Function at 0x413b40
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x118
push esi
mov esi, ecx
push str.shell32.dll
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x413b74
push str.SHGetSpecialFolderPathA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0xc], eax
mov byte [esi], 0
mov al, byte [0x45d9e8]
test al, al
jne 0x413df9
mov ecx, esi
call fcn.004135c0
push 0x104
push 0x45daf8
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x104
push 0x45dd08
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x45de10
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, 0x45de10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413bc3
sub eax, edx
cmp byte [eax + 0x45de0f], 0x5c
jne 0x413bef
mov eax, 0x45de10
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413be0
sub eax, edx
mov byte [eax + 0x45de0f], cl
push ebp
push edi
push 0x104
push 0x45dc00
mov ecx, esi
call fcn.004130c0
mov al, byte [0x45e334]
test al, al
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
je 0x413c34
mov eax, dword [esp + 0x14]
test eax, eax
je 0x413c34
push 0
push 0x17
push 0x45df18
push 0
call eax
jmp 0x413c78
lea eax, [esp + 0xc]
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
mov dword [esp + 0x24], 0x104
call esi
test eax, eax
jne 0x413c78
lea ecx, [esp + 0x10]
push ecx
push 0x45df18
lea edx, [esp + 0x24]
push edx
push eax
mov eax, dword [esp + 0x1c]
push str.Programs
push eax
call edi
mov ecx, dword [esp + 0xc]
push ecx
call ebp
mov al, byte [0x45e334]
test al, al
je 0x413c98
mov eax, dword [esp + 0x14]
test eax, eax
je 0x413c98
push 0
push 0x19
push 0x45e128
push 0
call eax
jmp 0x413cdd
lea edx, [esp + 0xc]
push edx
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
mov dword [esp + 0x24], 0x104
call esi
test eax, eax
jne 0x413cdd
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push 0x45e128
lea ecx, [esp + 0x24]
push ecx
push 0
push str.Desktop
push edx
call edi
mov eax, dword [esp + 0xc]
push eax
call ebp
mov al, byte [0x45e334]
test al, al
je 0x413cfd
mov eax, dword [esp + 0x14]
test eax, eax
je 0x413cfd
push 0
push 0x18
push 0x45e020
push 0
call eax
jmp 0x413d42
lea ecx, [esp + 0xc]
push ecx
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
mov dword [esp + 0x24], 0x104
call esi
test eax, eax
jne 0x413d42
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push 0x45e020
lea eax, [esp + 0x24]
push eax
push 0
push str.Startup
push ecx
call edi
mov edx, dword [esp + 0xc]
push edx
call ebp
mov al, byte [0x45e334]
test al, al
pop edi
pop ebp
je 0x413dc1
mov eax, dword [esp + 0xc]
test eax, eax
je 0x413dc1
push 0
push 0x28
lea ecx, [esp + 0x20]
push ecx
push 0
call eax
lea eax, [esp + 0x18]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413d70
sub eax, edx
cmp byte [esp + eax + 0x17], 0x5c
jne 0x413d94
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413d87
sub eax, edx
mov byte [esp + eax + 0x17], cl
lea edx, [esp + 0x18]
push 0x5c
push edx
call fcn.00425490
add esp, 8
mov byte [eax], 0
xor eax, eax
jmp 0x413db0
mov cl, byte [esp + eax + 0x18]
mov byte [eax + 0x45e338], cl
inc eax
test cl, cl
jne 0x413db0
jmp 0x413dd4
xor eax, eax
mov cl, byte [eax + 0x45dd08]
mov byte [eax + 0x45e338], cl
inc eax
test cl, cl
jne 0x413dc3
mov al, byte [0x45e334]
test al, al
mov byte [0x45d9e8], 1
je 0x413e03
mov esi, dword [esp + 0x10]
mov ecx, esi
call fcn.00413910
test eax, eax
setne al
mov byte [0x45e335], al
mov eax, esi
pop esi
add esp, 0x118
ret
mov eax, dword [esp + 0x10]
mov byte [0x45e335], 1
pop esi
add esp, 0x118
ret