Function at 0x4380f0
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x2b4
mov eax, dword [0x4652b0]
xor eax, esp
mov dword [esp + 0x2b0], eax
push ebx
push esi
push edi
push 0x104
lea eax, [esp + 0xb1]
mov edi, ecx
push 0
push eax
mov dword [esp + 0x1c], edi
mov byte [esp + 0xb8], 0
call fcn.00443400
push 0x104
lea ecx, [esp + 0x1c5]
push 0
push ecx
mov byte [esp + 0x1cc], 0
call fcn.00443400
add esp, 0x18
push 0x458650
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x43820a
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebp
push 0x45865c
push esi
call ebx
push str.SHGetSpecialFolderPathA
push esi
mov ebp, eax
call ebx
mov edi, eax
test ebp, ebp
jne 0x4381b0
test edi, edi
jne 0x4381ac
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.SHFolder.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4381ac
push 0x45865c
push esi
call ebx
push str.SHGetSpecialFolderPathA
push esi
mov ebp, eax
call ebx
mov edi, eax
test ebp, ebp
je 0x4381d6
lea edx, [esp + 0xb0]
push edx
push 0
push 0
push 0x19
push 0
call ebp
lea eax, [esp + 0x1b8]
push eax
push 0
push 0
push 0x10
push 0
call ebp
jmp 0x4381fa
test edi, edi
je 0x4381fa
push 0
push 0x19
lea ecx, [esp + 0xb8]
push ecx
push 0
call edi
push 0
push 0x10
lea edx, [esp + 0x1c0]
push edx
push 0
call edi
pop ebp
test esi, esi
je 0x438206
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x28], 2
jne 0x438270
cmp byte [esp + 0xac], 0
je 0x43824a
mov ecx, dword [esp + 0x2c4]
push ecx
lea edx, [esp + 0xb0]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
jmp 0x43833e
mov ebx, dword [esp + 0x2c4]
mov eax, edi
call fcn.004384b0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2b0]
xor ecx, esp
call fcn.0043defc
add esp, 0x2b4
ret
cmp byte [esp + 0x1b4], 0
je 0x438296
mov eax, dword [esp + 0x2c4]
push eax
lea ecx, [esp + 0x1b8]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
jmp 0x43833e
lea edx, [esp + 0xc]
push edx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x438316
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x2c4]
push eax
push edi
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0x45b548
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x438316
cmp byte [edi], 0
je 0x438316
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2b0]
xor ecx, esp
call fcn.0043defc
add esp, 0x2b4
ret
mov ecx, dword [esp + 0x2c4]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [esp + 0x2c4]
cmp ecx, 0x7fffffff
ja 0x43833e
push str.Desktop
call fcn.00402040
mov ecx, dword [esp + 0x2bc]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0043defc
add esp, 0x2b4
ret