Function at 0x4026d0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x4026ee
mov eax, 0x4f3703
push eax
push 1
mov ebx, 0x443850
call fcn.00442ec3
add esp, 0x10
mov dword [ebp - 4], eax
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
push str.Temp
push 1
mov ebx, 0x443850
call fcn.00442ec3
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.00402633
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x402752
push ebx
call fcn.00442eab
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x402762
push ebx
call fcn.00442eab
add esp, 4
cmp dword [ebp - 0xc], 0
je 0x402795
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
push str.Temp
push 1
mov ebx, 0x4433d0
call fcn.00442ec3
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x402eb1
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x4027aa
mov eax, 0x4f3703
push eax
push 1
mov ebx, 0x443850
call fcn.00442ec3
add esp, 0x10
mov dword [ebp - 4], eax
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
push str.WinDir
push 1
mov ebx, 0x443850
call fcn.00442ec3
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.00402633
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40280e
push ebx
call fcn.00442eab
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40281e
push ebx
call fcn.00442eab
add esp, 4
cmp dword [ebp - 0xc], 0
je 0x402851
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
push str.WinDir
push 1
mov ebx, 0x4433d0
call fcn.00442ec3
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x402eb1
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x402866
mov eax, 0x4f3703
push eax
push 1
mov ebx, 0x443850
call fcn.00442ec3
add esp, 0x10
mov dword [ebp - 4], eax
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
push str.USERPROFILE
push 1
mov ebx, 0x443850
call fcn.00442ec3
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.00402633
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4028ca
push ebx
call fcn.00442eab
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4028da
push ebx
call fcn.00442eab
add esp, 4
cmp dword [ebp - 0xc], 0
je 0x40290d
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
push str.USERPROFILE
push 1
mov ebx, 0x4433d0
call fcn.00442ec3
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x402eb1
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x402922
mov eax, 0x4f3703
push eax
push 1
mov ebx, 0x443850
call fcn.00442ec3
add esp, 0x10
mov dword [ebp - 4], eax
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
push str.ALLUSERSPROFILE
push 1
mov ebx, 0x443850
call fcn.00442ec3
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.00402633
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x402986
push ebx
call fcn.00442eab
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x402996
push ebx
call fcn.00442eab
add esp, 4
cmp dword [ebp - 0xc], 0
je 0x4029c9
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
push str.ALLUSERSPROFILE
push 1
mov ebx, 0x4433d0
call fcn.00442ec3
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x402eb1
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x4029de
mov eax, 0x4f3703
push eax
push 1
mov ebx, 0x443850
call fcn.00442ec3
add esp, 0x10
mov dword [ebp - 4], eax
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
push str.ProgramFiles
push 1
mov ebx, 0x443850
call fcn.00442ec3
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.00402633
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x402a42
push ebx
call fcn.00442eab
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x402a52
push ebx
call fcn.00442eab
add esp, 4
cmp dword [ebp - 0xc], 0
je 0x402a85
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
push str.ProgramFiles
push 1
mov ebx, 0x4433d0
call fcn.00442ec3
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x402eb1
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x402a9a
mov eax, 0x4f3703
push eax
push 1
mov ebx, 0x443850
call fcn.00442ec3
add esp, 0x10
mov dword [ebp - 4], eax
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
push str.CommonProgramFiles
push 1
mov ebx, 0x443850
call fcn.00442ec3
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.00402633
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x402afe
push ebx
call fcn.00442eab
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x402b0e
push ebx
call fcn.00442eab
add esp, 4
cmp dword [ebp - 0xc], 0
je 0x402b41
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
push str.CommonProgramFiles
push 1
mov ebx, 0x4433d0
call fcn.00442ec3
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x402eb1
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x402b56
mov eax, 0x4f3703
push eax
push 1
mov ebx, 0x443850
call fcn.00442ec3
add esp, 0x10
mov dword [ebp - 4], eax
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
push str.SystemDrive
push 1
mov ebx, 0x443850
call fcn.00442ec3
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.00402633
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x402bba
push ebx
call fcn.00442eab
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x402bca
push ebx
call fcn.00442eab
add esp, 4
cmp dword [ebp - 0xc], 0
je 0x402bfd
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
push str.SystemDrive
push 1
mov ebx, 0x4433d0
call fcn.00442ec3
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x402eb1
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x402c12
mov eax, 0x4f3703
push eax
push 1
mov ebx, 0x443850
call fcn.00442ec3
add esp, 0x10
mov dword [ebp - 4], eax
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
push str.System32
push 1
mov ebx, 0x443850
call fcn.00442ec3
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.00402633
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x402c76
push ebx
call fcn.00442eab
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x402c86
push ebx
call fcn.00442eab
add esp, 4
cmp dword [ebp - 0xc], 0
je 0x402d8c
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
push str.ComSpec
push 1
mov ebx, 0x4433d0
call fcn.00442ec3
add esp, 0x10
mov dword [ebp - 4], eax
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
push str.ComSpec
push 1
mov ebx, 0x4433d0
call fcn.00442ec3
add esp, 0x10
mov dword [ebp - 8], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
push 0x4f36f4
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x402d03
mov eax, 0x4f3703
push eax
push 4
mov ebx, 0x4436b0
call fcn.00442ec3
add esp, 0x34
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x402d29
push ebx
call fcn.00442eab
add esp, 4
fild dword [ebp - 0xc]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
fsub qword [0x4f3793]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
call fcn.00401401
push 0x80000301
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x402d5e
mov eax, 0x4f3703
push eax
push 2
mov ebx, 0x443470
call fcn.00442ec3
add esp, 0x1c
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x402d84
push ebx
call fcn.00442eab
add esp, 4
mov eax, dword [ebp - 0x20]
jmp 0x402eb1
push 0x80000301
push 0
push 6
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x402dad
mov eax, 0x4f3703
push eax
push 2
mov ebx, 0x443470
call fcn.00442ec3
add esp, 0x1c
mov dword [ebp - 4], eax
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x402dd6
mov eax, 0x4f3703
push eax
push 1
mov ebx, 0x443850
call fcn.00442ec3
add esp, 0x10
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x402dfc
push ebx
call fcn.00442eab
add esp, 4
push 0x4f379b
push dword [ebp - 8]
call fcn.00402633
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x402e2a
push ebx
call fcn.00442eab
add esp, 4
cmp dword [ebp - 0xc], 0
je 0x402e3e
mov eax, 4
jmp 0x402e43
mov eax, 3
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders_
mov ecx, 2
call fcn.004013a5
add esp, 8
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x402e79
mov eax, 0x4f3703
push eax
push 0x80000301
push 0
push dword [ebp - 0x10]
push 3
mov ebx, 0x444b30
call fcn.00442ec3
add esp, 0x28
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x402ea9
push ebx
call fcn.00442eab
add esp, 4
mov eax, dword [ebp - 0x18]
jmp 0x402eb1
mov esp, ebp
pop ebp
ret 4