Function at 0x46e0e0
Capabilities:
Check if file exists
Get file attributes
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x474
mov eax, dword [esp + 0x478]
push ebx
push ebp
push esi
xor esi, esi
lea ebp, [eax + 0x20a]
mov word [eax], si
add eax, 0x414
push 0x208
mov word [eax], si
lea eax, [esp + 0x276]
push esi
push eax
mov dword [esp + 0x28], esi
mov word [ebp], si
mov word [esp + 0x27c], si
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [0x47c2f8], esi
jne 0x46e155
mov ebx, 0x471824
call fcn.00460340
cmp eax, esi
mov dword [0x47c2f8], eax
je 0x46e155
push str.SHGetSpecialFolderPathW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x47c2f4], eax
cmp dword [0x47c2f4], esi
je 0x46e191
cmp dword [0x47bbac], esi
jne 0x46e17a
push 0x47bba8
mov dword [0x47bba8], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push esi
push 0x28
lea ecx, [esp + 0x278]
push ecx
push esi
call dword [0x47c2f4]
jmp 0x46e235
push 0x206
lea edx, [esp + 0x66]
push esi
push edx
mov word [esp + 0x6c], si
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x46e216
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x64]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push eax
push esi
lea ecx, [esp + 0x30]
push ecx
push edx
mov dword [esp + 0x24], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x46e20b
mov eax, dword [esp + 0xc]
cmp eax, 2
jb 0x46e206
shr eax, 1
mov word [esp + eax*2 + 0x60], si
jmp 0x46e20b
mov word [esp + 0x60], si
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x46e220
movzx ecx, word [esp + eax + 0x60]
mov word [esp + eax + 0x270], cx
add eax, 2
cmp cx, si
jne 0x46e220
lea ecx, [esp + 0x270]
push edi
push ecx
call sub.msvcrt.dll__wcsicmp
add esp, 8
test eax, eax
jne 0x46e5b0
cmp dword [0x47c2f8], esi
jne 0x46e27a
mov ebx, 0x471824
call fcn.00460340
cmp eax, esi
mov dword [0x47c2f8], eax
je 0x46e27a
push str.SHGetSpecialFolderPathW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x47c2f4], eax
cmp dword [0x47c2f4], esi
je 0x46e2af
cmp dword [0x47bbac], esi
jne 0x46e29f
push 0x47bba8
mov dword [0x47bba8], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push esi
push 0x1a
push ebp
push esi
call dword [0x47c2f4]
jmp 0x46e36f
push 0x206
lea edx, [esp + 0x66]
push esi
push edx
mov word [esp + 0x6c], si
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x46e352
xor eax, eax
jmp 0x46e2f0
movzx ecx, word [eax + str.AppData]
mov word [esp + eax + 0x20], cx
add eax, 2
cmp cx, si
jne 0x46e2f0
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x64]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
push esi
lea ecx, [esp + 0x30]
push ecx
push edx
mov dword [esp + 0x28], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x46e347
mov eax, dword [esp + 0x10]
cmp eax, 2
jb 0x46e342
shr eax, 1
mov word [esp + eax*2 + 0x60], si
jmp 0x46e347
mov word [esp + 0x60], si
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x60]
mov edx, ebp
mov ecx, eax
sub edx, ecx
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, si
jne 0x46e360
cmp dword [0x47c2f8], esi
jne 0x46e39b
mov ebx, 0x471824
call fcn.00460340
cmp eax, esi
mov dword [0x47c2f8], eax
je 0x46e39b
push str.SHGetSpecialFolderPathW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x47c2f4], eax
cmp dword [0x47c2f4], esi
je 0x46e3dc
cmp dword [0x47bbac], esi
jne 0x46e3c0
push 0x47bba8
mov dword [0x47bba8], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 0x484]
push esi
push 0x1c
add eax, 0x414
push eax
push esi
call dword [0x47c2f4]
jmp 0x46e485
push 0x206
lea edx, [esp + 0x66]
push esi
push edx
mov word [esp + 0x6c], si
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x46e461
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x64]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
push esi
lea ecx, [esp + 0x30]
push ecx
push edx
mov dword [esp + 0x28], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x46e456
mov eax, dword [esp + 0x10]
cmp eax, 2
jb 0x46e451
shr eax, 1
mov word [esp + eax*2 + 0x60], si
jmp 0x46e456
mov word [esp + 0x60], si
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x484]
lea eax, [esp + 0x60]
add edx, 0x414
mov ecx, eax
sub edx, ecx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, si
jne 0x46e476
cmp dword [0x47c2f8], esi
jne 0x46e4b1
mov ebx, 0x471824
call fcn.00460340
cmp eax, esi
mov dword [0x47c2f8], eax
je 0x46e4b1
push str.SHGetSpecialFolderPathW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x47c2f4], eax
cmp dword [0x47c2f4], esi
je 0x46e4f9
cmp dword [0x47bbac], esi
jne 0x46e4d6
push 0x47bba8
mov dword [0x47bba8], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov edx, dword [esp + 0x484]
push esi
push 0x22
push edx
push esi
call dword [0x47c2f4]
mov eax, 1
pop esi
pop ebp
pop ebx
add esp, 0x474
ret 4
push 0x206
lea eax, [esp + 0x66]
push esi
push eax
mov word [esp + 0x6c], si
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x46e57e
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x64]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push ecx
push esi
lea edx, [esp + 0x30]
push edx
push eax
mov dword [esp + 0x28], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x46e573
mov eax, dword [esp + 0x10]
cmp eax, 2
jb 0x46e56e
shr eax, 1
mov word [esp + eax*2 + 0x60], si
jmp 0x46e573
mov word [esp + 0x60], si
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x484]
lea eax, [esp + 0x60]
mov ecx, eax
sub edx, ecx
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, si
jne 0x46e590
mov eax, 1
pop esi
pop ebp
pop ebx
add esp, 0x474
ret 4
xor ebx, ebx
push 0x208
lea edx, [esp + 0x66]
push ebx
push edx
mov word [esp + 0x6c], bx
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x104
push str.NTUSER.DAT
lea eax, [esp + 0x68]
mov ecx, edi
call fcn.00460d00
add esp, 8
lea eax, [esp + 0x60]
push eax
lea esi, [esp + 0x18]
mov dword [esp + 0x18], ebx
call fcn.0044f780
test eax, eax
je 0x46e6be
push 0x20
mov ecx, esi
push ecx
call fcn.0044f9f0
mov esi, eax
cmp esi, ebx
je 0x46e6be
mov ebx, dword [esp + 0x484]
push ebx
mov ecx, 0x46f670
lea edx, [esp + 0x18]
call fcn.0046df80
test eax, eax
je 0x46e633
mov eax, ebx
mov ecx, edi
call fcn.0046e010
push ebp
mov ecx, str.AppData
mov eax, esi
lea edx, [esp + 0x18]
call fcn.0046df80
test eax, eax
je 0x46e651
mov eax, ebp
mov ecx, edi
call fcn.0046e010
lea eax, [ebx + 0x414]
push eax
mov ecx, str.Local_AppData
mov eax, esi
lea edx, [esp + 0x18]
call fcn.0046df80
test eax, eax
je 0x46e679
lea eax, [ebx + 0x414]
mov ecx, edi
call fcn.0046e010
cmp word [ebx], 0
je 0x46e6c5
cmp word [ebp], 0
je 0x46e6c5
cmp word [ebx + 0x414], 0
lea esi, [ebx + 0x414]
je 0x46e6c5
mov eax, ebx
call fcn.0045fc20
test eax, eax
je 0x46e6c5
mov eax, ebp
call fcn.0045fc20
test eax, eax
je 0x46e6c5
mov eax, esi
call fcn.0045fc20
test eax, eax
je 0x46e6c5
mov esi, 1
jmp 0x46e6c9
mov ebx, dword [esp + 0x484]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x46e6da
push eax
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
test esi, esi
jne 0x46e7a2
push 0x104
push str.Local_SettingsApplication_Data
lea eax, [ebx + 0x414]
mov ecx, edi
call fcn.00460d00
push 0x104
push str.Application_Data
mov eax, ebp
mov ecx, edi
call fcn.00460d00
push 0x104
push str.Local_SettingsHistory
mov eax, ebx
mov ecx, edi
call fcn.00460d00
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0x18
push ebp
call esi
test eax, 0x400
je 0x46e776
push 0x104
push str.AppDataLocal
lea eax, [ebx + 0x414]
mov ecx, edi
call fcn.00460d00
push 0x104
push str.MicrosoftWindowsHistory
mov eax, ebx
lea ecx, [ebx + 0x414]
call fcn.00460d00
push 0x104
push str.AppDataRoaming
mov eax, ebp
mov ecx, edi
call fcn.00460d00
add esp, 0x18
push ebx
call esi
cmp eax, 0xffffffff
jne 0x46e791
lea eax, [ebx + 0x414]
push eax
mov ecx, ebx
mov word [ebx], 0
call fcn.0046de70
mov eax, 1
pop esi
pop ebp
pop ebx
add esp, 0x474
ret 4
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x474
ret 4