Function at 0x4b5270
Capabilities:
Delete registry value
Persist via appinit_dlls registry key
Persist via run registry key
Persist via winlogon helper dll registry key

Disassembly:
push 0xffffffffffffffff
push 0x4f56b8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53fa2c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0x5116d8
mov ecx, 0x10dd2f4
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov esi, 0x10dd3a8
or ebp, 0xffffffff
nop
push ebp
push 0
mov ecx, esi
call sub.mfc90.dll_Ordinal_6494
add esi, 0x14
cmp esi, 0x10ddb78
jl 0x4b52b0
xor esi, esi
cmp byte [0x10da2cb], 0
jne 0x4b52ec
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 0x64
jge 0x4b52ec
push 0x3e8
call edi
inc esi
cmp byte [0x10da2cb], 0
je 0x4b52d6
push 0x10dd3a8
push 0
call fcn.004a2be0
mov eax, dword [0x53f398]
add esp, 8
test eax, eax
je 0x4b5317
push eax
call sub.mfc90.dll_Ordinal_266
add esp, 4
mov dword [0x53f398], 0
xor esi, esi
mov dword [0x53f3a0], esi
mov dword [0x53f39c], esi
lea ebx, [esi + 1]
mov eax, dword [esi + 0x10dd3c4]
cmp eax, dword [esi + 0x10ddbb4]
je 0x4b541b
mov edi, dword [0x53f39c]
test edi, edi
jl 0x4b5570
push ebp
lea eax, [edi + 1]
push eax
mov ecx, 0x53f394
call fcn.00458fe0
mov ecx, dword [0x53f398]
mov dword [ecx + edi*4], ebx
cmp dword [0x103a97c], 0
je 0x4b5540
mov eax, dword [esi + 0x10ddbb4]
mov ecx, dword [esi + 0x10dd3c4]
push eax
push ecx
push ebx
push str.index_d_g_arStartUp__d_
push 1
call fcn.0043d500
xor edi, edi
add esp, 0x14
cmp dword [esi + 0x10ddbb4], edi
jle 0x4b53ce
test edi, edi
jl 0x4b5570
cmp edi, dword [esi + 0x10ddbb4]
jge 0x4b5570
mov edx, dword [esi + 0x10ddbb0]
lea eax, [edx + edi*4]
mov eax, dword [eax]
push eax
push ebx
push str.index_d_Old__s_
push 1
call fcn.0043d500
inc edi
add esp, 0x10
cmp edi, dword [esi + 0x10ddbb4]
jl 0x4b5395
xor edi, edi
cmp dword [esi + 0x10dd3c4], edi
jle 0x4b5540
test edi, edi
jl 0x4b5570
cmp edi, dword [esi + 0x10dd3c4]
jge 0x4b5570
mov ecx, dword [esi + 0x10dd3c0]
mov edx, dword [ecx + edi*4]
lea eax, [ecx + edi*4]
push edx
push ebx
push str.index_d_new__s_
push 1
call fcn.0043d500
inc edi
add esp, 0x10
cmp edi, dword [esi + 0x10dd3c4]
jl 0x4b53dc
jmp 0x4b5540
xor edi, edi
test eax, eax
jle 0x4b5540
jmp 0x4b5430
cmp dword [esi + 0x10ddbb4], edi
jle 0x4b54fe
test edi, edi
jl 0x4b5570
cmp edi, dword [esi + 0x10ddbb4]
jge 0x4b5570
mov eax, dword [esi + 0x10ddbb0]
lea ebp, [edi*4]
add eax, ebp
cmp edi, dword [esi + 0x10dd3c4]
jge 0x4b5570
mov ecx, dword [esi + 0x10dd3c0]
mov eax, dword [eax]
add ecx, ebp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_1603]
test eax, eax
je 0x4b54f6
mov eax, dword [0x53f39c]
mov dword [esp + 0x14], eax
test eax, eax
jl 0x4b5570
push 0xffffffffffffffff
inc eax
push eax
mov ecx, 0x53f394
call fcn.00458fe0
mov ecx, dword [0x53f398]
mov edx, dword [esp + 0x14]
mov dword [ecx + edx*4], ebx
cmp dword [0x103a97c], 0
je 0x4b5530
cmp edi, dword [esi + 0x10dd3c4]
jge 0x4b5570
mov ecx, dword [esi + 0x10dd3c0]
add ecx, ebp
cmp edi, dword [esi + 0x10ddbb4]
jge 0x4b5570
mov eax, dword [esi + 0x10ddbb0]
mov ecx, dword [ecx]
mov edx, dword [eax + ebp]
push ecx
add eax, ebp
push edx
push ebx
push str.index_d_Old__s__New__s_
push 1
call fcn.0043d500
add esp, 0x14
jmp 0x4b5530
cmp dword [esi + 0x10ddbb4], edi
jg 0x4b5530
cmp dword [0x103a97c], 0
je 0x4b5530
test edi, edi
jl 0x4b5570
cmp edi, dword [esi + 0x10dd3c4]
jge 0x4b5570
mov eax, dword [esi + 0x10dd3c0]
mov ecx, dword [eax + edi*4]
lea eax, [eax + edi*4]
push ecx
push ebx
push str.index_d_New__s_
push 1
call fcn.0043d500
add esp, 0x10
inc edi
cmp edi, dword [esi + 0x10dd3c4]
jl 0x4b5430
or ebp, 0xffffffff
add esi, 0x14
inc ebx
cmp esi, 0x7bc
jl 0x4b5328
xor ebx, ebx
cmp dword [0x53f39c], ebx
jne 0x4b5575
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
call sub.mfc90.dll_Ordinal_1252
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
push str.DisableTaskMgr
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push bind
call esi
push str.DisableTaskMgr
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call esi
cmp dword [0x103a97c], ebx
je 0x4b55b4
push str.isChangedStartUp_End
push 1
call fcn.0043d500
add esp, 8
mov eax, dword [0x53f39c]
xor edi, edi
cmp eax, ebx
jle 0x4b6257
cmp edi, ebx
jl 0x4b5570
cmp edi, eax
jge 0x4b5570
mov edx, dword [0x53f398]
cmp dword [edx + edi*4], 1
jne 0x4b562c
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x5116d8
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x2c], ebx
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5116d8
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x30], 1
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.SoftwareMicrosoftWindowsCurrentVersionRunServicesOnce
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x34], 2
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x38], ebp
call fcn.004a3200
add esp, 0x10
cmp edi, dword [0x53f39c]
jge 0x4b5570
mov eax, dword [0x53f398]
cmp dword [eax + edi*4], 2
jne 0x4b569c
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5116d8
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x2c], 3
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5116d8
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x30], 4
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SoftwareMicrosoftWindowsCurrentVersionRunServicesOnce
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x34], 5
push bind
mov dword [esp + 0x38], ebp
call fcn.004a3200
add esp, 0x10
cmp edi, dword [0x53f39c]
jge 0x4b5570
mov ecx, dword [0x53f398]
cmp dword [ecx + edi*4], 3
jne 0x4b570d
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5116d8
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x2c], 6
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5116d8
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x30], 7
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x34], 8
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x38], ebp
call fcn.004a3200
add esp, 0x10
cmp edi, dword [0x53f39c]
jge 0x4b5570
mov edx, dword [0x53f398]
cmp dword [edx + edi*4], 4
jne 0x4b577e
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5116d8
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x2c], 9
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5116d8
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x30], 0xa
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x34], 0xb
push bind
mov dword [esp + 0x38], ebp
call fcn.004a3200
add esp, 0x10
cmp edi, dword [0x53f39c]
jge 0x4b5570
mov eax, dword [0x53f398]
cmp dword [eax + edi*4], 5
jne 0x4b57ee
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5116d8
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x2c], 0xc
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5116d8
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x30], 0xd
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogonNotify
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x34], 0xe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x38], ebp
call fcn.004a3200
add esp, 0x10
cmp edi, dword [0x53f39c]
jge 0x4b5570
mov ecx, dword [0x53f398]
cmp dword [ecx + edi*4], 6
jne 0x4b5897
cmp dword [0x53f200], 0x501
jle 0x4b5897
mov eax, dword [0x10ddc18]
cmp eax, ebx
je 0x4b5886
jle 0x4b5570
mov edx, dword [0x10ddc14]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov dword [esp + 0x2c], 0xf
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Userinit
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x30], 0x10
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x34], 0x11
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x38], ebp
call fcn.004a3200
add esp, 0x10
jmp 0x4b5897
push str.Userinit
push str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
push reloc.OLEAUT32.dll_SysReAllocString
call esi
cmp edi, dword [0x53f39c]
jge 0x4b5570
mov eax, dword [0x53f398]
cmp dword [eax + edi*4], 7
jne 0x4b592f
mov eax, dword [0x10ddc2c]
cmp eax, ebx
je 0x4b591e
jle 0x4b5570
mov edx, dword [0x10ddc28]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov dword [esp + 0x2c], 0x12
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Shell
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x30], 0x13
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x34], 0x14
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x38], ebp
call fcn.004a3200
add esp, 0x10
jmp 0x4b592f
push str.Shell
push str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
push reloc.OLEAUT32.dll_SysReAllocString
call esi
cmp edi, dword [0x53f39c]
jge 0x4b5570
mov eax, dword [0x53f398]
cmp dword [eax + edi*4], 8
jne 0x4b59c7
mov eax, dword [0x10ddc40]
cmp eax, ebx
je 0x4b59b6
jle 0x4b5570
mov edx, dword [0x10ddc3c]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov dword [esp + 0x2c], 0x15
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Shell
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x30], 0x16
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x34], 0x17
push bind
mov dword [esp + 0x38], ebp
call fcn.004a3200
add esp, 0x10
jmp 0x4b59c7
push str.Shell
push str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
push bind
call esi
cmp edi, dword [0x53f39c]
jge 0x4b5570
mov eax, dword [0x53f398]
cmp dword [eax + edi*4], 9
jne 0x4b5a37
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5116d8
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x2c], 0x18
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5116d8
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x30], 0x19
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x34], 0x1a
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x38], ebp
call fcn.004a3200
add esp, 0x10
cmp edi, dword [0x53f39c]
jge 0x4b5570
mov ecx, dword [0x53f398]
cmp dword [ecx + edi*4], 0xa
jne 0x4b5aa8
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5116d8
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x2c], 0x1b
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5116d8
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x30], 0x1c
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x34], 0x1d
push bind
mov dword [esp + 0x38], ebp
call fcn.004a3200
add esp, 0x10
cmp edi, dword [0x53f39c]
jge 0x4b5570
mov edx, dword [0x53f398]
cmp dword [edx + edi*4], 0xb
jne 0x4b5b19
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5116d8
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x2c], 0x1e
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5116d8
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x30], 0x1f
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnceEx
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x34], 0x20
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x38], ebp
call fcn.004a3200
add esp, 0x10
cmp edi, dword [0x53f39c]
jge 0x4b5570
mov eax, dword [0x53f398]
cmp dword [eax + edi*4], 0xc
jne 0x4b5b89
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5116d8
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x2c], 0x21
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5116d8
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x30], 0x22
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SoftwareMicrosoftWindowsCurrentVersionRun
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x34], 0x23
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x38], ebp
call fcn.004a3200
add esp, 0x10
cmp edi, dword [0x53f39c]
jge 0x4b5570
mov ecx, dword [0x53f398]
cmp dword [ecx + edi*4], 0xd
jne 0x4b5bfa
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5116d8
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x2c], 0x24
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5116d8
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x30], 0x25
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SoftwareMicrosoftWindowsCurrentVersionRun
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x34], 0x26
push bind
mov dword [esp + 0x38], ebp
call fcn.004a3200
add esp, 0x10
cmp edi, dword [0x53f39c]
jge 0x4b5570
mov edx, dword [0x53f398]
cmp dword [edx + edi*4], 0xe
jne 0x4b5c1c
push 0x18
call fcn.004a3b90
add esp, 4
cmp edi, dword [0x53f39c]
jge 0x4b5570
mov eax, dword [0x53f398]
cmp dword [eax + edi*4], 0xf
jne 0x4b5c3d
push 7
call fcn.004a3b90
add esp, 4
cmp edi, dword [0x53f39c]
jge 0x4b5570
mov ecx, dword [0x53f398]
cmp dword [ecx + edi*4], 0x10
jne 0x4b5cae
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5116d8
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x2c], 0x27
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5116d8
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x30], 0x28
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x34], 0x29
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x38], ebp
call fcn.004a3200
add esp, 0x10
cmp edi, dword [0x53f39c]
jge 0x4b5570
mov edx, dword [0x53f398]
cmp dword [edx + edi*4], 0x11
jne 0x4b5d1f
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5116d8
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x2c], 0x2a
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5116d8
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x30], 0x2b
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x34], 0x2c
push bind
mov dword [esp + 0x38], ebp
call fcn.004a3200
add esp, 0x10
cmp edi, dword [0x53f39c]
jge 0x4b5570
mov eax, dword [0x53f398]
cmp dword [eax + edi*4], 0x12
jne 0x4b5db7
mov eax, dword [0x10ddd08]
cmp eax, ebx
je 0x4b5da6
jle 0x4b5570
mov edx, dword [0x10ddd04]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov dword [esp + 0x2c], 0x2d
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.load
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x30], 0x2e
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x34], 0x2f
push bind
mov dword [esp + 0x38], ebp
call fcn.004a3200
add esp, 0x10
jmp 0x4b5db7
push str.load
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
push bind
call esi
cmp edi, dword [0x53f39c]
jge 0x4b5570
mov eax, dword [0x53f398]
cmp dword [eax + edi*4], 0x13
jne 0x4b5e4f
mov eax, dword [0x10ddd1c]
cmp eax, ebx
je 0x4b5e3e
jle 0x4b5570
mov edx, dword [0x10ddd18]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov dword [esp + 0x2c], 0x30
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x51ac18
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x30], 0x31
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x34], 0x32
push bind
mov dword [esp + 0x38], ebp
call fcn.004a3200
add esp, 0x10
jmp 0x4b5e4f
push 0x51ac18
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
push bind
call esi
cmp edi, dword [0x53f39c]
jge 0x4b5570
mov eax, dword [0x53f398]
cmp dword [eax + edi*4], 0x14
jne 0x4b5ee7
mov eax, dword [0x10ddd30]
cmp eax, ebx
je 0x4b5ed6
jle 0x4b5570
mov edx, dword [0x10ddd2c]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov dword [esp + 0x2c], 0x33
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.AppInit_DLLs
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x30], 0x34
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x34], 0x35
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x38], ebp
call fcn.004a3200
add esp, 0x10
jmp 0x4b5ee7
push str.AppInit_DLLs
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
push reloc.OLEAUT32.dll_SysReAllocString
call esi
cmp edi, dword [0x53f39c]
jge 0x4b5570
mov eax, dword [0x53f398]
cmp dword [eax + edi*4], 0x15
jne 0x4b5f57
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5116d8
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x2c], 0x36
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5116d8
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x30], 0x37
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SoftwareMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x34], 0x38
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x38], ebp
call fcn.004a3200
add esp, 0x10
cmp edi, dword [0x53f39c]
jge 0x4b5570
mov ecx, dword [0x53f398]
cmp dword [ecx + edi*4], 0x16
jne 0x4b5fc8
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5116d8
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x2c], 0x39
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5116d8
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x30], 0x3a
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x34], 0x3b
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x38], ebp
call fcn.004a3200
add esp, 0x10
cmp edi, dword [0x53f39c]
jge 0x4b5570
mov edx, dword [0x53f398]
cmp dword [edx + edi*4], 0x17
jne 0x4b605c
mov eax, dword [0x10ddd6c]
cmp eax, ebx
je 0x4b604b
jle 0x4b5570
mov eax, dword [0x10ddd68]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov dword [esp + 0x2c], 0x3c
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SCRNSAVE.EXE
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x30], 0x3d
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Control_PanelDesktop
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x34], 0x3e
push bind
mov dword [esp + 0x38], ebp
call fcn.004a3200
add esp, 0x10
jmp 0x4b605c
push str.SCRNSAVE.EXE
push str.Control_PanelDesktop
push bind
call esi
cmp edi, dword [0x53f39c]
jge 0x4b5570
mov ecx, dword [0x53f398]
cmp dword [ecx + edi*4], 0x18
jne 0x4b60f5
mov eax, dword [0x10ddd80]
cmp eax, ebx
je 0x4b60e4
jle 0x4b5570
mov edx, dword [0x10ddd7c]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov dword [esp + 0x2c], 0x3f
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.AutoRun
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x30], 0x40
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SoftwareMicrosoftCommand_Processor
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x34], 0x41
push bind
mov dword [esp + 0x38], ebp
call fcn.004a3200
add esp, 0x10
jmp 0x4b60f5
push str.AutoRun
push str.SoftwareMicrosoftCommand_Processor
push bind
call esi
cmp edi, dword [0x53f39c]
jge 0x4b5570
mov eax, dword [0x53f398]
cmp dword [eax + edi*4], 0x19
jne 0x4b618d
mov eax, dword [0x10ddd94]
cmp eax, ebx
je 0x4b617c
jle 0x4b5570
mov edx, dword [0x10ddd90]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov dword [esp + 0x2c], 0x42
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x504df0
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x30], 0x43
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x34], 0x44
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x38], ebp
call fcn.004a3200
add esp, 0x10
jmp 0x4b618d
push 0x504df0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push reloc.OLEAUT32.dll_SysReAllocString
call esi
cmp edi, dword [0x53f39c]
jge 0x4b5570
mov eax, dword [0x53f398]
cmp dword [eax + edi*4], 0x1a
jne 0x4b6225
mov eax, dword [0x10ddda8]
cmp eax, ebx
je 0x4b6214
jle 0x4b5570
mov edx, dword [0x10ddda4]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov dword [esp + 0x2c], 0x45
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x504df0
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x30], 0x46
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x34], 0x47
push bind
mov dword [esp + 0x38], ebp
call fcn.004a3200
add esp, 0x10
jmp 0x4b6225
push 0x504df0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push bind
call esi
cmp edi, dword [0x53f39c]
jge 0x4b5570
mov eax, dword [0x53f398]
cmp dword [eax + edi*4], 0x1c
jne 0x4b6249
push 0x8888
call fcn.004a3b90
add esp, 4
mov eax, dword [0x53f39c]
inc edi
cmp edi, eax
jl 0x4b55c3
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret