Function at 0x4070c0
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push str.shell32.dll
mov ebx, ecx
mov dword [esp + 8], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x4070ed
push str.SHGetSpecialFolderPathA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], eax
mov byte [ebx], 0
mov al, byte [0x4401c0]
test al, al
jne 0x4072f5
mov ecx, ebx
call fcn.00406c10
push 0x104
push 0x4402d0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x104
push 0x4404e0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x4405e8
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, 0x4405e8
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407140
sub eax, edx
cmp byte [eax + 0x4405e7], 0x5c
jne 0x40716f
mov eax, 0x4405e8
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407160
sub eax, edx
mov byte [eax + 0x4405e7], cl
push ebp
push esi
push edi
push 0x104
push 0x4403d8
mov ecx, ebx
call fcn.004067e0
mov al, byte [0x440b0c]
test al, al
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
je 0x4071b5
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4071b5
push 0
push 0x17
push 0x4406f0
push 0
call eax
jmp 0x4071f9
lea eax, [esp + 0x14]
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
mov dword [esp + 0x2c], 0x104
call esi
test eax, eax
jne 0x4071f9
lea ecx, [esp + 0x18]
push ecx
push 0x4406f0
lea edx, [esp + 0x24]
push edx
push eax
mov eax, dword [esp + 0x24]
push str.Programs
push eax
call edi
mov ecx, dword [esp + 0x14]
push ecx
call ebp
mov al, byte [0x440b0c]
test al, al
je 0x407219
mov eax, dword [esp + 0x10]
test eax, eax
je 0x407219
push 0
push 0x19
push 0x440900
push 0
call eax
jmp 0x40725e
lea edx, [esp + 0x14]
push edx
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
mov dword [esp + 0x2c], 0x104
call esi
test eax, eax
jne 0x40725e
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push 0x440900
lea ecx, [esp + 0x24]
push ecx
push 0
push str.Desktop
push edx
call edi
mov eax, dword [esp + 0x14]
push eax
call ebp
mov al, byte [0x440b0c]
test al, al
je 0x40727e
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40727e
push 0
push 0x18
push 0x4407f8
push 0
call eax
jmp 0x4072c3
lea ecx, [esp + 0x14]
push ecx
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
mov dword [esp + 0x2c], 0x104
call esi
test eax, eax
jne 0x4072c3
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push 0x4407f8
lea eax, [esp + 0x24]
push eax
push 0
push str.Startup
push ecx
call edi
mov edx, dword [esp + 0x14]
push edx
call ebp
mov al, byte [0x440b0c]
test al, al
pop edi
pop esi
mov byte [0x4401c0], 1
pop ebp
je 0x4072ee
mov ecx, ebx
call fcn.00406e90
test eax, eax
setne al
mov byte [0x440b0d], al
mov eax, ebx
pop ebx
add esp, 0x10
ret
mov byte [0x440b0d], 1
mov eax, ebx
pop ebx
add esp, 0x10
ret