Function at 0x489e90
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
mov dword [ebp - 0x29c], edi
mov dword [ebp - 0x2ac], ebx
mov dword [ebp - 0x2a4], eax
mov dword [ebp - 0x2a8], ecx
mov byte [ebp - 0x98], 0
mov dword [ebp - 0x2a0], 0
test ebx, ebx
je 0x489f14
cmp byte [ebx], 0
je 0x489f14
push ebx
call fcn.0047f140
movzx edx, ax
add esp, 4
add edx, ebx
push edx
lea eax, [ebp - 0x298]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x298]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [ebp - 0x298]
mov byte [eax + edx - 4], 0
cmp dword [0x4d2afc], 0
je 0x489f34
mov eax, dword [0x4c6444]
mov ecx, dword [0x4c6448]
mov dword [ebp - 0x2b4], eax
mov dword [ebp - 0x2b0], ecx
push str.DeleteRunProgram__
mov esi, edi
call fcn.0047fb10
mov esi, dword [ebp - 0x2a4]
add esp, 4
push ebx
call fcn.0047fb10
add esp, 4
push 0x4bb120
mov esi, 0x4bb120
call fcn.0047fb10
mov esi, dword [ebp - 0x2a8]
lea eax, [esi - 1]
add esp, 4
cmp eax, 0xfe
ja case.0x489f7f.8
movzx edx, byte [eax + 0x48a448]
jmp dword [edx*4 + 0x48a410]
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne case.0x489f7f.2
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov edx, 0x7ffffffe
mov eax, 0x80
lea ecx, [ebp - 0x98]
call fcn.00401000
lea ecx, [ebp - 0x98]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne case.0x489f7f.3
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
mov edx, 0x7ffffffe
mov eax, 0x80
lea ecx, [ebp - 0x98]
call fcn.00401000
lea edx, [ebp - 0x98]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne case.0x489f7f.4
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
mov edx, 0x7ffffffe
mov eax, 0x80
lea ecx, [ebp - 0x98]
call fcn.00401000
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne case.0x489f7f.5
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
mov edx, 0x7ffffffe
mov eax, 0x80
lea ecx, [ebp - 0x98]
call fcn.00401000
lea ecx, [ebp - 0x98]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne case.0x489f7f.6
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServicesOnce
mov edx, 0x7ffffffe
mov eax, 0x80
lea ecx, [ebp - 0x98]
call fcn.00401000
lea edx, [ebp - 0x98]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne case.0x489f7f.7
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceSetup
mov edx, 0x7ffffffe
mov eax, 0x80
lea ecx, [ebp - 0x98]
call fcn.00401000
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x48a0b3
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunPolicy
mov edx, 0x7ffffffe
mov eax, 0x80
lea ecx, [ebp - 0x98]
call fcn.00401000
push 0x10
push edi
push str.SoftwareBillP_StudiosWinPatrolDisabled
lea ecx, [ebp - 0x14]
mov edx, 0x80000002
call fcn.0048e050
add esp, 0xc
test eax, eax
mov ebx, 0x80000002
mov eax, edi
je 0x48a0fa
mov edi, dword [esi*4 + 0x4c472c]
call fcn.0048e230
mov eax, dword [ebp - 0x29c]
mov edi, str.SoftwareBillP_StudiosWinPatrolDisabled
call fcn.0048e230
mov dword [ebp - 0x2a0], eax
jmp 0x48a122
mov edi, dword [esi*4 + 0x4c4668]
call fcn.0048e230
mov ecx, esi
push ecx
push 0x4b7c94
lea edx, [ebp - 0x14]
push 0x10
push edx
mov dword [ebp - 0x2a0], eax
call fcn.00402830
add esp, 0x10
cmp byte [ebp - 0x298], 0
je 0x48a150
mov ebx, 0x80000002
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerStartupApprovedRun
lea eax, [ebp - 0x298]
call fcn.0048e230
lea eax, [ebp - 0x298]
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerStartupApprovedRun32
call fcn.0048e230
mov ebx, dword [ebp - 0x2ac]
mov edi, dword [ebp - 0x29c]
mov edx, 0x4bbc38
mov ecx, ebx
call fcn.0047dee0
test eax, eax
jne 0x48a18f
mov eax, dword [ebp - 0x2a4]
push eax
push ebx
push edi
xor ecx, ecx
mov edx, esi
call fcn.0048c740
add esp, 0xc
push 7
mov edx, ebx
mov ecx, edi
call fcn.0048c5e0
add esp, 4
mov eax, ebx
mov edi, str.SoftwareBillP_StudiosWinPatrolRun
mov ebx, 0x80000001
call fcn.0048e230
mov eax, dword [ebp - 0x29c]
call fcn.0048e230
cmp dword [0x4d2afc], 0
je 0x48a1cc
mov ecx, dword [ebp - 0x2b4]
mov edx, dword [ebp - 0x2b0]
mov dword [0x4c6444], ecx
mov dword [0x4c6448], edx
call fcn.0049c590
mov eax, dword [ebp - 0x2a0]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
push 0x10
push edi
push str.SoftwareBillP_StudiosWinPatrolDisabled
lea ecx, [ebp - 0x14]
mov edx, 0x80000002
call fcn.0048e050
add esp, 0xc
test eax, eax
mov eax, edi
je 0x48a224
mov edi, dword [esi*4 + 0x4c4704]
mov ebx, 0x80000002
call fcn.0048e230
mov eax, dword [ebp - 0x29c]
mov edi, str.SoftwareBillP_StudiosWinPatrolDisabled
jmp 0x48a230
mov edi, dword [esi*4 + 0x4c4640]
mov ebx, 0x80000001
call fcn.0048e230
cmp byte [ebp - 0x298], 0
mov dword [ebp - 0x2a0], eax
je 0x48a150
mov ebx, 0x80000001
jmp 0x48a130
push 0x10
push edi
push str.SoftwareBillP_StudiosWinPatrolDisabled
lea ecx, [ebp - 0x14]
mov edx, 0x80000002
call fcn.0048e050
add esp, 0xc
test eax, eax
mov ebx, 0x80000002
mov eax, edi
je 0x48a28e
mov edi, dword [esi*4 + 0x4c46dc]
call fcn.0048e230
mov eax, dword [ebp - 0x29c]
mov edi, str.SoftwareBillP_StudiosWinPatrolDisabled
jmp 0x48a230
mov edi, dword [esi*4 + 0x4c46c0]
jmp 0x48a230
push 0x10
push edi
push str.SoftwareBillP_StudiosWinPatrolDisabled
lea ecx, [ebp - 0x14]
mov edx, 0x80000002
call fcn.0048e050
add esp, 0xc
test eax, eax
je 0x48a2e0
mov eax, edi
mov edi, str.SoftwareBillP_StudiosWinPatrolDisabled
mov ebx, 0x80000002
call fcn.0048e230
mov eax, dword [ebp - 0x29c]
mov edi, str.SoftwareBillP_StudiosWinPatrolDisabledWinLoad
call fcn.0048e230
mov ebx, dword [ebp - 0x2ac]
mov edi, dword [ebp - 0x29c]
push ebx
mov ecx, str.load
call fcn.0048e690
add esp, 4
mov dword [ebp - 0x2a0], 1
jmp case.0x489f7f.8
push 0x10
push edi
push str.SoftwareBillP_StudiosWinPatrolDisabled
lea ecx, [ebp - 0x14]
mov edx, 0x80000002
call fcn.0048e050
add esp, 0xc
test eax, eax
je 0x48a346
mov eax, edi
mov edi, str.SoftwareBillP_StudiosWinPatrolDisabled
mov ebx, 0x80000002
call fcn.0048e230
mov eax, dword [ebp - 0x29c]
mov edi, str.SoftwareBillP_StudiosWinPatrolDisabledWinLoad
call fcn.0048e230
mov ebx, dword [ebp - 0x2ac]
mov edi, dword [ebp - 0x29c]
push ebx
mov ecx, 0x4bd708
call fcn.0048e690
add esp, 4
mov dword [ebp - 0x2a0], 1
jmp case.0x489f7f.8
push 0x10
push edi
push str.SoftwareBillP_StudiosWinPatrolDisabled
lea ecx, [ebp - 0x14]
mov edx, 0x80000002
call fcn.0048e050
add esp, 0xc
test eax, eax
je 0x48a39c
mov eax, edi
mov edi, str.SoftwareBillP_StudiosWinPatrolDisabled
mov ebx, 0x80000002
call fcn.0048e230
mov ebx, dword [ebp - 0x2ac]
mov edi, dword [ebp - 0x29c]
mov esi, dword [ebp - 0x2a4]
mov ecx, esi
call fcn.0047d280
test eax, eax
je 0x48a3af
mov ebx, esi
call fcn.0047dbc0
mov eax, edi
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerStartupApprovedStartupFolder
mov ebx, 0x80000002
mov dword [ebp - 0x2a0], 1
call fcn.0048e230
mov eax, dword [ebp - 0x29c]
mov ebx, 0x80000001
call fcn.0048e230
mov esi, dword [ebp - 0x2a8]
jmp 0x48a150
mov ecx, dword [ebp - 0x2a4]
push esi
push edi
mov esi, ebx
call fcn.0048a550
mov ecx, dword [ebp - 4]
add esp, 8
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a01d6
mov esp, ebp
pop ebp
ret