Function at 0x426290
Capabilities:
Check os version
Download url
Persist via run registry key
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49c21f
mov eax, dword fs:[0]
push eax
sub esp, 0x5c0
mov eax, dword [0x4c5cd8]
xor eax, ebp
mov dword [ebp - 0x24], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x548], ecx
mov byte [ebp - 0x1d], 0
push 0x11c
push 0
lea eax, [ebp - 0x144]
push eax
call fcn.00480c90
add esp, 0xc
mov dword [ebp - 0x144], 0x11c
lea ecx, [ebp - 0x144]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x426317
mov dword [ebp - 0x144], 0x114
lea edx, [ebp - 0x144]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x426317
jmp 0x426bda
cmp dword [ebp - 0x140], 6
jb 0x426324
mov byte [ebp - 0x1d], 1
lea ecx, [ebp - 0x14]
call fcn.0040ce40
mov dword [ebp - 4], 0
push 0x8f
lea ecx, [ebp - 0x14]
call fcn.0040d1c0
lea ecx, [ebp - 0x10]
call fcn.0040ce40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.0040cf60
mov esi, eax
push 0x2f
lea ecx, [ebp - 0x14]
call fcn.0040c4b0
sub esi, eax
sub esi, 1
push esi
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
call fcn.0040c500
mov byte [ebp - 4], 2
movzx ecx, byte [ebp - 0x1d]
test ecx, ecx
jne 0x4265ba
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea ecx, [ebp - 0x3a0]
call fcn.00401070
mov byte [ebp - 4], 3
push 0x2001f
push reloc.WS2_32.dll_accept
lea edx, [ebp - 0x3a0]
push edx
lea ecx, [ebp - 0x14c]
call fcn.00409920
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x3a0]
call fcn.00443bc0
push str.My_Pictures
lea ecx, [ebp - 0x3d8]
call fcn.00401f50
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x3bc]
call fcn.004010d0
mov dword [ebp - 0x54c], eax
mov eax, dword [ebp - 0x54c]
mov dword [ebp - 0x550], eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x550]
push ecx
lea edx, [ebp - 0x3d8]
push edx
lea eax, [ebp - 0x3f4]
push eax
lea ecx, [ebp - 0x14c]
call fcn.00409990
mov dword [ebp - 0x554], eax
mov ecx, dword [ebp - 0x554]
mov dword [ebp - 0x558], ecx
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x558]
call fcn.00401f30
push eax
lea ecx, [ebp - 0x150]
call fcn.0040ce80
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x3f4]
call fcn.00401100
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x3bc]
call fcn.00401100
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x3d8]
call fcn.00401100
lea ecx, [ebp - 0x150]
call fcn.0040cf60
test eax, eax
jne 0x42648f
push 0x4a905c
lea ecx, [ebp - 0x150]
call fcn.0043de70
push 0x24
lea edx, [ebp - 0x3f8]
push edx
mov ecx, dword [ebp - 0x548]
call fcn.00425d10
mov dword [ebp - 0x55c], eax
mov eax, dword [ebp - 0x55c]
mov dword [ebp - 0x560], eax
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x560]
call fcn.004157c0
push eax
push str._SystemRoot_
lea ecx, [ebp - 0x150]
call fcn.0042ae90
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x3f8]
call fcn.0040cf00
push 0x4a907c
lea ecx, [ebp - 0x3fc]
call fcn.0043c3e0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x3fc]
push edx
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x400]
push ecx
call fcn.0042b0f0
add esp, 0xc
mov dword [ebp - 0x564], eax
mov edx, dword [ebp - 0x564]
mov dword [ebp - 0x568], edx
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x568]
push eax
lea ecx, [ebp - 0x404]
push ecx
call fcn.0042b0f0
add esp, 0xc
mov dword [ebp - 0x56c], eax
mov edx, dword [ebp - 0x56c]
mov dword [ebp - 0x570], edx
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x570]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040c490
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x404]
call fcn.0040cf00
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x400]
call fcn.0040cf00
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x3fc]
call fcn.0040cf00
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x150]
call fcn.0040cf00
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14c]
call fcn.00409890
jmp 0x4266f5
push str.AppDatalocalLow
lea ecx, [ebp - 0x408]
call fcn.0043c3e0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x408]
push ecx
push 0x28
lea edx, [ebp - 0x40c]
push edx
mov ecx, dword [ebp - 0x548]
call fcn.00425d10
mov dword [ebp - 0x574], eax
mov eax, dword [ebp - 0x574]
mov dword [ebp - 0x578], eax
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x578]
push ecx
lea edx, [ebp - 0x154]
push edx
call fcn.0042b0f0
add esp, 0xc
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x40c]
call fcn.0040cf00
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x408]
call fcn.0040cf00
push 0x4a9094
lea ecx, [ebp - 0x410]
call fcn.0043c3e0
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x410]
push ecx
lea edx, [ebp - 0x154]
push edx
lea eax, [ebp - 0x414]
push eax
call fcn.0042b0f0
add esp, 0xc
mov dword [ebp - 0x57c], eax
mov ecx, dword [ebp - 0x57c]
mov dword [ebp - 0x580], ecx
mov byte [ebp - 4], 0x17
mov edx, dword [ebp - 0x580]
push edx
lea eax, [ebp - 0x418]
push eax
call fcn.0042b0f0
add esp, 0xc
mov dword [ebp - 0x584], eax
mov ecx, dword [ebp - 0x584]
mov dword [ebp - 0x588], ecx
mov byte [ebp - 4], 0x18
mov edx, dword [ebp - 0x588]
push edx
lea ecx, [ebp - 0x10]
call fcn.0040c490
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x418]
call fcn.0040cf00
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x414]
call fcn.0040cf00
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x410]
call fcn.0040cf00
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x154]
call fcn.0040cf00
push 0
push 0
lea ecx, [ebp - 0x10]
call fcn.004157c0
push eax
lea ecx, [ebp - 0x14]
call fcn.004157c0
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
jge 0x426742
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.0040cf00
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0040cf00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040cf00
jmp 0x426bda
lea ecx, [ebp - 0x1c]
call fcn.0041fe90
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x1c]
call fcn.00414960
push eax
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
lea ecx, [ebp - 0x1c]
call fcn.004157c0
test eax, eax
je 0x426b9f
mov dword [ebp - 0x158], 0
lea ecx, [ebp - 0x1c]
call fcn.004157c0
mov dword [ebp - 0x58c], eax
lea eax, [ebp - 0x264]
push eax
push 0x8000
mov ecx, dword [ebp - 0x158]
push ecx
mov edx, dword [ebp - 0x58c]
push edx
mov eax, dword [ebp - 0x58c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
call edx
test eax, eax
jne 0x426b9f
lea ecx, [ebp - 0x384]
call fcn.0040ce40
mov byte [ebp - 4], 0x1a
push 0x8e
lea ecx, [ebp - 0x384]
call fcn.0040d1c0
lea ecx, [ebp - 0x2f0]
call fcn.0040ce40
mov byte [ebp - 4], 0x1b
push 0x8d
lea ecx, [ebp - 0x2f0]
call fcn.0040d1c0
push 1
push 3
lea ecx, [ebp - 0x37c]
call fcn.0042bcc0
mov byte [ebp - 4], 0x1c
lea eax, [ebp - 0x37c]
test eax, eax
je 0x426820
lea ecx, [ebp - 0x37c]
add ecx, 8
mov dword [ebp - 0x590], ecx
jmp 0x42682a
mov dword [ebp - 0x590], 0
push str._000214A0_0000_0000_C000_000000000046__r
mov edx, dword [ebp - 0x590]
push edx
call fcn.004410b0
add esp, 8
lea eax, [ebp - 0x37c]
test eax, eax
je 0x426859
lea ecx, [ebp - 0x37c]
add ecx, 8
mov dword [ebp - 0x594], ecx
jmp 0x426863
mov dword [ebp - 0x594], 0
push str.Prop319_2_r
mov edx, dword [ebp - 0x594]
push edx
call fcn.004410b0
add esp, 8
lea eax, [ebp - 0x37c]
test eax, eax
je 0x426892
lea ecx, [ebp - 0x37c]
add ecx, 8
mov dword [ebp - 0x598], ecx
jmp 0x42689c
mov dword [ebp - 0x598], 0
push str._InternetShortcut__r
mov edx, dword [ebp - 0x598]
push edx
call fcn.004410b0
add esp, 8
lea eax, [ebp - 0x37c]
test eax, eax
je 0x4268cb
lea ecx, [ebp - 0x37c]
add ecx, 8
mov dword [ebp - 0x59c], ecx
jmp 0x4268d5
mov dword [ebp - 0x59c], 0
push 0x4a90e4
lea ecx, [ebp - 0x2f0]
call fcn.004157c0
push eax
lea ecx, [ebp - 0x49c]
call fcn.0042bea0
mov dword [ebp - 0x5a0], eax
mov edx, dword [ebp - 0x5a0]
mov dword [ebp - 0x5a4], edx
mov byte [ebp - 4], 0x1d
mov ecx, dword [ebp - 0x5a4]
call fcn.004157c0
push eax
push str.URL
mov eax, dword [ebp - 0x59c]
push eax
call fcn.004410b0
add esp, 8
push eax
call fcn.004410b0
add esp, 8
push eax
call fcn.004410b0
add esp, 8
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x49c]
call fcn.0042bed0
lea ecx, [ebp - 0x37c]
test ecx, ecx
je 0x426963
lea edx, [ebp - 0x37c]
add edx, 8
mov dword [ebp - 0x5a8], edx
jmp 0x42696d
mov dword [ebp - 0x5a8], 0
push 0x4a90f0
lea ecx, [ebp - 0x10]
call fcn.004157c0
push eax
lea ecx, [ebp - 0x520]
call fcn.0042bea0
mov dword [ebp - 0x5ac], eax
mov eax, dword [ebp - 0x5ac]
mov dword [ebp - 0x5b0], eax
mov byte [ebp - 4], 0x1e
mov ecx, dword [ebp - 0x5b0]
call fcn.004157c0
push eax
push str.IconFile
mov ecx, dword [ebp - 0x5a8]
push ecx
call fcn.004410b0
add esp, 8
push eax
call fcn.004410b0
add esp, 8
push eax
call fcn.004410b0
add esp, 8
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x520]
call fcn.0042bed0
lea edx, [ebp - 0x37c]
test edx, edx
je 0x4269f8
lea eax, [ebp - 0x37c]
add eax, 8
mov dword [ebp - 0x5b4], eax
jmp 0x426a02
mov dword [ebp - 0x5b4], 0
push str.IconIndex0
mov ecx, dword [ebp - 0x5b4]
push ecx
call fcn.004410b0
add esp, 8
mov edx, dword [ebp - 0x260]
push edx
lea ecx, [ebp - 0x380]
call fcn.0040ce80
mov byte [ebp - 4], 0x1f
push str..url
lea eax, [ebp - 0x384]
push eax
push 0x4a9118
lea ecx, [ebp - 0x524]
push ecx
call fcn.0042b250
add esp, 0xc
mov dword [ebp - 0x5b8], eax
mov edx, dword [ebp - 0x5b8]
mov dword [ebp - 0x5bc], edx
mov byte [ebp - 4], 0x20
mov eax, dword [ebp - 0x5bc]
push eax
lea ecx, [ebp - 0x528]
push ecx
call fcn.0042b1a0
add esp, 0xc
mov dword [ebp - 0x5c0], eax
mov edx, dword [ebp - 0x5c0]
mov dword [ebp - 0x5c4], edx
mov byte [ebp - 4], 0x21
mov eax, dword [ebp - 0x5c4]
push eax
lea ecx, [ebp - 0x380]
call fcn.0043c460
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x528]
call fcn.0040cf00
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x524]
call fcn.0040cf00
push 1
lea ecx, [ebp - 0x2ec]
call fcn.0042bf00
mov byte [ebp - 4], 0x22
push 0x40
push 0x12
lea ecx, [ebp - 0x380]
call fcn.004157c0
push eax
lea ecx, [ebp - 0x2ec]
call fcn.0042c020
lea ecx, [ebp - 0x544]
push ecx
lea ecx, [ebp - 0x37c]
call fcn.0042bdf0
mov dword [ebp - 0x5c8], eax
mov edx, dword [ebp - 0x5c8]
mov dword [ebp - 0x5cc], edx
mov byte [ebp - 4], 0x23
mov ecx, dword [ebp - 0x5cc]
call fcn.00402ed0
push eax
lea eax, [ebp - 0x2ec]
push eax
call fcn.004410b0
add esp, 8
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x544]
call fcn.00402960
lea ecx, [ebp - 0x2ec]
call fcn.0042c070
mov ecx, dword [ebp - 0x548]
mov byte [ecx + 0x14c], 1
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x2ec]
call fcn.0042a5b0
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x380]
call fcn.0040cf00
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x37c]
call fcn.0042a580
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x2f0]
call fcn.0040cf00
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x384]
call fcn.0040cf00
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.00407bf0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.0040cf00
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0040cf00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040cf00
xor edx, edx
jne 0x4262c2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.00480438
mov esp, ebp
pop ebp
ret