Function at 0x40b779
Capabilities:
Persist via run registry key

Disassembly:
push 0x7c
mov eax, 0x46acb0
call fcn.0042dc79
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
xor ebx, ebx
mov dword [ebp - 0x18], 0xf
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov byte [ebp - 0x80], bl
push dword [ebp - 0x80]
mov dword [ebp - 0x88], ebx
push 0x40
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.00404120
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x80], SysReAllocString
push eax
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x48]
call fcn.00407967
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 2
push eax
mov ecx, edi
call fcn.0040aa30
lea ecx, [ebp - 0x44]
call fcn.004043a0
mov eax, dword [ebp - 0x18]
mov esi, 0x1000
mov byte [ebp - 4], bl
cmp eax, 0x10
jb 0x40b828
mov ecx, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], ecx
cmp eax, esi
jb 0x40b81f
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x84]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x80]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders
mov byte [ebp - 0x80], bl
lea ecx, [ebp - 0x2c]
push dword [ebp - 0x80]
mov dword [ebp - 0x1c], ebx
push 0x45
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], bl
call fcn.00404120
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x80], SysReAllocString
push eax
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x48]
call fcn.00407967
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 4
push eax
mov ecx, edi
call fcn.0040aa30
lea ecx, [ebp - 0x44]
call fcn.004043a0
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], bl
cmp eax, 0x10
jb 0x40b8b8
mov ecx, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x84], ecx
cmp eax, esi
jb 0x40b8af
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x80]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x84]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov byte [ebp - 0x80], bl
lea ecx, [ebp - 0x2c]
push dword [ebp - 0x80]
mov dword [ebp - 0x1c], ebx
push 0x40
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], bl
call fcn.00404120
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x80], reloc.OLEAUT32.dll_SysReAllocString
push eax
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x48]
call fcn.00407967
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 6
push eax
mov ecx, edi
call fcn.0040aa30
lea ecx, [ebp - 0x44]
call fcn.004043a0
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], bl
cmp eax, 0x10
jb 0x40b948
mov ecx, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x84], ecx
cmp eax, esi
jb 0x40b93f
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x80]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x84]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders
mov byte [ebp - 0x80], bl
lea ecx, [ebp - 0x60]
push dword [ebp - 0x80]
mov dword [ebp - 0x50], ebx
push 0x45
mov dword [ebp - 0x4c], 0xf
mov byte [ebp - 0x60], bl
call fcn.00404120
lea eax, [ebp - 0x60]
mov dword [ebp - 0x80], reloc.OLEAUT32.dll_SysReAllocString
push eax
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x7c]
call fcn.00407967
lea eax, [ebp - 0x7c]
mov byte [ebp - 4], 8
push eax
mov ecx, edi
call fcn.0040aa30
lea ecx, [ebp - 0x78]
call fcn.004043a0
mov eax, dword [ebp - 0x4c]
cmp eax, 0x10
jb 0x40b9d5
mov ecx, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x84], ecx
cmp eax, esi
jb 0x40b9cc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x80]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x84]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
xor eax, eax
inc eax
jmp 0x40b9e6
call fcn.0042dbc6
ret