentVersionRunServicesOnce
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x24], esi
mov edx, dword [0x473118]
push 0
push 1
lea ecx, [esp + 0x2c]
push ecx
push edx
push 0
mov dword [esp + 0x50], 0x18
call fcn.00413450
push esi
mov dword [esp + 0x54], ebx
call fcn.0042f4d9
add esp, 0x20
mov eax, dword [0x473118]
push 0x20
push str.Shell
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push eax
push 0
call fcn.00411bb0
mov ecx, dword [0x473118]
push 0x20
push str.Shell
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push ecx
push 0
call fcn.00411bb0
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 0x20
push str.Shell
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push edx
push 0
call fcn.00411bb0
mov eax, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 0x20
push str.Shell
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push eax
push 0
call fcn.00411bb0
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
add esp, 0x50
push 0x20
push str.Taskman
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push ecx
push 0
call fcn.00411bb0
mov eax, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea edx, [esp + 0x34]
push edx
push 0x20019
push 0
push str.SystemCurrentControlSetControlSafeBootOption
push eax
call fcn.00409f10
add esp, 0x28
test eax, eax
jne 0x4141f9
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x2c]
push eax
push 0
push str.UseAlternateShell
push ecx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x3c], ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4141ee
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 0x2c
push str.AlternateShell
push str.SystemCurrentControlSetControlSafeBoot
push edx
push eax
call fcn.00411bb0
add esp, 0x14
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0040a890
test eax, eax
je 0x4142ad
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionTerminal_ServerInstallSoftwareMicrosoftWindowsCurrentVersionRunonce
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x28], esi
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 0
push 1
lea ecx, [esp + 0x30]
push ecx
push edx
push 0
mov dword [esp + 0x4c], 0x19
call fcn.00413450
push esi
call fcn.0042f4d9
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionTerminal_ServerInstallSoftwareMicrosoftWindowsCurrentVersionRunonceEx
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x44], esi
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 0
push 1
lea eax, [esp + 0x4c]
push eax
push ecx
push 0
mov dword [esp + 0x68], 0x1a
call fcn.00413450
push esi
call fcn.0042f4d9
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionTerminal_ServerInstallSoftwareMicrosoftWindowsCurrentVersionRun
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x60], esi
mov eax, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 0
push 1
lea edx, [esp + 0x68]
push edx
push eax
push 0
mov dword [esp + 0x84], 0x1b
call fcn.00413450
add esp, 0x50
push esi
call fcn.0042f4d9
add esp, 4
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x28], esi
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 0
push 1
lea ecx, [esp + 0x30]
push ecx
push edx
push 0
mov dword [esp + 0x4c], 0x1c
call fcn.00413450
push esi
mov dword [esp + 0x50], ebx
call fcn.0042f4d9
mov ebp, dword [esp + 0x30]
add esp, 0x1c
test ebp, ebp
je 0x414361
mov eax, dword [0x474eac]
test eax, eax
je 0x41430b
push 1
call eax
mov eax, dword [0x4746a8]
push 0x200
push eax
call edi
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRun
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x28], esi
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 0
push 1
lea ecx, [esp + 0x30]
push ecx
push edx
push 0
mov dword [esp + 0x4c], 0x1d
call fcn.00413450
push esi
mov dword [esp + 0x50], ebx
call fcn.0042f4d9
mov eax, dword [0x474eac]
add esp, 0x1c
test eax, eax
je 0x414361
push 0
call eax
mov eax, dword [0x4746a8]
push 0x100
push eax
call edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x28], esi
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 0
push 1
lea ecx, [esp + 0x30]
push ecx
push edx
push 0
mov dword [esp + 0x4c], 0x1e
call fcn.00413450
push esi
mov dword [esp + 0x50], ebx
call fcn.0042f4d9
add esp, 0x1c
test ebp, ebp
je 0x414411
mov eax, dword [0x474eac]
test eax, eax
je 0x4143bb
push 1
call eax
mov eax, dword [0x4746a8]
push 0x200
push eax
call edi
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRunOnceEx
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x28], esi
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 0
push 1
lea ecx, [esp + 0x30]
push ecx
push edx
push 0
mov dword [esp + 0x4c], 0x1f
call fcn.00413450
push esi
mov dword [esp + 0x50], ebx
call fcn.0042f4d9
mov eax, dword [0x474eac]
add esp, 0x1c
test eax, eax
je 0x414411
push 0
call eax
mov eax, dword [0x4746a8]
push 0x100
push eax
call edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x28], esi
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 0
push 1
lea ecx, [esp + 0x30]
push ecx
push edx
push 0
mov dword [esp + 0x4c], 0x20
call fcn.00413450
push esi
mov dword [esp + 0x50], ebx
call fcn.0042f4d9
add esp, 0x1c
test ebp, ebp
je 0x4144c1
mov eax, dword [0x474eac]
test eax, eax
je 0x41446b
push 1
call eax
mov eax, dword [0x4746a8]
push 0x200
push eax
call edi
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRunOnce
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x28], esi
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 0
push 1
lea ecx, [esp + 0x30]
push ecx
push edx
push 0
mov dword [esp + 0x4c], 0x21
call fcn.00413450
push esi
mov dword [esp + 0x50], ebx
call fcn.0042f4d9
mov eax, dword [0x474eac]
add esp, 0x1c
test eax, eax
je 0x4144c1
push 0
call eax
mov eax, dword [0x4746a8]
push 0x100
push eax
call edi
mov ebp, dword [esp + 0x3c]
and ebp, 4
je 0x4146ba
push str.SOFTWAREClassesProtocolsFilter
call fcn.0042f484
mov dword [esp + 0x20], eax
mov edx, dword [0x473118]
lea ecx, [esp + 0x20]
push ecx
push edx
push 0
mov dword [esp + 0x44], 0x22
call fcn.0041a360
mov eax, dword [esp + 0x2c]
push eax
call fcn.0042f4d9
push str.SOFTWAREClassesProtocolsFilter
call fcn.0042f484
mov dword [esp + 0x34], eax
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea ecx, [esp + 0x34]
push ecx
push edx
push 0
mov dword [esp + 0x58], 0x23
call fcn.0041a360
mov eax, dword [esp + 0x40]
push eax
call fcn.0042f4d9
push str.SOFTWAREClassesProtocolsHandler
call fcn.0042f484
mov dword [esp + 0x48], eax
mov edx, dword [0x473118]
lea ecx, [esp + 0x48]
push ecx
push edx
push 0
mov dword [esp + 0x6c], 0x24
call fcn.0041a360
mov eax, dword [esp + 0x54]
push eax
call fcn.0042f4d9
push str.SOFTWAREClassesProtocolsHandler
call fcn.0042f484
add esp, 0x40
mov dword [esp + 0x1c], eax
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea ecx, [esp + 0x1c]
push ecx
push edx
push 0
mov dword [esp + 0x40], 0x25
call fcn.0041a360
mov eax, dword [esp + 0x28]
push eax
call fcn.0042f4d9
push str.SOFTWAREMicrosoftInternet_ExplorerDesktopComponents
call fcn.0042f484
mov dword [esp + 0x30], eax
mov edx, dword [0x473118]
lea ecx, [esp + 0x30]
push ecx
push edx
push 0
mov dword [esp + 0x54], 0x26
call fcn.0041ac20
mov eax, dword [esp + 0x3c]
push eax
call fcn.0042f4d9
push str.SOFTWAREMicrosoftActive_SetupInstalled_Components
call fcn.0042f484
mov dword [esp + 0x44], eax
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea ecx, [esp + 0x44]
push ecx
push edx
mov dword [esp + 0x64], 0x27
push 0
call fcn.00402b70
mov eax, dword [esp + 0x50]
push eax
mov dword [esp + 0x6c], ebx
call fcn.0042f4d9
add esp, 0x38
cmp dword [esp + 0x14], 0
je 0x414680
mov eax, dword [0x474eac]
test eax, eax
je 0x41462c
push 1
call eax
mov ecx, dword [0x4746a8]
push 0x200
push ecx
call edi
push str.SOFTWAREWow6432NodeMicrosoftActive_SetupInstalled_Components
call fcn.0042f484
mov dword [esp + 0x20], eax
mov eax, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea edx, [esp + 0x20]
push edx
push eax
push 0
mov dword [esp + 0x44], 0x28
call fcn.00402b70
mov ecx, dword [esp + 0x2c]
push ecx
mov dword [esp + 0x48], ebx
call fcn.0042f4d9
mov eax, dword [0x474eac]
add esp, 0x14
test eax, eax
je 0x414680
push 0
call eax
mov edx, dword [0x4746a8]
push 0x100
push edx
call edi
push str.SOFTWAREMicrosoftActive_SetupInstalled_Components
call fcn.0042f484
mov dword [esp + 0x20], eax
mov ecx, dword [0x473118]
lea eax, [esp + 0x20]
push eax
push ecx
push 0
mov dword [esp + 0x44], 0x29
call fcn.00402b70
mov edx, dword [esp + 0x2c]
push edx
mov dword [esp + 0x48], ebx
call fcn.0042f4d9
add esp, 0x14
cmp dword [esp + 0x18], 0
je 0x4147ad
mov eax, dword [0x473118]
push str.AltStartup
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push eax
push 0
call fcn.004283c0
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push str.Common_AltStartup
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push ecx
push 0
call fcn.004283c0
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push str.Common_Startup
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edx
push 0
call fcn.004283c0
mov eax, dword [0x473118]
push str.Startup
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push eax
push 0
call fcn.004283c0
mov ecx, dword [0x473118]
add esp, 0x40
push 0x2c
push str.Load
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
push ecx
push 0
call fcn.00411bb0
mov edx, dword [0x473118]
push 0x2c
push 0x462150
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
push edx
push 0
call fcn.00411bb0
add esp, 0x28
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x414771
push 0
call fcn.0042b410
add esp, 4
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x28], esi
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 0
push 1
lea eax, [esp + 0x30]
push eax
push ecx
push 0
mov dword [esp + 0x4c], 0x2a
call fcn.00413450
push esi
mov dword [esp + 0x50], ebx
call fcn.0042f4d9
add esp, 0x1c
test ebp, ebp
je 0x414956
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x28], esi
mov eax, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 1
push 0
lea edx, [esp + 0x30]
push edx
push eax
push 0
mov dword [esp + 0x4c], 0x2b
call fcn.00413450
push esi
mov dword [esp + 0x50], ebx
call fcn.0042f4d9
add esp, 0x1c
cmp dword [esp + 0x14], 0
je 0x414868
mov eax, dword [0x474eac]
test eax, eax
je 0x414812
push 1
call eax
mov ecx, dword [0x4746a8]
push 0x200
push ecx
call edi
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x28], esi
mov eax, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 1
push 0
lea edx, [esp + 0x30]
push edx
push eax
push 0
mov dword [esp + 0x4c], 0x2c
call fcn.00413450
push esi
mov dword [esp + 0x50], ebx
call fcn.0042f4d9
mov eax, dword [0x474eac]
add esp, 0x1c
test eax, eax
je 0x414868
push 0
call eax
mov ecx, dword [0x4746a8]
push 0x100
push ecx
call edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x28], esi
mov eax, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 0
push 0
lea edx, [esp + 0x30]
push edx
push eax
push 0
mov dword [esp + 0x4c], 0x2d
call fcn.00413450
push esi
mov dword [esp + 0x50], ebx
call fcn.0042f4d9
add esp, 0x1c
cmp dword [esp + 0x14], 0
je 0x41491b
mov eax, dword [0x474eac]
test eax, eax
je 0x4148c5
push 1
call eax
mov ecx, dword [0x4746a8]
push 0x200
push ecx
call edi
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x28], esi
mov eax, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 0
push 0
lea edx, [esp + 0x30]
push edx
push eax
push 0
mov dword [esp + 0x4c], 0x2e
call fcn.00413450
push esi
mov dword [esp + 0x50], ebx
call fcn.0042f4d9
mov eax, dword [0x474eac]
add esp, 0x1c
test eax, eax
je 0x41491b
push 0
call eax
mov ecx, dword [0x4746a8]
push 0x100
push ecx
call edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x28], esi
mov eax, dword [0x473118]
push 0
push 0
lea edx, [esp + 0x30]
push edx
push eax
push 0
mov dword [esp + 0x4c], 0x2f
call fcn.00413450
push esi
mov dword [esp + 0x50], ebx
call fcn.0042f4d9
add esp, 0x1c
cmp dword [esp + 0x18], 0
je 0x414ac4
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x28], esi
mov edx, dword [0x473118]
push 0
push 1
lea ecx, [esp + 0x30]
push ecx
push edx
push 0
mov dword [esp + 0x4c], 0x30
call fcn.00413450
push esi
call fcn.0042f4d9
push str.SoftwareMicrosoftWindowsCurrentVersionRun
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x44], esi
mov ecx, dword [0x473118]
push 0
push 1
lea eax, [esp + 0x4c]
push eax
push ecx
push 0
mov dword [esp + 0x68], 0x31
call fcn.00413450
push esi
call fcn.0042f4d9
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x60], esi
mov eax, dword [0x473118]
push 0
push 1
lea edx, [esp + 0x68]
push edx
push eax
push 0
mov dword [esp + 0x84], 0x32
call fcn.00413450
add esp, 0x50
push esi
mov dword [esp + 0x38], ebx
call fcn.0042f4d9
add esp, 4
call fcn.0040a890
test eax, eax
je 0x414ac4
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionTerminal_ServerInstallSoftwareMicrosoftWindowsCurrentVersionRunonce
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x28], esi
mov edx, dword [0x473118]
push 0
push 1
lea ecx, [esp + 0x30]
push ecx
push edx
push 0
mov dword [esp + 0x4c], 0x33
call fcn.00413450
push esi
call fcn.0042f4d9
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionTerminal_ServerInstallSoftwareMicrosoftWindowsCurrentVersionRunonceEx
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x44], esi
mov ecx, dword [0x473118]
push 0
push 1
lea eax, [esp + 0x4c]
push eax
push ecx
push 0
mov dword [esp + 0x68], 0x34
call fcn.00413450
push esi
call fcn.0042f4d9
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionTerminal_ServerInstallSoftwareMicrosoftWindowsCurrentVersionRun
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x60], esi
mov eax, dword [0x473118]
push 0
push 1
lea edx, [esp + 0x68]
push edx
push eax
push 0
mov dword [esp + 0x84], 0x35
call fcn.00413450
add esp, 0x50
push esi
mov dword [esp + 0x38], ebx
call fcn.0042f4d9
add esp, 4
test byte [esp + 0x3c], 0x10
je 0x414ad5
push 0
call fcn.0042a480
add esp, 4
mov eax, dword [esp + 0x3c]
and eax, 8
mov dword [esp + 0x28], eax
je 0x414b91
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x28], esi
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea ecx, [esp + 0x28]
push ecx
push edx
push 0
mov dword [esp + 0x44], 0x36
call fcn.0040fa30
push esi
mov dword [esp + 0x48], ebx
call fcn.0042f4d9
add esp, 0x14
cmp dword [esp + 0x14], 0
je 0x414b91
mov eax, dword [0x474eac]
test eax, eax
je 0x414b3f
push 1
call eax
mov eax, dword [0x4746a8]
push 0x200
push eax
call edi
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x28], esi
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea ecx, [esp + 0x28]
push ecx
push edx
push 0
mov dword [esp + 0x44], 0x37
call fcn.0040fa30
push esi
mov dword [esp + 0x48], ebx
call fcn.0042f4d9
mov eax, dword [0x474eac]
add esp, 0x14
test eax, eax
je 0x414b91
push 0
call eax
mov eax, dword [0x4746a8]
push 0x100
push eax
call edi
test ebp, ebp
je 0x4156c1
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x28], esi
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 1
push 0
lea ecx, [esp + 0x30]
push ecx
push edx
push 0
mov dword [esp + 0x4c], 0x38
call fcn.00413450
push esi
mov dword [esp + 0x50], ebx
call fcn.0042f4d9
mov ebp, dword [esp + 0x30]
add esp, 0x1c
test ebp, ebp
je 0x414c4d
mov eax, dword [0x474eac]
test eax, eax
je 0x414bf7
push 1
call eax
mov eax, dword [0x4746a8]
push 0x200
push eax
call edi
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x28], esi
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 1
push 0
lea ecx, [esp + 0x30]
push ecx
push edx
push 0
mov dword [esp + 0x4c], 0x39
call fcn.00413450
push esi
mov dword [esp + 0x50], ebx
call fcn.0042f4d9
mov eax, dword [0x474eac]
add esp, 0x1c
test eax, eax
je 0x414c4d
push 0
call eax
mov eax, dword [0x4746a8]
push 0x100
push eax
call edi
push str.SoftwareClassesShellExContextMenuHandlers
call fcn.0042f484
mov dword [esp + 0x20], eax
mov edx, dword [0x473118]
lea ecx, [esp + 0x20]
push ecx
push edx
push 0
mov dword [esp + 0x44], 0x3a
call fcn.004218e0
mov eax, dword [esp + 0x2c]
push eax
call fcn.0042f4d9
push str.SoftwareClassesShellExContextMenuHandlers
call fcn.0042f484
mov dword [esp + 0x34], eax
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea ecx, [esp + 0x34]
push ecx
push edx
push 0
mov dword [esp + 0x58], 0x3b
call fcn.004218e0
mov eax, dword [esp + 0x40]
push eax
mov dword [esp + 0x5c], ebx
call fcn.0042f4d9
add esp, 0x28
test ebp, ebp
je 0x414d2d
mov eax, dword [0x474eac]
test eax, eax
je 0x414cd9
push 1
call eax
mov ecx, dword [0x4746a8]
push 0x200
push ecx
call edi
push str.SoftwareClassesShellExContextMenuHandlers
call fcn.0042f484
mov dword [esp + 0x20], eax
mov eax, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea edx, [esp + 0x20]
push edx
push eax
push 0
mov dword [esp + 0x44], 0x3c
call fcn.004218e0
mov ecx, dword [esp + 0x2c]
push ecx
mov dword [esp + 0x48], ebx
call fcn.0042f4d9
mov eax, dword [0x474eac]
add esp, 0x14
test eax, eax
je 0x414d2d
push 0
call eax
mov edx, dword [0x4746a8]
push 0x100
push edx
call edi
push str.SoftwareClassesAllFileSystemObjectsShellExContextMenuHandlers
call fcn.0042f484
mov dword [esp + 0x20], eax
mov ecx, dword [0x473118]
lea eax, [esp + 0x20]
push eax
push ecx
push 0
mov dword [esp + 0x44], 0x3d
call fcn.004218e0
mov edx, dword [esp + 0x2c]
push edx
call fcn.0042f4d9
push str.SoftwareClassesAllFileSystemObjectsShellExContextMenuHandlers
call fcn.0042f484
mov dword [esp + 0x34], eax
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea eax, [esp + 0x34]
push eax
push ecx
push 0
mov dword [esp + 0x58], 0x3e
call fcn.004218e0
mov edx, dword [esp + 0x40]
push edx
mov dword [esp + 0x5c], ebx
call fcn.0042f4d9
add esp, 0x28
test ebp, ebp
je 0x414e0d
mov eax, dword [0x474eac]
test eax, eax
je 0x414db8
push 1
call eax
mov eax, dword [0x4746a8]
push 0x200
push eax
call edi
push str.SoftwareClassesAllFileSystemObjectsShellExContextMenuHandlers
call fcn.0042f484
mov dword [esp + 0x20], eax
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea ecx, [esp + 0x20]
push ecx
push edx
push 0
mov dword [esp + 0x44], 0x3f
call fcn.004218e0
mov eax, dword [esp + 0x2c]
push eax
mov dword [esp + 0x48], ebx
call fcn.0042f4d9
mov eax, dword [0x474eac]
add esp, 0x14
test eax, eax
je 0x414e0d
push 0
call eax
mov ecx, dword [0x4746a8]
push 0x100
push ecx
call edi
push str.SoftwareClassesDirectoryShellExContextMenuHandlers
call fcn.0042f484
mov dword [esp + 0x20], eax
mov eax, dword [0x473118]
lea edx, [esp + 0x20]
push edx
push eax
push 0
mov dword [esp + 0x44], 0x40
call fcn.004218e0
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.0042f4d9
push str.SoftwareClassesDirectoryShellExContextMenuHandlers
call fcn.0042f484
mov dword [esp + 0x34], eax
mov eax, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea edx, [esp + 0x34]
push edx
push eax
push 0
mov dword [esp + 0x58], 0x41
call fcn.004218e0
mov ecx, dword [esp + 0x40]
push ecx
mov dword [esp + 0x5c], ebx
call fcn.0042f4d9
add esp, 0x28
test ebp, ebp
je 0x414eeb
mov eax, dword [0x474eac]
test eax, eax
je 0x414e97
push 1
call eax
mov edx, dword [0x4746a8]
push 0x200
push edx
call edi
push str.SoftwareClassesDirectoryShellExContextMenuHandlers
call fcn.0042f484
mov dword [esp + 0x20], eax
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea eax, [esp + 0x20]
push eax
push ecx
push 0
mov dword [esp + 0x44], 0x42
call fcn.004218e0
mov edx, dword [esp + 0x2c]
push edx
mov dword [esp + 0x48], ebx
call fcn.0042f4d9
mov eax, dword [0x474eac]
add esp, 0x14
test eax, eax
je 0x414eeb
push 0
call eax
mov eax, dword [0x4746a8]
push 0x100
push eax
call edi
push str.SoftwareClassesDirectoryShellexDragDropHandlers
call fcn.0042f484
mov dword [esp + 0x20], eax
mov edx, dword [0x473118]
lea ecx, [esp + 0x20]
push ecx
push edx
push 0
mov dword [esp + 0x44], 0x43
call fcn.004218e0
mov eax, dword [esp + 0x2c]
push eax
call fcn.0042f4d9
push str.SoftwareClassesDirectoryShellexDragDropHandlers
call fcn.0042f484
mov dword [esp + 0x34], eax
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea ecx, [esp + 0x34]
push ecx
push edx
push 0
mov dword [esp + 0x58], 0x44
call fcn.004218e0
mov eax, dword [esp + 0x40]
push eax
mov dword [esp + 0x5c], ebx
call fcn.0042f4d9
add esp, 0x28
test ebp, ebp
je 0x414fcb
mov eax, dword [0x474eac]
test eax, eax
je 0x414f77
push 1
call eax
mov ecx, dword [0x4746a8]
push 0x200
push ecx
call edi
push str.SoftwareWow6432NodeClassesDirectoryShellexDragDropHandlers
call fcn.0042f484
mov dword [esp + 0x20], eax
mov eax, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea edx, [esp + 0x20]
push edx
push eax
push 0
mov dword [esp + 0x44], 0x45
call fcn.004218e0
mov ecx, dword [esp + 0x2c]
push ecx
mov dword [esp + 0x48], ebx
call fcn.0042f4d9
mov eax, dword [0x474eac]
add esp, 0x14
test eax, eax
je 0x414fcb
push 0
call eax
mov edx, dword [0x4746a8]
push 0x100
push edx
call edi
push str.SoftwareClassesDirectoryShellexPropertySheetHandlers
call fcn.0042f484
mov dword [esp + 0x20], eax
mov ecx, dword [0x473118]
lea eax, [esp + 0x20]
push eax
push ecx
push 0
mov dword [esp + 0x44], 0x46
call fcn.004218e0
mov edx, dword [esp + 0x2c]
push edx
call fcn.0042f4d9
push str.SoftwareClassesDirectoryShellexPropertySheetHandlers
call fcn.0042f484
mov dword [esp + 0x34], eax
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea eax, [esp + 0x34]
push eax
push ecx
push 0
mov dword [esp + 0x58], 0x47
call fcn.004218e0
mov edx, dword [esp + 0x40]
push edx
mov dword [esp + 0x5c], ebx
call fcn.0042f4d9
add esp, 0x28
test ebp, ebp
je 0x4150ab
mov eax, dword [0x474eac]
test eax, eax
je 0x415056
push 1
call eax
mov eax, dword [0x4746a8]
push 0x200
push eax
call edi
push str.SoftwareWow6432NodeClassesDirectoryShellexPropertySheetHandlers
call fcn.0042f484
mov dword [esp + 0x20], eax
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea ecx, [esp + 0x20]
push ecx
push edx
push 0
mov dword [esp + 0x44], 0x48
call fcn.004218e0
mov eax, dword [esp + 0x2c]
push eax
mov dword [esp + 0x48], ebx
call fcn.0042f4d9
mov eax, dword [0x474eac]
add esp, 0x14
test eax, eax
je 0x4150ab
push 0
call eax
mov ecx, dword [0x4746a8]
push 0x100
push ecx
call edi
push str.SoftwareClassesDirectoryShellexCopyHookHandlers
call fcn.0042f484
mov dword [esp + 0x20], eax
mov eax, dword [0x473118]
lea edx, [esp + 0x20]
push edx
push eax
push 0
mov dword [esp + 0x44], 0x49
call fcn.004218e0
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.0042f4d9
push str.SoftwareClassesDirectoryShellexCopyHookHandlers
call fcn.0042f484
mov dword [esp + 0x34], eax
mov eax, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea edx, [esp + 0x34]
push edx
push eax
push 0
mov dword [esp + 0x58], 0x4a
call fcn.004218e0
mov ecx, dword [esp + 0x40]
push ecx
mov dword [esp + 0x5c], ebx
call fcn.0042f4d9
add esp, 0x28
test ebp, ebp
je 0x415189
mov eax, dword [0x474eac]
test eax, eax
je 0x415135
push 1
call eax
mov edx, dword [0x4746a8]
push 0x200
push edx
call edi
push str.SoftwareWow6432NodeClassesDirectoryShellexCopyHookHandlers
call fcn.0042f484
mov dword [esp + 0x20], eax
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea eax, [esp + 0x20]
push eax
push ecx
push 0
mov dword [esp + 0x44], 0x4b
call fcn.004218e0
mov edx, dword [esp + 0x2c]
push edx
mov dword [esp + 0x48], ebx
call fcn.0042f4d9
mov eax, dword [0x474eac]
add esp, 0x14
test eax, eax
je 0x415189
push 0
call eax
mov eax, dword [0x4746a8]
push 0x100
push eax
call edi
push str.SoftwareClassesFolderShellexColumnHandlers
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x28], esi
mov edx, dword [0x473118]
lea ecx, [esp + 0x28]
push ecx
push edx
push 0
mov dword [esp + 0x44], 0x4c
call fcn.0040fa30
push esi
call fcn.0042f4d9
push str.SoftwareClassesFolderShellexColumnHandlers
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x3c], esi
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea eax, [esp + 0x3c]
push eax
push ecx
push 0
mov dword [esp + 0x58], 0x4d
call fcn.0040fa30
push esi
mov dword [esp + 0x5c], ebx
call fcn.0042f4d9
add esp, 0x28
test ebp, ebp
je 0x415264
mov eax, dword [0x474eac]
test eax, eax
je 0x415211
push 1
call eax
mov edx, dword [0x4746a8]
push 0x200
push edx
call edi
push str.SoftwareWow6432NodeClassesFolderShellexColumnHandlers
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x28], esi
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea eax, [esp + 0x28]
push eax
push ecx
push 0
mov dword [esp + 0x44], 0x4e
call fcn.0040fa30
push esi
mov dword [esp + 0x48], ebx
call fcn.0042f4d9
mov eax, dword [0x474eac]
add esp, 0x14
test eax, eax
je 0x415264
push 0
call eax
mov edx, dword [0x4746a8]
push 0x100
push edx
call edi
push str.SoftwareClassesFolderShellExContextMenuHandlers
call fcn.0042f484
mov dword [esp + 0x20], eax
mov ecx, dword [0x473118]
lea eax, [esp + 0x20]
push eax
push ecx
push 0
mov dword [esp + 0x44], 0x4f
call fcn.004218e0
mov edx, dword [esp + 0x2c]
push edx
call fcn.0042f4d9
push str.SoftwareClassesFolderShellExContextMenuHandlers
call fcn.0042f484
mov dword [esp + 0x34], eax
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea eax, [esp + 0x34]
push eax
push ecx
push 0
mov dword [esp + 0x58], 0x50
call fcn.004218e0
mov edx, dword [esp + 0x40]
push edx
mov dword [esp + 0x5c], ebx
call fcn.0042f4d9
add esp, 0x28
test ebp, ebp
je 0x415344
mov eax, dword [0x474eac]
test eax, eax
je 0x4152ef
push 1
call eax
mov eax, dword [0x4746a8]
push 0x200
push eax
call edi
push str.SoftwareClassesFolderShellExContextMenuHandlers
call fcn.0042f484
mov dword [esp + 0x20], eax
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea ecx, [esp + 0x20]
push ecx
push edx
push 0
mov dword [esp + 0x44], 0x51
call fcn.004218e0
mov eax, dword [esp + 0x2c]
push eax
mov dword [esp + 0x48], ebx
call fcn.0042f4d9
mov eax, dword [0x474eac]
add esp, 0x14
test eax, eax
je 0x415344
push 0
call eax
mov ecx, dword [0x4746a8]
push 0x100
push ecx
call edi
push str.SoftwareClassesDirectoryBackgroundShellExContextMenuHandlers
call fcn.0042f484
mov dword [esp + 0x20], eax
mov eax, dword [0x473118]
lea edx, [esp + 0x20]
push edx
push eax
push 0
mov dword [esp + 0x44], 0x52
call fcn.004218e0
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.0042f4d9
push str.SoftwareClassesDirectoryBackgroundShellExContextMenuHandlers
call fcn.0042f484
mov dword [esp + 0x34], eax
mov eax, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea edx, [esp + 0x34]
push edx
push eax
push 0
mov dword [esp + 0x58], 0x53
call fcn.004218e0
mov ecx, dword [esp + 0x40]
push ecx
mov dword [esp + 0x5c], ebx
call fcn.0042f4d9
add esp, 0x28
test ebp, ebp
je 0x415422
mov eax, dword [0x474eac]
test eax, eax
je 0x4153ce
push 1
call eax
mov edx, dword [0x4746a8]
push 0x200
push edx
call edi
push str.SoftwareClassesDirectoryBackgroundShellExContextMenuHandlers
call fcn.0042f484
mov dword [esp + 0x20], eax
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea eax, [esp + 0x20]
push eax
push ecx
push 0
mov dword [esp + 0x44], 0x54
call fcn.004218e0
mov edx, dword [esp + 0x2c]
push edx
mov dword [esp + 0x48], ebx
call fcn.0042f4d9
mov eax, dword [0x474eac]
add esp, 0x14
test eax, eax
je 0x415422
push 0
call eax
mov eax, dword [0x4746a8]
push 0x100
push eax
call edi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers
call fcn.0042f484
mov dword [esp + 0x20], eax
mov edx, dword [0x473118]
lea ecx, [esp + 0x20]
push ecx
push edx
push 0
mov dword [esp + 0x44], 0x55
call fcn.004218e0
mov eax, dword [esp + 0x2c]
push eax
call fcn.0042f4d9
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers
call fcn.0042f484
mov dword [esp + 0x34], eax
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea ecx, [esp + 0x34]
push ecx
push edx
push 0
mov dword [esp + 0x58], 0x56
call fcn.004218e0
mov eax, dword [esp + 0x40]
push eax
mov dword [esp + 0x5c], ebx
call fcn.0042f4d9
add esp, 0x28
test ebp, ebp
je 0x415502
mov eax, dword [0x474eac]
test eax, eax
je 0x4154ae
push 1
call eax
mov ecx, dword [0x4746a8]
push 0x200
push ecx
call edi
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers
call fcn.0042f484
mov dword [esp + 0x20], eax
mov eax, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea edx, [esp + 0x20]
push edx
push eax
push 0
mov dword [esp + 0x44], 0x57
call fcn.004218e0
mov ecx, dword [esp + 0x2c]
push ecx
mov dword [esp + 0x48], ebx
call fcn.0042f4d9
mov eax, dword [0x474eac]
add esp, 0x14
test eax, eax
je 0x415502
push 0
call eax
mov edx, dword [0x4746a8]
push 0x100
push edx
call edi
push str.SoftwareMicrosoftCtfLangBarAddin
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x28], esi
mov ecx, dword [0x473118]
lea eax, [esp + 0x28]
push eax
push ecx
push 0
mov dword [esp + 0x44], 0x58
call fcn.0040fa30
push esi
call fcn.0042f4d9
push str.SoftwareMicrosoftCtfLangBarAddin
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x3c], esi
mov eax, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea edx, [esp + 0x3c]
push edx
push eax
push 0
mov dword [esp + 0x58], 0x59
call fcn.0040fa30
push esi
mov dword [esp + 0x5c], ebx
call fcn.0042f4d9
add esp, 0x28
test ebp, ebp
je 0x4155db
mov eax, dword [0x474eac]
test eax, eax
je 0x415589
push 1
call eax
mov ecx, dword [0x4746a8]
push 0x200
push ecx
call edi
push str.SoftwareMicrosoftCtfLangBarAddin
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x28], esi
mov eax, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea edx, [esp + 0x28]
push edx
push eax
push 0
mov dword [esp + 0x44], 0x5a
call fcn.0040fa30
push esi
mov dword [esp + 0x48], ebx
call fcn.0042f4d9
mov eax, dword [0x474eac]
add esp, 0x14
test eax, eax
je 0x4155db
push 0
call eax
mov ecx, dword [0x4746a8]
push 0x100
push ecx
call edi
push str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x28], esi
mov eax, dword [0x473118]
push 1
push 0
lea edx, [esp + 0x30]
push edx
push eax
push 0
mov dword [esp + 0x4c], 0x5b
call fcn.00413450
push esi
call fcn.0042f4d9
push str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x44], esi
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 1
push 0
lea ecx, [esp + 0x4c]
push ecx
push edx
push 0
mov dword [esp + 0x68], 0x5c
call fcn.00413450
push esi
mov dword [esp + 0x6c], ebx
call fcn.0042f4d9
add esp, 0x38
test ebp, ebp
je 0x4156c5
mov eax, dword [0x474eac]
test eax, eax
je 0x415669
push 1
call eax
mov eax, dword [0x4746a8]
push 0x200
push eax
call edi
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x28], esi
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 1
push 0
lea ecx, [esp + 0x30]
push ecx
push edx
push 0
mov dword [esp + 0x4c], 0x5d
call fcn.00413450
push esi
mov dword [esp + 0x50], ebx
call fcn.0042f4d9
mov eax, dword [0x474eac]
add esp, 0x1c
test eax, eax
je 0x4156c5
push 0
call eax
mov eax, dword [0x4746a8]
push 0x100
push eax
call edi
jmp 0x4156c5
mov ebp, dword [esp + 0x14]
cmp dword [esp + 0x28], 0
je 0x4159e3
push str.SoftwareMicrosoftInternet_ExplorerUrlSearchHooks
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x2c], esi
mov edx, dword [0x473118]
push 1
push 0
lea ecx, [esp + 0x34]
push ecx
push edx
push 0
mov dword [esp + 0x4c], 0x5e
call fcn.00413450
push esi
call fcn.0042f4d9
push str.SoftwareMicrosoftInternet_ExplorerToolbar
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x48], esi
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 1
push 0
lea eax, [esp + 0x50]
push eax
push ecx
push 0
mov dword [esp + 0x68], 0x5f
call fcn.00413450
push esi
mov dword [esp + 0x6c], ebx
call fcn.0042f4d9
add esp, 0x38
test ebp, ebp
je 0x4157b7
mov eax, dword [0x474eac]
test eax, eax
je 0x415760
push 1
call eax
mov edx, dword [0x4746a8]
push 0x200
push edx
call edi
push str.SoftwareWow6432NodeMicrosoftInternet_ExplorerToolbar
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x2c], esi
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 1
push 0
lea eax, [esp + 0x34]
push eax
push ecx
push 0
mov dword [esp + 0x4c], 0x60
call fcn.00413450
push esi
mov dword [esp + 0x50], ebx
call fcn.0042f4d9
mov eax, dword [0x474eac]
add esp, 0x1c
test eax, eax
je 0x4157b7
push 0
call eax
mov edx, dword [0x4746a8]
push 0x100
push edx
call edi
push str.SoftwareMicrosoftInternet_ExplorerExplorer_Bars
call fcn.0042f484
mov dword [esp + 0x20], eax
mov ecx, dword [0x473118]
lea eax, [esp + 0x20]
push eax
push ecx
push 0
mov dword [esp + 0x44], 0x61
call fcn.0041b840
mov edx, dword [esp + 0x2c]
push edx
call fcn.0042f4d9
push str.SoftwareMicrosoftInternet_ExplorerExplorer_Bars
call fcn.0042f484
mov dword [esp + 0x34], eax
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea eax, [esp + 0x34]
push eax
push ecx
push 0
mov dword [esp + 0x58], 0x62
call fcn.0041b840
mov edx, dword [esp + 0x40]
push edx
mov dword [esp + 0x5c], ebx
call fcn.0042f4d9
add esp, 0x28
test ebp, ebp
je 0x4158ce
mov eax, dword [0x474eac]
test eax, eax
je 0x415846
push 1
call eax
mov eax, dword [0x4746a8]
push 0x200
push eax
call edi
push str.SoftwareWow6432NodeMicrosoftInternet_ExplorerExplorer_Bars
call fcn.0042f484
mov dword [esp + 0x20], eax
mov edx, dword [0x473118]
lea ecx, [esp + 0x20]
push ecx
push edx
push 0
mov dword [esp + 0x44], 0x63
call fcn.0041b840
mov eax, dword [esp + 0x2c]
push eax
call fcn.0042f4d9
push str.SoftwareWow6432NodeMicrosoftInternet_ExplorerExplorer_Bars
call fcn.0042f484
mov dword [esp + 0x34], eax
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea ecx, [esp + 0x34]
push ecx
push edx
push 0
mov dword [esp + 0x58], 0x64
call fcn.0041b840
mov eax, dword [esp + 0x40]
push eax
mov dword [esp + 0x5c], ebx
call fcn.0042f4d9
mov eax, dword [0x474eac]
add esp, 0x28
test eax, eax
je 0x4158ce
push 0
call eax
mov ecx, dword [0x4746a8]
push 0x100
push ecx
call edi
push str.SoftwareMicrosoftInternet_ExplorerExtensions
call fcn.0042f484
mov dword [esp + 0x20], eax
mov eax, dword [0x473118]
lea edx, [esp + 0x20]
push edx
push eax
push 0
mov dword [esp + 0x44], 0x65
call fcn.0041b840
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.0042f4d9
push str.SoftwareMicrosoftInternet_ExplorerExtensions
call fcn.0042f484
mov dword [esp + 0x34], eax
mov eax, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea edx, [esp + 0x34]
push edx
push eax
push 0
mov dword [esp + 0x58], 0x66
call fcn.0041b840
mov ecx, dword [esp + 0x40]
push ecx
mov dword [esp + 0x5c], ebx
call fcn.0042f4d9
add esp, 0x28
test ebp, ebp
je 0x4159e3
mov eax, dword [0x474eac]
test eax, eax
je 0x41595c
push 1
call eax
mov edx, dword [0x4746a8]
push 0x200
push edx
call edi
push str.SoftwareWow6432NodeMicrosoftInternet_ExplorerExtensions
call fcn.0042f484
mov dword [esp + 0x20], eax
mov ecx, dword [0x473118]
lea eax, [esp + 0x20]
push eax
push ecx
push 0
mov dword [esp + 0x44], 0x67
call fcn.0041b840
mov edx, dword [esp + 0x2c]
push edx
call fcn.0042f4d9
push str.SoftwareWow6432NodeMicrosoftInternet_ExplorerExtensions
call fcn.0042f484
mov dword [esp + 0x34], eax
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea eax, [esp + 0x34]
push eax
push ecx
push 0
mov dword [esp + 0x58], 0x68
call fcn.0041b840
mov edx, dword [esp + 0x40]
push edx
mov dword [esp + 0x5c], ebx
call fcn.0042f4d9
mov eax, dword [0x474eac]
add esp, 0x28
test eax, eax
je 0x4159e3
push 0
call eax
mov eax, dword [0x4746a8]
push 0x100
push eax
call edi
test byte [esp + 0x3c], 0x80
je 0x415c37
push str.SoftwareMicrosoftWindows_NTCurrentVersionDrivers32
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x40], esi
mov edx, dword [0x473118]
push 0
push 1
lea ecx, [esp + 0x48]
push ecx
push edx
push 0
mov dword [esp + 0x4c], 0x69
call fcn.00413450
push esi
call fcn.0042f4d9
push str.SoftwareMicrosoftWindows_NTCurrentVersionDrivers32
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x5c], esi
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 0
push 1
lea eax, [esp + 0x64]
push eax
push ecx
push 0
mov dword [esp + 0x68], 0x6a
call fcn.00413450
push esi
mov dword [esp + 0x6c], ebx
call fcn.0042f4d9
add esp, 0x38
test ebp, ebp
je 0x415b0d
mov eax, dword [0x474eac]
test eax, eax
je 0x415a82
push 1
call eax
mov edx, dword [0x4746a8]
push 0x200
push edx
call edi
push str.SoftwareWow6432NodeMicrosoftWindows_NTCurrentVersionDrivers32
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x40], esi
mov ecx, dword [0x473118]
push 0
push 1
lea eax, [esp + 0x48]
push eax
push ecx
push 0
mov dword [esp + 0x4c], 0x6b
call fcn.00413450
push esi
call fcn.0042f4d9
push str.SoftwareWow6432NodeMicrosoftWindows_NTCurrentVersionDrivers32
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x5c], esi
mov eax, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 0
push 1
lea edx, [esp + 0x64]
push edx
push eax
push 0
mov dword [esp + 0x68], 0x6c
call fcn.00413450
push esi
mov dword [esp + 0x6c], ebx
call fcn.0042f4d9
mov eax, dword [0x474eac]
add esp, 0x38
test eax, eax
je 0x415b0d
push 0
call eax
mov ecx, dword [0x4746a8]
push 0x100
push ecx
call edi
push str.SoftwareClassesFilter
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x40], esi
mov eax, dword [0x473118]
lea edx, [esp + 0x40]
push edx
push eax
push 0
mov dword [esp + 0x44], 0x6d
call fcn.0040fa30
push esi
call fcn.0042f4d9
push str.SoftwareClassesFilter
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x54], esi
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea ecx, [esp + 0x54]
push ecx
push edx
push 0
mov dword [esp + 0x58], 0x6e
call fcn.0040fa30
push esi
mov dword [esp + 0x5c], ebx
call fcn.0042f4d9
add esp, 0x28
test ebp, ebp
je 0x415be5
mov eax, dword [0x474eac]
test eax, eax
je 0x415b93
push 1
call eax
mov eax, dword [0x4746a8]
push 0x200
push eax
call edi
push str.SoftwareClassesFilter
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x40], esi
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea ecx, [esp + 0x40]
push ecx
push edx
push 0
mov dword [esp + 0x44], 0x6f
call fcn.0040fa30
push esi
mov dword [esp + 0x48], ebx
call fcn.0042f4d9
mov eax, dword [0x474eac]
add esp, 0x14
test eax, eax
je 0x415be5
push 0
call eax
mov eax, dword [0x4746a8]
push 0x100
push eax
call edi
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push str.083863F1_70DE_11d0_BD40_00A0C911CE86
push ecx
push 0
push ebp
call fcn.0040faf0
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push str.AC757296_3522_4E11_9862_C17BE5A1767E
push edx
push 0
push ebp
call fcn.0040faf0
mov eax, dword [reloc.OLEAUT32.dll_SysReAllocString]
push str.7ED96837_96F0_4812_B211_F13C24117ED3
push eax
push 0
push ebp
call fcn.0040faf0
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push str.ABE3B9A4_257D_4B97_BD1A_294AF496222E
push ecx
push 0
push ebp
call fcn.0040faf0
add esp, 0x40
cmp dword [esp + 0x18], 0
je 0x415ca9
push str.SoftwarePoliciesMicrosoftWindowsSystemScriptsLogoff
call fcn.0042f484
mov dword [esp + 0x40], eax
mov eax, dword [0x473118]
push 1
lea edx, [esp + 0x44]
push edx
push eax
push 0
mov dword [esp + 0x48], 0x70
call fcn.004196f0
mov ecx, dword [esp + 0x50]
push ecx
call fcn.0042f4d9
push str.SoftwarePoliciesMicrosoftWindowsSystemScriptsShutdown
call fcn.0042f484
mov dword [esp + 0x58], eax
mov eax, dword [reloc.OLEAUT32.dll_SysReAllocString]
push 1
lea edx, [esp + 0x5c]
push edx
push eax
push 0
mov dword [esp + 0x60], 0x71
call fcn.004196f0
mov ecx, dword [esp + 0x68]
push ecx
call fcn.0042f4d9
add esp, 0x30
cmp byte [0x474ea6], 0
je 0x415d27
call fcn.004312c5
mov esi, eax
add esi, 0x20
add dword [esi + 4], ebx
js 0x415cca
mov edx, dword [esi]
mov byte [edx], 0x3c
inc dword [esi]
jmp 0x415cd5
push esi
push 0x3c
call fcn.0043147a
add esp, 8
add dword [esi + 4], ebx
js 0x415ce3
mov eax, dword [esi]
mov byte [eax], 0x2f
inc dword [esi]
jmp 0x415cee
push esi
push 0x2f
call fcn.0043147a
add esp, 8
push str.autoruns
push esi
call fcn.00404430
add esp, 8
add dword [esi + 4], ebx
js 0x415d1c
mov ecx, dword [esi]
mov byte [ecx], 0x3e
inc dword [esi]
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
push esi
push 0x3e
call fcn.0043147a
add esp, 8
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret