Function at 0x4308b0
Capabilities:
Check os version
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59b5a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf8
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
push edi
cmp eax, esi
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], esi
je 0x430cce
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], esi
mov word [ebp - 0x24], si
lea eax, [ebp - 0x104]
mov byte [ebp - 4], 1
push eax
xor bl, bl
mov dword [ebp - 0x104], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x430aea
cmp dword [ebp - 0xf4], 2
jne 0x430aea
cmp dword [ebp - 0x100], 6
jb 0x430aea
push str.shell32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, esi
mov dword [ebp - 0x1c], edi
je 0x430aea
push str.SHGetKnownFolderPath
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x430ad9
push 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x40], 0xb4bfcc3a
mov word [ebp - 0x3c], 0xdb2c
mov word [ebp - 0x3a], 0x424c
mov byte [ebp - 0x38], 0xb0
mov byte [ebp - 0x37], 0x29
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0xe9
mov byte [ebp - 0x34], 0x9a
mov byte [ebp - 0x33], 0x87
mov byte [ebp - 0x32], 0xc6
mov byte [ebp - 0x31], 0x41
call dword [sym.imp.ole32.dll_CoInitialize]
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x40]
push ecx
push 0
push 0
push edx
call esi
test eax, eax
jne 0x430ad3
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x430ad3
push eax
call fcn.0056aeae
mov ecx, eax
mov eax, dword [ebp - 0x14]
add esp, 4
mov edi, 0x660ffc
cmp word [eax + ecx*2 - 2], 0x5c
je 0x4309de
mov edi, 0x637028
mov edx, 0x637020
mov esi, eax
test edx, edx
je 0x430ac7
test eax, eax
je 0x430ac7
test edi, edi
je 0x430ac7
push edx
lea ecx, [ebp - 0x70]
call fcn.004039f0
push esi
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.004039c0
mov bl, 3
push edi
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], bl
call fcn.004039c0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 4
call fcn.00401070
mov edi, dword [ebp - 0x58]
test edi, edi
jne 0x430a37
lea edi, [ebp - 0x54]
mov esi, dword [ebp - 0x68]
lea ecx, [ebp - 0x64]
call fcn.00403a70
push eax
call fcn.0056aeae
mov edx, eax
push edi
mov dword [ebp - 0x2c], edx
call fcn.0056aeae
mov ecx, dword [ebp - 0x2c]
add esi, ecx
add eax, esi
lea edx, [eax + eax + 2]
push edx
call fcn.00582ecc
add esp, 0xc
mov dword [ebp - 0x28], eax
test eax, eax
je 0x430aa1
lea ecx, [ebp - 0x64]
call fcn.00403a70
push eax
lea ecx, [ebp - 0x58]
call fcn.00403a70
push eax
lea ecx, [ebp - 0x70]
call fcn.00403a70
push eax
mov eax, dword [ebp - 0x28]
push eax
call fcn.0056aef4
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.0056aeae
add esp, 0x14
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.00401070
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 1
call fcn.00401070
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov edi, dword [ebp - 0x1c]
mov bl, 1
call dword [sym.imp.ole32.dll_CoUninitialize]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test bl, bl
jne 0x430bdc
xor esi, esi
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x14], esi
push edx
push 0xf003f
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders_
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x430cc2
mov ecx, dword [ebp - 0x1c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push esi
push str.Desktop
push ecx
call edi
test eax, eax
jne 0x430bc9
mov edx, dword [0x65ca8c]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 5
call fcn.00586f74
mov edx, dword [ebp - 0x1c]
lea ecx, [ebp - 0x14]
mov esi, eax
push ecx
push esi
push 0
push 0
push str.Desktop
push edx
call edi
test eax, eax
jne 0x430bbb
mov eax, dword [0x65ca8c]
mov dword [ebp - 0x30], eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp - 4], 6
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [ecx + esi - 1]
cmp al, 0x5c
mov eax, 0x660ff8
je 0x430b8c
mov eax, 0x6384b8
push eax
push esi
lea ecx, [ebp - 0x30]
push 0x637020
push ecx
call fcn.0057f8fb
mov edx, dword [ebp - 0x30]
add esp, 0x10
lea ecx, [ebp - 0x28]
push 0
push edx
call fcn.00402610
lea ecx, [ebp - 0x30]
mov bl, 1
mov byte [ebp - 4], 5
call fcn.00586b33
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00586b33
xor esi, esi
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x430bde
jmp 0x430cc2
xor esi, esi
mov ecx, dword [0x65ca8c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x18]
push edx
mov bl, 7
push 0x636fa0
push eax
mov byte [ebp - 4], bl
call fcn.0057f8fb
mov ecx, dword [ebp - 0x18]
add esp, 0xc
push 0x5c
push ecx
call fcn.0056aa30
add esp, 8
cmp eax, esi
je 0x430cb6
mov byte [eax + 1], 0
mov edx, dword [ebp - 0x18]
push esi
push edx
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x44], esi
mov word [ebp - 0x48], si
call fcn.00402610
mov eax, dword [ebp - 0x28]
cmp eax, esi
mov ecx, eax
jne 0x430c3e
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 0x4c]
cmp eax, esi
jne 0x430c48
lea eax, [ebp - 0x48]
push ecx
push eax
call fcn.0056cfcc
add esp, 8
test eax, eax
jne 0x430cab
mov eax, dword [0x6619bc]
mov ecx, dword [0x6619c0]
push 0x1030
push eax
push ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00586b33
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.00401070
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00586b33
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.00401070
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret