Function at 0x402210
Capabilities:
Persist via run registry key
Query environment variable

Disassembly:
push ebp
mov ebp, esp
lea edx, [ebp - 0x18]
push edi
push esi
push ebx
sub esp, 0x8c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x44], 0x408ad0
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
mov dword [ebp - 0x40], 0x4168aa
mov dword [ebp - 0x38], 0x4023d5
mov dword [ebp - 0x34], esp
call fcn.0040c1f0
mov dword [esp], str.NbLauncher::findUserDir__
mov dword [ebp - 0x58], 0xffffffff
call fcn.004056d0
mov eax, dword [str._HOME]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [esp + 8], eax
mov edx, dword [str._HOME]
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_strncmp
test eax, eax
jne 0x402384
mov edx, dword [ebp - 0x64]
add edx, 0x10
mov dword [ebp - 0x68], edx
mov edx, dword [ebp - 0x64]
mov eax, dword [edx + 0x10]
mov eax, dword [eax - 0xc]
test eax, eax
jne 0x4022f5
mov eax, dword [str.USERPROFILE]
mov dword [esp], eax
call sub.msvcrt.dll_getenv
mov dword [ebp - 0x6c], eax
test eax, eax
je 0x402422
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x6c]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.00414028
mov edx, dword [ebp - 0x64]
mov eax, dword [edx + 0x10]
mov dword [esp], 0x4193c9
mov dword [ebp - 0x58], 0xffffffff
mov dword [esp + 4], eax
call fcn.004056d0
mov eax, dword [ebp - 0x64]
mov edx, dword [ebp - 0x64]
add eax, 0x14
mov dword [ebp - 0x74], eax
mov eax, dword [str._HOME]
add edx, 0x10
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [ebp - 0x58], 0xffffffff
mov ebx, dword [ebp + 0xc]
add eax, ebx
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x28]
mov dword [esp], eax
call fcn.00415818
mov edx, dword [ebp - 0x78]
mov dword [esp], edx
call sub.msvcrt.dll_strlen
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x78]
lea edx, [ebp - 0x28]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [ebp - 0x58], 2
call fcn.00413c88
mov dword [ebp - 0x58], 1
mov edx, dword [ebp - 0x74]
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00414138
mov dword [ebp - 0x58], 0xffffffff
lea eax, [ebp - 0x28]
mov dword [esp], eax
call fcn.00415f88
jmp 0x4023b5
mov eax, dword [ebp - 0x64]
mov edx, dword [ebp + 0xc]
add eax, 0x14
mov dword [esp], edx
mov dword [ebp - 0x80], eax
call sub.msvcrt.dll_strlen
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x80]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x58], 0xffffffff
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.00414028
mov dword [ebp - 0x60], 1
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call fcn.0040c2d0
mov eax, dword [ebp - 0x60]
add esp, 0x8c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x80000001
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x58], 0xffffffff
mov dword [esp + 0xc], eax
mov eax, dword [str.Desktop]
mov dword [esp + 8], eax
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders]
mov dword [esp + 4], eax
call fcn.00406010
mov dword [ebp - 0x60], 0
test al, al
je 0x4023bc
mov dword [ebp - 0x58], 0xffffffff
mov edx, dword [ebp - 0x68]
mov eax, 0xffffffff
mov dword [esp + 8], eax
mov eax, 0x5c
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.00412b48
mov dword [ebp - 0x70], eax
mov edx, dword [ebp - 0x64]
mov eax, dword [edx + 0x10]
mov edx, dword [ebp - 0x70]
cmp dword [eax - 0xc], edx
jb 0x4024c8
mov edx, dword [ebp - 0x64]
xor esi, esi
mov edi, dword [ebp - 0x70]
mov eax, dword [edx + 0x10]
mov edx, dword [ebp - 0x68]
mov eax, dword [eax - 0xc]
mov dword [esp + 0xc], esi
mov dword [esp], edx
sub eax, edi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x58], 0xffffffff
mov dword [esp + 4], eax
call fcn.00415528
jmp 0x4022d8
mov dword [esp], 0x4193d7
call fcn.00409a30
jmp 0x402492