Function at 0x1002df60
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1009a2d0
mov eax, dword fs:[0]
push eax
sub esp, 0x78
push ebx
push esi
push edi
mov eax, dword [0x100e6018]
xor eax, esp
push eax
lea eax, [esp + 0x88]
mov dword fs:[0], eax
mov edi, ecx
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x20]
call sym.iImportLib.dll_public:_void___thiscall_elex::reg::RegPath::constructor_struct_HKEY_____wchar_t_const___bool_
mov ebx, dword [ebp + 8]
push ebx
push eax
mov ecx, edi
mov dword [esp + 0x98], 0
call sym.iImportLib.dll_private:_bool___thiscall_elex::StartupAppEnumerator::EnumStartupReg_class_elex::reg::RegPath_const___class_std::vector_struct_elex::RegStartupAppInfo___class_std::allocator_struct_elex::RegStartupAppInfo_____
mov dword [esp + 0x90], 0xffffffff
cmp dword [esp + 0x48], 8
mov esi, dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
jb 0x1002dfde
push dword [esp + 0x34]
call esi
add esp, 4
xor eax, eax
cmp dword [esp + 0x2c], 8
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
mov word [esp + 0x34], ax
jb 0x1002e005
push dword [esp + 0x18]
call esi
add esp, 4
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServicesOnce
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x20]
call sym.iImportLib.dll_public:_void___thiscall_elex::reg::RegPath::constructor_struct_HKEY_____wchar_t_const___bool_
push ebx
push eax
mov ecx, edi
mov dword [esp + 0x98], 1
call sym.iImportLib.dll_private:_bool___thiscall_elex::StartupAppEnumerator::EnumStartupReg_class_elex::reg::RegPath_const___class_std::vector_struct_elex::RegStartupAppInfo___class_std::allocator_struct_elex::RegStartupAppInfo_____
mov dword [esp + 0x90], 0xffffffff
cmp dword [esp + 0x48], 8
jb 0x1002e049
push dword [esp + 0x34]
call esi
add esp, 4
xor eax, eax
cmp dword [esp + 0x2c], 8
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
mov word [esp + 0x34], ax
jb 0x1002e070
push dword [esp + 0x18]
call esi
add esp, 4
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x20]
call sym.iImportLib.dll_public:_void___thiscall_elex::reg::RegPath::constructor_struct_HKEY_____wchar_t_const___bool_
push ebx
push eax
mov ecx, edi
mov dword [esp + 0x98], 2
call sym.iImportLib.dll_private:_bool___thiscall_elex::StartupAppEnumerator::EnumStartupReg_class_elex::reg::RegPath_const___class_std::vector_struct_elex::RegStartupAppInfo___class_std::allocator_struct_elex::RegStartupAppInfo_____
mov dword [esp + 0x90], 0xffffffff
cmp dword [esp + 0x48], 8
jb 0x1002e0b4
push dword [esp + 0x34]
call esi
add esp, 4
xor eax, eax
cmp dword [esp + 0x2c], 8
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
mov word [esp + 0x34], ax
jb 0x1002e0db
push dword [esp + 0x18]
call esi
add esp, 4
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x20]
call sym.iImportLib.dll_public:_void___thiscall_elex::reg::RegPath::constructor_struct_HKEY_____wchar_t_const___bool_
push ebx
push eax
mov ecx, edi
mov dword [esp + 0x98], 3
call sym.iImportLib.dll_private:_bool___thiscall_elex::StartupAppEnumerator::EnumStartupReg_class_elex::reg::RegPath_const___class_std::vector_struct_elex::RegStartupAppInfo___class_std::allocator_struct_elex::RegStartupAppInfo_____
mov dword [esp + 0x90], 0xffffffff
cmp dword [esp + 0x48], 8
jb 0x1002e11f
push dword [esp + 0x34]
call esi
add esp, 4
xor eax, eax
cmp dword [esp + 0x2c], 8
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
mov word [esp + 0x34], ax
jb 0x1002e146
push dword [esp + 0x18]
call esi
add esp, 4
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceSetup
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x20]
call sym.iImportLib.dll_public:_void___thiscall_elex::reg::RegPath::constructor_struct_HKEY_____wchar_t_const___bool_
push ebx
push eax
mov ecx, edi
mov dword [esp + 0x98], 4
call sym.iImportLib.dll_private:_bool___thiscall_elex::StartupAppEnumerator::EnumStartupReg_class_elex::reg::RegPath_const___class_std::vector_struct_elex::RegStartupAppInfo___class_std::allocator_struct_elex::RegStartupAppInfo_____
mov dword [esp + 0x90], 0xffffffff
cmp dword [esp + 0x48], 8
jb 0x1002e18a
push dword [esp + 0x34]
call esi
add esp, 4
xor eax, eax
cmp dword [esp + 0x2c], 8
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
mov word [esp + 0x34], ax
jb 0x1002e1b1
push dword [esp + 0x18]
call esi
add esp, 4
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x20]
call sym.iImportLib.dll_public:_void___thiscall_elex::reg::RegPath::constructor_struct_HKEY_____wchar_t_const___bool_
push ebx
push eax
mov ecx, edi
mov dword [esp + 0x98], 5
call sym.iImportLib.dll_private:_bool___thiscall_elex::StartupAppEnumerator::EnumStartupReg_class_elex::reg::RegPath_const___class_std::vector_struct_elex::RegStartupAppInfo___class_std::allocator_struct_elex::RegStartupAppInfo_____
mov dword [esp + 0x90], 0xffffffff
cmp dword [esp + 0x48], 8
jb 0x1002e1f5
push dword [esp + 0x34]
call esi
add esp, 4
xor eax, eax
cmp dword [esp + 0x2c], 8
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
mov word [esp + 0x34], ax
jb 0x1002e21c
push dword [esp + 0x18]
call esi
add esp, 4
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunEx
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x20]
call sym.iImportLib.dll_public:_void___thiscall_elex::reg::RegPath::constructor_struct_HKEY_____wchar_t_const___bool_
push ebx
push eax
mov ecx, edi
mov dword [esp + 0x98], 6
call sym.iImportLib.dll_private:_bool___thiscall_elex::StartupAppEnumerator::EnumStartupReg_class_elex::reg::RegPath_const___class_std::vector_struct_elex::RegStartupAppInfo___class_std::allocator_struct_elex::RegStartupAppInfo_____
mov dword [esp + 0x90], 0xffffffff
cmp dword [esp + 0x48], 8
jb 0x1002e260
push dword [esp + 0x34]
call esi
add esp, 4
xor eax, eax
cmp dword [esp + 0x2c], 8
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
mov word [esp + 0x34], ax
jb 0x1002e287
push dword [esp + 0x18]
call esi
add esp, 4
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x20]
call sym.iImportLib.dll_public:_void___thiscall_elex::reg::RegPath::constructor_struct_HKEY_____wchar_t_const___bool_
push ebx
push eax
mov ecx, edi
mov dword [esp + 0x98], 7
call sym.iImportLib.dll_private:_bool___thiscall_elex::StartupAppEnumerator::EnumStartupReg_class_elex::reg::RegPath_const___class_std::vector_struct_elex::RegStartupAppInfo___class_std::allocator_struct_elex::RegStartupAppInfo_____
mov dword [esp + 0x90], 0xffffffff
cmp dword [esp + 0x48], 8
jb 0x1002e2cb
push dword [esp + 0x34]
call esi
add esp, 4
xor eax, eax
cmp dword [esp + 0x2c], 8
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
mov word [esp + 0x34], ax
jb 0x1002e2f2
push dword [esp + 0x18]
call esi
add esp, 4
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun
push SysReAllocString
lea ecx, [esp + 0x20]
call sym.iImportLib.dll_public:_void___thiscall_elex::reg::RegPath::constructor_struct_HKEY_____wchar_t_const___bool_
push ebx
push eax
mov ecx, edi
mov dword [esp + 0x98], 8
call sym.iImportLib.dll_private:_bool___thiscall_elex::StartupAppEnumerator::EnumStartupReg_class_elex::reg::RegPath_const___class_std::vector_struct_elex::RegStartupAppInfo___class_std::allocator_struct_elex::RegStartupAppInfo_____
mov dword [esp + 0x90], 0xffffffff
cmp dword [esp + 0x48], 8
jb 0x1002e336
push dword [esp + 0x34]
call esi
add esp, 4
xor eax, eax
cmp dword [esp + 0x2c], 8
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
mov word [esp + 0x34], ax
jb 0x1002e35d
push dword [esp + 0x18]
call esi
add esp, 4
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServicesOnce
push SysReAllocString
lea ecx, [esp + 0x20]
call sym.iImportLib.dll_public:_void___thiscall_elex::reg::RegPath::constructor_struct_HKEY_____wchar_t_const___bool_
push ebx
push eax
mov ecx, edi
mov dword [esp + 0x98], 9
call sym.iImportLib.dll_private:_bool___thiscall_elex::StartupAppEnumerator::EnumStartupReg_class_elex::reg::RegPath_const___class_std::vector_struct_elex::RegStartupAppInfo___class_std::allocator_struct_elex::RegStartupAppInfo_____
mov dword [esp + 0x90], 0xffffffff
cmp dword [esp + 0x48], 8
jb 0x1002e3a1
push dword [esp + 0x34]
call esi
add esp, 4
xor eax, eax
cmp dword [esp + 0x2c], 8
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
mov word [esp + 0x34], ax
jb 0x1002e3c8
push dword [esp + 0x18]
call esi
add esp, 4
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
push SysReAllocString
lea ecx, [esp + 0x20]
call sym.iImportLib.dll_public:_void___thiscall_elex::reg::RegPath::constructor_struct_HKEY_____wchar_t_const___bool_
push ebx
push eax
mov ecx, edi
mov dword [esp + 0x98], 0xa
call sym.iImportLib.dll_private:_bool___thiscall_elex::StartupAppEnumerator::EnumStartupReg_class_elex::reg::RegPath_const___class_std::vector_struct_elex::RegStartupAppInfo___class_std::allocator_struct_elex::RegStartupAppInfo_____
mov dword [esp + 0x90], 0xffffffff
cmp dword [esp + 0x48], 8
jb 0x1002e40c
push dword [esp + 0x34]
call esi
add esp, 4
xor eax, eax
cmp dword [esp + 0x2c], 8
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
mov word [esp + 0x34], ax
jb 0x1002e433
push dword [esp + 0x18]
call esi
add esp, 4
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
push SysReAllocString
lea ecx, [esp + 0x20]
call sym.iImportLib.dll_public:_void___thiscall_elex::reg::RegPath::constructor_struct_HKEY_____wchar_t_const___bool_
push ebx
push eax
mov ecx, edi
mov dword [esp + 0x98], 0xb
call sym.iImportLib.dll_private:_bool___thiscall_elex::StartupAppEnumerator::EnumStartupReg_class_elex::reg::RegPath_const___class_std::vector_struct_elex::RegStartupAppInfo___class_std::allocator_struct_elex::RegStartupAppInfo_____
mov dword [esp + 0x90], 0xffffffff
cmp dword [esp + 0x48], 8
jb 0x1002e477
push dword [esp + 0x34]
call esi
add esp, 4
xor eax, eax
cmp dword [esp + 0x2c], 8
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
mov word [esp + 0x34], ax
jb 0x1002e49e
push dword [esp + 0x18]
call esi
add esp, 4
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceSetup
push SysReAllocString
lea ecx, [esp + 0x20]
call sym.iImportLib.dll_public:_void___thiscall_elex::reg::RegPath::constructor_struct_HKEY_____wchar_t_const___bool_
push ebx
push eax
mov ecx, edi
mov dword [esp + 0x98], 0xc
call sym.iImportLib.dll_private:_bool___thiscall_elex::StartupAppEnumerator::EnumStartupReg_class_elex::reg::RegPath_const___class_std::vector_struct_elex::RegStartupAppInfo___class_std::allocator_struct_elex::RegStartupAppInfo_____
mov dword [esp + 0x90], 0xffffffff
cmp dword [esp + 0x48], 8
jb 0x1002e4e2
push dword [esp + 0x34]
call esi
add esp, 4
xor eax, eax
cmp dword [esp + 0x2c], 8
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
mov word [esp + 0x34], ax
jb 0x1002e509
push dword [esp + 0x18]
call esi
add esp, 4
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push SysReAllocString
lea ecx, [esp + 0x20]
call sym.iImportLib.dll_public:_void___thiscall_elex::reg::RegPath::constructor_struct_HKEY_____wchar_t_const___bool_
push ebx
push eax
mov ecx, edi
mov dword [esp + 0x98], 0xd
call sym.iImportLib.dll_private:_bool___thiscall_elex::StartupAppEnumerator::EnumStartupReg_class_elex::reg::RegPath_const___class_std::vector_struct_elex::RegStartupAppInfo___class_std::allocator_struct_elex::RegStartupAppInfo_____
mov dword [esp + 0x90], 0xffffffff
cmp dword [esp + 0x48], 8
jb 0x1002e54d
push dword [esp + 0x34]
call esi
add esp, 4
xor eax, eax
cmp dword [esp + 0x2c], 8
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
mov word [esp + 0x34], ax
jb 0x1002e574
push dword [esp + 0x18]
call esi
add esp, 4
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunEx
push SysReAllocString
lea ecx, [esp + 0x20]
call sym.iImportLib.dll_public:_void___thiscall_elex::reg::RegPath::constructor_struct_HKEY_____wchar_t_const___bool_
push ebx
push eax
mov ecx, edi
mov dword [esp + 0x98], 0xe
call sym.iImportLib.dll_private:_bool___thiscall_elex::StartupAppEnumerator::EnumStartupReg_class_elex::reg::RegPath_const___class_std::vector_struct_elex::RegStartupAppInfo___class_std::allocator_struct_elex::RegStartupAppInfo_____
mov dword [esp + 0x90], 0xffffffff
cmp dword [esp + 0x48], 8
jb 0x1002e5b8
push dword [esp + 0x34]
call esi
add esp, 4
xor eax, eax
cmp dword [esp + 0x2c], 8
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
mov word [esp + 0x34], ax
jb 0x1002e5df
push dword [esp + 0x18]
call esi
add esp, 4
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push SysReAllocString
lea ecx, [esp + 0x58]
call sym.iImportLib.dll_public:_void___thiscall_elex::reg::RegPath::constructor_struct_HKEY_____wchar_t_const___bool_
push ebx
push eax
mov ecx, edi
mov dword [esp + 0x98], 0xf
call sym.iImportLib.dll_private:_bool___thiscall_elex::StartupAppEnumerator::EnumStartupReg_class_elex::reg::RegPath_const___class_std::vector_struct_elex::RegStartupAppInfo___class_std::allocator_struct_elex::RegStartupAppInfo_____
cmp dword [esp + 0x80], 8
jb 0x1002e61b
push dword [esp + 0x6c]
call esi
add esp, 4
xor eax, eax
cmp dword [esp + 0x64], 8
mov dword [esp + 0x80], 7
mov dword [esp + 0x7c], 0
mov word [esp + 0x6c], ax
jb 0x1002e645
push dword [esp + 0x50]
call esi
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x88]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4