Function at 0x10015fb0
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x118
push esi
mov esi, ecx
push str.shell32.dll
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x10015fe4
push str.SHGetSpecialFolderPathA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0xc], eax
mov byte [esi], 0
mov al, byte [0x1004fb40]
test al, al
jne 0x10016269
mov ecx, esi
call fcn.10015b00
push 0x104
push 0x1004fc50
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x104
push 0x1004fe60
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x1004ff68
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, 0x1004ff68
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10016033
sub eax, edx
cmp byte [eax + 0x1004ff67], 0x5c
jne 0x1001605f
mov eax, 0x1004ff68
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10016050
sub eax, edx
mov byte [eax + 0x1004ff67], cl
push ebp
push edi
push 0x104
push 0x1004fd58
mov ecx, esi
call fcn.10015920
mov al, byte [0x1005048c]
test al, al
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
je 0x100160a4
mov eax, dword [esp + 0x14]
test eax, eax
je 0x100160a4
push 0
push 0x17
push 0x10050070
push 0
call eax
jmp 0x100160e8
lea eax, [esp + 0xc]
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
mov dword [esp + 0x24], 0x104
call esi
test eax, eax
jne 0x100160e8
lea ecx, [esp + 0x10]
push ecx
push 0x10050070
lea edx, [esp + 0x24]
push edx
push eax
mov eax, dword [esp + 0x1c]
push str.Programs
push eax
call edi
mov ecx, dword [esp + 0xc]
push ecx
call ebp
mov al, byte [0x1005048c]
test al, al
je 0x10016108
mov eax, dword [esp + 0x14]
test eax, eax
je 0x10016108
push 0
push 0x19
push 0x10050280
push 0
call eax
jmp 0x1001614d
lea edx, [esp + 0xc]
push edx
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
mov dword [esp + 0x24], 0x104
call esi
test eax, eax
jne 0x1001614d
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push 0x10050280
lea ecx, [esp + 0x24]
push ecx
push 0
push str.Desktop
push edx
call edi
mov eax, dword [esp + 0xc]
push eax
call ebp
mov al, byte [0x1005048c]
test al, al
je 0x1001616d
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1001616d
push 0
push 0x18
push 0x10050178
push 0
call eax
jmp 0x100161b2
lea ecx, [esp + 0xc]
push ecx
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
mov dword [esp + 0x24], 0x104
call esi
test eax, eax
jne 0x100161b2
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push 0x10050178
lea eax, [esp + 0x24]
push eax
push 0
push str.Startup
push ecx
call edi
mov edx, dword [esp + 0xc]
push edx
call ebp
mov al, byte [0x1005048c]
test al, al
pop edi
pop ebp
je 0x10016231
mov eax, dword [esp + 0xc]
test eax, eax
je 0x10016231
push 0
push 0x28
lea ecx, [esp + 0x20]
push ecx
push 0
call eax
lea eax, [esp + 0x18]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100161e0
sub eax, edx
cmp byte [esp + eax + 0x17], 0x5c
jne 0x10016204
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100161f7
sub eax, edx
mov byte [esp + eax + 0x17], cl
lea edx, [esp + 0x18]
push 0x5c
push edx
call fcn.1001b850
add esp, 8
mov byte [eax], 0
xor eax, eax
jmp 0x10016220
mov cl, byte [esp + eax + 0x18]
mov byte [eax + 0x10050490], cl
inc eax
test cl, cl
jne 0x10016220
jmp 0x10016244
xor eax, eax
mov cl, byte [eax + 0x1004fe60]
mov byte [eax + 0x10050490], cl
inc eax
test cl, cl
jne 0x10016233
mov al, byte [0x1005048c]
test al, al
mov byte [0x1004fb40], 1
je 0x10016273
mov esi, dword [esp + 0x10]
mov ecx, esi
call fcn.10015d80
test eax, eax
setne al
mov byte [0x1005048d], al
mov eax, esi
pop esi
add esp, 0x118
ret
mov eax, dword [esp + 0x10]
mov byte [0x1005048d], 1
pop esi
add esp, 0x118
ret