Function at 0x4078c0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10d8
call fcn.0040f760
mov dword [ebp - 0x158], 0x4130b8
mov dword [ebp - 0x154], 0x4130b8
mov dword [ebp - 0x150], 0x4130b8
mov dword [ebp - 0x14c], 0x4130b8
mov dword [ebp - 0x148], str.shell32.dll7
mov eax, dword [0x41f364]
inc eax
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._seek_disk
mov dword [esp + 8], 1
mov dword [esp + 4], 0x417364
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._read_disk
mov dword [ebp - 0x14], 0x417364
mov byte [0x41f374], 1
mov dword [ebp - 0xf6c], 0x400
cmp dword [ebp + 0x14], 2
jne 0x407a87
lea eax, [ebp - 0xb5c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov dword [esp], 0x80000002
call sym._RegOpenKeyExA_20
sub esp, 0x14
test eax, eax
je 0x4079a1
mov dword [esp], str.Error:__Regedit_cannot__be_opened_
call sym._printf
mov dword [ebp - 0x1094], 0xffffffff
jmp 0x407fd4
call sym._GetCurrentVersion
fld qword [0x414688]
fxch st(1)
fucompp
fnstsw ax
sahf
jae 0x4079b7
jmp 0x4079c3
mov dword [ebp - 0x1098], str.Common_Programs
jmp 0x4079cd
mov dword [ebp - 0x1098], str.Common_Start_Menu
lea eax, [ebp - 0xf6c]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0xf68]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x1098]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xb5c]
mov dword [esp], eax
call sym._RegQueryValueExA_24
sub esp, 0x18
test eax, eax
jne 0x407a23
mov eax, dword [ebp - 0xb5c]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
jmp 0x407a3e
mov dword [esp], str.Read_StartMenu_path_failed_
call sym._printf
mov dword [ebp - 0x1094], 0xffffffff
jmp 0x407fd4
lea eax, [ebp - 0xf68]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x41314b
lea eax, [ebp - 0x758]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 4], 0
lea eax, [ebp - 0x758]
mov dword [esp], eax
call sym._access
test eax, eax
je 0x407a87
mov dword [ebp - 0x1094], 0xffffffff
jmp 0x407fd4
lea eax, [ebp - 0x128]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x12c]
mov byte [eax], 0
mov dword [ebp - 0x10], 2
cmp dword [0x416b44], 0
jne 0x407b9e
mov dword [ebp - 0xf74], 0x417564
mov eax, dword [ebp - 0xf74]
movzx eax, byte [eax + 0x1ad]
mov dword [ebp - 0xf70], eax
mov eax, dword [ebp - 0xf70]
and al, 0x80
test al, al
je 0x407af9
mov dword [esp + 4], str.___chs
mov eax, dword [ebp - 0x12c]
mov dword [esp], eax
call sym._sprintf
mov edx, eax
lea eax, [ebp - 0x12c]
add dword [eax], edx
lea eax, [ebp - 0xf70]
and dword [eax], 0x7f
cmp dword [ebp - 0xf70], 0x3f
je 0x407b35
mov eax, dword [ebp - 0xf70]
mov dword [esp + 8], eax
mov dword [esp + 4], str.___max_sectors__d
mov eax, dword [ebp - 0x12c]
mov dword [esp], eax
call sym._sprintf
mov edx, eax
lea eax, [ebp - 0x12c]
add dword [eax], edx
cmp byte [0x417571], 0
je 0x407b4a
mov dword [ebp - 0xf78], str.copy
jmp 0x407b9e
cmp byte [0x41757c], 0
je 0x407b5f
mov dword [ebp - 0x109c], str.init
jmp 0x407b69
mov dword [ebp - 0x109c], str.zero
mov eax, dword [ebp - 0x109c]
mov dword [ebp - 0xf78], eax
cmp byte [0x41758a], 0x29
jne 0x407b9e
mov dword [esp + 4], str.___zip
mov eax, dword [ebp - 0x12c]
mov dword [esp], eax
call sym._sprintf
mov edx, eax
lea eax, [ebp - 0x12c]
add dword [eax], edx
mov eax, dword [ebp - 0x14]
cmp word [eax + 0xa], 0x3f00
je 0x407bd4
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + 0xa]
mov dword [esp + 8], eax
mov dword [esp + 4], str.___primary__d
mov eax, dword [ebp - 0x12c]
mov dword [esp], eax
call sym._sprintf
mov edx, eax
lea eax, [ebp - 0x12c]
add dword [eax], edx
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0xc], 0
je 0x407c07
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str.___extended__ld
mov eax, dword [ebp - 0x12c]
mov dword [esp], eax
call sym._sprintf
mov edx, eax
lea eax, [ebp - 0x12c]
add dword [eax], edx
mov eax, dword [ebp - 0x14]
movzx edx, word [eax + 8]
mov eax, edx
shl eax, 8
sub eax, edx
add eax, eax
cmp eax, 0x6f900
je 0x407c52
mov eax, dword [ebp - 0x14]
movzx edx, word [eax + 8]
mov eax, edx
shl eax, 8
sub eax, edx
add eax, eax
mov dword [esp + 8], eax
mov dword [esp + 4], str.___list_size__d
mov eax, dword [ebp - 0x12c]
mov dword [esp], eax
call sym._sprintf
mov edx, eax
lea eax, [ebp - 0x12c]
add dword [eax], edx
mov dword [ebp - 0xc], 0
mov eax, dword [0x416b54]
add eax, dword [0x416b24]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov eax, dword [0x41f5d4]
add eax, dword [ebp - 0xc]
cmp byte [eax], 0
je 0x407fbe
mov eax, dword [ebp - 0xc]
add eax, dword [0x41f5d4]
mov dword [ebp - 0xf78], eax
mov eax, dword [ebp - 0xf78]
mov eax, dword [eax + 2]
cmp eax, dword [0x41f5e4]
jae 0x407cd4
mov eax, dword [ebp - 0xf78]
mov edx, dword [eax + 6]
add edx, 0x1fd
mov eax, 0x80808081
mul edx
mov eax, edx
shr eax, 8
mov dword [ebp - 0xf70], eax
mov edx, dword [ebp - 0xf70]
lea eax, [ebp - 0x18]
add dword [eax], edx
jmp 0x407cf6
mov eax, dword [ebp - 0xf78]
mov eax, dword [eax + 6]
add eax, 0x1ff
shr eax, 9
mov dword [ebp - 0xf70], eax
mov edx, dword [ebp - 0xf70]
lea eax, [ebp - 0x1c]
add dword [eax], edx
mov edx, dword [ebp - 0xf78]
mov eax, dword [ebp - 0xf70]
add eax, dword [edx + 2]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xf78]
add eax, 0xa
mov dword [esp], eax
call sym._localtime
mov dword [ebp - 0xf74], eax
cmp dword [ebp + 0xc], 0
je 0x407f3a
cmp byte [0x41f374], 0
je 0x407d4b
mov eax, dword [ebp - 0xf78]
add eax, 0xe
mov dword [esp], eax
call sym._UTF8ToANSI
mov dword [ebp - 0x10a0], eax
jmp 0x407d5a
mov eax, dword [ebp - 0xf78]
add eax, 0xe
mov dword [ebp - 0x10a0], eax
mov eax, dword [ebp - 0x10a0]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov dword [esp], eax
call sym._wildcard_matches
cmp eax, 1
jne 0x407f3a
cmp dword [ebp + 0x14], 1
jne 0x407dc7
cmp byte [0x41f374], 0
je 0x407da2
mov eax, dword [ebp - 0xf78]
add eax, 0xe
mov dword [esp], eax
call sym._UTF8ToANSI
mov dword [ebp - 0x10a4], eax
jmp 0x407db1
mov eax, dword [ebp - 0xf78]
add eax, 0xe
mov dword [ebp - 0x10a4], eax
mov eax, dword [ebp - 0x10a4]
mov dword [esp + 4], eax
mov dword [esp], 0x41352c
call sym._printf
cmp dword [ebp + 0x14], 2
jne 0x407f22
cmp dword [ebp + 0xc], 1
jle 0x407f22
cmp byte [0x41f374], 0
je 0x407dfd
mov eax, dword [ebp - 0xf78]
add eax, 0xe
mov dword [esp], eax
call sym._UTF8ToANSI
mov dword [ebp - 0x10a8], eax
jmp 0x407e0c
mov eax, dword [ebp - 0xf78]
add eax, 0xe
mov dword [ebp - 0x10a8], eax
mov eax, dword [ebp - 0x10a8]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x758]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s__s.lnk
lea eax, [ebp - 0x558]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x558]
mov dword [ebp - 0x154], eax
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x1088]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
test eax, eax
je 0x407e73
lea eax, [ebp - 0x1088]
mov dword [ebp - 0x150], eax
cmp byte [0x41f374], 0
je 0x407e95
mov eax, dword [ebp - 0xf78]
add eax, 0xe
mov dword [esp], eax
call sym._UTF8ToANSI
mov dword [ebp - 0x10ac], eax
jmp 0x407ea4
mov eax, dword [ebp - 0xf78]
add eax, 0xe
mov dword [ebp - 0x10ac], eax
mov eax, dword [ebp + 0x10]
add eax, 4
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x10ac]
mov dword [esp + 8], eax
mov dword [esp + 4], str.__udload___s____s_
lea eax, [ebp - 0xb58]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0xb58]
mov dword [ebp - 0x14c], eax
cmp dword [ebp + 0xc], 2
jle 0x407f0c
mov eax, dword [ebp + 0x10]
add eax, 8
mov dword [esp + 4], 0x414684
mov eax, dword [eax]
mov dword [esp], eax
call sym._strrchr
test eax, eax
je 0x407f0c
mov eax, dword [ebp + 0x10]
add eax, 8
mov eax, dword [eax]
mov dword [ebp - 0x148], eax
lea eax, [ebp - 0x158]
mov dword [esp + 4], eax
mov dword [esp], 5
call sym._shortcut
mov eax, dword [ebp - 0xf78]
mov eax, dword [eax + 6]
add eax, 0x3ff
mov edx, eax
shr edx, 0xa
lea eax, [ebp - 0x10]
add dword [eax], edx
cmp dword [ebp + 0xc], 0
jne 0x407fa5
cmp dword [ebp + 0x14], 1
jne 0x407f8d
cmp byte [0x41f374], 0
je 0x407f68
mov eax, dword [ebp - 0xf78]
add eax, 0xe
mov dword [esp], eax
call sym._UTF8ToANSI
mov dword [ebp - 0x10b0], eax
jmp 0x407f77
mov eax, dword [ebp - 0xf78]
add eax, 0xe
mov dword [ebp - 0x10b0], eax
mov eax, dword [ebp - 0x10b0]
mov dword [esp + 4], eax
mov dword [esp], 0x41352c
call sym._printf
mov eax, dword [ebp - 0xf78]
mov eax, dword [eax + 6]
add eax, 0x3ff
mov edx, eax
shr edx, 0xa
lea eax, [ebp - 0x10]
add dword [eax], edx
mov eax, dword [0x41f5d4]
add eax, dword [ebp - 0xc]
movzx eax, byte [eax]
add eax, dword [ebp - 0xc]
add eax, 2
mov dword [ebp - 0xc], eax
jmp 0x407c75
mov eax, dword [0x41f5d4]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1094], eax
mov eax, dword [ebp - 0x1094]
leave
ret