Function at 0x523d90
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x83c
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [esp + 0x850]
mov ebp, dword [esp + 0x85c]
mov esi, dword [esp + 0x854]
mov dword [ecx + 0xc], 0
mov byte [esp + 0x30], 0
mov dword [ecx], eax
mov eax, dword [esp + 0x858]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [esp], ebp
mov edi, eax
call sub.msvcrt.dll_strlen
test esi, esi
lea edi, [edi + eax + 8]
je 0x523f81
cmp esi, 1
je 0x523f24
lea esi, [esp + 0x30]
cmp byte [esp + 0x31], 0
jne 0x523e11
cmp byte [esp + 0x30], 0
je 0x524010
mov dword [esp], esi
call sub.msvcrt.dll_wcslen
lea eax, [eax + eax + 2]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [esp + 4], esi
mov edi, eax
mov dword [esp], eax
call sub.msvcrt.dll_wcscpy
mov dword [esp], edi
call sub.msvcrt.dll_wcslen
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x7ff
mov dword [esp], esi
call fcn.0060a560
mov byte [esp + eax + 0x30], 0
mov dword [esp], edi
call fcn.004defc0
mov eax, esi
mov ecx, dword [eax]
add eax, 4
lea edx, [ecx - 0x1010101]
not ecx
and edx, ecx
and edx, 0x80808080
je 0x523e62
mov ecx, edx
mov edi, dword [esp + 0x858]
mov dword [esp + 0x10], ebp
shr ecx, 0x10
test edx, 0x8080
mov dword [esp + 8], str.__s__s.prefs
cmove edx, ecx
lea ecx, [eax + 2]
mov dword [esp + 0xc], edi
cmove eax, ecx
mov ecx, edx
add cl, dl
mov edx, 0x800
sbb eax, 3
sub eax, esi
sub edx, eax
add eax, esi
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0060b840
movzx edx, byte [esp + 0x30]
mov eax, esi
test dl, dl
jne 0x523f1d
mov dword [esp], esi
mov esi, dword [sym.imp.msvcrt.dll__strdup]
call esi
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x858]
mov dword [esp], eax
call esi
mov dword [esp], ebp
mov dword [ebx + 8], eax
call esi
mov ecx, ebx
mov dword [ebx + 0xc], eax
call fcn.005238c0
add esp, 0x83c
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov byte [eax], 0x2f
add eax, 1
movzx edx, byte [eax]
test dl, dl
je 0x523ecd
cmp dl, 0x5c
jne 0x523f13
jmp 0x523f10
lea eax, [esp + 0x2c]
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov dword [esp], 0x80000001
mov dword [esp + 8], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
sub esp, 0xc
test eax, eax
lea esi, [esp + 0x30]
jne 0x523dff
mov eax, 0x800
mov dword [esp + 0x10], esi
mov dword [esp + 8], 0
sub eax, edi
mov dword [esp + 4], str.AppData
mov dword [esp + 0x28], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x24]
mov dword [esp + 0xc], eax
jmp 0x523fdc
lea eax, [esp + 0x2c]
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov dword [esp], 0x80000002
mov dword [esp + 8], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
sub esp, 0xc
test eax, eax
jne 0x523dfb
mov eax, 0x800
lea esi, [esp + 0x30]
mov dword [esp + 8], 0
sub eax, edi
mov dword [esp + 4], str.Common_AppData
mov dword [esp + 0x28], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
lea eax, [esp + 0x24]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
je 0x523ff7
cmp dword [esp + 0x24], 1
je 0x524025
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 4
jmp 0x523dff
mov dword [esp + 0x30], 0x465c3a43
mov dword [esp + 0x34], 0x4b544c
jmp 0x523e60
mov byte [esp + 0x30], 0
mov byte [esp + 0x31], 0
jmp 0x523ff7