Function at 0x4279b8
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push 0x160
mov eax, 0x67b6d2
call fcn.005b8597
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 0x138], ebx
call fcn.004b8afa
push eax
lea ecx, [ebp - 0x154]
call fcn.004015a6
mov dword [ebp - 4], ebx
call fcn.004b8afa
push eax
lea ecx, [ebp - 0x11c]
call fcn.004015a6
mov byte [ebp - 4], 1
call fcn.004b8afa
push eax
lea ecx, [ebp - 0x118]
call fcn.004015a6
mov byte [ebp - 4], 2
call fcn.004c66d7
mov ecx, dword [eax + 4]
call fcn.004c34d8
push dword [esi + 0xc]
mov eax, dword [esi + 0x68]
push ecx
sub eax, 0x10
mov dword [ebp - 0x120], esp
mov edi, esp
push eax
mov byte [ebp - 4], 3
call fcn.0040149c
add eax, 0x10
mov dword [edi], eax
pop ecx
lea eax, [ebp - 0x124]
push eax
call fcn.004426d5
pop ecx
pop ecx
push dword [eax]
lea eax, [ebp - 0x154]
push str._s_s
push eax
mov byte [ebp - 4], 4
call fcn.0040255b
mov ecx, dword [ebp - 0x124]
add esp, 0x10
add ecx, 0xfffffff0
mov byte [ebp - 4], 3
call fcn.0040124d
mov edi, dword [ebp - 0x154]
cmp byte [esi + 0xb6], bl
je 0x427b8a
lea eax, [ebp - 0x130]
push eax
push 0x2001f
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionSharedDLLs
push 0x80000002
call dword [0x69b024]
mov dword [ebp - 0x124], eax
cmp eax, ebx
jne 0x427b4a
push 4
pop eax
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x15c], eax
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x158]
push eax
push ebx
push edi
push dword [ebp - 0x130]
mov dword [ebp - 0x134], ebx
call dword [0x69b020]
inc dword [ebp - 0x134]
push 4
lea eax, [ebp - 0x134]
push eax
push 4
push ebx
push edi
push dword [ebp - 0x130]
call dword [0x69b01c]
push dword [ebp - 0x130]
call dword [0x69b018]
lea ecx, [ebp - 0x118]
call fcn.00401563
push dword [ebp - 0x134]
lea eax, [ebp - 0x118]
push edi
push str.Increment_usage_count:__s__New_count___d_
push eax
call fcn.0040255b
add esp, 0x10
push ebx
push ebx
push ebx
jmp 0x427b73
lea ecx, [ebp - 0x118]
call fcn.00401563
push edi
lea eax, [ebp - 0x118]
push str.Increment_usage_count:__s
push eax
call fcn.0040255b
add esp, 0xc
push ebx
push dword [ebp - 0x124]
push 1
mov ecx, dword [0x7534c4]
push dword [ebp - 0x118]
add ecx, 0x6dc
call fcn.0043b7c8
cmp byte [esi + 0xa4], bl
je 0x427ec2
cmp byte [esi + 5], bl
je 0x427c71
lea eax, [ebp - 0x130]
push eax
push 0x2001f
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [0x69b024]
mov dword [ebp - 0x124], eax
cmp eax, ebx
jne 0x427c2c
push edi
lea eax, [ebp - 0x114]
push str.regsvr32.exe__s__s
push eax
call dword [0x69b9ac]
mov eax, dword [esi + 0xc]
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x114]
push ecx
push 1
push ebx
push eax
push dword [ebp - 0x130]
call dword [0x69b01c]
push dword [ebp - 0x130]
call dword [0x69b018]
lea ecx, [ebp - 0x118]
call fcn.00401563
push edi
lea eax, [ebp - 0x118]
push str.Register_COM_file_on_reboot:__s
push eax
call fcn.0040255b
add esp, 0xc
push ebx
push ebx
push ebx
jmp 0x427c55
lea ecx, [ebp - 0x118]
call fcn.00401563
push edi
lea eax, [ebp - 0x118]
push str.Register_COM_file_on_reboot:__s
push eax
call fcn.0040255b
add esp, 0xc
push ebx
push dword [ebp - 0x124]
push 1
mov ecx, dword [0x7534c4]
push dword [ebp - 0x118]
add ecx, 0x6dc
call fcn.0043b7c8
jmp 0x427ec2
push 0x69c5b8
lea ecx, [ebp - 0x124]
mov dword [ebp - 0x128], ebx
call fcn.00401b65
mov ecx, dword [ebp - 0x13c]
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x128]
push eax
push edi
mov byte [ebp - 4], 5
call fcn.0042536f
mov dword [ebp - 0x144], eax
cmp eax, ebx
jle 0x427e76
dec eax
je 0x427d4d
dec eax
je 0x427d0a
dec eax
jne 0x427d9a
push ecx
mov ecx, esp
mov dword [ebp - 0x120], esp
push str.ERR_DLL_REG_FAIL
call fcn.00401b65
mov ecx, dword [0x7534c4]
lea eax, [ebp - 0x150]
push eax
add ecx, 0x16c
call fcn.0043db02
push eax
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 8
call fcn.0040191c
mov ecx, dword [ebp - 0x150]
jmp 0x427d8e
push ecx
mov ecx, esp
mov dword [ebp - 0x120], esp
push str.ERR_DLL_REG_GETPROC
call fcn.00401b65
mov ecx, dword [0x7534c4]
lea eax, [ebp - 0x148]
push eax
add ecx, 0x16c
call fcn.0043db02
push eax
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 7
call fcn.0040191c
mov ecx, dword [ebp - 0x148]
jmp 0x427d8e
push ecx
mov ecx, esp
mov dword [ebp - 0x120], esp
push str.ERR_DLL_REG_LOAD
call fcn.00401b65
mov ecx, dword [0x7534c4]
lea eax, [ebp - 0x12c]
push eax
add ecx, 0x16c
call fcn.0043db02
push eax
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 6
call fcn.0040191c
mov ecx, dword [ebp - 0x12c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 5
call fcn.0040124d
push dword [ebp - 0x128]
mov eax, dword [ebp - 0x11c]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x120], esp
mov dword [ebp - 0x12c], esp
push eax
call fcn.0040149c
mov ecx, dword [ebp - 0x12c]
add eax, 0x10
mov dword [ecx], eax
lea eax, [edi - 0x10]
mov dword [ebp - 0x14c], esp
mov dword [ebp - 0x12c], esp
push eax
mov byte [ebp - 4], 9
call fcn.0040149c
pop ecx
mov ecx, dword [ebp - 0x12c]
add eax, 0x10
mov dword [ecx], eax
mov ecx, dword [ebp - 0x13c]
push ebx
mov byte [ebp - 4], 5
call fcn.00424f8d
cmp eax, ebx
jne 0x427e0a
mov dword [ebp - 0x138], 0x88
lea ecx, [ebp - 0x118]
call fcn.00401563
push dword [ebp - 0x128]
lea eax, [ebp - 0x118]
push edi
push str.Register_COM_file:__s___System_Error___u
push eax
call fcn.0040255b
mov ecx, dword [0x7534c4]
add esp, 0x10
push ebx
push dword [ebp - 0x144]
add ecx, 0x6dc
push 1
push dword [ebp - 0x118]
call fcn.0043b7c8
mov eax, dword [ebp - 0x124]
cmp dword [eax - 0xc], ebx
je 0x427eb0
push eax
lea eax, [ebp - 0x118]
push str.Register_COM_failure_reason:__s
push eax
call fcn.0040255b
add esp, 0xc
push ebx
push ebx
push 4
jmp 0x427e99
lea ecx, [ebp - 0x118]
call fcn.00401563
push edi
lea eax, [ebp - 0x118]
push str.Register_COM_file:__s
push eax
call fcn.0040255b
add esp, 0xc
push ebx
push ebx
push ebx
mov ecx, dword [0x7534c4]
push dword [ebp - 0x118]
add ecx, 0x6dc
call fcn.0043b7c8
mov ecx, dword [ebp - 0x124]
add ecx, 0xfffffff0
mov byte [ebp - 4], 3
call fcn.0040124d
cmp byte [esi + 5], bl
jne 0x42834c
cmp byte [esi + 0xa5], bl
je 0x42834c
cmp dword [ebp - 0x138], ebx
jne 0x42834c
push 0x69c5b8
lea ecx, [ebp - 0x124]
mov dword [ebp - 0x128], ebx
call fcn.00401b65
mov ecx, dword [ebp - 0x13c]
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x128]
push eax
push edi
mov byte [ebp - 4], 0xa
call fcn.00425445
cmp eax, ebx
jle 0x42830f
mov esi, dword [ebp - 0x128]
mov eax, 0x8002802e
cmp esi, eax
ja 0x4280c2
je 0x42807c
cmp esi, 0x80028018
je 0x428036
cmp esi, 0x80028019
je 0x427ff0
cmp esi, 0x8002801c
je 0x427faa
cmp esi, 0x80028029
jne 0x4280ee
push ecx
mov ecx, esp
mov dword [ebp - 0x120], esp
push str.ERR_TLB_STATE
call fcn.00401b65
mov ecx, dword [0x7534c4]
lea eax, [ebp - 0x144]
push eax
add ecx, 0x16c
call fcn.0043db02
push eax
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 0xe
call fcn.0040191c
mov ecx, dword [ebp - 0x144]
jmp 0x428244
push ecx
mov ecx, esp
mov dword [ebp - 0x120], esp
push str.ERR_TLB_REGISTRY
call fcn.00401b65
mov ecx, dword [0x7534c4]
lea eax, [ebp - 0x12c]
push eax
add ecx, 0x16c
call fcn.0043db02
push eax
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 0x13
call fcn.0040191c
mov ecx, dword [ebp - 0x12c]
jmp 0x428244
push ecx
mov ecx, esp
mov dword [ebp - 0x120], esp
push str.ERR_TLB_FORMAT
call fcn.00401b65
mov ecx, dword [0x7534c4]
lea eax, [ebp - 0x148]
push eax
add ecx, 0x16c
call fcn.0043db02
push eax
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 0x10
call fcn.0040191c
mov ecx, dword [ebp - 0x148]
jmp 0x428244
push ecx
mov ecx, esp
mov dword [ebp - 0x120], esp
push str.ERR_TLB_READ
call fcn.00401b65
mov ecx, dword [0x7534c4]
lea eax, [ebp - 0x150]
push eax
add ecx, 0x16c
call fcn.0043db02
push eax
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 0xf
call fcn.0040191c
mov ecx, dword [ebp - 0x150]
jmp 0x428244
push ecx
mov ecx, esp
mov dword [ebp - 0x120], esp
push str.ERR_TLB_LCID
call fcn.00401b65
mov ecx, dword [0x7534c4]
lea eax, [ebp - 0x164]
push eax
add ecx, 0x16c
call fcn.0043db02
push eax
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 0x11
call fcn.0040191c
mov ecx, dword [ebp - 0x164]
jmp 0x428244
cmp esi, 0x80028ca2
je 0x428203
cmp esi, 0x80029c4a
je 0x4281c0
cmp esi, 0x8007000e
je 0x42817a
cmp esi, 0x80070057
je 0x428134
push ecx
mov ecx, esp
mov dword [ebp - 0x120], esp
push str.ERR_TLB_DEFAULT
call fcn.00401b65
mov ecx, dword [0x7534c4]
lea eax, [ebp - 0x16c]
push eax
add ecx, 0x16c
call fcn.0043db02
push eax
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 0x14
call fcn.0040191c
mov ecx, dword [ebp - 0x16c]
jmp 0x428244
push ecx
mov ecx, esp
mov dword [ebp - 0x120], esp
push str.ERR_TLB_ARGS
call fcn.00401b65
mov ecx, dword [0x7534c4]
lea eax, [ebp - 0x160]
push eax
add ecx, 0x16c
call fcn.0043db02
push eax
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 0xc
call fcn.0040191c
mov ecx, dword [ebp - 0x160]
jmp 0x428244
push ecx
mov ecx, esp
mov dword [ebp - 0x120], esp
push str.ERR_TLB_MEM
call fcn.00401b65
mov ecx, dword [0x7534c4]
lea eax, [ebp - 0x168]
push eax
add ecx, 0x16c
call fcn.0043db02
push eax
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 0xb
call fcn.0040191c
mov ecx, dword [ebp - 0x168]
jmp 0x428244
push ecx
mov ecx, esp
mov dword [ebp - 0x120], esp
push str.ERR_TLB_LOAD
call fcn.00401b65
mov ecx, dword [0x7534c4]
lea eax, [ebp - 0x14c]
push eax
add ecx, 0x16c
call fcn.0043db02
push eax
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 0x12
call fcn.0040191c
mov ecx, dword [ebp - 0x14c]
jmp 0x428244
push ecx
mov ecx, esp
mov dword [ebp - 0x120], esp
push str.ERR_TLB_IO
call fcn.00401b65
mov ecx, dword [0x7534c4]
lea eax, [ebp - 0x120]
push eax
add ecx, 0x16c
call fcn.0043db02
push eax
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 0xd
call fcn.0040191c
mov ecx, dword [ebp - 0x120]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xa
call fcn.0040124d
mov eax, dword [ebp - 0x11c]
push esi
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x120], esp
mov esi, esp
push eax
call fcn.0040149c
add eax, 0x10
mov dword [esi], eax
lea eax, [edi - 0x10]
mov dword [ebp - 0x14c], esp
mov esi, esp
push eax
mov byte [ebp - 4], 0x15
call fcn.0040149c
pop ecx
mov ecx, dword [ebp - 0x13c]
add eax, 0x10
mov dword [esi], eax
push 1
mov byte [ebp - 4], 0xa
call fcn.00424f8d
cmp eax, ebx
jne 0x4282a8
mov dword [ebp - 0x138], 0x88
push dword [ebp - 0x128]
lea eax, [ebp - 0x118]
push dword [ebp - 0x11c]
push edi
push str.RegisterTypeLib:__s____s
push eax
call fcn.0040255b
mov ecx, dword [0x7534c4]
add esp, 0x14
push ebx
push dword [ebp - 0x128]
add ecx, 0x6dc
push 1
push dword [ebp - 0x118]
call fcn.0043b7c8
mov eax, dword [ebp - 0x124]
cmp dword [eax - 0xc], ebx
je 0x42833e
push eax
lea eax, [ebp - 0x118]
push str.RegisterTypeLib_failure_reason:__s
push eax
call fcn.0040255b
add esp, 0xc
push ebx
push ebx
push 4
jmp 0x428327
push edi
lea eax, [ebp - 0x118]
push str.RegisterTypeLib:__s
push eax
call fcn.0040255b
add esp, 0xc
push ebx
push ebx
push ebx
mov ecx, dword [0x7534c4]
push dword [ebp - 0x118]
add ecx, 0x6dc
call fcn.0043b7c8
mov ecx, dword [ebp - 0x124]
add ecx, 0xfffffff0
call fcn.0040124d
lea ecx, [ebp - 0x13d]
mov byte [ebp - 4], 2
call fcn.0040fd41
mov ecx, dword [ebp - 0x118]
add ecx, 0xfffffff0
call fcn.0040124d
mov ecx, dword [ebp - 0x11c]
add ecx, 0xfffffff0
call fcn.0040124d
lea ecx, [edi - 0x10]
call fcn.0040124d
mov eax, dword [ebp - 0x138]
call fcn.005b861a
ret 4