Function at 0x455480
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff68
push ebx
push esi
push edi
mov byte [ebp - 0x95], cl
mov dword [ebp - 0x94], edx
mov dword [ebp - 0x90], eax
mov eax, 0x7942a0
call fcn.0074df70
cmp dword [ebp - 0x94], 0
jne 0x4554c5
xor eax, eax
mov edx, dword [ebp - 0x8c]
mov dword fs:[0], edx
jmp 0x455cc5
mov byte [ebp - 0x96], 0
mov word [ebp - 0x7c], 0x18
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRun
lea eax, [ebp - 4]
call fcn.004539c4
add dword [ebp - 0x70], 2
mov word [ebp - 0x7c], 0xc
mov word [ebp - 0x7c], 0x24
mov edx, str.Once
lea eax, [ebp - 8]
call fcn.004539c4
add dword [ebp - 0x70], 2
mov word [ebp - 0x7c], 0xc
mov word [ebp - 0x7c], 0x30
mov word [ebp - 0x7c], 0x3c
mov edx, str.rem_PACK_HKLM_RunOnce
lea eax, [ebp - 0xc]
call fcn.0075c45c
mov edx, eax
inc dword [ebp - 0x70]
mov edx, dword [edx]
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
call dword [ecx + 0x38]
dec dword [ebp - 0x70]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0075c648
mov word [ebp - 0x7c], 0x48
lea eax, [ebp - 0x10]
call fcn.00453790
mov ecx, eax
add dword [ebp - 0x70], 2
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.00453d6c
lea edx, [ebp - 0x10]
push dword [edx]
mov ecx, SysStringLen
mov edx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x90]
call fcn.00459074
xor ecx, ecx
mov cl, al
cmp ecx, 1
sbb eax, eax
neg eax
push eax
sub dword [ebp - 0x70], 2
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004537c8
pop ecx
test cl, cl
je 0x45559f
jmp 0x4555d4
mov word [ebp - 0x7c], 0x54
mov edx, 0x792ba4
lea eax, [ebp - 0x14]
call fcn.0075c45c
mov edx, eax
inc dword [ebp - 0x70]
mov edx, dword [edx]
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
call dword [ecx + 0x38]
dec dword [ebp - 0x70]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0075c648
mov byte [ebp - 0x96], 1
mov eax, dword [0x7b9688]
mov eax, dword [eax]
call fcn.005152fc
mov word [ebp - 0x7c], 0xc
jmp 0x4555fa
mov word [ebp - 0x7c], 0x6c
mov word [ebp - 0x7c], 0x78
mov edx, str.rem_PACK_HKLM_Run
lea eax, [ebp - 0x18]
call fcn.0075c45c
mov edx, eax
inc dword [ebp - 0x70]
mov edx, dword [edx]
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
call dword [ecx + 0x38]
dec dword [ebp - 0x70]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.0075c648
push dword [ebp - 4]
mov ecx, SysStringLen
mov edx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x90]
call fcn.00459074
test al, al
jne 0x455689
mov word [ebp - 0x7c], 0x84
mov edx, 0x792bb7
lea eax, [ebp - 0x1c]
call fcn.0075c45c
mov edx, eax
inc dword [ebp - 0x70]
mov edx, dword [edx]
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
call dword [ecx + 0x38]
dec dword [ebp - 0x70]
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.0075c648
jmp 0x4556be
mov word [ebp - 0x7c], 0x90
mov edx, 0x792bc9
lea eax, [ebp - 0x20]
call fcn.0075c45c
mov edx, eax
inc dword [ebp - 0x70]
mov edx, dword [edx]
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
call dword [ecx + 0x38]
dec dword [ebp - 0x70]
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.0075c648
mov byte [ebp - 0x96], 1
mov eax, dword [0x7b9688]
mov eax, dword [eax]
call fcn.005152fc
mov word [ebp - 0x7c], 0xc
jmp 0x4556e4
mov edx, dword [ebp - 0x90]
cmp byte [edx + 0x742], 0
je 0x4558d5
mov word [ebp - 0x7c], 0xa8
mov word [ebp - 0x7c], 0xb4
mov edx, str.rem_PACK_HKLM_RunOnce64
lea eax, [ebp - 0x24]
call fcn.0075c45c
mov edx, eax
inc dword [ebp - 0x70]
mov edx, dword [edx]
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
call dword [ecx + 0x38]
dec dword [ebp - 0x70]
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.0075c648
mov word [ebp - 0x7c], 0xc0
lea eax, [ebp - 0x28]
call fcn.00453790
mov ecx, eax
add dword [ebp - 0x70], 2
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.00453d6c
lea edx, [ebp - 0x28]
push dword [edx]
mov ecx, SysStringLen
mov edx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x90]
call fcn.004595c8
xor ecx, ecx
mov cl, al
cmp ecx, 1
sbb eax, eax
neg eax
push eax
sub dword [ebp - 0x70], 2
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.004537c8
pop ecx
test cl, cl
je 0x455790
jmp 0x4557c5
mov word [ebp - 0x7c], 0xcc
mov edx, 0x792be2
lea eax, [ebp - 0x2c]
call fcn.0075c45c
mov edx, eax
inc dword [ebp - 0x70]
mov edx, dword [edx]
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
call dword [ecx + 0x38]
dec dword [ebp - 0x70]
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.0075c648
mov byte [ebp - 0x96], 1
mov eax, dword [0x7b9688]
mov eax, dword [eax]
call fcn.005152fc
mov word [ebp - 0x7c], 0xc
jmp 0x4557eb
mov word [ebp - 0x7c], 0xe4
mov word [ebp - 0x7c], 0xf0
mov edx, str.rem_PACK_HKLM_Run64
lea eax, [ebp - 0x30]
call fcn.0075c45c
mov edx, eax
inc dword [ebp - 0x70]
mov edx, dword [edx]
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
call dword [ecx + 0x38]
dec dword [ebp - 0x70]
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.0075c648
push dword [ebp - 4]
mov ecx, SysStringLen
mov edx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x90]
call fcn.004595c8
test al, al
jne 0x45587a
mov word [ebp - 0x7c], 0xfc
mov edx, 0x792bf7
lea eax, [ebp - 0x34]
call fcn.0075c45c
mov edx, eax
inc dword [ebp - 0x70]
mov edx, dword [edx]
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
call dword [ecx + 0x38]
dec dword [ebp - 0x70]
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.0075c648
jmp 0x4558af
mov word [ebp - 0x7c], 0x108
mov edx, 0x792c09
lea eax, [ebp - 0x38]
call fcn.0075c45c
mov edx, eax
inc dword [ebp - 0x70]
mov edx, dword [edx]
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
call dword [ecx + 0x38]
dec dword [ebp - 0x70]
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.0075c648
mov byte [ebp - 0x96], 1
mov eax, dword [0x7b9688]
mov eax, dword [eax]
call fcn.005152fc
mov word [ebp - 0x7c], 0xc
jmp 0x4558d5
mov word [ebp - 0x7c], 0x120
mov word [ebp - 0x7c], 0x12c
mov edx, str.rem_PACK_HKCU_RunOnce
lea eax, [ebp - 0x3c]
call fcn.0075c45c
mov edx, eax
inc dword [ebp - 0x70]
mov edx, dword [edx]
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
call dword [ecx + 0x38]
dec dword [ebp - 0x70]
lea eax, [ebp - 0x3c]
mov edx, 2
call fcn.0075c648
mov word [ebp - 0x7c], 0x138
lea eax, [ebp - 0x40]
call fcn.00453790
mov ecx, eax
add dword [ebp - 0x70], 2
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.00453d6c
lea edx, [ebp - 0x40]
push dword [edx]
mov ecx, SysReAllocStringLen
mov edx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x90]
call fcn.00459074
xor ecx, ecx
mov cl, al
cmp ecx, 1
sbb eax, eax
neg eax
push eax
sub dword [ebp - 0x70], 2
lea eax, [ebp - 0x40]
mov edx, 2
call fcn.004537c8
pop ecx
test cl, cl
je 0x45596e
jmp 0x4559a3
mov word [ebp - 0x7c], 0x144
mov edx, 0x792c20
lea eax, [ebp - 0x44]
call fcn.0075c45c
mov edx, eax
inc dword [ebp - 0x70]
mov edx, dword [edx]
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
call dword [ecx + 0x38]
dec dword [ebp - 0x70]
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.0075c648
mov byte [ebp - 0x96], 1
mov eax, dword [0x7b9688]
mov eax, dword [eax]
call fcn.005152fc
mov word [ebp - 0x7c], 0xc
jmp 0x4559c9
mov word [ebp - 0x7c], 0x15c
mov word [ebp - 0x7c], 0x168
mov edx, str.rem_PACK_HKCU_Run
lea eax, [ebp - 0x48]
call fcn.0075c45c
mov edx, eax
inc dword [ebp - 0x70]
mov edx, dword [edx]
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
call dword [ecx + 0x38]
dec dword [ebp - 0x70]
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.0075c648
push dword [ebp - 4]
mov ecx, SysReAllocStringLen
mov edx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x90]
call fcn.00459074
test al, al
jne 0x455a58
mov word [ebp - 0x7c], 0x174
mov edx, 0x792c33
lea eax, [ebp - 0x4c]
call fcn.0075c45c
mov edx, eax
inc dword [ebp - 0x70]
mov edx, dword [edx]
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
call dword [ecx + 0x38]
dec dword [ebp - 0x70]
lea eax, [ebp - 0x4c]
mov edx, 2
call fcn.0075c648
jmp 0x455a8d
mov word [ebp - 0x7c], 0x180
mov edx, 0x792c45
lea eax, [ebp - 0x50]
call fcn.0075c45c
mov edx, eax
inc dword [ebp - 0x70]
mov edx, dword [edx]
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
call dword [ecx + 0x38]
dec dword [ebp - 0x70]
lea eax, [ebp - 0x50]
mov edx, 2
call fcn.0075c648
mov byte [ebp - 0x96], 1
mov eax, dword [0x7b9688]
mov eax, dword [eax]
call fcn.005152fc
mov word [ebp - 0x7c], 0xc
jmp 0x455ab3
cmp byte [ebp - 0x95], 0
jne 0x455c8e
mov word [ebp - 0x7c], 0x198
mov word [ebp - 0x7c], 0x1a4
mov edx, str.rem_PACK_Common_Startup
lea eax, [ebp - 0x54]
call fcn.0075c45c
mov edx, eax
inc dword [ebp - 0x70]
mov edx, dword [edx]
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
call dword [ecx + 0x38]
dec dword [ebp - 0x70]
lea eax, [ebp - 0x54]
mov edx, 2
call fcn.0075c648
mov ecx, 2
mov edx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x90]
call fcn.00455ccc
test al, al
jne 0x455b4c
mov word [ebp - 0x7c], 0x1b0
mov edx, 0x792c5e
lea eax, [ebp - 0x58]
call fcn.0075c45c
mov edx, eax
inc dword [ebp - 0x70]
mov edx, dword [edx]
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
call dword [ecx + 0x38]
dec dword [ebp - 0x70]
lea eax, [ebp - 0x58]
mov edx, 2
call fcn.0075c648
jmp 0x455b81
mov word [ebp - 0x7c], 0x1bc
mov edx, 0x792c70
lea eax, [ebp - 0x5c]
call fcn.0075c45c
mov edx, eax
inc dword [ebp - 0x70]
mov edx, dword [edx]
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
call dword [ecx + 0x38]
dec dword [ebp - 0x70]
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.0075c648
mov byte [ebp - 0x96], 1
mov eax, dword [0x7b9688]
mov eax, dword [eax]
call fcn.005152fc
mov word [ebp - 0x7c], 0xc
jmp 0x455ba7
mov word [ebp - 0x7c], 0x1d4
mov word [ebp - 0x7c], 0x1e0
mov edx, str.rem_PACK_User_Startup
lea eax, [ebp - 0x60]
call fcn.0075c45c
mov edx, eax
inc dword [ebp - 0x70]
mov edx, dword [edx]
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
call dword [ecx + 0x38]
dec dword [ebp - 0x70]
lea eax, [ebp - 0x60]
mov edx, 2
call fcn.0075c648
mov ecx, 1
mov edx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x90]
call fcn.00455ccc
test al, al
jne 0x455c33
mov word [ebp - 0x7c], 0x1ec
mov edx, str.rem_error_reading
lea eax, [ebp - 0x64]
call fcn.0075c45c
mov edx, eax
inc dword [ebp - 0x70]
mov edx, dword [edx]
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
call dword [ecx + 0x38]
dec dword [ebp - 0x70]
lea eax, [ebp - 0x64]
mov edx, 2
call fcn.0075c648
jmp 0x455c68
mov word [ebp - 0x7c], 0x1f8
mov edx, 0x792c99
lea eax, [ebp - 0x68]
call fcn.0075c45c
mov edx, eax
inc dword [ebp - 0x70]
mov edx, dword [edx]
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
call dword [ecx + 0x38]
dec dword [ebp - 0x70]
lea eax, [ebp - 0x68]
mov edx, 2
call fcn.0075c648
mov byte [ebp - 0x96], 1
mov eax, dword [0x7b9688]
mov eax, dword [eax]
call fcn.005152fc
mov word [ebp - 0x7c], 0xc
jmp 0x455c8e
mov al, byte [ebp - 0x96]
push eax
sub dword [ebp - 0x70], 2
lea eax, [ebp - 8]
mov edx, 2
call fcn.004537c8
sub dword [ebp - 0x70], 2
lea eax, [ebp - 4]
mov edx, 2
call fcn.004537c8
pop eax
mov edx, dword [ebp - 0x8c]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret