Function at 0x4219f0
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x469a5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x890
mov eax, dword [0x48e070]
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x890], eax
mov al, byte [esi + 0x14]
test al, al
push edi
lea edi, [esi + 8]
jne 0x421b3c
mov ecx, edi
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
call fcn.0044a600
add esp, 4
test al, al
je 0x421aab
lea eax, [esp + 0x260]
push 0x104
push eax
call fcn.004498a0
lea ecx, [esp + 0x478]
push ecx
push 0
lea edx, [esp + 0x270]
push 0x472db4
push edx
call fcn.004498c0
add esp, 0x18
lea eax, [esp + 0x470]
lea ebx, [esi + 0xc]
push eax
mov ecx, ebx
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::operator]
mov ecx, ebx
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
mov ecx, edi
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
call fcn.0044b690
add esp, 8
test al, al
je 0x421d6d
mov ecx, edi
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
call fcn.00449b10
add esp, 4
mov ecx, edi
add esi, 4
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
mov ecx, esi
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
call fcn.0044b690
add esp, 8
test al, al
je 0x421d6d
lea ecx, [esp + 0x40]
call fcn.0044e530
lea ecx, [esp + 0x40]
push ecx
mov ecx, esi
mov dword [esp + 0x8a8], 0
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
call fcn.0044aee0
add esp, 8
lea edx, [esp + 0x40]
push edx
mov ecx, edi
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
call fcn.0044a400
add esp, 8
lea ecx, [esp + 0x40]
mov dword [esp + 0x8a4], 0xffffffff
call fcn.0044e540
xor eax, eax
jmp 0x421d70
push edi
lea ecx, [esp + 0x18]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_2]
mov dword [esp + 0x10], vtable.CMacrPath.0
lea eax, [esp + 0x24]
mov ebx, 1
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x8a8], ebx
call fcn.00446300
lea ecx, [esp + 0x680]
push ecx
push 0
push 0x472dac
mov ecx, eax
mov byte [esp + 0x8b0], 2
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
call fcn.004498c0
add esp, 0x10
lea ecx, [esp + 0x24]
mov byte [esp + 0x8a4], bl
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
lea edx, [esp + 0x680]
push edx
lea ecx, [esp + 0x2c]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT]
mov dword [esp + 0x24], vtable.CMacrPath.0
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x8a8], 3
call dword [0x46e364]
lea ecx, [esp + 0x24]
mov byte [esp + 0x8a4], bl
call fcn.004462f0
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esi + 0x10]
call dword [0x46e364]
lea ecx, [esp + 0x14]
add esi, 4
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
mov ecx, esi
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
call fcn.0044b690
add esp, 8
lea ecx, [esp + 0x30]
call fcn.0044e530
lea edx, [esp + 0x30]
push edx
mov ecx, esi
mov byte [esp + 0x8a8], 4
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
call fcn.0044aee0
add esp, 8
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
call fcn.0044a400
lea ecx, [esp + 0x58]
push ecx
call fcn.00449700
add esp, 0xc
lea edx, [esp + 0x50]
push edx
lea ecx, [esp + 0x24]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT]
mov dword [esp + 0x1c], vtable.CMacrPath.0
mov byte [esp + 0x8a4], 5
push str.replace.exe
lea ecx, [esp + 0x20]
call fcn.00446590
push 0x104
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x28]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT]
push 0x46ffc8
lea ecx, [esp + 0x10]
mov byte [esp + 0x8a8], 6
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::operator_2]
push 0x46f268
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::operator_2]
push edi
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::operator_1]
push 0x472d8c
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::operator_2]
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::operator_1]
push 0x46f268
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::operator_2]
lea eax, [esp + 0x2c]
push eax
push 0x20006
push 0
push str.softwaremicrosoftwindowscurrentversion_runonce
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x421d91
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x8a4], 4
call fcn.004462f0
lea ecx, [esp + 0x30]
mov byte [esp + 0x8a4], bl
call fcn.0044e540
lea ecx, [esp + 0x10]
mov dword [esp + 0x8a4], 0xffffffff
call fcn.004462f0
or eax, 0xffffffff
mov ecx, dword [esp + 0x89c]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x894]
call fcn.004664a7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x14]
call fcn.00446490
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71U.DLL_CHtmlView::GetLeft]
lea edx, [eax + eax + 1]
push edx
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
push ebx
push 0
lea ecx, [esp + 0x28]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 0x2c]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x18]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x8a4], 4
call fcn.004462f0
lea ecx, [esp + 0x30]
mov byte [esp + 0x8a4], bl
call fcn.0044e540
lea ecx, [esp + 0x10]
mov dword [esp + 0x8a4], 0xffffffff
call fcn.004462f0
test esi, esi
jne 0x421d6d
xor eax, eax
jmp 0x421d70