Function at 0x406d60
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push str.shell32.dll
mov ebx, ecx
mov dword [esp + 8], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x406d8d
push str.SHGetSpecialFolderPathA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], eax
mov byte [ebx], 0
mov al, byte [0x43e180]
test al, al
jne 0x406f95
mov ecx, ebx
call fcn.004068b0
push 0x104
push 0x43e290
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x104
push 0x43e4a0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x43e5a8
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, 0x43e5a8
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406de0
sub eax, edx
cmp byte [eax + 0x43e5a7], 0x5c
jne 0x406e0f
mov eax, 0x43e5a8
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406e00
sub eax, edx
mov byte [eax + 0x43e5a7], cl
push ebp
push esi
push edi
push 0x104
push 0x43e398
mov ecx, ebx
call fcn.004065a0
mov al, byte [0x43eacc]
test al, al
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
je 0x406e55
mov eax, dword [esp + 0x10]
test eax, eax
je 0x406e55
push 0
push 0x17
push 0x43e6b0
push 0
call eax
jmp 0x406e99
lea eax, [esp + 0x14]
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
mov dword [esp + 0x2c], 0x104
call esi
test eax, eax
jne 0x406e99
lea ecx, [esp + 0x18]
push ecx
push 0x43e6b0
lea edx, [esp + 0x24]
push edx
push eax
mov eax, dword [esp + 0x24]
push str.Programs
push eax
call edi
mov ecx, dword [esp + 0x14]
push ecx
call ebp
mov al, byte [0x43eacc]
test al, al
je 0x406eb9
mov eax, dword [esp + 0x10]
test eax, eax
je 0x406eb9
push 0
push 0x19
push 0x43e8c0
push 0
call eax
jmp 0x406efe
lea edx, [esp + 0x14]
push edx
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
mov dword [esp + 0x2c], 0x104
call esi
test eax, eax
jne 0x406efe
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push 0x43e8c0
lea ecx, [esp + 0x24]
push ecx
push 0
push str.Desktop
push edx
call edi
mov eax, dword [esp + 0x14]
push eax
call ebp
mov al, byte [0x43eacc]
test al, al
je 0x406f1e
mov eax, dword [esp + 0x10]
test eax, eax
je 0x406f1e
push 0
push 0x18
push 0x43e7b8
push 0
call eax
jmp 0x406f63
lea ecx, [esp + 0x14]
push ecx
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
mov dword [esp + 0x2c], 0x104
call esi
test eax, eax
jne 0x406f63
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push 0x43e7b8
lea eax, [esp + 0x24]
push eax
push 0
push str.Startup
push ecx
call edi
mov edx, dword [esp + 0x14]
push edx
call ebp
mov al, byte [0x43eacc]
test al, al
pop edi
pop esi
mov byte [0x43e180], 1
pop ebp
je 0x406f8e
mov ecx, ebx
call fcn.00406b30
test eax, eax
setne al
mov byte [0x43eacd], al
mov eax, ebx
pop ebx
add esp, 0x10
ret
mov byte [0x43eacd], 1
mov eax, ebx
pop ebx
add esp, 0x10
ret