Function at 0x4232a0
Capabilities:
Check os version
Encode data using xor
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c0690
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x515e20]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x51804c]
mov dword [ebp - 0x30], 0
test al, 1
jne 0x423307
or eax, 1
mov dword [0x51804c], eax
mov eax, dword [0x5159f8]
mov ecx, 0x5159f8
call dword [eax + 0xc]
add eax, 0x10
push 0x4cf030
mov dword [0x518048], eax
call fcn.0049dc31
mov eax, dword [0x51804c]
add esp, 4
test al, 2
jne 0x42333a
or eax, 2
mov dword [0x51804c], eax
mov eax, dword [0x5159f8]
mov ecx, 0x5159f8
call dword [eax + 0xc]
add eax, 0x10
push 0x4cf060
mov dword [0x518050], eax
call fcn.0049dc31
mov eax, dword [0x51804c]
add esp, 4
test al, 4
jne 0x42336d
or eax, 4
mov dword [0x51804c], eax
mov eax, dword [0x5159f8]
mov ecx, 0x5159f8
call dword [eax + 0xc]
add eax, 0x10
push 0x4cf090
mov dword [0x518054], eax
call fcn.0049dc31
mov eax, dword [0x51804c]
add esp, 4
test al, 8
jne 0x42339b
or eax, 8
mov dword [0x51804c], eax
mov eax, dword [0x5159f8]
mov ecx, 0x5159f8
call dword [eax + 0xc]
add eax, 0x10
push 0x4cf000
mov dword [0x518058], eax
call fcn.0049dc31
add esp, 4
mov eax, dword [0x518050]
cmp dword [eax - 0xc], 0
je 0x4233c0
push 0x518040
push 0x518058
call fcn.00402960
add esp, 8
test al, al
je 0x423be7
push 0x518040
mov ecx, 0x518058
call fcn.00402610
mov ecx, 0x518048
call fcn.004050e0
mov ecx, 0x518050
call fcn.004050e0
mov ecx, 0x518054
call fcn.004050e0
xor eax, eax
mov dword [ebp - 0x24], eax
mov eax, dword [0x5159f8]
mov ecx, 0x5159f8
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x1c], esi
mov eax, dword [0x5159f8]
mov ecx, 0x5159f8
mov dword [ebp - 4], 0
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x20], edi
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push str.Volatile_Environment
push SysReAllocStringLen
mov byte [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, 1
test eax, eax
jne 0x423621
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x423611
mov dword [ebp - 0x18], 0x104
mov eax, dword [esi - 8]
mov ecx, ebx
sub ecx, dword [esi - 4]
sub eax, 0x82
or eax, ecx
jge 0x42349f
push 0x82
lea ecx, [ebp - 0x1c]
call fcn.00406d00
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x28]
push eax
push 0
push str.AppData
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4234e6
push dword [esi - 8]
push esi
call fcn.0049ef33
add esp, 8
test eax, eax
js 0x4234dc
cmp eax, dword [esi - 8]
jg 0x4234dc
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
jmp 0x4234f1
push 0x80070057
call fcn.00403080
lea ecx, [ebp - 0x1c]
call fcn.004050e0
mov esi, dword [ebp - 0x1c]
mov eax, dword [0x518048]
mov dword [ebp - 0x18], 0x104
mov ecx, dword [eax - 8]
mov edx, ebx
sub edx, dword [eax - 4]
sub ecx, 0x82
or ecx, edx
jge 0x423523
push 0x82
mov ecx, 0x518048
call fcn.00406d00
mov eax, dword [0x518048]
lea ecx, [ebp - 0x18]
push ecx
push eax
lea eax, [ebp - 0x28]
push eax
push 0
push str.Local_AppData
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x423576
mov eax, dword [0x518048]
push dword [eax - 8]
push eax
call fcn.0049ef33
mov edx, eax
add esp, 8
test edx, edx
js 0x4234dc
mov ecx, dword [0x518048]
cmp edx, dword [ecx - 8]
jg 0x4234dc
mov dword [ecx - 0xc], edx
mov eax, dword [0x518048]
xor ecx, ecx
mov word [eax + edx*2], cx
jmp 0x423580
mov ecx, 0x518048
call fcn.004050e0
mov dword [ebp - 0x18], 0x104
mov eax, dword [edi - 8]
mov ecx, ebx
sub ecx, dword [edi - 4]
sub eax, 0x82
or eax, ecx
jge 0x4235a8
push 0x82
lea ecx, [ebp - 0x20]
call fcn.00406d00
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
push eax
push edi
lea eax, [ebp - 0x28]
push eax
push 0
push str.A520A1A4_1780_4FF6_BD18_167343C5AF16
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4235f6
push dword [edi - 8]
push edi
call fcn.0049ef33
add esp, 8
test eax, eax
js 0x4234dc
cmp eax, dword [edi - 8]
jg 0x4234dc
mov dword [edi - 0xc], eax
xor ecx, ecx
mov word [edi + eax*2], cx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x423621
push 0x518048
lea ecx, [ebp - 0x20]
call fcn.00402610
push dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x423621
push 0x518048
lea ecx, [ebp - 0x20]
call fcn.00402610
mov edi, dword [ebp - 0x20]
call fcn.00423c30
test al, al
je 0x4238cd
mov ebx, dword [0x517280]
mov eax, ebx
imul eax, ebx
and eax, 0x8000000f
jns 0x423645
dec eax
or eax, 0xfffffff0
inc eax
cmp eax, 2
jne 0x4236d3
xor edx, edx
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, ebx
mov eax, edx
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, ebx
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, ebx
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, ebx
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, ebx
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, ebx
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, ebx
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, ebx
sar ecx, 1
xor eax, ecx
inc edx
add ebx, eax
cmp edx, 0x100
jl 0x423650
mov dword [0x517280], ebx
lea eax, [ebx + 1]
imul eax, ebx
cdq
mov ecx, 0x17
idiv ecx
mov byte [ebp - 0xd], 1
cmp edx, 0xe
jne 0x42374e
test ebx, ebx
je 0x42374e
mov edi, edi
mov ecx, ebx
and ecx, 0x80000001
jns 0x4236ff
dec ecx
or ecx, 0xfffffffe
inc ecx
jne 0x42370c
mov eax, ebx
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
jmp 0x423713
lea ebx, [ebx*2 + 1]
mov eax, 0x55555556
imul ebx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, ebx
lea eax, [eax + eax*2]
sub ecx, eax
mov dword [0x517280], ebx
sub ecx, 0
je 0x42373d
sub ecx, 2
je 0x423740
dec ecx
je 0x423741
jmp 0x42374a
add ebx, 2
inc ebx
add ebx, 2
mov dword [0x517280], ebx
test ebx, ebx
jne 0x4236f0
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, 1
test eax, eax
jne 0x423817
mov dword [ebp - 0x18], 0x104
mov eax, dword [esi - 8]
mov ecx, ebx
sub ecx, dword [esi - 4]
sub eax, 0x82
or eax, ecx
jge 0x42379e
push 0x82
lea ecx, [ebp - 0x1c]
call fcn.00406d00
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x28]
push eax
push 0
push str.Isolation
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x423804
push dword [esi - 8]
push esi
call fcn.0049ef33
add esp, 8
test eax, eax
js 0x4234dc
cmp eax, dword [esi - 8]
jg 0x4234dc
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
mov byte [ebp - 0xd], cl
cmp dword [esi - 0xc], ecx
jl 0x423804
push str.PMIL
push esi
call fcn.0049ef52
add esp, 8
test eax, eax
je 0x423804
sub eax, esi
sar eax, 1
jne 0x423804
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0xd], 0
je 0x4238d1
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftInternet_ExplorerAdvancedOptionsCRYPTOPROTECTEDMODESECURITY
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4238c6
mov dword [ebp - 0x18], 0x104
mov eax, dword [esi - 8]
sub ebx, dword [esi - 4]
sub eax, 0x82
or eax, ebx
jge 0x423860
push 0x82
lea ecx, [ebp - 0x1c]
call fcn.00406d00
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x28]
push eax
push 0
push str.DefaultValue
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esi - 8]
push esi
call fcn.0049ef33
add esp, 8
test eax, eax
js 0x4234dc
cmp eax, dword [esi - 8]
jg 0x4234dc
mov dword [esi - 0xc], eax
xor ecx, ecx
mov word [esi + eax*2], cx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esi - 0xc], 0
jl 0x4238d1
push str.PMIL
push esi
call fcn.0049ef52
add esp, 8
test eax, eax
je 0x4238d1
sub eax, esi
sar eax, 1
jne 0x4238d1
mov eax, 1
jmp 0x4238d4
mov eax, ebx
jmp 0x4238d4
mov eax, dword [ebp - 0x24]
or ebx, 0xffffffff
cmp dword [0x51112c], 0x80000002
jne 0x423905
push 0x518040
mov ecx, 0x518050
call fcn.00402610
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x518048
call fcn.00402610
jmp 0x423a4d
test eax, eax
je 0x42396a
call fcn.00423c50
test al, al
je 0x4238e3
cmp byte [0x517ebc], 0
jne 0x4238e3
push str.Software_
lea ecx, [ebp - 0x24]
call fcn.00401c40
push eax
mov ecx, 0x518050
mov byte [ebp - 4], 2
call fcn.00402610
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4238f2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x518048
call fcn.00402610
jmp 0x423a4d
push 0x518048
call fcn.00422d50
add esp, 4
test al, al
jne 0x42398c
push 0x1e
push str.Packageswindows_ie_ac_001AC
mov ecx, 0x518048
call fcn.00402ea0
push str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppContainerStoragewindows_ie_ac_001Software_
lea ecx, [ebp - 0x24]
call fcn.00401c40
push eax
mov ecx, 0x518050
mov byte [ebp - 4], 3
call fcn.00402610
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4239c8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [0x517280]
mov eax, ecx
imul eax, ecx
and eax, reloc.OLEAUT32.dll_VariantInit
jns 0x4239df
dec eax
or eax, 0xfffffff8
inc eax
cmp eax, 5
jne 0x423a4d
test ecx, ecx
je 0x423a4d
jmp 0x4239f0
mov eax, ecx
and eax, 0x80000001
jns 0x4239fe
dec eax
or eax, 0xfffffffe
inc eax
jne 0x423a0b
mov eax, ecx
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
jmp 0x423a12
lea ecx, [ecx*2 + 1]
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
lea eax, [eax + eax*2]
sub edx, eax
mov dword [0x517280], ecx
sub edx, 0
je 0x423a3c
sub edx, 2
je 0x423a3f
dec edx
je 0x423a40
jmp 0x423a49
add ecx, 2
inc ecx
add ecx, 2
mov dword [0x517280], ecx
test ecx, ecx
jne 0x4239f0
mov eax, dword [0x518050]
cmp dword [eax - 0xc], 0
jl 0x423a87
push str.windows_ie_ac_001
push eax
call fcn.0049ef52
add esp, 8
test eax, eax
je 0x423a87
sub eax, dword [0x518050]
sar eax, 1
test eax, eax
jle 0x423a87
push 0x518040
mov ecx, 0x518054
call fcn.00402610
jmp 0x423ae8
call fcn.00423c50
test al, al
je 0x423aac
cmp byte [0x517ebc], 0
jne 0x423aac
push str.Software_
lea ecx, [ebp - 0x24]
call fcn.00401c40
mov byte [ebp - 4], 5
jmp 0x423abd
push str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppContainerStoragewindows_ie_ac_001Software_
lea ecx, [ebp - 0x24]
call fcn.00401c40
mov byte [ebp - 4], 4
push eax
mov ecx, 0x518054
call fcn.00402610
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
mov byte [ebp - 4], 1
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x423ae8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [0x51112c], reloc.OLEAUT32.dll_SysReAllocString
je 0x423b85
cmp byte [0x511128], 0
je 0x423b85
lea eax, [ebp - 0x24]
push eax
call fcn.00424440
add esp, 4
mov eax, dword [eax]
mov ecx, 0x518050
push dword [eax - 0xc]
mov byte [ebp - 4], 6
push eax
call fcn.00402ea0
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x423b45
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x2c]
push eax
call fcn.00424440
add esp, 4
mov eax, dword [eax]
mov ecx, 0x518054
push dword [eax - 0xc]
mov byte [ebp - 4], 7
push eax
call fcn.00402ea0
mov edx, dword [ebp - 0x2c]
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x423b85
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 1
push dword [0x51112c]
push 0x518050
call fcn.00422c20
push 1
push dword [0x51112c]
push 0x518054
call fcn.00422c20
add edi, 0xfffffff0
add esp, 0x18
mov byte [ebp - 4], 0
lea eax, [edi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x423bc9
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x423be7
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp + 0x10], 0
je 0x423c01
cmp byte [ebp + 0xc], 0
je 0x423bfa
mov eax, dword [0x518054]
jmp 0x423c06
mov eax, dword [0x518050]
jmp 0x423c06
mov eax, dword [0x518048]
add eax, 0xfffffff0
push eax
call fcn.00404f90
lea ecx, [eax + 0x10]
mov eax, dword [ebp + 8]
add esp, 4
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret