Function at 0x4c34c9
Capabilities:
Persist via run registry key

Disassembly:
push 0x158
mov eax, 0x6654e8
call fcn.005b47af
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x130], ecx
xor ecx, ecx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x164], eax
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
xor eax, eax
mov dword [ebp - 0x148], ecx
inc eax
mov dword [ebp - 0x144], ecx
mov ebx, eax
mov dword [ebp - 0x140], ecx
mov dword [ebp - 0x134], ebx
mov esi, SysReAllocStringLen
mov dword [ebp - 4], eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x2c], esi
call fcn.004078a3
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x148]
call fcn.00470c0e
push 0
push ebx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00409de7
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
mov dword [ebp - 0x2c], esi
push edi
lea ecx, [ebp - 0x28]
call fcn.004078a3
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x148]
call fcn.00470c0e
push 0
push ebx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00409de7
inc esi
lea ecx, [ebp - 0x28]
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov dword [ebp - 0x2c], esi
call fcn.004078a3
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x148]
call fcn.00470c0e
push 0
push ebx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00409de7
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x2c], esi
call fcn.004078a3
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x148]
call fcn.00470c0e
push 0
mov byte [ebp - 4], bl
push ebx
lea ecx, [ebp - 0x28]
call fcn.00409de7
mov edi, dword [ebp - 0x148]
jmp 0x4c3b1e
mov eax, dword [edi]
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x2c], eax
lea eax, [edi + 4]
push eax
call fcn.0040bd70
lea ecx, [ebp - 0x128]
call fcn.004c20e0
push 0xf003f
push 0x200
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x128]
call fcn.004c42c3
test al, al
je 0x4c3888
lea eax, [ebp - 0x154]
push eax
lea ecx, [ebp - 0x128]
call fcn.004c320c
mov esi, dword [ebp - 0x154]
mov byte [ebp - 4], 8
cmp esi, dword [ebp - 0x150]
je 0x4c3879
mov edi, dword [ebp - 0x13c]
push esi
lea ecx, [ebp - 0x60]
call fcn.0040bd70
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x78]
call fcn.0040bd70
and dword [ebp - 0x34], 0
xor eax, eax
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 0xb
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0xcc]
push eax
lea ecx, [ebp - 0x128]
call fcn.004c3b47
push eax
lea ecx, [ebp - 0x90]
call fcn.0040bd4b
push 0
push 1
lea ecx, [ebp - 0xcc]
call fcn.00409de7
push 0
push 1
lea ecx, [ebp - 0x44]
call fcn.00409de7
push 0
push 1
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0xe
call fcn.00409de7
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0xf0]
push eax
call fcn.00598fb5
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0xf
call fcn.00411307
push 0
push 1
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0x11
call fcn.00409de7
push dword [ebp - 0x130]
lea eax, [ebp - 0xb4]
push eax
call fcn.004115fd
pop ecx
pop ecx
test al, al
jne 0x4c377d
mov ecx, dword [ebp - 0x130]
lea eax, [ebp - 0xb4]
push eax
call fcn.00411dc1
test al, al
jne 0x4c377d
lea eax, [ebp - 0xd8]
push eax
lea ecx, [ebp - 0xb4]
call fcn.00411b9c
push dword [ebp - 0x130]
or ebx, 2
mov byte [ebp - 4], 0x12
mov ecx, eax
mov dword [ebp - 0x134], ebx
call fcn.00411dc1
mov byte [ebp - 0x129], 0
test al, al
je 0x4c3784
mov byte [ebp - 0x129], 1
mov dword [ebp - 4], 0x11
test bl, 2
je 0x4c37b3
and ebx, 0xfffffffd
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0x134], ebx
call fcn.00409ec4
push 0
push 1
lea ecx, [ebp - 0xd8]
call fcn.00409de7
cmp byte [ebp - 0x129], 0
je 0x4c382b
push 0x6869a4
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.004290f9
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0x13
push ecx
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.0042ab45
add esp, 0x18
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x44]
push eax
call fcn.0040bd4b
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 0x15
push eax
mov ecx, edi
call fcn.00470c0e
push 0
push 1
lea ecx, [ebp - 0x44]
call fcn.00409de7
push 0
push 1
lea ecx, [ebp - 0xcc]
call fcn.00409de7
push 0
push 1
lea ecx, [ebp - 0x78]
call fcn.00409de7
lea ecx, [ebp - 0x9c]
call fcn.00409ec4
push 0
push 1
lea ecx, [ebp - 0xb4]
call fcn.00409de7
push 0
push 1
lea ecx, [ebp - 0x90]
call fcn.00409de7
push 0
push 1
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 8
call fcn.00409de7
add esi, 0x18
cmp esi, dword [ebp - 0x150]
jne 0x4c3661
mov edi, dword [ebp - 0x138]
lea ecx, [ebp - 0x154]
mov byte [ebp - 4], 7
call fcn.00409ec4
push 0xf003f
push 0x100
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x128]
call fcn.004c42c3
test al, al
je 0x4c3b00
lea eax, [ebp - 0x160]
push eax
lea ecx, [ebp - 0x128]
call fcn.004c320c
mov esi, dword [ebp - 0x160]
mov byte [ebp - 4], 0x16
cmp esi, dword [ebp - 0x15c]
je 0x4c3af5
mov edi, dword [ebp - 0x13c]
push esi
lea ecx, [ebp - 0x60]
call fcn.0040bd70
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 0x17
push eax
lea ecx, [ebp - 0x90]
call fcn.0040bd70
and dword [ebp - 0x34], 0
xor eax, eax
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 0x19
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0xf0]
push eax
lea ecx, [ebp - 0x128]
call fcn.004c3b47
push eax
lea ecx, [ebp - 0x78]
call fcn.0040bd4b
push 0
push 1
lea ecx, [ebp - 0xf0]
call fcn.00409de7
push 0
push 1
lea ecx, [ebp - 0x44]
call fcn.00409de7
push 0
push 1
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 0x1c
call fcn.00409de7
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.00598fb5
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0x1d
call fcn.00411307
push 0
push 1
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 0x1f
call fcn.00409de7
push dword [ebp - 0x130]
lea eax, [ebp - 0xb4]
push eax
call fcn.004115fd
pop ecx
pop ecx
test al, al
jne 0x4c39f6
mov ecx, dword [ebp - 0x130]
lea eax, [ebp - 0xb4]
push eax
call fcn.00411dc1
test al, al
jne 0x4c39f6
lea eax, [ebp - 0xfc]
push eax
lea ecx, [ebp - 0xb4]
call fcn.00411b9c
push dword [ebp - 0x130]
or ebx, 4
mov byte [ebp - 4], 0x20
mov ecx, eax
mov dword [ebp - 0x134], ebx
call fcn.00411dc1
mov byte [ebp - 0x129], 0
test al, al
je 0x4c39fd
mov byte [ebp - 0x129], 1
mov dword [ebp - 4], 0x1f
test bl, 4
je 0x4c3a2c
and ebx, 0xfffffffb
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0x134], ebx
call fcn.00409ec4
push 0
push 1
lea ecx, [ebp - 0xfc]
call fcn.00409de7
cmp byte [ebp - 0x129], 0
je 0x4c3aaa
push 0x6869a4
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x90]
push eax
call fcn.004290f9
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0x21
push ecx
push eax
lea eax, [ebp - 0xf0]
push eax
call fcn.0042ab45
add esp, 0x18
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x44]
push eax
call fcn.0040bd4b
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 0x23
push eax
mov ecx, edi
call fcn.00470c0e
push 0
push 1
lea ecx, [ebp - 0x44]
call fcn.00409de7
push 0
push 1
lea ecx, [ebp - 0xf0]
call fcn.00409de7
push 0
push 1
lea ecx, [ebp - 0x90]
call fcn.00409de7
lea ecx, [ebp - 0x9c]
call fcn.00409ec4
push 0
push 1
lea ecx, [ebp - 0xb4]
call fcn.00409de7
push 0
push 1
lea ecx, [ebp - 0x78]
call fcn.00409de7
push 0
push 1
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0x16
call fcn.00409de7
add esi, 0x18
cmp esi, dword [ebp - 0x15c]
jne 0x4c38d7
mov edi, dword [ebp - 0x138]
lea ecx, [ebp - 0x160]
call fcn.00409ec4
lea ecx, [ebp - 0x128]
call fcn.004c211d
push 0
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00409de7
add edi, 0x1c
mov dword [ebp - 0x138], edi
cmp edi, dword [ebp - 0x144]
jne 0x4c35f2
lea ecx, [ebp - 0x148]
call fcn.0046f766
mov eax, dword [ebp - 0x13c]
call fcn.005b4759
ret