Function at 0x430400
Capabilities:
Check if file exists
Check os version
Get file attributes
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x59d107
push eax
mov eax, dword [0x663680]
mov dword fs:[0], esp
sub esp, 0x2ec
push ebx
xor ebx, ebx
push ebp
push esi
cmp eax, ebx
push edi
jne 0x430437
call fcn.0042eb00
test al, al
je 0x4309ca
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0xf4]
mov edx, dword [0x663680]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x18]
lea ecx, [esp + 0xf4]
push eax
push ecx
push ebx
push ebx
push str.LocalPathW
push edx
mov dword [esp + 0x30], 0x208
call edi
test eax, eax
jne 0x430491
mov ecx, dword [esp + 0x30c]
lea eax, [esp + 0xf4]
push eax
call fcn.00402e10
mov al, 1
jmp 0x4309cc
mov ecx, dword [0x65ec1c]
mov dword [esp + 0x1c], ecx
mov eax, dword [0x663680]
lea edx, [esp + 0x18]
push edx
push ebx
push ebx
push ebx
push str.LocalPath
push eax
mov dword [esp + 0x31c], ebx
call edi
test eax, eax
jne 0x43055b
mov ecx, dword [esp + 0x18]
push ecx
lea ecx, [esp + 0x20]
call fcn.00588b01
lea edx, [esp + 0x18]
mov ebp, eax
mov eax, dword [0x663680]
push edx
push ebp
push ebx
push ebx
push str.LocalPath
push eax
call edi
test eax, eax
jne 0x43055b
mov esi, dword [esp + 0x30c]
mov ecx, esi
call fcn.00401070
cmp ebp, ebx
je 0x430540
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x430540
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
push ebx
push 0xffffffffffffffff
push ebp
push ebx
push ebx
call edi
cmp eax, ebx
mov dword [esi + 8], eax
je 0x430540
lea ecx, [eax + eax + 2]
push ecx
call fcn.00584a5c
add esp, 4
cmp eax, ebx
mov dword [esi], eax
je 0x430540
mov edx, dword [esi + 8]
push edx
push eax
push 0xffffffffffffffff
push ebp
push ebx
push ebx
call edi
mov dword [esi + 8], eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x304], 0xffffffff
call fcn.005886c0
mov al, 1
jmp 0x4309cc
lea eax, [esp + 0x60]
mov dword [esp + 0x60], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov esi, dword [esp + 0x30c]
test eax, eax
je 0x4307b1
cmp dword [esp + 0x70], 2
jne 0x4307b1
cmp dword [esp + 0x64], 6
jb 0x4307b1
push str.shell32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
cmp ebp, ebx
mov dword [esp + 0x24], ebp
je 0x4307b1
push str.SHGetKnownFolderPath
push ebp
mov byte [esp + 0x1b], bl
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, ebx
je 0x430783
push ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x2c], 0x374de290
mov word [esp + 0x30], 0x123f
mov word [esp + 0x32], 0x4565
mov byte [esp + 0x34], 0x91
mov byte [esp + 0x35], 0x64
mov byte [esp + 0x36], 0x39
mov byte [esp + 0x37], 0xc4
mov byte [esp + 0x38], 0x92
mov byte [esp + 0x39], 0x5e
mov byte [esp + 0x3a], 0x46
mov byte [esp + 0x3b], 0x7b
call dword [sym.imp.ole32.dll_CoInitialize]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x28]
push ecx
push ebx
push ebx
push edx
call edi
cmp eax, ebx
jne 0x43077d
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x43077d
push eax
call fcn.0056ca2e
mov ebp, dword [esp + 0x18]
add esp, 4
mov edi, 0x66318c
cmp word [ebp + eax*2 - 2], 0x5c
je 0x430650
mov edi, 0x639030
mov eax, 0x639028
test eax, eax
je 0x43076d
cmp ebp, ebx
je 0x43076d
cmp edi, ebx
je 0x43076d
push ebx
push eax
lea ecx, [esp + 0x4c]
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x54], ebx
mov word [esp + 0x50], bx
call fcn.00402600
push ebp
lea ecx, [esp + 0x3c]
mov byte [esp + 0x308], 1
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x44], ebx
mov word [esp + 0x40], bx
call fcn.00402e10
push edi
lea ecx, [esp + 0x58]
mov byte [esp + 0x308], 2
call fcn.004039b0
mov ecx, esi
mov byte [esp + 0x304], 3
call fcn.00401070
mov edi, dword [esp + 0x4c]
lea ecx, [esp + 0x54]
call fcn.00403a60
push eax
call fcn.0056ca2e
add esp, 4
lea ecx, [esp + 0x38]
mov ebp, eax
call fcn.00403a60
push eax
call fcn.0056ca2e
add edi, ebp
add eax, edi
lea ecx, [eax + eax + 2]
push ecx
call fcn.00584a5c
add esp, 8
cmp eax, ebx
mov dword [esi], eax
je 0x430737
lea ecx, [esp + 0x54]
call fcn.00403a60
push eax
lea ecx, [esp + 0x3c]
call fcn.00403a60
push eax
lea ecx, [esp + 0x4c]
call fcn.00403a60
mov edx, dword [esi]
push eax
push edx
call fcn.0056ca74
mov eax, dword [esi]
push eax
call fcn.0056ca2e
add esp, 0x14
mov dword [esi + 8], eax
lea ecx, [esp + 0x54]
mov byte [esp + 0x304], 2
call fcn.00401070
lea ecx, [esp + 0x38]
mov byte [esp + 0x304], 1
call fcn.00401070
lea ecx, [esp + 0x44]
mov byte [esp + 0x304], bl
call fcn.00401070
mov ebp, dword [esp + 0x14]
push ebp
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ebp, dword [esp + 0x24]
mov byte [esp + 0x13], 1
call dword [sym.imp.ole32.dll_CoUninitialize]
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp byte [esp + 0x13], bl
je 0x4307ab
lea ecx, [esp + 0x1c]
mov dword [esp + 0x304], 0xffffffff
call fcn.005886c0
mov al, 1
jmp 0x4309cc
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x20]
push ecx
push 0xf003f
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders_
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4309b6
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x18]
push edx
push ebx
push ebx
push ebx
push str.Personal
push eax
call edi
test eax, eax
jne 0x4309ab
mov ecx, dword [esp + 0x18]
push ecx
lea ecx, [esp + 0x20]
call fcn.00588b01
lea edx, [esp + 0x18]
mov ebp, eax
mov eax, dword [esp + 0x20]
push edx
push ebp
push ebx
push ebx
push str.Personal
push eax
mov dword [esp + 0x68], ebp
call edi
test eax, eax
jne 0x4309ab
mov ecx, dword [0x65ec1c]
mov dword [esp + 0x14], ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + 0x304], 4
mov al, byte [ecx + ebp - 1]
cmp al, 0x5c
mov eax, 0x663188
je 0x43084e
mov eax, 0x63a4cc
push eax
push ebp
lea edx, [esp + 0x1c]
push str._s_sDownloads_
push edx
call fcn.0058148b
mov ebp, dword [esp + 0x24]
add esp, 0x10
mov ecx, esi
call fcn.00401070
cmp ebp, ebx
je 0x4308b7
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x4308b7
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
push ebx
push 0xffffffffffffffff
push ebp
push ebx
push ebx
call edi
cmp eax, ebx
mov dword [esi + 8], eax
je 0x4308b7
lea eax, [eax + eax + 2]
push eax
call fcn.00584a5c
add esp, 4
cmp eax, ebx
mov dword [esi], eax
je 0x4308b7
mov ecx, dword [esi + 8]
push ecx
push eax
push 0xffffffffffffffff
push ebp
push ebx
push ebx
call edi
mov dword [esi + 8], eax
mov eax, dword [esi]
cmp eax, ebx
jne 0x4308c0
lea eax, [esi + 4]
push ebx
push eax
call fcn.00465850
mov eax, dword [0x63c2c4]
add esp, 8
xor edi, edi
cmp eax, ebx
mov eax, dword [esi]
je 0x4308f0
cmp eax, ebx
jne 0x4308de
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x430978
jmp 0x430923
cmp eax, ebx
jne 0x4308f7
lea eax, [esi + 4]
push eax
lea ecx, [esp + 0x28]
call fcn.00588780
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x430916
mov edi, 1
lea ecx, [esp + 0x24]
call fcn.005886c0
cmp edi, ebx
je 0x430978
mov ecx, esi
call fcn.00401070
mov ebp, dword [esp + 0x50]
cmp ebp, ebx
je 0x430978
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x430978
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
push ebx
push 0xffffffffffffffff
push ebp
push ebx
push ebx
call edi
cmp eax, ebx
mov dword [esi + 8], eax
je 0x430978
lea eax, [eax + eax + 2]
push eax
call fcn.00584a5c
add esp, 4
cmp eax, ebx
mov dword [esi], eax
je 0x430978
mov ecx, dword [esi + 8]
push ecx
push eax
push 0xffffffffffffffff
push ebp
push ebx
push ebx
call edi
mov dword [esi + 8], eax
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x14]
mov byte [esp + 0x304], bl
call fcn.005886c0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x304], 0xffffffff
call fcn.005886c0
mov al, 1
jmp 0x4309cc
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x304], 0xffffffff
call fcn.005886c0
xor al, al
mov ecx, dword [esp + 0x2fc]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2f8
ret