Function at 0x4302c0
Capabilities:
Check if file exists
Check os version
Get file attributes
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x59b547
push eax
mov eax, dword [0x6614e8]
mov dword fs:[0], esp
sub esp, 0x2ec
push ebx
xor ebx, ebx
push ebp
push esi
cmp eax, ebx
push edi
jne 0x4302f7
call fcn.0042e9c0
test al, al
je 0x43088a
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0xf4]
mov edx, dword [0x6614e8]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x18]
lea ecx, [esp + 0xf4]
push eax
push ecx
push ebx
push ebx
push str.LocalPathW
push edx
mov dword [esp + 0x30], 0x208
call edi
test eax, eax
jne 0x430351
mov ecx, dword [esp + 0x30c]
lea eax, [esp + 0xf4]
push eax
call fcn.00402e20
mov al, 1
jmp 0x43088c
mov ecx, dword [0x65ca8c]
mov dword [esp + 0x1c], ecx
mov eax, dword [0x6614e8]
lea edx, [esp + 0x18]
push edx
push ebx
push ebx
push ebx
push str.LocalPath
push eax
mov dword [esp + 0x31c], ebx
call edi
test eax, eax
jne 0x43041b
mov ecx, dword [esp + 0x18]
push ecx
lea ecx, [esp + 0x20]
call fcn.00586f74
lea edx, [esp + 0x18]
mov ebp, eax
mov eax, dword [0x6614e8]
push edx
push ebp
push ebx
push ebx
push str.LocalPath
push eax
call edi
test eax, eax
jne 0x43041b
mov esi, dword [esp + 0x30c]
mov ecx, esi
call fcn.00401070
cmp ebp, ebx
je 0x430400
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x430400
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
push ebx
push 0xffffffffffffffff
push ebp
push ebx
push ebx
call edi
cmp eax, ebx
mov dword [esi + 8], eax
je 0x430400
lea ecx, [eax + eax + 2]
push ecx
call fcn.00582ecc
add esp, 4
cmp eax, ebx
mov dword [esi], eax
je 0x430400
mov edx, dword [esi + 8]
push edx
push eax
push 0xffffffffffffffff
push ebp
push ebx
push ebx
call edi
mov dword [esi + 8], eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x304], 0xffffffff
call fcn.00586b33
mov al, 1
jmp 0x43088c
lea eax, [esp + 0x60]
mov dword [esp + 0x60], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov esi, dword [esp + 0x30c]
test eax, eax
je 0x430671
cmp dword [esp + 0x70], 2
jne 0x430671
cmp dword [esp + 0x64], 6
jb 0x430671
push str.shell32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
cmp ebp, ebx
mov dword [esp + 0x24], ebp
je 0x430671
push str.SHGetKnownFolderPath
push ebp
mov byte [esp + 0x1b], bl
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, ebx
je 0x430643
push ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x2c], 0x374de290
mov word [esp + 0x30], 0x123f
mov word [esp + 0x32], 0x4565
mov byte [esp + 0x34], 0x91
mov byte [esp + 0x35], 0x64
mov byte [esp + 0x36], 0x39
mov byte [esp + 0x37], 0xc4
mov byte [esp + 0x38], 0x92
mov byte [esp + 0x39], 0x5e
mov byte [esp + 0x3a], 0x46
mov byte [esp + 0x3b], 0x7b
call dword [sym.imp.ole32.dll_CoInitialize]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x28]
push ecx
push ebx
push ebx
push edx
call edi
cmp eax, ebx
jne 0x43063d
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x43063d
push eax
call fcn.0056aeae
mov ebp, dword [esp + 0x18]
add esp, 4
mov edi, 0x660ffc
cmp word [ebp + eax*2 - 2], 0x5c
je 0x430510
mov edi, 0x637028
mov eax, 0x637020
test eax, eax
je 0x43062d
cmp ebp, ebx
je 0x43062d
cmp edi, ebx
je 0x43062d
push ebx
push eax
lea ecx, [esp + 0x4c]
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x54], ebx
mov word [esp + 0x50], bx
call fcn.00402610
push ebp
lea ecx, [esp + 0x3c]
mov byte [esp + 0x308], 1
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x44], ebx
mov word [esp + 0x40], bx
call fcn.00402e20
push edi
lea ecx, [esp + 0x58]
mov byte [esp + 0x308], 2
call fcn.004039c0
mov ecx, esi
mov byte [esp + 0x304], 3
call fcn.00401070
mov edi, dword [esp + 0x4c]
lea ecx, [esp + 0x54]
call fcn.00403a70
push eax
call fcn.0056aeae
add esp, 4
lea ecx, [esp + 0x38]
mov ebp, eax
call fcn.00403a70
push eax
call fcn.0056aeae
add edi, ebp
add eax, edi
lea ecx, [eax + eax + 2]
push ecx
call fcn.00582ecc
add esp, 8
cmp eax, ebx
mov dword [esi], eax
je 0x4305f7
lea ecx, [esp + 0x54]
call fcn.00403a70
push eax
lea ecx, [esp + 0x3c]
call fcn.00403a70
push eax
lea ecx, [esp + 0x4c]
call fcn.00403a70
mov edx, dword [esi]
push eax
push edx
call fcn.0056aef4
mov eax, dword [esi]
push eax
call fcn.0056aeae
add esp, 0x14
mov dword [esi + 8], eax
lea ecx, [esp + 0x54]
mov byte [esp + 0x304], 2
call fcn.00401070
lea ecx, [esp + 0x38]
mov byte [esp + 0x304], 1
call fcn.00401070
lea ecx, [esp + 0x44]
mov byte [esp + 0x304], bl
call fcn.00401070
mov ebp, dword [esp + 0x14]
push ebp
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ebp, dword [esp + 0x24]
mov byte [esp + 0x13], 1
call dword [sym.imp.ole32.dll_CoUninitialize]
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp byte [esp + 0x13], bl
je 0x43066b
lea ecx, [esp + 0x1c]
mov dword [esp + 0x304], 0xffffffff
call fcn.00586b33
mov al, 1
jmp 0x43088c
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x20]
push ecx
push 0xf003f
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders_
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x430876
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x18]
push edx
push ebx
push ebx
push ebx
push str.Personal
push eax
call edi
test eax, eax
jne 0x43086b
mov ecx, dword [esp + 0x18]
push ecx
lea ecx, [esp + 0x20]
call fcn.00586f74
lea edx, [esp + 0x18]
mov ebp, eax
mov eax, dword [esp + 0x20]
push edx
push ebp
push ebx
push ebx
push str.Personal
push eax
mov dword [esp + 0x68], ebp
call edi
test eax, eax
jne 0x43086b
mov ecx, dword [0x65ca8c]
mov dword [esp + 0x14], ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + 0x304], 4
mov al, byte [ecx + ebp - 1]
cmp al, 0x5c
mov eax, 0x660ff8
je 0x43070e
mov eax, 0x6384b8
push eax
push ebp
lea edx, [esp + 0x1c]
push str._s_sDownloads_
push edx
call fcn.0057f8fb
mov ebp, dword [esp + 0x24]
add esp, 0x10
mov ecx, esi
call fcn.00401070
cmp ebp, ebx
je 0x430777
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x430777
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
push ebx
push 0xffffffffffffffff
push ebp
push ebx
push ebx
call edi
cmp eax, ebx
mov dword [esi + 8], eax
je 0x430777
lea eax, [eax + eax + 2]
push eax
call fcn.00582ecc
add esp, 4
cmp eax, ebx
mov dword [esi], eax
je 0x430777
mov ecx, dword [esi + 8]
push ecx
push eax
push 0xffffffffffffffff
push ebp
push ebx
push ebx
call edi
mov dword [esi + 8], eax
mov eax, dword [esi]
cmp eax, ebx
jne 0x430780
lea eax, [esi + 4]
push ebx
push eax
call fcn.004651a0
mov eax, dword [0x63a28c]
add esp, 8
xor edi, edi
cmp eax, ebx
mov eax, dword [esi]
je 0x4307b0
cmp eax, ebx
jne 0x43079e
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x430838
jmp 0x4307e3
cmp eax, ebx
jne 0x4307b7
lea eax, [esi + 4]
push eax
lea ecx, [esp + 0x28]
call fcn.00586bf3
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4307d6
mov edi, 1
lea ecx, [esp + 0x24]
call fcn.00586b33
cmp edi, ebx
je 0x430838
mov ecx, esi
call fcn.00401070
mov ebp, dword [esp + 0x50]
cmp ebp, ebx
je 0x430838
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x430838
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
push ebx
push 0xffffffffffffffff
push ebp
push ebx
push ebx
call edi
cmp eax, ebx
mov dword [esi + 8], eax
je 0x430838
lea eax, [eax + eax + 2]
push eax
call fcn.00582ecc
add esp, 4
cmp eax, ebx
mov dword [esi], eax
je 0x430838
mov ecx, dword [esi + 8]
push ecx
push eax
push 0xffffffffffffffff
push ebp
push ebx
push ebx
call edi
mov dword [esi + 8], eax
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x14]
mov byte [esp + 0x304], bl
call fcn.00586b33
lea ecx, [esp + 0x1c]
mov dword [esp + 0x304], 0xffffffff
call fcn.00586b33
mov al, 1
jmp 0x43088c
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x304], 0xffffffff
call fcn.00586b33
xor al, al
mov ecx, dword [esp + 0x2fc]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2f8
ret