Function at 0x4444f0
Capabilities:
Check os version
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ed6c0
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push esi
push edi
mov eax, dword [0x555ab0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x12], dl
mov ebx, ecx
mov dword [ebp - 0x3c], ebx
mov eax, dword [0x55fdc4]
mov dword [ebp - 0x4c], 0
test al, 1
jne 0x44455f
or eax, 1
mov dword [0x55fdc4], eax
mov eax, dword [0x5556d8]
mov ecx, 0x5556d8
call dword [eax + 0xc]
add eax, 0x10
push 0x4f98c0
mov dword [0x55fdc8], eax
call fcn.004b08e6
mov eax, dword [0x55fdc4]
add esp, 4
test al, 2
jne 0x444592
or eax, 2
mov dword [0x55fdc4], eax
mov eax, dword [0x5556d8]
mov ecx, 0x5556d8
call dword [eax + 0xc]
add eax, 0x10
push 0x4f9890
mov dword [0x55fdc0], eax
call fcn.004b08e6
mov eax, dword [0x55fdc4]
add esp, 4
test al, 4
jne 0x4445c5
or eax, 4
mov dword [0x55fdc4], eax
mov eax, dword [0x5556d8]
mov ecx, 0x5556d8
call dword [eax + 0xc]
add eax, 0x10
push 0x4f9860
mov dword [0x55fdbc], eax
call fcn.004b08e6
mov eax, dword [0x55fdc4]
add esp, 4
test al, 8
jne 0x4445f3
or eax, 8
mov dword [0x55fdc4], eax
mov eax, dword [0x5556d8]
mov ecx, 0x5556d8
call dword [eax + 0xc]
add eax, 0x10
push 0x4f9830
mov dword [0x55fdcc], eax
call fcn.004b08e6
add esp, 4
mov eax, dword [0x55fdc0]
cmp dword [eax - 0xc], 0
je 0x44460b
call fcn.004478f0
test al, al
je 0x444f96
mov eax, dword [0x55f7bc]
mov esi, dword [0x55fdcc]
lea edi, [eax - 0x10]
add esi, 0xfffffff0
cmp edi, esi
je 0x444664
cmp dword [esi + 0xc], 0
lea ebx, [esi + 0xc]
jl 0x444656
mov edx, dword [edi]
cmp edx, dword [esi]
jne 0x444656
mov ecx, edi
call fcn.004022e0
mov edi, eax
or ecx, 0xffffffff
lock xadd dword [ebx], ecx
dec ecx
test ecx, ecx
jg 0x44464c
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
lea eax, [edi + 0x10]
mov dword [0x55fdcc], eax
jmp 0x444664
push dword [eax - 0xc]
mov ecx, 0x55fdcc
push eax
call fcn.004021b0
mov ecx, 0x55fdc8
call fcn.00401f60
mov ecx, 0x55fdc0
call fcn.00401f60
mov ecx, 0x55fdbc
call fcn.00401f60
xor eax, eax
mov dword [ebp - 0x38], eax
mov eax, dword [0x5556d8]
mov ecx, 0x5556d8
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0
mov eax, dword [0x5556d8]
mov ecx, 0x5556d8
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x24], edi
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
push str.Volatile_Environment
push SysReAllocStringLen
mov byte [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, 1
test eax, eax
jne 0x4448b6
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4448a6
mov dword [ebp - 0x1c], 0x104
mov eax, dword [esi - 8]
mov ecx, ebx
sub ecx, dword [esi - 4]
sub eax, 0x82
or eax, ecx
jge 0x444734
push 0x82
lea ecx, [ebp - 0x20]
call fcn.00402270
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
push eax
push esi
lea eax, [ebp - 0x28]
push eax
push 0
push str.AppData
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44477b
push dword [esi - 8]
push esi
call fcn.004b13a3
add esp, 8
test eax, eax
js 0x444771
cmp eax, dword [esi - 8]
jg 0x444771
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
jmp 0x444786
push 0x80070057
call fcn.00401840
lea ecx, [ebp - 0x20]
call fcn.00401f60
mov esi, dword [ebp - 0x20]
mov eax, dword [0x55fdc8]
mov dword [ebp - 0x1c], 0x104
mov ecx, dword [eax - 8]
mov edx, ebx
sub edx, dword [eax - 4]
sub ecx, 0x82
or ecx, edx
jge 0x4447b8
push 0x82
mov ecx, 0x55fdc8
call fcn.00402270
mov eax, dword [0x55fdc8]
lea ecx, [ebp - 0x1c]
push ecx
push eax
lea eax, [ebp - 0x28]
push eax
push 0
push str.Local_AppData
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44480b
mov eax, dword [0x55fdc8]
push dword [eax - 8]
push eax
call fcn.004b13a3
mov edx, eax
add esp, 8
test edx, edx
js 0x444771
mov ecx, dword [0x55fdc8]
cmp edx, dword [ecx - 8]
jg 0x444771
mov dword [ecx - 0xc], edx
mov eax, dword [0x55fdc8]
xor ecx, ecx
mov word [eax + edx*2], cx
jmp 0x444815
mov ecx, 0x55fdc8
call fcn.00401f60
mov dword [ebp - 0x1c], 0x104
mov eax, dword [edi - 8]
mov ecx, ebx
sub ecx, dword [edi - 4]
sub eax, 0x82
or eax, ecx
jge 0x44483d
push 0x82
lea ecx, [ebp - 0x24]
call fcn.00402270
mov edi, dword [ebp - 0x24]
lea eax, [ebp - 0x1c]
push eax
push edi
lea eax, [ebp - 0x28]
push eax
push 0
push str.A520A1A4_1780_4FF6_BD18_167343C5AF16
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44488b
push dword [edi - 8]
push edi
call fcn.004b13a3
add esp, 8
test eax, eax
js 0x444771
cmp eax, dword [edi - 8]
jg 0x444771
mov dword [edi - 0xc], eax
xor ecx, ecx
mov word [edi + eax*2], cx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4448b6
push 0x55fdc8
lea ecx, [ebp - 0x24]
call fcn.004020f0
push dword [ebp - 0x18]
mov edi, dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4448b6
push 0x55fdc8
lea ecx, [ebp - 0x24]
call fcn.004020f0
mov edi, dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_GetVersion]
movzx ecx, al
shr eax, 8
movzx eax, al
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], ecx
mov ecx, dword [0x55e860]
mov dword [ebp - 0x30], 0x17
lea eax, [ecx + 1]
imul eax, ecx
cdq
idiv dword [ebp - 0x30]
mov eax, dword [0x55f824]
movsd xmm1, qword [0x53f9d8]
movsd xmm5, qword [0x53fa00]
movsd xmm4, qword [0x53f9d0]
mov dword [ebp - 0x30], 0x4d1c0de7
xorps xmm2, xmm2
movsd qword [ebp - 0x5c], xmm5
movsd qword [ebp - 0x54], xmm4
cmp edx, 0xb
cmove eax, dword [ebp - 0x30]
mov dword [0x55f824], eax
mov eax, dword [ebp - 0x40]
movsd qword [ebp - 0x44], xmm1
movsd qword [ebp - 0x34], xmm2
cmp eax, 6
ja 0x44493f
jne 0x444938
cmp dword [ebp - 0x48], ebx
ja 0x44493f
mov eax, ebx
jmp 0x444bd0
imul ecx, ecx
mov eax, ecx
cdq
mov ecx, 0x15
idiv ecx
mov byte [ebp - 0x11], bl
cmp edx, 5
jne 0x44496a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x50
div ecx
inc edx
mov dword [0x55e860], edx
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x444b0e
mov dword [ebp - 0x1c], 0x104
mov eax, dword [esi - 8]
sub ebx, dword [esi - 4]
sub eax, 0x82
or eax, ebx
jge 0x4449b3
push 0x82
lea ecx, [ebp - 0x20]
call fcn.00402270
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
push eax
push esi
lea eax, [ebp - 0x28]
push eax
push 0
push str.Isolation
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x444af7
mov ebx, dword [0x55e860]
lea ecx, [ebx + 1]
lea eax, [ebx + 2]
imul eax, ecx
imul eax, ebx
cdq
mov ecx, 0x13
idiv ecx
cmp edx, 0xb
jne 0x444a40
movsd xmm3, qword [ebp - 0x44]
movsd xmm2, qword [ebp - 0x34]
movsd xmm5, qword [ebp - 0x54]
movsd xmm6, qword [ebp - 0x5c]
movd xmm4, ebx
cvtdq2pd xmm4, xmm4
nop
addsd xmm2, xmm3
movapd xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x444a2a
subsd xmm2, xmm3
divsd xmm3, xmm6
movapd xmm1, xmm2
mulsd xmm1, xmm2
movapd xmm0, xmm4
subsd xmm0, xmm1
comisd xmm0, xmm5
ja 0x444a10
push dword [esi - 8]
push esi
call fcn.004b13a3
add esp, 8
test eax, eax
js 0x444771
cmp eax, dword [esi - 8]
jg 0x444771
mov dword [esi - 0xc], eax
xor ecx, ecx
mov word [esi + eax*2], cx
mov ebx, dword [0x55e860]
mov byte [ebp - 0x11], cl
lea ecx, [ebx + 1]
lea eax, [ebx + 2]
imul eax, ecx
imul eax, ebx
cdq
mov ecx, 7
idiv ecx
cmp edx, 2
jne 0x444ad2
movsd xmm3, qword [ebp - 0x44]
movsd xmm2, qword [ebp - 0x34]
movd xmm4, ebx
cvtdq2pd xmm4, xmm4
lea ebx, [ebx]
addsd xmm2, xmm3
movapd xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x444abb
subsd xmm2, xmm3
divsd xmm3, qword [ebp - 0x5c]
movapd xmm1, xmm2
mulsd xmm1, xmm2
movapd xmm0, xmm4
subsd xmm0, xmm1
comisd xmm0, xmmword [ebp - 0x54]
ja 0x444aa0
cmp dword [esi - 0xc], 0
jl 0x444af7
push 0x53b0c0
push esi
call fcn.004b0d33
add esp, 8
test eax, eax
je 0x444af7
sub eax, esi
sar eax, 1
jne 0x444af7
mov dword [ebp - 0x38], 1
push dword [ebp - 0x18]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
cmp byte [ebp - 0x11], 0
je 0x444bac
jmp 0x444b14
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftInternet_ExplorerAdvancedOptionsCRYPTOPROTECTEDMODESECURITY
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x444bb1
lea eax, [ebp - 0x1c]
push eax
push 0x82
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x104
call fcn.00401fc0
push eax
lea eax, [ebp - 0x28]
push eax
push 0
push str.DefaultValue
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, dword [ebp - 0x20]
push dword [esi - 8]
push esi
call fcn.004b13a3
add esp, 8
test eax, eax
js 0x444771
cmp eax, dword [esi - 8]
jg 0x444771
mov dword [esi - 0xc], eax
xor ecx, ecx
mov word [esi + eax*2], cx
push dword [ebp - 0x18]
call ebx
cmp dword [esi - 0xc], 0
jl 0x444bac
push str.PMIL
push esi
call fcn.004b0d33
add esp, 8
test eax, eax
je 0x444bac
sub eax, esi
sar eax, 1
je 0x444bb1
mov eax, dword [ebp - 0x38]
jmp 0x444bb6
mov eax, 1
mov ecx, dword [0x55e860]
movsd xmm2, qword [ebp - 0x34]
movsd xmm1, qword [ebp - 0x44]
movsd xmm4, qword [ebp - 0x54]
movsd xmm5, qword [ebp - 0x5c]
cmp dword [0x558ef4], reloc.OLEAUT32.dll_SysReAllocString
jne 0x444bfe
push 0x55f7bc
mov ecx, 0x55fdc0
call fcn.004020f0
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x55fdc8
call fcn.004020f0
jmp 0x444d74
test eax, eax
je 0x444c92
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
call ebx
cmp al, 6
setb al
test al, al
je 0x444c70
cmp byte [0x55e978], 0
jne 0x444c70
push 0x53b210
lea ecx, [ebp - 0x48]
call fcn.00402020
push eax
mov ecx, 0x55fdc0
mov byte [ebp - 4], 2
call fcn.004020f0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x48]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x444c7f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x55fdc8
call fcn.004020f0
jmp 0x444d7a
push 0x55f7bc
mov ecx, 0x55fdc0
call fcn.004020f0
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x55fdc8
call fcn.004020f0
jmp 0x444d7a
lea eax, [ecx + 1]
imul eax, ecx
cdq
mov ebx, 0xf
idiv ebx
cmp edx, 4
jne 0x444cea
movd xmm3, ecx
cvtdq2pd xmm3, xmm3
lea ecx, [ecx]
addsd xmm2, xmm1
movapd xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm3
jbe 0x444ccf
subsd xmm2, xmm1
divsd xmm1, xmm5
movsd qword [ebp - 0x44], xmm1
movapd xmm1, xmm2
mulsd xmm1, xmm2
movapd xmm0, xmm3
subsd xmm0, xmm1
movsd xmm1, qword [ebp - 0x44]
comisd xmm0, xmm4
ja 0x444cb0
call fcn.00444360
test al, al
jne 0x444d02
push str.Packageswindows_ie_ac_001AC
mov ecx, 0x55fdc8
call fcn.0041c880
push 0x53b118
lea ecx, [ebp - 0x48]
call fcn.00402020
push eax
mov ecx, 0x55fdc0
mov byte [ebp - 4], 3
call fcn.004020f0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x48]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x444d3f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [0x55e860]
lea ecx, [edx + 1]
lea eax, [edx + 2]
imul eax, ecx
imul eax, edx
cdq
mov ecx, 0xd
idiv ecx
cmp edx, 1
jne 0x444d74
call fcn.004b0a92
mov ecx, dword [0x55e860]
cmp ecx, eax
jne 0x444d74
dec ecx
mov dword [0x55e860], ecx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
mov eax, dword [0x55fdc0]
cmp dword [eax - 0xc], 0
jl 0x444db4
push str.windows_ie_ac_001
push eax
call fcn.004b0d33
add esp, 8
test eax, eax
je 0x444db4
sub eax, dword [0x55fdc0]
sar eax, 1
test eax, eax
jle 0x444db4
push 0x55f7bc
mov ecx, 0x55fdbc
call fcn.004020f0
jmp 0x444e2a
call ebx
cmp al, 6
setb al
test al, al
je 0x444ded
cmp byte [0x55e978], 0
jne 0x444ded
push 0x53b224
lea ecx, [ebp - 0x48]
call fcn.00402020
push eax
mov ecx, 0x55fdbc
mov byte [ebp - 4], 5
call fcn.004020f0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x48]
jmp 0x444e10
push str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppContainerStoragewindows_ie_ac_001Software_
lea ecx, [ebp - 0x40]
call fcn.00402020
push eax
mov ecx, 0x55fdbc
mov byte [ebp - 4], 4
call fcn.004020f0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x40]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x444e2a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [0x558ef4]
cmp ebx, reloc.OLEAUT32.dll_SysReAllocString
je 0x444ebd
lea ecx, [ebp - 0x38]
call fcn.004440f0
mov byte [ebp - 4], 6
mov eax, dword [eax]
mov ecx, 0x55fdc0
push dword [eax - 0xc]
push eax
call fcn.00411e80
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x38]
add edx, 0xfffffff0
or ebx, 0xffffffff
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x444e7b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x38]
call fcn.004440f0
mov byte [ebp - 4], 7
mov eax, dword [eax]
mov ecx, 0x55fdbc
push dword [eax - 0xc]
push eax
call fcn.00411e80
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x38]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x444eb7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [0x558ef4]
lea eax, [ebp - 0x24]
push eax
push 0x20019
push 0
push dword [0x55fdc0]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x444efd
push 0
lea eax, [ebp - 0x24]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [0x55fdc0]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x444f06
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [0x558ef4]
lea eax, [ebp - 0x30]
push eax
push 0x20019
push 0
push dword [0x55fdbc]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x444f4c
push 0
lea eax, [ebp - 0x30]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [0x55fdbc]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x444f55
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add edi, 0xfffffff0
or ebx, 0xffffffff
mov byte [ebp - 4], 0
lea eax, [edi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x444f75
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x444f93
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [ebp - 0x3c]
cmp byte [ebp - 0x12], 0
mov ecx, dword [0x55fdbc]
jne 0x444fa8
mov ecx, dword [0x55fdc0]
lea ecx, [ecx - 0x10]
call fcn.004022e0
add eax, 0x10
mov dword [ebx], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret