Function at 0x4f3245
Capabilities:
Persist via appinit_dlls registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x513545
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x3848
call fcn.005106b0
lea ecx, [ebp - 0x828]
call sub.MFC42.DLL_CStringArray::CStringArray
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2040]
call sub.MFC42.DLL_CStringArray::CStringArray
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2040]
call fcn.0050f5b0
push 0x5a7c00
lea ecx, [ebp - 0x2040]
call fcn.0050f680
push str.SoftwareWow6432NodeMicrosoftWindows_NTCurrentVersionWindows
lea ecx, [ebp - 0x2040]
call fcn.0050f680
mov dword [ebp - 0x14], 0
jmp 0x4f32c5
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x2040]
call fcn.0050f110
cmp dword [ebp - 0x14], eax
jge 0x4f38f0
lea ecx, [ebp - 0x828]
call fcn.0050f5b0
mov ecx, dword [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x2040]
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5a7c7c
push 0x5b6504
push 0x80000002
lea edx, [ebp - 0x384c]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x3850], eax
mov eax, dword [ebp - 0x3850]
mov dword [ebp - 0x3854], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x3854]
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x3848]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x384c]
call sub.MFC42.DLL_CString::CString
push str.NULL1
lea edx, [ebp - 0x3848]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4f3396
push str.NULL2
lea eax, [ebp - 0x3848]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4f33aa
push 0x5b8f10
lea ecx, [ebp - 0x3848]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5b8f14
lea edx, [ebp - 0x3848]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4f34bb
lea eax, [ebp - 0x3848]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x2848], eax
mov dword [ebp - 0x82c], 0
mov dword [ebp - 0x2044], 0
jmp 0x4f340f
mov ecx, dword [ebp - 0x82c]
add ecx, 1
mov dword [ebp - 0x82c], ecx
mov edx, dword [ebp - 0x2044]
add edx, 1
mov dword [ebp - 0x2044], edx
mov eax, dword [ebp - 0x82c]
cmp eax, dword [ebp - 0x2848]
jge 0x4f34bb
mov ecx, dword [ebp - 0x82c]
movsx edx, byte [ebp + ecx - 0x3848]
cmp edx, 0x20
jne 0x4f346b
mov eax, dword [ebp - 0x2044]
mov byte [ebp + eax - 0x814], 0
movsx ecx, byte [ebp - 0x814]
test ecx, ecx
je 0x4f345f
lea edx, [ebp - 0x814]
push edx
lea ecx, [ebp - 0x828]
call fcn.0050f680
mov dword [ebp - 0x2044], 0xffffffff
jmp 0x4f33f1
mov eax, dword [ebp - 0x2044]
mov ecx, dword [ebp - 0x82c]
mov dl, byte [ebp + ecx - 0x3848]
mov byte [ebp + eax - 0x814], dl
mov eax, dword [ebp - 0x2848]
sub eax, 1
cmp dword [ebp - 0x82c], eax
jne 0x4f34b6
mov ecx, dword [ebp - 0x2044]
mov byte [ebp + ecx - 0x813], 0
lea edx, [ebp - 0x814]
push edx
lea ecx, [ebp - 0x828]
call fcn.0050f680
jmp 0x4f33f1
push 0x5b8f18
lea eax, [ebp - 0x202c]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 0x82c], 0
jmp 0x4f34ea
mov ecx, dword [ebp - 0x82c]
add ecx, 1
mov dword [ebp - 0x82c], ecx
lea ecx, [ebp - 0x828]
call fcn.0050f110
cmp dword [ebp - 0x82c], eax
jge 0x4f3830
mov edx, dword [ebp - 0x82c]
push edx
lea ecx, [ebp - 0x828]
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
lea eax, [ebp - 0x814]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
movsx ecx, byte [ebp - 0x814]
cmp ecx, 0x22
jne 0x4f35be
lea edx, [ebp - 0x814]
push edx
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x2848], eax
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x2044], 0
jmp 0x4f357a
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x2044]
add ecx, 1
mov dword [ebp - 0x2044], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0x2848]
jge 0x4f35b0
mov eax, dword [ebp - 0x10]
movsx ecx, byte [ebp + eax - 0x814]
cmp ecx, 0x22
jne 0x4f3597
jmp 0x4f35b0
mov edx, dword [ebp - 0x2044]
mov eax, dword [ebp - 0x10]
mov cl, byte [ebp + eax - 0x814]
mov byte [ebp + edx - 0x814], cl
jmp 0x4f3562
mov edx, dword [ebp - 0x2044]
mov byte [ebp + edx - 0x814], 0
movsx eax, byte [ebp - 0x813]
cmp eax, 0x3a
je 0x4f35fd
lea ecx, [ebp - 0x814]
push ecx
push 0x5b7db4
push 0x5a7c9c
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
lea edx, [ebp - 0x814]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0x814]
push eax
lea ecx, [ebp - 0x2844]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5a7ca4
lea edx, [ebp - 0x2844]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
lea eax, [ebp - 0x814]
push eax
lea ecx, [ebp - 0x102c]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea edx, [ebp - 0x102c]
push edx
call fcn.00401fca
add esp, 4
push 0
lea eax, [ebp - 0x814]
push eax
call fcn.004f9b07
add esp, 8
test eax, eax
je 0x4f37c2
push 0
lea ecx, [ebp - 0x2844]
push ecx
call fcn.004f9b07
add esp, 8
test eax, eax
je 0x4f37c2
push str.AUDIOSRV32.DLL
lea edx, [ebp - 0x102c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f37c2
push str.BITGUA1.DLL
lea eax, [ebp - 0x102c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f37c2
push str.BITGUARD.DLL
lea ecx, [ebp - 0x102c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f37c2
push str.BROWSE1.DLL
lea edx, [ebp - 0x102c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f37c2
push str.CURSLIB.DLL
lea eax, [ebp - 0x102c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f37c2
push str.LISER.DLL
lea ecx, [ebp - 0x102c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f37c2
push str.MGRLDR.DLL
lea edx, [ebp - 0x102c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f37c2
push str.PRINTE1.DLL
lea eax, [ebp - 0x102c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f37c2
push str.QUERY32.DLL
lea ecx, [ebp - 0x102c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f37c2
push str.SPROTE1.DLL
lea edx, [ebp - 0x102c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f37c2
push str.TESTABD.DLL
lea eax, [ebp - 0x102c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f37c2
push str.WINCERTWIN
lea ecx, [ebp - 0x102c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4f37d8
lea edx, [ebp - 0x102c]
push edx
mov ecx, 0x5b5bf0
call fcn.0050f680
jmp 0x4f34db
mov eax, dword [ebp - 0x82c]
push eax
lea ecx, [ebp - 0x828]
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x202c]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
lea ecx, [ebp - 0x828]
call fcn.0050f110
sub eax, 1
cmp dword [ebp - 0x82c], eax
je 0x4f382b
push 0x5a7d64
lea edx, [ebp - 0x202c]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
jmp 0x4f34db
lea eax, [ebp - 0x202c]
push eax
lea ecx, [ebp - 0x3848]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4f38eb
mov edx, dword [ebp - 0x14]
push edx
lea ecx, [ebp - 0x2040]
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0x202c]
push eax
push 0x54
push str.AppInit_DLLs
push 0x5b6504
push 0x80000002
call fcn.00402bb9
add esp, 0x14
cmp dword [ebp - 0x14], 0
jne 0x4f38bb
lea ecx, [ebp - 0x202c]
push ecx
lea edx, [ebp - 0x3848]
push edx
push str.Restaurado__AppInit_DLLs__n_AppInit_DLLs_anterior_____s__n_AppInit_DLLs_actual_______s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
jmp 0x4f38dc
lea eax, [ebp - 0x202c]
push eax
lea ecx, [ebp - 0x3848]
push ecx
push str.Restaurado__AppInit_DLLs__x86___n_AppInit_DLLs_anterior_____s__n_AppInit_DLLs_actual_______s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
jmp 0x4f32bc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2040]
call fcn.0051046c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x828]
call fcn.0051046c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret