Function at 0x47bec6
Capabilities:
Persist via run registry key

Disassembly:
push 4
mov eax, 0x5cedcd
call fcn.00506dc7
mov edi, ecx
xor ebx, ebx
mov esi, reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x47c1cc
cmp dword [edi + 8], ebx
jne 0x47c250
push ebx
push ecx
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
call fcn.00413f09
push esi
mov ecx, edi
call fcn.0047a0a9
call fcn.00472ad9
cmp dword [0x683574], ebx
jne 0x47c250
call fcn.00430f47
test eax, eax
je 0x47bf37
push 1
push ecx
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
call fcn.00413f09
push esi
mov ecx, edi
call fcn.0047a0a9
call fcn.00472ad9
cmp dword [0x683574], ebx
jne 0x47c250
push ebx
push ecx
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
call fcn.00413f09
push SysReAllocString
mov ecx, edi
call fcn.0047a0a9
call fcn.00472ad9
cmp dword [0x683574], ebx
jne 0x47c250
push ebx
push ecx
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
call fcn.00413f09
push esi
mov ecx, edi
call fcn.0047a0a9
call fcn.00472ad9
cmp dword [0x683574], ebx
jne 0x47c250
call fcn.00430f47
test eax, eax
je 0x47bfba
push 1
push ecx
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
call fcn.00413f09
push esi
mov ecx, edi
call fcn.0047a0a9
call fcn.00472ad9
cmp dword [0x683574], ebx
jne 0x47c250
push ebx
push ecx
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
call fcn.00413f09
push SysReAllocString
mov ecx, edi
call fcn.0047a0a9
call fcn.00472ad9
cmp dword [0x683574], ebx
jne 0x47c250
cmp dword [edi + 8], ebx
jne 0x47c250
mov ebx, dword [ebp + 8]
push ecx
mov esi, esp
mov dword [ebp + 0xc], esp
add ebx, 0xfffffff0
mov dword [ebp - 0x10], esi
push ebx
call fcn.00412393
add eax, 0x10
pop ecx
mov dword [esi], eax
push 0
push ecx
mov ecx, esp
mov byte [ebp - 4], 1
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths
call fcn.00413f09
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.0047f481
call fcn.00430f47
test eax, eax
je 0x47c07e
push ecx
mov esi, esp
mov dword [ebp + 0xc], esp
push ebx
mov dword [ebp - 0x10], esi
call fcn.00412393
add eax, 0x10
pop ecx
mov dword [esi], eax
push 1
push ecx
mov ecx, esp
mov byte [ebp - 4], 2
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths
call fcn.00413f09
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.0047f481
cmp dword [edi + 8], 0
jne 0x47c250
mov ebx, dword [ebp + 8]
push ecx
mov esi, esp
mov dword [ebp + 0xc], esp
add ebx, 0xfffffff0
mov dword [ebp - 0x10], esi
push ebx
call fcn.00412393
add eax, 0x10
pop ecx
mov dword [esi], eax
push 0
push ecx
mov ecx, esp
mov byte [ebp - 4], 3
push str.SOFTWARE
call fcn.00413f09
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.00485717
call fcn.00430f47
test eax, eax
je 0x47c107
push ecx
mov esi, esp
mov dword [ebp + 0xc], esp
push ebx
mov dword [ebp - 0x10], esi
call fcn.00412393
add eax, 0x10
pop ecx
mov dword [esi], eax
push 1
push ecx
mov ecx, esp
mov byte [ebp - 4], 4
push str.SOFTWARE
call fcn.00413f09
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.00485717
push ecx
mov esi, esp
mov dword [ebp + 0xc], esp
push ebx
mov dword [ebp - 0x10], esi
call fcn.00412393
add eax, 0x10
pop ecx
mov dword [esi], eax
xor ebx, ebx
mov byte [ebp - 4], 5
push ebx
push ecx
mov ecx, esp
push str.SOFTWARE
call fcn.00413f09
push SysReAllocString
mov ecx, edi
mov byte [ebp - 4], bl
call fcn.00485717
cmp dword [edi + 8], ebx
jne 0x47c250
mov ebx, dword [ebp + 8]
push ecx
mov esi, esp
mov dword [ebp + 0xc], esp
add ebx, 0xfffffff0
mov dword [ebp - 0x10], esi
push ebx
call fcn.00412393
add eax, 0x10
pop ecx
mov dword [esi], eax
push 0
push ecx
mov ecx, esp
mov byte [ebp - 4], 6
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
call fcn.00413f09
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.00491e56
call fcn.00430f47
test eax, eax
je 0x47c1ca
push ecx
mov esi, esp
mov dword [ebp + 0xc], esp
push ebx
mov dword [ebp - 0x10], esi
call fcn.00412393
add eax, 0x10
pop ecx
mov dword [esi], eax
push 1
push ecx
mov ecx, esp
mov byte [ebp - 4], 7
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
call fcn.00413f09
xor ebx, ebx
mov ecx, edi
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], bl
call fcn.00491e56
jmp 0x47c1cc
xor ebx, ebx
cmp dword [edi + 8], ebx
jne 0x47c250
mov ebx, dword [ebp + 8]
push ecx
mov esi, esp
mov dword [ebp + 0xc], esp
add ebx, 0xfffffff0
mov dword [ebp - 0x10], esi
push ebx
call fcn.00412393
add eax, 0x10
pop ecx
mov dword [esi], eax
push 0
push ecx
mov ecx, esp
mov byte [ebp - 4], 8
push str.SOFTWAREClasses
call fcn.00413f09
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.004836a8
call fcn.00430f47
test eax, eax
je 0x47c250
push ecx
mov esi, esp
mov dword [ebp + 0xc], esp
push ebx
mov dword [ebp - 0x10], esi
call fcn.00412393
add eax, 0x10
pop ecx
mov dword [esi], eax
push 1
push ecx
mov ecx, esp
mov byte [ebp - 4], 9
push str.SOFTWAREClasses
call fcn.00413f09
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.004836a8
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
call fcn.00506d90
ret 8