Function at 0x47fa75
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a74c1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x168
mov dword [ebp - 0x16c], ecx
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x154]
push eax
lea ecx, [ebp - 0x30]
call fcn.004322d0
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x150], ecx
lea edx, [ebp - 0x30]
mov dword [ebp - 0x14c], edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
push SysStringLen
call fcn.0043dbef
mov ecx, eax
call fcn.004408e5
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks
push SysStringLen
call fcn.0043dbef
mov ecx, eax
call fcn.004408e5
push 0x539ae8
push SysStringLen
call fcn.0043dbef
mov ecx, eax
call fcn.004408e5
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push closesocket
call fcn.0043dbef
mov ecx, eax
call fcn.004408e5
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
push SysStringLen
call fcn.0043dbef
mov ecx, eax
call fcn.004408e5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.0043dbef
mov ecx, eax
call fcn.0043e347
lea eax, [ebp - 0x150]
push eax
push 0x47f283
lea ecx, [ebp - 0x30]
push ecx
call fcn.00431fc6
mov ecx, eax
call fcn.00431152
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x30]
call fcn.0048c270
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x34], 0
jmp 0x47fba9
mov edx, dword [ebp - 0x34]
add edx, 1
mov dword [ebp - 0x34], edx
lea ecx, [ebp - 0x30]
call fcn.0048c270
cmp dword [ebp - 0x34], eax
jae 0x47fcb3
mov eax, dword [ebp - 0x34]
push eax
lea ecx, [ebp - 0x30]
call fcn.00432280
mov ecx, dword [eax]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0
je 0x47fcae
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0xc], 1
jne 0x47fc1d
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x15c], eax
mov ecx, dword [ebp - 0x15c]
mov dword [ebp - 0x158], ecx
cmp dword [ebp - 0x158], 0
je 0x47fc11
push 1
mov ecx, dword [ebp - 0x158]
call fcn.004817b0
mov dword [ebp - 0x170], eax
jmp 0x47fc1b
mov dword [ebp - 0x170], 0
jmp 0x47fba0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x16c]
call fcn.0047fa40
test eax, eax
je 0x47fc76
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x164], ecx
mov edx, dword [ebp - 0x164]
mov dword [ebp - 0x160], edx
cmp dword [ebp - 0x160], 0
je 0x47fc67
push 1
mov ecx, dword [ebp - 0x160]
call fcn.004817b0
mov dword [ebp - 0x174], eax
jmp 0x47fc71
mov dword [ebp - 0x174], 0
jmp 0x47fba0
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x3c], edx
mov ecx, dword [ebp - 0x18]
call fcn.00441560
push eax
push 0x104
lea eax, [ebp - 0x144]
push eax
call fcn.004154e0
lea ecx, [ebp - 0x144]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004819d0
jmp 0x47fba0
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [ebp - 0x168], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00481a20
mov eax, dword [ebp - 0x168]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc