Function at 0x4d67cb
Capabilities:
Persist via run registry key

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx]
test eax, eax
je 0x4d6a08
cmp eax, 0x1a
jg 0x4d690c
je 0x4d68ed
sub eax, 8
je 0x4d68ce
sub eax, 3
je 0x4d68af
sub eax, 5
je 0x4d6890
sub eax, 6
je 0x4d6871
dec eax
je 0x4d6852
dec eax
je 0x4d6833
dec eax
jne 0x4d6a40
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea eax, [ebx + 8]
push eax
mov dword [ebx + 4], reloc.OLEAUT32.dll_SysReAllocString
call fcn.00412116
push str.Common_Desktop
jmp 0x4d6a37
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea eax, [ebx + 8]
push eax
mov dword [ebx + 4], reloc.OLEAUT32.dll_SysReAllocString
call fcn.00412116
push str.Common_Startup
jmp 0x4d6a37
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea eax, [ebx + 8]
push eax
mov dword [ebx + 4], reloc.OLEAUT32.dll_SysReAllocString
call fcn.00412116
push str.Common_Programs
jmp 0x4d6a37
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea eax, [ebx + 8]
push eax
mov dword [ebx + 4], reloc.OLEAUT32.dll_SysReAllocString
call fcn.00412116
push str.Common_Start_Menu
jmp 0x4d6a37
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea eax, [ebx + 8]
push eax
mov dword [ebx + 4], SysReAllocString
call fcn.00412116
push str.Desktop
jmp 0x4d6a37
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea eax, [ebx + 8]
push eax
mov dword [ebx + 4], SysReAllocString
call fcn.00412116
push str.Start_Menu
jmp 0x4d6a37
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea eax, [ebx + 8]
push eax
mov dword [ebx + 4], SysReAllocString
call fcn.00412116
push str.Recent
jmp 0x4d6a37
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea eax, [ebx + 8]
push eax
mov dword [ebx + 4], SysReAllocString
call fcn.00412116
push str.AppData
jmp 0x4d6a37
sub eax, 0x1c
je 0x4d69ec
sub eax, 4
je 0x4d69d0
dec eax
je 0x4d69b4
dec eax
je 0x4d6995
dec eax
je 0x4d6976
sub eax, 3
je 0x4d6957
dec eax
dec eax
jne 0x4d6a40
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea eax, [ebx + 8]
push eax
mov dword [ebx + 4], SysReAllocString
call fcn.00412116
push str.Personal
jmp 0x4d6a37
push str.SOFTWAREMicrosoftWindowsCurrentVersion
lea eax, [ebx + 8]
push eax
mov dword [ebx + 4], reloc.OLEAUT32.dll_SysReAllocString
call fcn.00412116
push str.ProgramFilesDir
jmp 0x4d6a37
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea eax, [ebx + 8]
push eax
mov dword [ebx + 4], reloc.OLEAUT32.dll_SysReAllocString
call fcn.00412116
push str.Common_AppData
jmp 0x4d6a37
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea eax, [ebx + 8]
push eax
mov dword [ebx + 4], SysReAllocString
call fcn.00412116
push 0x539a60
jmp 0x4d6a37
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea eax, [ebx + 8]
push eax
mov dword [ebx + 4], SysReAllocString
call fcn.00412116
push 0x539a70
jmp 0x4d6a37
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea eax, [ebx + 8]
push eax
mov dword [ebx + 4], SysReAllocString
call fcn.00412116
push 0x5398a8
jmp 0x4d6a37
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea eax, [ebx + 8]
push eax
mov dword [ebx + 4], SysReAllocString
call fcn.00412116
push str.Local_AppData
jmp 0x4d6a37
push esi
push edi
push 4
pop ecx
mov edi, 0x525d5c
lea esi, [ebx + 0x14]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
pop edi
pop esi
jne 0x4d6a40
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea eax, [ebx + 8]
push eax
mov dword [ebx + 4], SysReAllocString
call fcn.00412116
push str.A520A1A4_1780_4FF6_BD18_167343C5AF16
add ebx, 0xc
push ebx
call fcn.00412116
pop ebx
ret