Function at 0x4183f0
Capabilities:
Check if file exists
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5933f2
mov eax, dword fs:[0]
push eax
mov eax, 0x16f8
call fcn.00555270
mov eax, dword [0x5deba8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x16b4], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x820], eax
xor ecx, ecx
mov word [ebp - 0x364], cx
push 0x256
push 0
lea edx, [ebp - 0x362]
push edx
call fcn.005533a0
add esp, 0xc
xor eax, eax
mov word [ebp - 0x81c], ax
push 0x256
push 0
lea ecx, [ebp - 0x81a]
push ecx
call fcn.005533a0
add esp, 0xc
xor edx, edx
mov word [ebp - 0x5bc], dx
push 0x256
push 0
lea eax, [ebp - 0x5ba]
push eax
call fcn.005533a0
add esp, 0xc
lea ecx, [ebp - 0x5c0]
push ecx
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.SHELL32.dll_SHChangeNotifyRegister
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4184ea
mov dword [ebp - 0x850], 0x12c
lea edx, [ebp - 0x850]
push edx
lea eax, [ebp - 0x364]
push eax
push 0
push 0
push str.Common_Programs
mov ecx, dword [ebp - 0x5c0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x5c0]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x5c0]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push SHChangeNotifyDeregister
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x418547
mov dword [ebp - 0x854], 0x12c
lea ecx, [ebp - 0x854]
push ecx
lea edx, [ebp - 0x81c]
push edx
push 0
push 0
push str.Programs
mov eax, dword [ebp - 0x5c0]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x5c0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x84c]
call fcn.0041f300
mov dword [ebp - 4], 0
push str.Calculator.lnk
lea ecx, [ebp - 0x2c]
call fcn.0041e5e0
mov byte [ebp - 4], 1
push 0x5b68ac
lea edx, [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x84c]
call fcn.0041f330
mov ecx, eax
call fcn.0041e6c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.0041e660
push str.Paint.lnk
lea ecx, [ebp - 0x48]
call fcn.0041e5e0
mov byte [ebp - 4], 2
push 0x5b68c8
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x84c]
call fcn.0041f330
mov ecx, eax
call fcn.0041e6c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.0041e660
push str.Remote_Desktop_Connection.lnk
lea ecx, [ebp - 0x64]
call fcn.0041e5e0
mov byte [ebp - 4], 3
push 0x5b690c
lea ecx, [ebp - 0x64]
push ecx
lea ecx, [ebp - 0x84c]
call fcn.0041f330
mov ecx, eax
call fcn.0041e6c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x64]
call fcn.0041e660
push str.Snipping_Tool.lnk
lea ecx, [ebp - 0x80]
call fcn.0041e5e0
mov byte [ebp - 4], 4
push 0x5b6940
lea edx, [ebp - 0x80]
push edx
lea ecx, [ebp - 0x84c]
call fcn.0041f330
mov ecx, eax
call fcn.0041e6c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x80]
call fcn.0041e660
push str.Run.lnk
lea ecx, [ebp - 0x9c]
call fcn.0041e5e0
mov byte [ebp - 4], 5
push 0x5b695c
lea eax, [ebp - 0x9c]
push eax
lea ecx, [ebp - 0x84c]
call fcn.0041f330
mov ecx, eax
call fcn.0041e6c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x9c]
call fcn.0041e660
push str.Command_Prompt.lnk
lea ecx, [ebp - 0xb8]
call fcn.0041e5e0
mov byte [ebp - 4], 6
push 0x5b698c
lea ecx, [ebp - 0xb8]
push ecx
lea ecx, [ebp - 0x84c]
call fcn.0041f330
mov ecx, eax
call fcn.0041e6c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb8]
call fcn.0041e660
push str.Notepad.lnk
lea ecx, [ebp - 0xd4]
call fcn.0041e5e0
mov byte [ebp - 4], 7
push 0x5b69b0
lea edx, [ebp - 0xd4]
push edx
lea ecx, [ebp - 0x84c]
call fcn.0041f330
mov ecx, eax
call fcn.0041e6c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xd4]
call fcn.0041e660
push str.Magnify.lnk
lea ecx, [ebp - 0xf0]
call fcn.0041e5e0
mov byte [ebp - 4], 8
push str._eY_
lea eax, [ebp - 0xf0]
push eax
lea ecx, [ebp - 0x84c]
call fcn.0041f330
mov ecx, eax
call fcn.0041e6c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xf0]
call fcn.0041e660
push str.On_Screen_Keyboard.lnk
lea ecx, [ebp - 0x10c]
call fcn.0041e5e0
mov byte [ebp - 4], 9
push str.OU.
lea ecx, [ebp - 0x10c]
push ecx
lea ecx, [ebp - 0x84c]
call fcn.0041f330
mov ecx, eax
call fcn.0041e6c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10c]
call fcn.0041e660
call fcn.00416be0
cmp eax, 0x13
jl 0x418837
lea edx, [ebp - 0x364]
add edx, 0xfffffffe
mov dword [ebp - 0x16b8], edx
mov eax, dword [ebp - 0x16b8]
mov cx, word [eax + 2]
mov word [ebp - 0x16ba], cx
add dword [ebp - 0x16b8], 2
cmp word [ebp - 0x16ba], 0
jne 0x41879b
mov edi, dword [ebp - 0x16b8]
mov ecx, 6
mov esi, 0x5b6a14
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edx, [ebp - 0x81c]
add edx, 0xfffffffe
mov dword [ebp - 0x16c0], edx
mov eax, dword [ebp - 0x16c0]
mov cx, word [eax + 2]
mov word [ebp - 0x16c2], cx
add dword [ebp - 0x16c0], 2
cmp word [ebp - 0x16c2], 0
jne 0x4187e0
mov edi, dword [ebp - 0x16c0]
mov ecx, 6
mov esi, str.Accessories
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edx, [ebp - 0x81c]
push edx
push str._sAccessibility
lea eax, [ebp - 0x5bc]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x4188e2
lea ecx, [ebp - 0x364]
add ecx, 0xfffffffe
mov dword [ebp - 0x16c8], ecx
mov edx, dword [ebp - 0x16c8]
mov ax, word [edx + 2]
mov word [ebp - 0x16ca], ax
add dword [ebp - 0x16c8], 2
cmp word [ebp - 0x16ca], 0
jne 0x418846
mov edi, dword [ebp - 0x16c8]
mov ecx, dword [0x5b6a70]
mov dword [edi], ecx
mov edx, dword [0x5b6a74]
mov dword [edi + 4], edx
lea eax, [ebp - 0x81c]
add eax, 0xfffffffe
mov dword [ebp - 0x16d0], eax
mov ecx, dword [ebp - 0x16d0]
mov dx, word [ecx + 2]
mov word [ebp - 0x16d2], dx
add dword [ebp - 0x16d0], 2
cmp word [ebp - 0x16d2], 0
jne 0x41888e
mov edi, dword [ebp - 0x16d0]
mov eax, dword [0x5b6a78]
mov dword [edi], eax
mov ecx, dword [0x5b6a7c]
mov dword [edi + 4], ecx
lea edx, [ebp - 0x81c]
push edx
push 0x5b6a80
lea eax, [ebp - 0x5bc]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x858]
push ecx
lea ecx, [ebp - 0x84c]
call fcn.0041f480
jmp 0x41890a
push 0
lea edx, [ebp - 0x1684]
push edx
lea ecx, [ebp - 0x858]
call fcn.0041f4e0
lea eax, [ebp - 0x1688]
push eax
lea ecx, [ebp - 0x84c]
call fcn.0041f4a0
push eax
lea ecx, [ebp - 0x858]
call fcn.0041f510
movzx ecx, al
test ecx, ecx
je 0x418b05
xor edx, edx
mov word [ebp - 0xd0c], dx
push 0x256
push 0
lea eax, [ebp - 0xd0a]
push eax
call fcn.005533a0
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0xab4], cx
push 0x256
push 0
lea edx, [ebp - 0xab2]
push edx
call fcn.005533a0
add esp, 0xc
lea ecx, [ebp - 0x858]
call fcn.0041f4c0
mov ecx, eax
call fcn.0041e6e0
push eax
lea eax, [ebp - 0x364]
push eax
push 0x5b6a90
lea ecx, [ebp - 0xd0c]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0x858]
call fcn.0041f4c0
add eax, 0x1c
mov ecx, eax
call fcn.0041e6e0
push eax
lea edx, [ebp - 0x364]
push edx
push 0x5b6a9c
lea eax, [ebp - 0xab4]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov dword [ebp - 0xd10], 0
lea ecx, [ebp - 0xd0c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x418a3b
mov edx, dword [ebp - 0x820]
mov eax, dword [edx + 4]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x168c], esp
lea edx, [ebp - 0xd0c]
push edx
call fcn.0041d9b0
mov dword [ebp - 0x16d8], eax
mov eax, dword [ebp - 0x16b4]
mov ecx, dword [eax + 0x19c]
push ecx
call fcn.0041a9c0
add esp, 0xc
mov dword [ebp - 0x16dc], eax
mov edx, dword [ebp - 0x16dc]
mov dword [ebp - 0xd10], edx
jmp 0x418a98
lea eax, [ebp - 0xab4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x418a98
mov ecx, dword [ebp - 0x820]
mov edx, dword [ecx + 4]
push edx
push ecx
mov ecx, esp
mov dword [ebp - 0x1690], esp
lea eax, [ebp - 0xab4]
push eax
call fcn.0041d9b0
mov dword [ebp - 0x16e0], eax
mov ecx, dword [ebp - 0x16b4]
mov edx, dword [ecx + 0x19c]
push edx
call fcn.0041a9c0
add esp, 0xc
mov dword [ebp - 0x16e4], eax
mov eax, dword [ebp - 0x16e4]
mov dword [ebp - 0xd10], eax
cmp dword [ebp - 0xd10], 0
je 0x418b00
lea ecx, [ebp - 0x858]
call fcn.0041f4c0
add eax, 0x1c
mov ecx, eax
call fcn.0041e6e0
push eax
mov ecx, dword [ebp - 0xd10]
call fcn.004285f0
push 2
mov ecx, dword [ebp - 0xd10]
call fcn.0042d890
push 1
mov ecx, dword [ebp - 0xd10]
call fcn.00428970
mov ecx, dword [ebp - 0xd10]
push ecx
mov edx, dword [ebp - 0x820]
add edx, 0x16c0
mov eax, dword [ebp - 0x820]
mov ecx, dword [eax + 0x16c0]
push edx
mov edx, dword [ecx]
call edx
jmp 0x4188f6
lea eax, [ebp - 0xd14]
push eax
lea ecx, [ebp - 0x84c]
call fcn.0041f480
jmp 0x418b2d
push 0
lea ecx, [ebp - 0x1694]
push ecx
lea ecx, [ebp - 0xd14]
call fcn.0041f4e0
lea edx, [ebp - 0x1698]
push edx
lea ecx, [ebp - 0x84c]
call fcn.0041f4a0
push eax
lea ecx, [ebp - 0xd14]
call fcn.0041f510
movzx eax, al
test eax, eax
je 0x418d28
xor ecx, ecx
mov word [ebp - 0x11c4], cx
push 0x256
push 0
lea edx, [ebp - 0x11c2]
push edx
call fcn.005533a0
add esp, 0xc
xor eax, eax
mov word [ebp - 0xf6c], ax
push 0x256
push 0
lea ecx, [ebp - 0xf6a]
push ecx
call fcn.005533a0
add esp, 0xc
lea ecx, [ebp - 0xd14]
call fcn.0041f4c0
mov ecx, eax
call fcn.0041e6e0
push eax
lea edx, [ebp - 0x81c]
push edx
push 0x5b6ab0
lea eax, [ebp - 0x11c4]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0xd14]
call fcn.0041f4c0
add eax, 0x1c
mov ecx, eax
call fcn.0041e6e0
push eax
lea ecx, [ebp - 0x81c]
push ecx
push 0x5b6abc
lea edx, [ebp - 0xf6c]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov dword [ebp - 0x11c8], 0
lea eax, [ebp - 0x11c4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x418c5e
mov ecx, dword [ebp - 0x820]
mov edx, dword [ecx + 4]
push edx
push ecx
mov ecx, esp
mov dword [ebp - 0x169c], esp
lea eax, [ebp - 0x11c4]
push eax
call fcn.0041d9b0
mov dword [ebp - 0x16e8], eax
mov ecx, dword [ebp - 0x16b4]
mov edx, dword [ecx + 0x19c]
push edx
call fcn.0041a9c0
add esp, 0xc
mov dword [ebp - 0x16ec], eax
mov eax, dword [ebp - 0x16ec]
mov dword [ebp - 0x11c8], eax
jmp 0x418cbb
lea ecx, [ebp - 0xf6c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x418cbb
mov edx, dword [ebp - 0x820]
mov eax, dword [edx + 4]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x16a0], esp
lea edx, [ebp - 0xf6c]
push edx
call fcn.0041d9b0
mov dword [ebp - 0x16f0], eax
mov eax, dword [ebp - 0x16b4]
mov ecx, dword [eax + 0x19c]
push ecx
call fcn.0041a9c0
add esp, 0xc
mov dword [ebp - 0x16f4], eax
mov edx, dword [ebp - 0x16f4]
mov dword [ebp - 0x11c8], edx
cmp dword [ebp - 0x11c8], 0
je 0x418d23
lea ecx, [ebp - 0xd14]
call fcn.0041f4c0
add eax, 0x1c
mov ecx, eax
call fcn.0041e6e0
push eax
mov ecx, dword [ebp - 0x11c8]
call fcn.004285f0
push 2
mov ecx, dword [ebp - 0x11c8]
call fcn.0042d890
push 1
mov ecx, dword [ebp - 0x11c8]
call fcn.00428970
mov eax, dword [ebp - 0x11c8]
push eax
mov ecx, dword [ebp - 0x820]
add ecx, 0x16c0
mov edx, dword [ebp - 0x820]
mov eax, dword [edx + 0x16c0]
push ecx
mov ecx, dword [eax]
call ecx
jmp 0x418b19
lea edx, [ebp - 0x11cc]
push edx
lea ecx, [ebp - 0x84c]
call fcn.0041f480
jmp 0x418d50
push 0
lea eax, [ebp - 0x16a4]
push eax
lea ecx, [ebp - 0x11cc]
call fcn.0041f4e0
lea ecx, [ebp - 0x16a8]
push ecx
lea ecx, [ebp - 0x84c]
call fcn.0041f4a0
push eax
lea ecx, [ebp - 0x11cc]
call fcn.0041f510
movzx edx, al
test edx, edx
je 0x418f4b
xor eax, eax
mov word [ebp - 0x167c], ax
push 0x256
push 0
lea ecx, [ebp - 0x167a]
push ecx
call fcn.005533a0
add esp, 0xc
xor edx, edx
mov word [ebp - 0x1424], dx
push 0x256
push 0
lea eax, [ebp - 0x1422]
push eax
call fcn.005533a0
add esp, 0xc
lea ecx, [ebp - 0x11cc]
call fcn.0041f4c0
mov ecx, eax
call fcn.0041e6e0
push eax
lea ecx, [ebp - 0x5bc]
push ecx
push 0x5b6ad0
lea edx, [ebp - 0x167c]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0x11cc]
call fcn.0041f4c0
add eax, 0x1c
mov ecx, eax
call fcn.0041e6e0
push eax
lea eax, [ebp - 0x5bc]
push eax
push str._s_s.lnk
lea ecx, [ebp - 0x1424]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov dword [ebp - 0x1680], 0
lea edx, [ebp - 0x167c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x418e81
mov eax, dword [ebp - 0x820]
mov ecx, dword [eax + 4]
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0x16ac], esp
lea edx, [ebp - 0x167c]
push edx
call fcn.0041d9b0
mov dword [ebp - 0x16f8], eax
mov eax, dword [ebp - 0x16b4]
mov ecx, dword [eax + 0x19c]
push ecx
call fcn.0041a9c0
add esp, 0xc
mov dword [ebp - 0x16fc], eax
mov edx, dword [ebp - 0x16fc]
mov dword [ebp - 0x1680], edx
jmp 0x418ede
lea eax, [ebp - 0x1424]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x418ede
mov ecx, dword [ebp - 0x820]
mov edx, dword [ecx + 4]
push edx
push ecx
mov ecx, esp
mov dword [ebp - 0x16b0], esp
lea eax, [ebp - 0x1424]
push eax
call fcn.0041d9b0
mov dword [ebp - 0x1700], eax
mov ecx, dword [ebp - 0x16b4]
mov edx, dword [ecx + 0x19c]
push edx
call fcn.0041a9c0
add esp, 0xc
mov dword [ebp - 0x1704], eax
mov eax, dword [ebp - 0x1704]
mov dword [ebp - 0x1680], eax
cmp dword [ebp - 0x1680], 0
je 0x418f46
lea ecx, [ebp - 0x11cc]
call fcn.0041f4c0
add eax, 0x1c
mov ecx, eax
call fcn.0041e6e0
push eax
mov ecx, dword [ebp - 0x1680]
call fcn.004285f0
push 2
mov ecx, dword [ebp - 0x1680]
call fcn.0042d890
push 1
mov ecx, dword [ebp - 0x1680]
call fcn.00428970
mov ecx, dword [ebp - 0x1680]
push ecx
mov edx, dword [ebp - 0x820]
add edx, 0x16c0
mov eax, dword [ebp - 0x820]
mov ecx, dword [eax + 0x16c0]
push edx
mov edx, dword [ecx]
call edx
jmp 0x418d3c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x84c]
call fcn.00418f80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055338c
mov esp, ebp
pop ebp
ret 4