Function at 0x403f80
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Contain obfuscated stackstrings
Get number of processors
Get process heap flags
Get process heap force flags
Parse pe header
Persist via run registry key
Persist via winlogon helper dll registry key

Disassembly:
push 0xffffffffffffffff
push 0x44f0cc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x40], esi
call fcn.004066f0
lea ebp, [esi + 0x24]
xor ebx, ebx
mov ecx, ebp
mov dword [esp + 0x60], ebx
mov dword [esp + 0x3c], ebp
call fcn.00424280
mov eax, 0x454560
mov ecx, 1
mov dword [ebp + 0xc], eax
cmp word [0x454560], 0xffff
mov byte [esp + 0x60], cl
je 0x403fe2
add eax, 4
inc ecx
cmp word [eax], 0xffff
jne 0x403fd7
lea edi, [ecx*8]
push edi
call fcn.0044560d
mov edx, eax
add esp, 4
cmp edx, ebx
mov dword [ebp + 0x10], edx
je 0x40400f
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov dword [esi + 0x1c], 0x45455c
mov dword [esi + 0x20], 0x454558
push 0xffffff
mov dword [esi + 0x3c], ebx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esi + 0x3c], eax
lea edi, [esi + 0x40]
mov byte [esp + 0x60], 3
mov ecx, edi
call fcn.00423590
or ebp, 0xffffffff
mov byte [edi + 0x1c], bl
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebp
mov dword [edi + 0x18], ebp
mov dword [esi + 0x60], ebx
lea edi, [esi + 0x64]
mov byte [esp + 0x60], 5
mov ecx, edi
mov dword [esp + 0x3c], edi
call fcn.004399f0
lea eax, [esp + 0x13]
lea ecx, [edi + 0x20]
push eax
mov byte [esp + 0x64], 6
call fcn.004251e0
mov dword [edi + 0x30], ebp
mov dword [edi], 0x45454c
lea edi, [esi + 0x98]
mov byte [esp + 0x60], 7
mov ecx, edi
mov dword [esp + 0x3c], edi
call fcn.004066f0
lea ecx, [edi + 0x1c]
mov byte [esp + 0x60], 8
call fcn.00426570
lea ecx, [edi + 0x3c]
mov byte [esp + 0x60], 9
call fcn.00401000
lea ecx, [edi + 0x1d8]
mov byte [esp + 0x60], 0xa
call fcn.004385a0
lea ecx, [edi + 0x248]
mov byte [esp + 0x60], 0xb
call fcn.004385a0
lea ecx, [edi + 0x2b8]
mov byte [esp + 0x60], 0xc
call fcn.004385a0
mov dword [edi + 0x328], ebx
mov dword [edi], 0x454540
lea edi, [esi + 0x3c4]
mov byte [esp + 0x60], 0xd
mov ecx, edi
mov dword [esp + 0x3c], edi
call fcn.004399f0
lea ecx, [edi + 0x20]
mov byte [esp + 0x60], 0xe
call fcn.00437450
mov dword [edi + 0x84], ebx
mov dword [edi + 0x88], ebx
mov dword [edi + 0x8c], ebx
lea ecx, [edi + 0x90]
mov byte [esp + 0x60], 0x10
call fcn.004366c0
mov dword [edi], 0x454534
mov dword [esi + 0x488], ebx
lea edi, [esi + 0x48c]
mov byte [esp + 0x60], 0x12
mov ecx, edi
mov dword [esp + 0x3c], edi
call fcn.004066f0
lea ecx, [edi + 0x1c]
mov byte [esp + 0x60], 0x13
call fcn.00426570
lea ecx, [edi + 0x3c]
mov byte [esp + 0x60], 0x14
call fcn.00427970
lea ecx, [edi + 0x40]
mov byte [esp + 0x60], 0x15
call fcn.004366c0
lea ecx, [edi + 0x74]
mov byte [esp + 0x60], 0x16
call fcn.00406700
lea ecx, [edi + 0x580]
mov byte [esp + 0x60], 0x17
call fcn.0043adf0
lea ecx, [edi + 0x690]
mov byte [esp + 0x60], 0x18
call fcn.0043adf0
lea ecx, [edi + 0x7a0]
mov byte [esp + 0x60], 0x19
call fcn.0043adf0
lea ecx, [edi + 0x8b0]
mov byte [esp + 0x60], 0x1a
call fcn.0043adf0
lea ecx, [edi + 0x9c0]
mov byte [esp + 0x60], 0x1b
call fcn.0043adf0
lea ecx, [esp + 0x13]
mov dword [edi + 0xad0], ebx
push ecx
lea ecx, [edi + 0xad8]
mov byte [esp + 0x64], 0x1c
mov dword [edi + 0xad4], ebx
call fcn.004251e0
mov dword [edi], 0x454528
mov dword [edi + 0xae8], ebx
lea edi, [esi + 0xf78]
mov byte [esp + 0x60], 0x1d
mov ecx, edi
mov dword [esp + 0x3c], edi
call fcn.004066f0
lea ecx, [edi + 0x1c]
mov byte [esp + 0x60], 0x1e
call fcn.00426570
lea ecx, [edi + 0x3c]
mov byte [esp + 0x60], 0x1f
call fcn.00427970
lea ecx, [edi + 0x40]
mov byte [esp + 0x60], 0x20
call fcn.004366c0
lea ecx, [edi + 0x74]
mov byte [esp + 0x60], 0x21
call fcn.00406700
lea ecx, [edi + 0x580]
mov byte [esp + 0x60], 0x22
call fcn.0043adf0
lea ecx, [edi + 0x690]
mov byte [esp + 0x60], 0x23
call fcn.0043adf0
lea ecx, [edi + 0x7a0]
mov byte [esp + 0x60], 0x24
call fcn.0043adf0
lea ecx, [edi + 0x8b0]
mov byte [esp + 0x60], 0x25
call fcn.0043adf0
lea ecx, [edi + 0x9c0]
mov byte [esp + 0x60], 0x26
call fcn.0043adf0
lea edx, [esp + 0x13]
mov dword [edi + 0xad0], ebx
push edx
lea ecx, [edi + 0xad8]
mov byte [esp + 0x64], 0x27
mov dword [edi + 0xad4], ebx
call fcn.004251e0
mov dword [edi], 0x454528
mov dword [edi + 0xae8], ebx
lea edi, [esi + 0x1a64]
mov byte [esp + 0x60], 0x28
mov ecx, edi
mov dword [esp + 0x3c], edi
call fcn.004066f0
lea ecx, [edi + 0x1c]
mov byte [esp + 0x60], 0x29
call fcn.00426570
lea ecx, [edi + 0x3c]
mov byte [esp + 0x60], 0x2a
call fcn.00427970
lea ecx, [edi + 0x40]
mov byte [esp + 0x60], 0x2b
call fcn.004366c0
lea ecx, [edi + 0x74]
mov byte [esp + 0x60], 0x2c
call fcn.00406700
lea ecx, [edi + 0x580]
mov byte [esp + 0x60], 0x2d
call fcn.0043adf0
lea ecx, [edi + 0x690]
mov byte [esp + 0x60], 0x2e
call fcn.0043adf0
lea ecx, [edi + 0x7a0]
mov byte [esp + 0x60], 0x2f
call fcn.0043adf0
lea ecx, [edi + 0x8b0]
mov byte [esp + 0x60], 0x30
call fcn.0043adf0
lea ecx, [edi + 0x9c0]
mov byte [esp + 0x60], 0x31
call fcn.0043adf0
lea eax, [esp + 0x13]
mov dword [edi + 0xad0], ebx
push eax
lea ecx, [edi + 0xad8]
mov byte [esp + 0x64], 0x32
mov dword [edi + 0xad4], ebx
call fcn.004251e0
mov dword [edi], 0x454528
mov dword [edi + 0xae8], ebx
lea edi, [esi + 0x2550]
mov byte [esp + 0x60], 0x33
mov dword [esp + 0x44], edi
mov ecx, edi
call fcn.004066f0
lea ecx, [edi + 0x1c]
mov byte [esp + 0x60], 0x34
call fcn.00426570
lea ecx, [edi + 0x3c]
mov byte [esp + 0x60], 0x35
call fcn.00427970
lea ecx, [edi + 0x40]
mov byte [esp + 0x60], 0x36
call fcn.004366c0
lea ecx, [edi + 0x74]
mov byte [esp + 0x60], 0x37
call fcn.00406700
lea ecx, [edi + 0x580]
mov byte [esp + 0x60], 0x38
call fcn.0043adf0
lea ecx, [edi + 0x690]
mov byte [esp + 0x60], 0x39
call fcn.0043adf0
lea ecx, [edi + 0x7a0]
mov byte [esp + 0x60], 0x3a
call fcn.0043adf0
lea ecx, [edi + 0x8b0]
mov byte [esp + 0x60], 0x3b
call fcn.0043adf0
lea ecx, [edi + 0x9c0]
mov byte [esp + 0x60], 0x3c
call fcn.0043adf0
lea ecx, [esp + 0x13]
lea ebp, [edi + 0xad8]
lea edx, [esp + 0x14]
push ecx
mov dword [edi + 0xad0], ebx
push edx
mov ecx, ebp
mov byte [esp + 0x68], 0x3d
mov dword [edi + 0xad4], ebx
call fcn.00428a00
lea eax, [esp + 0x15]
lea edx, [esp + 0x16]
push eax
lea ecx, [edi + 0xae8]
push edx
mov byte [esp + 0x68], 0x3e
call fcn.00427ff0
lea eax, [esp + 0x17]
lea ecx, [edi + 0xaf8]
push eax
mov byte [esp + 0x64], 0x3f
call fcn.004251e0
lea ecx, [esp + 0x2c]
push str.HKEY_CLASSES_ROOT
push ecx
mov ecx, ebp
mov byte [esp + 0x68], 0x40
mov dword [edi], 0x45451c
mov dword [esp + 0x34], SysReAllocString
call fcn.00428ab0
mov ecx, eax
call fcn.00425f80
lea edx, [esp + 0x30]
push str.HKEY_CURRENT_CONFIG
push edx
mov ecx, ebp
mov dword [esp + 0x38], VariantCopyInd
call fcn.00428ab0
mov ecx, eax
call fcn.00425f80
lea eax, [esp + 0x34]
push str.HKEY_CURRENT_USER
push eax
mov ecx, ebp
mov dword [esp + 0x3c], SysReAllocString
call fcn.00428ab0
mov ecx, eax
call fcn.00425f80
lea ecx, [esp + 0x38]
push str.HKEY_LOCAL_MACHINE
push ecx
mov ecx, ebp
mov dword [esp + 0x40], reloc.OLEAUT32.dll_SysReAllocString
call fcn.00428ab0
mov ecx, eax
call fcn.00425f80
lea edx, [esp + 0x3c]
push str.HKEY_USERS
push edx
mov ecx, ebp
mov dword [esp + 0x44], VariantCopyInd
call fcn.00428ab0
mov ecx, eax
call fcn.00425f80
push str.HKEY_CLASSES_ROOT
lea ecx, [esp + 0x1c]
call fcn.00425b80
lea eax, [esp + 0x18]
lea ebp, [edi + 0xae8]
push eax
mov ecx, ebp
mov byte [esp + 0x64], 0x41
call fcn.004280a0
lea ecx, [esp + 0x18]
mov dword [eax], SysReAllocString
mov byte [esp + 0x60], 0x40
call fcn.00429590
push str.HKEY_CURRENT_CONFIG
lea ecx, [esp + 0x20]
call fcn.00425b80
lea ecx, [esp + 0x1c]
mov byte [esp + 0x60], 0x42
push ecx
mov ecx, ebp
call fcn.004280a0
lea ecx, [esp + 0x1c]
mov dword [eax], VariantCopyInd
mov byte [esp + 0x60], 0x40
call fcn.00429590
push str.HKEY_CURRENT_USER
lea ecx, [esp + 0x24]
call fcn.00425b80
lea edx, [esp + 0x20]
mov ecx, ebp
push edx
mov byte [esp + 0x64], 0x43
call fcn.004280a0
lea ecx, [esp + 0x20]
mov dword [eax], SysReAllocString
mov byte [esp + 0x60], 0x40
call fcn.00429590
push str.HKEY_LOCAL_MACHINE
lea ecx, [esp + 0x28]
call fcn.00425b80
lea eax, [esp + 0x24]
mov ecx, ebp
push eax
mov byte [esp + 0x64], 0x44
call fcn.004280a0
lea ecx, [esp + 0x24]
mov dword [eax], reloc.OLEAUT32.dll_SysReAllocString
mov byte [esp + 0x60], 0x40
call fcn.00429590
push str.HKEY_USERS
lea ecx, [esp + 0x2c]
call fcn.00425b80
lea ecx, [esp + 0x28]
mov byte [esp + 0x60], 0x45
push ecx
mov ecx, ebp
call fcn.004280a0
lea ecx, [esp + 0x28]
mov dword [eax], VariantInit
mov byte [esp + 0x60], 0x40
call fcn.00429590
mov dword [edi + 0xb08], ebx
lea ebp, [esi + 0x305c]
mov byte [esp + 0x60], 0x46
mov ecx, ebp
mov dword [esp + 0x44], ebp
call fcn.004066f0
lea ecx, [ebp + 0x1c]
mov byte [esp + 0x60], 0x47
call fcn.00426570
lea ecx, [ebp + 0x3c]
mov byte [esp + 0x60], 0x48
call fcn.00427970
lea ecx, [ebp + 0x40]
mov byte [esp + 0x60], 0x49
call fcn.004366c0
lea ecx, [ebp + 0x74]
mov byte [esp + 0x60], 0x4a
call fcn.00406700
lea ecx, [ebp + 0x580]
mov byte [esp + 0x60], 0x4b
call fcn.0043adf0
lea ecx, [ebp + 0x690]
mov byte [esp + 0x60], 0x4c
call fcn.0043adf0
lea ecx, [ebp + 0x7a0]
mov byte [esp + 0x60], 0x4d
call fcn.0043adf0
lea ecx, [ebp + 0x8b0]
mov byte [esp + 0x60], 0x4e
call fcn.0043adf0
lea ecx, [ebp + 0x9c0]
mov byte [esp + 0x60], 0x4f
call fcn.0043adf0
lea edx, [esp + 0x17]
lea edi, [ebp + 0xad8]
lea eax, [esp + 0x16]
push edx
mov dword [ebp + 0xad0], ebx
push eax
mov ecx, edi
mov byte [esp + 0x68], 0x50
mov dword [ebp + 0xad4], ebx
call fcn.00428a00
lea edx, [esp + 0x15]
lea eax, [esp + 0x14]
push edx
lea ecx, [ebp + 0xae8]
push eax
mov byte [esp + 0x68], 0x51
call fcn.00427ff0
lea ecx, [esp + 0x13]
mov byte [esp + 0x60], 0x52
push ecx
lea ecx, [ebp + 0xaf8]
call fcn.004251e0
mov byte [esp + 0x60], 0x53
mov dword [ebp], 0x45451c
lea edx, [esp + 0x3c]
push str.HKEY_CLASSES_ROOT
push edx
mov ecx, edi
mov dword [esp + 0x44], SysReAllocString
call fcn.00428ab0
mov ecx, eax
call fcn.00425f80
lea eax, [esp + 0x38]
push str.HKEY_CURRENT_CONFIG
push eax
mov ecx, edi
mov dword [esp + 0x40], VariantCopyInd
call fcn.00428ab0
mov ecx, eax
call fcn.00425f80
lea ecx, [esp + 0x34]
push str.HKEY_CURRENT_USER
push ecx
mov ecx, edi
mov dword [esp + 0x3c], SysReAllocString
call fcn.00428ab0
mov ecx, eax
call fcn.00425f80
lea edx, [esp + 0x30]
push str.HKEY_LOCAL_MACHINE
push edx
mov ecx, edi
mov dword [esp + 0x38], reloc.OLEAUT32.dll_SysReAllocString
call fcn.00428ab0
mov ecx, eax
call fcn.00425f80
lea eax, [esp + 0x2c]
push str.HKEY_USERS
push eax
mov ecx, edi
mov dword [esp + 0x34], VariantCopyInd
call fcn.00428ab0
mov ecx, eax
call fcn.00425f80
push str.HKEY_CLASSES_ROOT
lea ecx, [esp + 0x2c]
call fcn.00425b80
lea ecx, [esp + 0x28]
lea edi, [ebp + 0xae8]
push ecx
mov ecx, edi
mov byte [esp + 0x64], 0x54
call fcn.004280a0
lea ecx, [esp + 0x28]
mov dword [eax], SysReAllocString
mov byte [esp + 0x60], 0x53
call fcn.00429590
push str.HKEY_CURRENT_CONFIG
lea ecx, [esp + 0x28]
call fcn.00425b80
lea edx, [esp + 0x24]
mov ecx, edi
push edx
mov byte [esp + 0x64], 0x55
call fcn.004280a0
lea ecx, [esp + 0x24]
mov dword [eax], VariantCopyInd
mov byte [esp + 0x60], 0x53
call fcn.00429590
push str.HKEY_CURRENT_USER
lea ecx, [esp + 0x24]
call fcn.00425b80
lea eax, [esp + 0x20]
mov ecx, edi
push eax
mov byte [esp + 0x64], 0x56
call fcn.004280a0
lea ecx, [esp + 0x20]
mov dword [eax], SysReAllocString
mov byte [esp + 0x60], 0x53
call fcn.00429590
push str.HKEY_LOCAL_MACHINE
lea ecx, [esp + 0x20]
call fcn.00425b80
lea ecx, [esp + 0x1c]
mov byte [esp + 0x60], 0x57
push ecx
mov ecx, edi
call fcn.004280a0
lea ecx, [esp + 0x1c]
mov dword [eax], reloc.OLEAUT32.dll_SysReAllocString
mov byte [esp + 0x60], 0x53
call fcn.00429590
push str.HKEY_USERS
lea ecx, [esp + 0x1c]
call fcn.00425b80
lea edx, [esp + 0x18]
mov ecx, edi
push edx
mov byte [esp + 0x64], 0x58
call fcn.004280a0
lea ecx, [esp + 0x18]
mov dword [eax], VariantInit
mov byte [esp + 0x60], 0x53
call fcn.00429590
mov dword [ebp + 0xb08], ebx
lea edi, [esi + 0x3b68]
mov byte [esp + 0x60], 0x59
mov ecx, edi
mov dword [esp + 0x44], edi
call fcn.004066f0
lea ecx, [edi + 0x1c]
mov byte [esp + 0x60], 0x5a
call fcn.00426570
lea ecx, [edi + 0x3c]
mov byte [esp + 0x60], 0x5b
call fcn.00427970
lea ecx, [edi + 0x40]
mov byte [esp + 0x60], 0x5c
call fcn.004366c0
lea ecx, [edi + 0x74]
mov byte [esp + 0x60], 0x5d
call fcn.00406700
lea ecx, [edi + 0x580]
mov byte [esp + 0x60], 0x5e
call fcn.0043adf0
lea ecx, [edi + 0x690]
mov byte [esp + 0x60], 0x5f
call fcn.0043adf0
lea ecx, [edi + 0x7a0]
mov byte [esp + 0x60], 0x60
call fcn.0043adf0
lea ecx, [edi + 0x8b0]
mov byte [esp + 0x60], 0x61
call fcn.0043adf0
lea ecx, [edi + 0x9c0]
mov byte [esp + 0x60], 0x62
call fcn.0043adf0
lea eax, [esp + 0x17]
lea ecx, [esp + 0x16]
lea ebp, [edi + 0xad8]
push eax
push ecx
mov dword [edi + 0xad0], ebx
mov ecx, ebp
mov byte [esp + 0x68], 0x63
mov dword [edi + 0xad4], ebx
call fcn.00428a00
mov byte [esp + 0x60], 0x64
lea edx, [esp + 0x15]
lea eax, [esp + 0x14]
push edx
lea ecx, [edi + 0xae8]
push eax
call fcn.00427ff0
lea ecx, [esp + 0x13]
mov byte [esp + 0x60], 0x65
push ecx
lea ecx, [edi + 0xaf8]
call fcn.004251e0
lea edx, [esp + 0x3c]
push str.HKEY_CLASSES_ROOT
push edx
mov ecx, ebp
mov byte [esp + 0x68], 0x66
mov dword [edi], 0x45451c
mov dword [esp + 0x44], SysReAllocString
call fcn.00428ab0
mov ecx, eax
call fcn.00425f80
lea eax, [esp + 0x38]
push str.HKEY_CURRENT_CONFIG
push eax
mov ecx, ebp
mov dword [esp + 0x40], VariantCopyInd
call fcn.00428ab0
mov ecx, eax
call fcn.00425f80
lea ecx, [esp + 0x34]
push str.HKEY_CURRENT_USER
push ecx
mov ecx, ebp
mov dword [esp + 0x3c], SysReAllocString
call fcn.00428ab0
mov ecx, eax
call fcn.00425f80
lea edx, [esp + 0x30]
push str.HKEY_LOCAL_MACHINE
push edx
mov ecx, ebp
mov dword [esp + 0x38], reloc.OLEAUT32.dll_SysReAllocString
call fcn.00428ab0
mov ecx, eax
call fcn.00425f80
lea eax, [esp + 0x2c]
push str.HKEY_USERS
push eax
mov ecx, ebp
mov dword [esp + 0x34], VariantCopyInd
call fcn.00428ab0
mov ecx, eax
call fcn.00425f80
push str.HKEY_CLASSES_ROOT
lea ecx, [esp + 0x2c]
call fcn.00425b80
lea ecx, [esp + 0x28]
lea ebp, [edi + 0xae8]
push ecx
mov ecx, ebp
mov byte [esp + 0x64], 0x67
call fcn.004280a0
lea ecx, [esp + 0x28]
mov dword [eax], SysReAllocString
mov byte [esp + 0x60], 0x66
call fcn.00429590
push str.HKEY_CURRENT_CONFIG
lea ecx, [esp + 0x28]
call fcn.00425b80
lea edx, [esp + 0x24]
mov ecx, ebp
push edx
mov byte [esp + 0x64], 0x68
call fcn.004280a0
mov dword [eax], VariantCopyInd
mov byte [esp + 0x60], 0x66
lea ecx, [esp + 0x24]
call fcn.00429590
push str.HKEY_CURRENT_USER
lea ecx, [esp + 0x24]
call fcn.00425b80
lea eax, [esp + 0x20]
mov ecx, ebp
push eax
mov byte [esp + 0x64], 0x69
call fcn.004280a0
lea ecx, [esp + 0x20]
mov dword [eax], SysReAllocString
mov byte [esp + 0x60], 0x66
call fcn.00429590
push str.HKEY_LOCAL_MACHINE
lea ecx, [esp + 0x20]
call fcn.00425b80
lea ecx, [esp + 0x1c]
mov byte [esp + 0x60], 0x6a
push ecx
mov ecx, ebp
call fcn.004280a0
lea ecx, [esp + 0x1c]
mov dword [eax], reloc.OLEAUT32.dll_SysReAllocString
mov byte [esp + 0x60], 0x66
call fcn.00429590
push str.HKEY_USERS
lea ecx, [esp + 0x1c]
call fcn.00425b80
lea edx, [esp + 0x18]
mov ecx, ebp
push edx
mov byte [esp + 0x64], 0x6b
call fcn.004280a0
lea ecx, [esp + 0x18]
mov dword [eax], VariantInit
mov byte [esp + 0x60], 0x66
call fcn.00429590
mov dword [edi + 0xb08], ebx
lea edi, [esi + 0x4674]
mov byte [esp + 0x60], 0x6c
mov ecx, edi
mov dword [esp + 0x44], edi
call fcn.004066f0
lea ecx, [edi + 0x1c]
mov byte [esp + 0x60], 0x6d
call fcn.00426570
lea ecx, [edi + 0x3c]
mov byte [esp + 0x60], 0x6e
call fcn.00427970
lea ecx, [edi + 0x40]
mov byte [esp + 0x60], 0x6f
call fcn.004366c0
lea ecx, [edi + 0x74]
mov byte [esp + 0x60], 0x70
call fcn.00406700
lea ecx, [edi + 0x580]
mov byte [esp + 0x60], 0x71
call fcn.0043adf0
lea ecx, [edi + 0x690]
mov byte [esp + 0x60], 0x72
call fcn.0043adf0
lea ecx, [edi + 0x7a0]
mov byte [esp + 0x60], 0x73
call fcn.0043adf0
lea ecx, [edi + 0x8b0]
mov byte [esp + 0x60], 0x74
call fcn.0043adf0
mov byte [esp + 0x60], 0x75
lea ecx, [edi + 0x9c0]
call fcn.0043adf0
lea eax, [esp + 0x17]
lea ecx, [esp + 0x16]
lea ebp, [edi + 0xad8]
push eax
push ecx
mov dword [edi + 0xad0], ebx
mov ecx, ebp
mov byte [esp + 0x68], 0x76
mov dword [edi + 0xad4], ebx
call fcn.00428a00
lea edx, [esp + 0x15]
lea eax, [esp + 0x14]
push edx
lea ecx, [edi + 0xae8]
push eax
mov byte [esp + 0x68], 0x77
call fcn.00427ff0
lea ecx, [esp + 0x13]
mov byte [esp + 0x60], 0x78
push ecx
lea ecx, [edi + 0xaf8]
call fcn.004251e0
lea edx, [esp + 0x3c]
push str.HKEY_CLASSES_ROOT
push edx
mov ecx, ebp
mov byte [esp + 0x68], 0x79
mov dword [edi], 0x45451c
mov dword [esp + 0x44], SysReAllocString
call fcn.00428ab0
mov ecx, eax
call fcn.00425f80
lea eax, [esp + 0x38]
push str.HKEY_CURRENT_CONFIG
push eax
mov ecx, ebp
mov dword [esp + 0x40], VariantCopyInd
call fcn.00428ab0
mov ecx, eax
call fcn.00425f80
lea ecx, [esp + 0x34]
push str.HKEY_CURRENT_USER
push ecx
mov ecx, ebp
mov dword [esp + 0x3c], SysReAllocString
call fcn.00428ab0
mov ecx, eax
call fcn.00425f80
lea edx, [esp + 0x30]
push str.HKEY_LOCAL_MACHINE
push edx
mov ecx, ebp
mov dword [esp + 0x38], reloc.OLEAUT32.dll_SysReAllocString
call fcn.00428ab0
mov ecx, eax
call fcn.00425f80
lea eax, [esp + 0x2c]
push str.HKEY_USERS
push eax
mov ecx, ebp
mov dword [esp + 0x34], VariantCopyInd
call fcn.00428ab0
mov ecx, eax
call fcn.00425f80
push str.HKEY_CLASSES_ROOT
lea ecx, [esp + 0x2c]
call fcn.00425b80
lea ecx, [esp + 0x28]
lea ebp, [edi + 0xae8]
push ecx
mov ecx, ebp
mov byte [esp + 0x64], 0x7a
call fcn.004280a0
mov dword [eax], SysReAllocString
lea ecx, [esp + 0x28]
mov byte [esp + 0x60], 0x79
call fcn.00429590
push str.HKEY_CURRENT_CONFIG
lea ecx, [esp + 0x28]
call fcn.00425b80
lea edx, [esp + 0x24]
mov ecx, ebp
push edx
mov byte [esp + 0x64], 0x7b
call fcn.004280a0
lea ecx, [esp + 0x24]
mov dword [eax], VariantCopyInd
mov byte [esp + 0x60], 0x79
call fcn.00429590
push str.HKEY_CURRENT_USER
lea ecx, [esp + 0x24]
call fcn.00425b80
lea eax, [esp + 0x20]
mov ecx, ebp
push eax
mov byte [esp + 0x64], 0x7c
call fcn.004280a0
lea ecx, [esp + 0x20]
mov dword [eax], SysReAllocString
mov byte [esp + 0x60], 0x79
call fcn.00429590
push str.HKEY_LOCAL_MACHINE
lea ecx, [esp + 0x20]
call fcn.00425b80
lea ecx, [esp + 0x1c]
mov byte [esp + 0x60], 0x7d
push ecx
mov ecx, ebp
call fcn.004280a0
lea ecx, [esp + 0x1c]
mov dword [eax], reloc.OLEAUT32.dll_SysReAllocString
mov byte [esp + 0x60], 0x79
call fcn.00429590
push str.HKEY_USERS
lea ecx, [esp + 0x1c]
call fcn.00425b80
lea edx, [esp + 0x18]
mov ecx, ebp
push edx
mov byte [esp + 0x64], 0x7e
call fcn.004280a0
lea ecx, [esp + 0x18]
mov dword [eax], VariantInit
mov byte [esp + 0x60], 0x79
call fcn.00429590
mov dword [edi + 0xb08], ebx
lea edi, [esi + 0x5180]
mov byte [esp + 0x60], 0x7f
mov ecx, edi
mov dword [esp + 0x44], edi
call fcn.004066f0
lea ecx, [edi + 0x1c]
mov byte [esp + 0x60], 0x80
call fcn.00426570
lea ecx, [edi + 0x3c]
mov byte [esp + 0x60], 0x81
call fcn.00427970
lea ecx, [edi + 0x40]
mov byte [esp + 0x60], 0x82
call fcn.004366c0
lea ecx, [edi + 0x74]
mov byte [esp + 0x60], 0x83
call fcn.00406700
mov byte [esp + 0x60], 0x84
lea ecx, [edi + 0x580]
call fcn.0043adf0
lea ecx, [edi + 0x690]
mov byte [esp + 0x60], 0x85
call fcn.0043adf0
lea ecx, [edi + 0x7a0]
mov byte [esp + 0x60], 0x86
call fcn.0043adf0
lea ecx, [edi + 0x8b0]
mov byte [esp + 0x60], 0x87
call fcn.0043adf0
lea ecx, [edi + 0x9c0]
mov byte [esp + 0x60], 0x88
call fcn.0043adf0
lea eax, [esp + 0x17]
lea ecx, [esp + 0x16]
lea ebp, [edi + 0xad8]
push eax
push ecx
mov dword [edi + 0xad0], ebx
mov ecx, ebp
mov byte [esp + 0x68], 0x89
mov dword [edi + 0xad4], ebx
call fcn.00428a00
lea edx, [esp + 0x15]
lea eax, [esp + 0x14]
push edx
lea ecx, [edi + 0xae8]
push eax
mov byte [esp + 0x68], 0x8a
call fcn.00427ff0
lea ecx, [esp + 0x13]
mov byte [esp + 0x60], 0x8b
push ecx
lea ecx, [edi + 0xaf8]
call fcn.004251e0
lea edx, [esp + 0x3c]
push str.HKEY_CLASSES_ROOT
push edx
mov ecx, ebp
mov byte [esp + 0x68], 0x8c
mov dword [edi], 0x45451c
mov dword [esp + 0x44], SysReAllocString
call fcn.00428ab0
mov ecx, eax
call fcn.00425f80
lea eax, [esp + 0x38]
push str.HKEY_CURRENT_CONFIG
push eax
mov ecx, ebp
mov dword [esp + 0x40], VariantCopyInd
call fcn.00428ab0
mov ecx, eax
call fcn.00425f80
lea ecx, [esp + 0x34]
push str.HKEY_CURRENT_USER
push ecx
mov ecx, ebp
mov dword [esp + 0x3c], SysReAllocString
call fcn.00428ab0
mov ecx, eax
call fcn.00425f80
lea edx, [esp + 0x30]
push str.HKEY_LOCAL_MACHINE
push edx
mov ecx, ebp
mov dword [esp + 0x38], reloc.OLEAUT32.dll_SysReAllocString
call fcn.00428ab0
mov ecx, eax
call fcn.00425f80
lea eax, [esp + 0x2c]
push str.HKEY_USERS
mov dword [esp + 0x30], VariantCopyInd
push eax
mov ecx, ebp
call fcn.00428ab0
mov ecx, eax
call fcn.00425f80
push str.HKEY_CLASSES_ROOT
lea ecx, [esp + 0x2c]
call fcn.00425b80
lea ecx, [esp + 0x28]
lea ebp, [edi + 0xae8]
push ecx
mov ecx, ebp
mov byte [esp + 0x64], 0x8d
call fcn.004280a0
lea ecx, [esp + 0x28]
mov dword [eax], SysReAllocString
mov byte [esp + 0x60], 0x8c
call fcn.00429590
push str.HKEY_CURRENT_CONFIG
lea ecx, [esp + 0x28]
call fcn.00425b80
lea edx, [esp + 0x24]
mov ecx, ebp
push edx
mov byte [esp + 0x64], 0x8e
call fcn.004280a0
lea ecx, [esp + 0x24]
mov dword [eax], VariantCopyInd
mov byte [esp + 0x60], 0x8c
call fcn.00429590
push str.HKEY_CURRENT_USER
lea ecx, [esp + 0x24]
call fcn.00425b80
lea eax, [esp + 0x20]
mov ecx, ebp
push eax
mov byte [esp + 0x64], 0x8f
call fcn.004280a0
lea ecx, [esp + 0x20]
mov dword [eax], SysReAllocString
mov byte [esp + 0x60], 0x8c
call fcn.00429590
push str.HKEY_LOCAL_MACHINE
lea ecx, [esp + 0x20]
call fcn.00425b80
lea ecx, [esp + 0x1c]
mov byte [esp + 0x60], 0x90
push ecx
mov ecx, ebp
call fcn.004280a0
lea ecx, [esp + 0x1c]
mov dword [eax], reloc.OLEAUT32.dll_SysReAllocString
mov byte [esp + 0x60], 0x8c
call fcn.00429590
push str.HKEY_USERS
lea ecx, [esp + 0x1c]
call fcn.00425b80
lea edx, [esp + 0x18]
mov ecx, ebp
push edx
mov byte [esp + 0x64], 0x91
call fcn.004280a0
lea ecx, [esp + 0x18]
mov dword [eax], VariantInit
mov byte [esp + 0x60], 0x8c
call fcn.00429590
mov dword [edi + 0xb08], ebx
lea edi, [esi + 0x5c8c]
mov byte [esp + 0x60], 0x92
mov ecx, edi
call fcn.00419480
lea ebp, [esi + 0x6798]
mov byte [esp + 0x60], 0x93
mov ecx, ebp
call fcn.00419480
lea ecx, [esi + 0x72a4]
mov byte [esp + 0x60], 0x94
call fcn.00419480
lea ecx, [esi + 0x7db0]
mov byte [esp + 0x60], 0x95
call fcn.00419480
lea ecx, [esi + 0x88bc]
mov byte [esp + 0x60], 0x96
call fcn.00406f80
lea ecx, [esi + 0x93b8]
mov byte [esp + 0x60], 0x97
call fcn.00406f80
lea ecx, [esi + 0x9eb4]
mov byte [esp + 0x60], 0x98
call fcn.00406f80
lea ecx, [esi + 0xa9b0]
mov byte [esp + 0x60], 0x99
call fcn.00406f80
lea ecx, [esi + 0xb4ac]
mov byte [esp + 0x60], 0x9a
call fcn.004399f0
mov dword [esi + 0xb4ac], 0x454510
lea eax, [esp + 0x17]
lea ecx, [esp + 0x48]
push eax
mov byte [esp + 0x64], 0x9b
mov dword [esi], 0x454504
mov dword [esi + 0x1c], 0x454500
mov dword [esi + 0x20], 0x4544fc
mov dword [esi + 0xb4cc], ebx
call fcn.004251e0
mov bl, 0x9c
lea ecx, [esp + 0x48]
mov byte [esp + 0x60], bl
call fcn.00424c90
push ecx
mov ecx, esp
mov dword [esp + 0x48], esp
push str.Common_Startup
call fcn.00425b80
push ecx
mov byte [esp + 0x68], 0x9d
mov ecx, esp
mov dword [esp + 0x40], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.00425b80
lea ecx, [esp + 0x44]
push reloc.OLEAUT32.dll_SysReAllocString
push ecx
mov byte [esp + 0x70], bl
call fcn.0042c2b0
add esp, 0x10
mov edx, dword [esp + 0x50]
push eax
push edx
lea ecx, [esp + 0x50]
mov byte [esp + 0x68], 0x9e
call fcn.0042b2a0
lea ecx, [esp + 0x3c]
mov byte [esp + 0x60], bl
call fcn.00429590
push ecx
mov ecx, esp
mov dword [esp + 0x48], esp
push str.Startup
call fcn.00425b80
push ecx
mov byte [esp + 0x68], 0x9f
mov ecx, esp
mov dword [esp + 0x40], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.00425b80
lea eax, [esp + 0x44]
push SysReAllocString
push eax
mov byte [esp + 0x70], bl
call fcn.0042c2b0
add esp, 0x10
mov ecx, dword [esp + 0x50]
push eax
push ecx
lea ecx, [esp + 0x50]
mov byte [esp + 0x68], 0xa0
call fcn.0042b2a0
lea ecx, [esp + 0x3c]
mov byte [esp + 0x60], bl
call fcn.00429590
lea edx, [esp + 0x48]
lea ecx, [esi + 0xf64]
push edx
call fcn.00424aa0
lea ecx, [esp + 0x48]
call fcn.00424c90
push ecx
mov ecx, esp
mov dword [esp + 0x48], esp
push str.Common_Startup
call fcn.00425b80
push ecx
mov byte [esp + 0x68], 0xa1
mov ecx, esp
mov dword [esp + 0x40], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.00425b80
lea eax, [esp + 0x44]
push reloc.OLEAUT32.dll_SysReAllocString
push eax
mov byte [esp + 0x70], bl
call fcn.0042c2b0
add esp, 0x10
mov ecx, dword [esp + 0x50]
push eax
push ecx
lea ecx, [esp + 0x50]
mov byte [esp + 0x68], 0xa2
call fcn.0042b2a0
lea ecx, [esp + 0x3c]
mov byte [esp + 0x60], bl
call fcn.00429590
lea edx, [esp + 0x48]
lea ecx, [esi + 0x1a50]
push edx
call fcn.00424aa0
lea ecx, [esp + 0x48]
call fcn.00424c90
push ecx
mov ecx, esp
mov dword [esp + 0x48], esp
push str.Startup
call fcn.00425b80
push ecx
mov byte [esp + 0x68], 0xa3
mov ecx, esp
mov dword [esp + 0x40], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.00425b80
lea eax, [esp + 0x44]
push SysReAllocString
push eax
mov byte [esp + 0x70], bl
call fcn.0042c2b0
add esp, 0x10
mov ecx, dword [esp + 0x50]
mov byte [esp + 0x60], 0xa4
push eax
push ecx
lea ecx, [esp + 0x50]
call fcn.0042b2a0
lea ecx, [esp + 0x3c]
mov byte [esp + 0x60], bl
call fcn.00429590
lea edx, [esp + 0x48]
lea ecx, [esi + 0x253c]
push edx
call fcn.00424aa0
lea ecx, [esp + 0x48]
call fcn.00424c90
push str.HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun
lea ecx, [esp + 0x2c]
call fcn.00425b80
mov ecx, dword [esp + 0x50]
lea eax, [esp + 0x28]
push eax
push ecx
lea ecx, [esp + 0x50]
mov byte [esp + 0x68], 0xa5
call fcn.0042b2a0
lea ecx, [esp + 0x28]
mov byte [esp + 0x60], bl
call fcn.00429590
push str.HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunOnce
lea ecx, [esp + 0x2c]
call fcn.00425b80
mov eax, dword [esp + 0x50]
lea edx, [esp + 0x28]
push edx
push eax
lea ecx, [esp + 0x50]
mov byte [esp + 0x68], 0xa6
call fcn.0042b2a0
lea ecx, [esp + 0x28]
mov byte [esp + 0x60], bl
call fcn.00429590
push str.HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunServices
lea ecx, [esp + 0x2c]
call fcn.00425b80
mov edx, dword [esp + 0x50]
lea ecx, [esp + 0x28]
push ecx
push edx
lea ecx, [esp + 0x50]
mov byte [esp + 0x68], 0xa7
call fcn.0042b2a0
lea ecx, [esp + 0x28]
mov byte [esp + 0x60], bl
call fcn.00429590
push str.HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunServicesOnce
lea ecx, [esp + 0x2c]
call fcn.00425b80
mov ecx, dword [esp + 0x50]
lea eax, [esp + 0x28]
push eax
push ecx
lea ecx, [esp + 0x50]
mov byte [esp + 0x68], 0xa8
call fcn.0042b2a0
lea ecx, [esp + 0x28]
mov byte [esp + 0x60], bl
call fcn.00429590
push str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun
lea ecx, [esp + 0x2c]
call fcn.00425b80
mov eax, dword [esp + 0x50]
lea edx, [esp + 0x28]
push edx
push eax
lea ecx, [esp + 0x50]
mov byte [esp + 0x68], 0xa9
call fcn.0042b2a0
mov byte [esp + 0x60], bl
lea ecx, [esp + 0x28]
call fcn.00429590
push str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunOnce
lea ecx, [esp + 0x2c]
call fcn.00425b80
mov edx, dword [esp + 0x50]
lea ecx, [esp + 0x28]
push ecx
push edx
lea ecx, [esp + 0x50]
mov byte [esp + 0x68], 0xaa
call fcn.0042b2a0
lea ecx, [esp + 0x28]
mov byte [esp + 0x60], bl
call fcn.00429590
sub esp, 0x10
lea eax, [esp + 0x58]
mov ecx, esp
mov dword [esp + 0x54], esp
push eax
call fcn.004249d0
lea ecx, [esi + 0x2550]
call fcn.004192a0
lea ecx, [esp + 0x48]
call fcn.00424c90
push str.HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun
lea ecx, [esp + 0x2c]
call fcn.00425b80
mov edx, dword [esp + 0x50]
lea ecx, [esp + 0x28]
push ecx
push edx
lea ecx, [esp + 0x50]
mov byte [esp + 0x68], 0xab
call fcn.0042b2a0
lea ecx, [esp + 0x28]
mov byte [esp + 0x60], bl
call fcn.00429590
push str.HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunOnce
lea ecx, [esp + 0x2c]
call fcn.00425b80
mov ecx, dword [esp + 0x50]
lea eax, [esp + 0x28]
push eax
push ecx
lea ecx, [esp + 0x50]
mov byte [esp + 0x68], 0xac
call fcn.0042b2a0
lea ecx, [esp + 0x28]
mov byte [esp + 0x60], bl
call fcn.00429590
push str.HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunServices
lea ecx, [esp + 0x2c]
call fcn.00425b80
mov eax, dword [esp + 0x50]
lea edx, [esp + 0x28]
push edx
push eax
lea ecx, [esp + 0x50]
mov byte [esp + 0x68], 0xad
call fcn.0042b2a0
lea ecx, [esp + 0x28]
mov byte [esp + 0x60], bl
call fcn.00429590
push str.HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunServicesOnce
lea ecx, [esp + 0x2c]
call fcn.00425b80
mov edx, dword [esp + 0x50]
lea ecx, [esp + 0x28]
push ecx
push edx
lea ecx, [esp + 0x50]
mov byte [esp + 0x68], 0xae
call fcn.0042b2a0
lea ecx, [esp + 0x28]
mov byte [esp + 0x60], bl
call fcn.00429590
sub esp, 0x10
lea eax, [esp + 0x58]
mov ecx, esp
mov dword [esp + 0x54], esp
push eax
call fcn.004249d0
lea ecx, [esi + 0x305c]
call fcn.004192a0
lea ecx, [esp + 0x48]
call fcn.00424c90
push str.HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun
lea ecx, [esp + 0x2c]
call fcn.00425b80
mov edx, dword [esp + 0x50]
lea ecx, [esp + 0x28]
push ecx
push edx
lea ecx, [esp + 0x50]
mov byte [esp + 0x68], 0xaf
call fcn.0042b2a0
lea ecx, [esp + 0x28]
mov byte [esp + 0x60], bl
call fcn.00429590
sub esp, 0x10
lea eax, [esp + 0x58]
mov ecx, esp
mov dword [esp + 0x54], esp
push eax
call fcn.004249d0
lea ecx, [esi + 0x3b68]
call fcn.004192a0
lea ecx, [esp + 0x48]
call fcn.00424c90
push str.HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunOnce
lea ecx, [esp + 0x2c]
call fcn.00425b80
mov edx, dword [esp + 0x50]
lea ecx, [esp + 0x28]
push ecx
push edx
lea ecx, [esp + 0x50]
mov byte [esp + 0x68], 0xb0
call fcn.0042b2a0
lea ecx, [esp + 0x28]
mov byte [esp + 0x60], bl
call fcn.00429590
sub esp, 0x10
lea eax, [esp + 0x58]
mov ecx, esp
mov dword [esp + 0x54], esp
push eax
call fcn.004249d0
lea ecx, [esi + 0x4674]
call fcn.004192a0
lea ecx, [esp + 0x48]
call fcn.00424c90
push str.HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunServices
lea ecx, [esp + 0x2c]
call fcn.00425b80
mov edx, dword [esp + 0x50]
lea ecx, [esp + 0x28]
push ecx
push edx
lea ecx, [esp + 0x50]
mov byte [esp + 0x68], 0xb1
call fcn.0042b2a0
lea ecx, [esp + 0x28]
mov byte [esp + 0x60], bl
call fcn.00429590
sub esp, 0x10
lea eax, [esp + 0x58]
mov ecx, esp
mov dword [esp + 0x54], esp
push eax
call fcn.004249d0
lea ecx, [esi + 0x5180]
call fcn.004192a0
lea ecx, [esp + 0x48]
call fcn.00424c90
push str.HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunServicesOnce
lea ecx, [esp + 0x2c]
call fcn.00425b80
mov edx, dword [esp + 0x50]
lea ecx, [esp + 0x28]
push ecx
push edx
lea ecx, [esp + 0x50]
mov byte [esp + 0x68], 0xb2
call fcn.0042b2a0
lea ecx, [esp + 0x28]
mov byte [esp + 0x60], bl
call fcn.00429590
sub esp, 0x10
lea eax, [esp + 0x58]
mov ecx, esp
mov dword [esp + 0x54], esp
push eax
call fcn.004249d0
mov ecx, edi
call fcn.004192a0
lea ecx, [esp + 0x48]
call fcn.00424c90
push str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun
lea ecx, [esp + 0x2c]
call fcn.00425b80
mov edx, dword [esp + 0x50]
lea ecx, [esp + 0x28]
push ecx
push edx
lea ecx, [esp + 0x50]
mov byte [esp + 0x68], 0xb3
call fcn.0042b2a0
lea ecx, [esp + 0x28]
mov byte [esp + 0x60], bl
call fcn.00429590
push str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunOnce
lea ecx, [esp + 0x2c]
call fcn.00425b80
mov ecx, dword [esp + 0x50]
lea eax, [esp + 0x28]
push eax
push ecx
lea ecx, [esp + 0x50]
mov byte [esp + 0x68], 0xb4
call fcn.0042b2a0
lea ecx, [esp + 0x28]
mov byte [esp + 0x60], bl
call fcn.00429590
sub esp, 0x10
lea edx, [esp + 0x58]
mov ecx, esp
mov dword [esp + 0x54], esp
push edx
call fcn.004249d0
mov ecx, ebp
call fcn.004192a0
lea ecx, [esp + 0x48]
call fcn.00424c90
push str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun
lea ecx, [esp + 0x2c]
call fcn.00425b80
mov ecx, dword [esp + 0x50]
lea eax, [esp + 0x28]
push eax
push ecx
lea ecx, [esp + 0x50]
mov byte [esp + 0x68], 0xb5
call fcn.0042b2a0
lea ecx, [esp + 0x28]
mov byte [esp + 0x60], bl
call fcn.00429590
sub esp, 0x10
lea edx, [esp + 0x58]
mov ecx, esp
mov dword [esp + 0x54], esp
push edx
call fcn.004249d0
lea ecx, [esi + 0x72a4]
call fcn.004192a0
lea ecx, [esp + 0x48]
call fcn.00424c90
push str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunOnce
lea ecx, [esp + 0x2c]
call fcn.00425b80
mov ecx, dword [esp + 0x50]
lea eax, [esp + 0x28]
push eax
push ecx
lea ecx, [esp + 0x50]
mov byte [esp + 0x68], 0xb6
call fcn.0042b2a0
lea ecx, [esp + 0x28]
mov byte [esp + 0x60], bl
call fcn.00429590
sub esp, 0x10
lea edx, [esp + 0x58]
mov ecx, esp
mov dword [esp + 0x54], esp
push edx
call fcn.004249d0
lea ecx, [esi + 0x7db0]
call fcn.004192a0
lea ecx, [esp + 0x48]
call fcn.00424c90
push str.HKEY_CURRENT_USERSoftwareMicrosoftWindows_NTCurrentVersionWindowsLoad
lea ecx, [esp + 0x2c]
call fcn.00425b80
mov ecx, dword [esp + 0x50]
lea eax, [esp + 0x28]
push eax
push ecx
lea ecx, [esp + 0x50]
mov byte [esp + 0x68], 0xb7
call fcn.0042b2a0
lea ecx, [esp + 0x28]
mov byte [esp + 0x60], bl
call fcn.00429590
push str.HKEY_CURRENT_USERSoftwareMicrosoftWindows_NTCurrentVersionWindowsRun
lea ecx, [esp + 0x2c]
call fcn.00425b80
mov eax, dword [esp + 0x50]
lea edx, [esp + 0x28]
push edx
push eax
lea ecx, [esp + 0x50]
mov byte [esp + 0x68], 0xb8
call fcn.0042b2a0
lea ecx, [esp + 0x28]
mov byte [esp + 0x60], bl
call fcn.00429590
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esi + 0x9394]
call fcn.00424aa0
lea ecx, [esp + 0x48]
call fcn.00424c90
push str.HKEY_CURRENT_USERSoftwareMicrosoftWindows_NTCurrentVersionWindowsLoad
lea ecx, [esp + 0x2c]
call fcn.00425b80
mov eax, dword [esp + 0x50]
lea edx, [esp + 0x28]
push edx
push eax
lea ecx, [esp + 0x50]
mov byte [esp + 0x68], 0xb9
call fcn.0042b2a0
lea ecx, [esp + 0x28]
mov byte [esp + 0x60], bl
call fcn.00429590
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esi + 0x9e90]
call fcn.00424aa0
lea ecx, [esp + 0x48]
call fcn.00424c90
push str.HKEY_CURRENT_USERSoftwareMicrosoftWindows_NTCurrentVersionWindowsRun
lea ecx, [esp + 0x2c]
call fcn.00425b80
mov eax, dword [esp + 0x50]
lea edx, [esp + 0x28]
push edx
push eax
lea ecx, [esp + 0x50]
mov byte [esp + 0x68], 0xba
call fcn.0042b2a0
lea ecx, [esp + 0x28]
mov byte [esp + 0x60], bl
call fcn.00429590
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esi + 0xa98c]
call fcn.00424aa0
lea ecx, [esp + 0x48]
call fcn.00424c90
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionWinlogonUserinit
lea ecx, [esp + 0x2c]
call fcn.00425b80
mov eax, dword [esp + 0x50]
lea edx, [esp + 0x28]
push edx
push eax
lea ecx, [esp + 0x50]
mov byte [esp + 0x68], 0xbb
call fcn.0042b2a0
lea ecx, [esp + 0x28]
mov byte [esp + 0x60], bl
call fcn.00429590
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esi + 0xb488]
call fcn.00424aa0
lea ecx, [esp + 0x48]
mov byte [esp + 0x60], 0x9b
call fcn.00424a40
mov ecx, dword [esp + 0x58]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x54
ret