Function at 0x4309f0
Capabilities:
Check os version
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59d160
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf8
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
push edi
cmp eax, esi
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], esi
je 0x430e0e
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], esi
mov word [ebp - 0x24], si
lea eax, [ebp - 0x104]
mov byte [ebp - 4], 1
push eax
xor bl, bl
mov dword [ebp - 0x104], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x430c2a
cmp dword [ebp - 0xf4], 2
jne 0x430c2a
cmp dword [ebp - 0x100], 6
jb 0x430c2a
push str.shell32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, esi
mov dword [ebp - 0x1c], edi
je 0x430c2a
push str.SHGetKnownFolderPath
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x430c19
push 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x40], 0xb4bfcc3a
mov word [ebp - 0x3c], 0xdb2c
mov word [ebp - 0x3a], 0x424c
mov byte [ebp - 0x38], 0xb0
mov byte [ebp - 0x37], 0x29
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0xe9
mov byte [ebp - 0x34], 0x9a
mov byte [ebp - 0x33], 0x87
mov byte [ebp - 0x32], 0xc6
mov byte [ebp - 0x31], 0x41
call dword [sym.imp.ole32.dll_CoInitialize]
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x40]
push ecx
push 0
push 0
push edx
call esi
test eax, eax
jne 0x430c13
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x430c13
push eax
call fcn.0056ca2e
mov ecx, eax
mov eax, dword [ebp - 0x14]
add esp, 4
mov edi, 0x66318c
cmp word [eax + ecx*2 - 2], 0x5c
je 0x430b1e
mov edi, 0x639030
mov edx, 0x639028
mov esi, eax
test edx, edx
je 0x430c07
test eax, eax
je 0x430c07
test edi, edi
je 0x430c07
push edx
lea ecx, [ebp - 0x70]
call fcn.004039e0
push esi
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.004039b0
mov bl, 3
push edi
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], bl
call fcn.004039b0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 4
call fcn.00401070
mov edi, dword [ebp - 0x58]
test edi, edi
jne 0x430b77
lea edi, [ebp - 0x54]
mov esi, dword [ebp - 0x68]
lea ecx, [ebp - 0x64]
call fcn.00403a60
push eax
call fcn.0056ca2e
mov edx, eax
push edi
mov dword [ebp - 0x2c], edx
call fcn.0056ca2e
mov ecx, dword [ebp - 0x2c]
add esi, ecx
add eax, esi
lea edx, [eax + eax + 2]
push edx
call fcn.00584a5c
add esp, 0xc
mov dword [ebp - 0x28], eax
test eax, eax
je 0x430be1
lea ecx, [ebp - 0x64]
call fcn.00403a60
push eax
lea ecx, [ebp - 0x58]
call fcn.00403a60
push eax
lea ecx, [ebp - 0x70]
call fcn.00403a60
push eax
mov eax, dword [ebp - 0x28]
push eax
call fcn.0056ca74
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.0056ca2e
add esp, 0x14
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.00401070
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 1
call fcn.00401070
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov edi, dword [ebp - 0x1c]
mov bl, 1
call dword [sym.imp.ole32.dll_CoUninitialize]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test bl, bl
jne 0x430d1c
xor esi, esi
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x14], esi
push edx
push 0xf003f
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders_
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x430e02
mov ecx, dword [ebp - 0x1c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push esi
push str.Desktop
push ecx
call edi
test eax, eax
jne 0x430d09
mov edx, dword [0x65ec1c]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 5
call fcn.00588b01
mov edx, dword [ebp - 0x1c]
lea ecx, [ebp - 0x14]
mov esi, eax
push ecx
push esi
push 0
push 0
push str.Desktop
push edx
call edi
test eax, eax
jne 0x430cfb
mov eax, dword [0x65ec1c]
mov dword [ebp - 0x30], eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp - 4], 6
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [ecx + esi - 1]
cmp al, 0x5c
mov eax, 0x663188
je 0x430ccc
mov eax, 0x63a4cc
push eax
push esi
lea ecx, [ebp - 0x30]
push 0x639028
push ecx
call fcn.0058148b
mov edx, dword [ebp - 0x30]
add esp, 0x10
lea ecx, [ebp - 0x28]
push 0
push edx
call fcn.00402600
lea ecx, [ebp - 0x30]
mov bl, 1
mov byte [ebp - 4], 5
call fcn.005886c0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.005886c0
xor esi, esi
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x430d1e
jmp 0x430e02
xor esi, esi
mov ecx, dword [0x65ec1c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x18]
push edx
mov bl, 7
push 0x638fa8
push eax
mov byte [ebp - 4], bl
call fcn.0058148b
mov ecx, dword [ebp - 0x18]
add esp, 0xc
push 0x5c
push ecx
call fcn.0056c5b0
add esp, 8
cmp eax, esi
je 0x430df6
mov byte [eax + 1], 0
mov edx, dword [ebp - 0x18]
push esi
push edx
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x44], esi
mov word [ebp - 0x48], si
call fcn.00402600
mov eax, dword [ebp - 0x28]
cmp eax, esi
mov ecx, eax
jne 0x430d7e
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 0x4c]
cmp eax, esi
jne 0x430d88
lea eax, [ebp - 0x48]
push ecx
push eax
call fcn.0056eb4c
add esp, 8
test eax, eax
jne 0x430deb
mov eax, dword [0x663b54]
mov ecx, dword [0x663b58]
push 0x1030
push eax
push ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.005886c0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.00401070
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.005886c0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.00401070
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret