Function at 0x518ea3
Capabilities:
Persist via run registry key

Disassembly:
push ebp
lea ebp, [esp - 0x11bc]
mov eax, 0x11bc
call fcn.0059cbb0
push 0xffffffffffffffff
push 0x5ec6a9
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp + 0x11b8], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0x11c4]
mov esi, dword [ebp + 0x11c8]
lea ecx, [ebp]
call fcn.004aafa5
xor ebx, ebx
lea ecx, [ebp + 0x40c]
mov dword [ebp - 4], ebx
call fcn.00427139
lea ecx, [ebp + 0x844]
mov byte [ebp - 4], 1
call fcn.00427139
lea ecx, [ebp + 0xc7c]
mov byte [ebp - 4], 2
call fcn.00427139
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.005756ee
push 0xffffffffffffffff
push ebx
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.005757d6
lea ecx, [ebp + 0x40c]
call fcn.00499aa1
test eax, eax
jne 0x518fb6
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.00575a31
lea ecx, [ebp + 0xc7c]
mov byte [ebp - 4], 2
call fcn.0042719c
lea ecx, [ebp + 0x844]
mov byte [ebp - 4], 1
call fcn.0042719c
lea ecx, [ebp + 0x40c]
mov byte [ebp - 4], bl
call fcn.0042719c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.004ac1a5
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x11b8]
xor ecx, ebp
call fcn.0059ca15
add ebp, 0x11bc
leave
ret 8
push SysReAllocStringLen
lea ecx, [ebp]
call fcn.004aafcd
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea ecx, [ebp]
call fcn.004ab3d4
push ebx
push edi
lea ecx, [ebp]
call fcn.004ab5bd
mov edi, eax
cmp edi, ebx
je 0x518f4b
push edi
lea ecx, [ebp + 0x844]
call fcn.00498be1
push edi
lea ecx, [ebp + 0xc7c]
call fcn.00498be1
push edi
call fcn.00564e3f
pop ecx
jmp 0x51902f
lea eax, [ebp + 0xc7c]
push eax
lea eax, [ebp + 0x40c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x519046
lea eax, [ebp + 0x10b4]
push eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x20]
call fcn.00575c79
lea eax, [ebp + 0x10b4]
push eax
push ebx
lea ecx, [ebp + 0xc7c]
call fcn.00498d2a
test eax, eax
jne 0x519005
lea ecx, [ebp + 0xc7c]
call fcn.004992e9
test eax, eax
je 0x518f4b
cmp dword [ebp - 0x18], ebx
jg 0x5190ab
xor esi, esi
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.00575a31
lea ecx, [ebp + 0xc7c]
mov byte [ebp - 4], 2
call fcn.0042719c
lea ecx, [ebp + 0x844]
mov byte [ebp - 4], 1
call fcn.0042719c
lea ecx, [ebp + 0x40c]
mov byte [ebp - 4], bl
call fcn.0042719c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.004ac1a5
mov eax, esi
jmp 0x518f91
lea eax, [ebp + 0x10b4]
push eax
push ebx
lea ecx, [ebp + 0xc7c]
call fcn.00499340
push ebx
push 0x5f7710
lea ecx, [ebp + 0x40c]
call fcn.0049a237
jmp 0x51914a
push eax
lea eax, [ebp + 0x40c]
push eax
lea ecx, [ebp + 0x844]
call fcn.00499340
lea eax, [ebp + 0xc7c]
push eax
lea eax, [ebp + 0x844]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x51913f
mov edi, dword [ebp - 0x18]
dec edi
cmp edi, ebx
jl 0x51911e
push edi
lea ecx, [ebp - 0x20]
call fcn.004026b0
push dword [eax]
lea ecx, [ebp + 0x844]
push ebx
call fcn.00499340
dec edi
jns 0x519104
lea ecx, [ebp + 0x844]
call fcn.004992e9
test eax, eax
je 0x51913f
mov eax, dword [esi + 8]
lea ecx, [ebp + 0x844]
push ecx
push eax
mov ecx, esi
call fcn.00575c79
lea ecx, [ebp + 0x40c]
call fcn.0049980d
cmp eax, ebx
jne 0x5190d1
mov esi, dword [esi + 8]
xor eax, eax
cmp esi, ebx
setg al
mov esi, eax
jmp 0x519060