Function at 0x474020
Capabilities:
Persist via com hijack
Persist via default file association registry key
Persist via explorer tools registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479bb5
mov eax, dword fs:[0]
push eax
sub esp, 0x7ac
mov eax, dword [0x49b7c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x7b8], ecx
mov eax, dword [0x489c14]
mov dword [ebp - 0x668], eax
mov ecx, dword [0x489c18]
mov dword [ebp - 0x664], ecx
mov edx, dword [0x489c1c]
mov dword [ebp - 0x660], edx
mov ecx, 0xb
mov esi, 0x489c20
lea edi, [ebp - 0x454]
rep movsd dword es:[edi], dword [esi]
push 0x40
lea eax, [ebp - 0x7a4]
push eax
push 0x48aa70
call dword [sym.imp.ole32.dll_StringFromGUID2]
push 0x104
lea ecx, [ebp - 0x21c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x489c4c
push 0x4a04ac
lea edx, [ebp - 0x718]
push edx
call fcn.00401e60
add esp, 0xc
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x724]
call fcn.004017f0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x718]
push eax
push str._s_0
lea ecx, [ebp - 0x724]
push ecx
call fcn.00401870
add esp, 0xc
lea ecx, [ebp - 0x720]
call fcn.004017f0
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x718]
push edx
push str.__s___CommonStart_showtype1_pingbackid22_
lea eax, [ebp - 0x720]
push eax
call fcn.00401870
add esp, 0xc
mov dword [ebp - 0x10], 0x1104
mov dword [ebp - 0x714], SysReAllocString
mov dword [ebp - 0x710], 0x489cd0
lea ecx, [ebp - 0x7a4]
mov dword [ebp - 0x70c], ecx
mov dword [ebp - 0x708], 0
lea edx, [ebp - 0x668]
mov dword [ebp - 0x704], edx
mov dword [ebp - 0x700], 1
mov dword [ebp - 0x6fc], SysReAllocString
mov dword [ebp - 0x6f8], str.SoftwareClassesCLSID_s
lea eax, [ebp - 0x7a4]
mov dword [ebp - 0x6f4], eax
mov dword [ebp - 0x6f0], str.InfoTip
lea ecx, [ebp - 0x454]
mov dword [ebp - 0x6ec], ecx
mov dword [ebp - 0x6e8], 1
mov dword [ebp - 0x6e4], SysReAllocString
mov dword [ebp - 0x6e0], 0x489d48
lea edx, [ebp - 0x7a4]
mov dword [ebp - 0x6dc], edx
mov dword [ebp - 0x6d8], 0
mov dword [ebp - 0x6d4], 0x489d9c
mov dword [ebp - 0x6d0], 1
mov dword [ebp - 0x6cc], SysReAllocString
mov dword [ebp - 0x6c8], str.SoftwareClassesCLSID_sInprocServer32
lea eax, [ebp - 0x7a4]
mov dword [ebp - 0x6c4], eax
mov dword [ebp - 0x6c0], str.ThreadingModel
mov dword [ebp - 0x6bc], 0x489e1c
mov dword [ebp - 0x6b8], 1
mov dword [ebp - 0x6b4], SysReAllocString
mov dword [ebp - 0x6b0], str.SoftwareClassesCLSID_sDefaultIcon
lea ecx, [ebp - 0x7a4]
mov dword [ebp - 0x6ac], ecx
mov dword [ebp - 0x6a8], 0
lea ecx, [ebp - 0x724]
call fcn.00404fb0
mov dword [ebp - 0x6a4], eax
mov dword [ebp - 0x6a0], 1
mov dword [ebp - 0x69c], SysReAllocString
mov dword [ebp - 0x698], str.SoftwareClassesCLSID_sShellOpenCommand
lea edx, [ebp - 0x7a4]
mov dword [ebp - 0x694], edx
mov dword [ebp - 0x690], 0
lea ecx, [ebp - 0x720]
call fcn.00404fb0
mov dword [ebp - 0x68c], eax
mov dword [ebp - 0x688], 1
mov dword [ebp - 0x684], SysReAllocString
mov dword [ebp - 0x680], str.SoftwareClassesCLSID_sShellFolder
lea eax, [ebp - 0x7a4]
mov dword [ebp - 0x67c], eax
mov dword [ebp - 0x678], str.Attributes
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x674], ecx
mov dword [ebp - 0x670], 4
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x71c], 0
mov dword [ebp - 0x7a8], 0
jmp 0x47431d
mov edx, dword [ebp - 0x7a8]
add edx, 1
mov dword [ebp - 0x7a8], edx
cmp dword [ebp - 0x71c], 0
jl 0x4744da
cmp dword [ebp - 0x7a8], 7
jae 0x4744da
mov eax, dword [ebp - 0x7a8]
imul eax, eax, 0x18
mov ecx, dword [ebp + eax - 0x70c]
push ecx
mov edx, dword [ebp - 0x7a8]
imul edx, edx, 0x18
mov eax, dword [ebp + edx - 0x710]
push eax
push 0x104
lea ecx, [ebp - 0x65c]
push ecx
call fcn.00404f30
add esp, 0x10
mov dword [ebp - 0x71c], eax
cmp dword [ebp - 0x71c], 0
jl 0x4744d5
push 0
lea edx, [ebp - 0x428]
push edx
push 0
push 0x20006
push 0
push 0
push 0
lea eax, [ebp - 0x65c]
push eax
mov ecx, dword [ebp - 0x7a8]
imul ecx, ecx, 0x18
mov edx, dword [ebp + ecx - 0x714]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x7ac], eax
cmp dword [ebp - 0x7ac], 0
jne 0x4744cb
mov eax, dword [ebp - 0x7a8]
imul eax, eax, 0x18
cmp dword [ebp + eax - 0x700], 1
jne 0x474465
lea ecx, [ebp - 0x21c]
push ecx
mov edx, dword [ebp - 0x7a8]
imul edx, edx, 0x18
mov eax, dword [ebp + edx - 0x704]
push eax
push 0x104
lea ecx, [ebp - 0x424]
push ecx
call fcn.00404f30
add esp, 0x10
mov dword [ebp - 0x71c], eax
cmp dword [ebp - 0x71c], 0
jl 0x474463
lea edx, [ebp - 0x424]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x424]
push ecx
mov edx, dword [ebp - 0x7a8]
imul edx, edx, 0x18
mov eax, dword [ebp + edx - 0x700]
push eax
push 0
mov ecx, dword [ebp - 0x7a8]
imul ecx, ecx, 0x18
mov edx, dword [ebp + ecx - 0x708]
push edx
mov eax, dword [ebp - 0x428]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x4744bc
mov ecx, dword [ebp - 0x7a8]
imul ecx, ecx, 0x18
cmp dword [ebp + ecx - 0x700], 4
jne 0x4744bc
push 4
mov edx, dword [ebp - 0x7a8]
imul edx, edx, 0x18
mov eax, dword [ebp + edx - 0x704]
push eax
mov ecx, dword [ebp - 0x7a8]
imul ecx, ecx, 0x18
mov edx, dword [ebp + ecx - 0x700]
push edx
push 0
mov eax, dword [ebp - 0x7a8]
imul eax, eax, 0x18
mov ecx, dword [ebp + eax - 0x708]
push ecx
mov edx, dword [ebp - 0x428]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x428]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4744d5
mov dword [ebp - 0x71c], 0x80040201
jmp 0x47430e
cmp dword [ebp - 0x71c], 0
jl 0x4745c3
mov dword [ebp - 0x71c], 0x80040201
lea ecx, [ebp - 0x7a4]
push ecx
push 0x489f58
push 0x104
lea edx, [ebp - 0x65c]
push edx
call fcn.00404f30
add esp, 0x10
test eax, eax
jl 0x4745c3
push 0
lea eax, [ebp - 0x428]
push eax
push 0
push 0x20006
push 0
push 0
push 0
lea ecx, [ebp - 0x65c]
push ecx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x7b0], eax
cmp dword [ebp - 0x7b0], 0
jne 0x4745c3
lea edx, [ebp - 0x668]
push edx
push 0x104
lea eax, [ebp - 0x424]
push eax
call fcn.00404ee0
mov dword [ebp - 0x71c], eax
cmp dword [ebp - 0x71c], 0
jl 0x4745c3
lea ecx, [ebp - 0x424]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x424]
push eax
push 1
push 0
push 0
mov ecx, dword [ebp - 0x428]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x7b0], eax
mov edx, dword [ebp - 0x428]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x11
mov ecx, dword [ebp - 0x7b8]
call fcn.00473d00
cmp dword [ebp - 0x71c], 0
jge 0x4745d7
mov ecx, dword [ebp - 0x7b8]
call fcn.00473f10
mov eax, dword [ebp - 0x71c]
mov dword [ebp - 0x7b4], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x720]
call fcn.00405f40
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x724]
call fcn.00405f40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x718]
call fcn.00405f40
mov eax, dword [ebp - 0x7b4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0043bdb2
mov esp, ebp
pop ebp
ret