Function at 0x4431bc
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
xor eax, eax
push ebp
push 0x44346a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.0040627c
cmp byte [ebp - 5], 0
je 0x44321c
mov ebx, 0x23
jmp 0x443221
mov ebx, 0x1a
xor eax, eax
push ebp
push 0x443261
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push ebx
lea eax, [ebp - 0x216]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x216]
call fcn.00406428
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44326f
cmp byte [ebp - 0xd], 0
je 0x443287
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040db14
test al, al
jne 0x443444
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.0040627c
xor eax, eax
push ebp
push 0x44333d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x434944]
call fcn.00434a80
mov ebx, eax
mov dword [ebx + 0x18], 1
cmp byte [ebp - 5], 0
je 0x4432d9
mov edx, 0x80000002
mov eax, ebx
call fcn.00434b20
lea eax, [ebp - 4]
mov edx, 0x443484
call fcn.004062d0
jmp 0x4432f2
mov edx, 0x80000001
mov eax, ebx
call fcn.00434b20
lea eax, [ebp - 4]
mov edx, 0x4434b0
call fcn.004062d0
mov edx, 0x4434cc
mov eax, ebx
call fcn.00435084
test al, al
je 0x44332c
mov edx, 0x4434cc
xor ecx, ecx
mov eax, ebx
call fcn.00434b84
test al, al
je 0x44332c
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00434ef8
mov byte [ebp - 0xd], 1
mov eax, ebx
call fcn.00434af0
mov eax, ebx
call fcn.00403dbc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x443347
cmp byte [ebp - 0xd], 0
je 0x44335f
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040db14
test al, al
jne 0x443444
mov eax, dword [0x55c53c]
cmp dword [eax], 5
jg 0x4433cd
cmp byte [ebp - 5], 0
je 0x443392
lea eax, [ebp - 0x21c]
call fcn.00443134
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0xc]
mov ecx, 0x44355c
call fcn.00406750
jmp 0x44342c
lea eax, [ebp - 0x220]
call fcn.00443134
push dword [ebp - 0x220]
push 0x4435d0
lea eax, [ebp - 0x224]
call fcn.004430f0
push dword [ebp - 0x224]
push 0x443610
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.00406834
jmp 0x44342c
cmp byte [ebp - 5], 0
je 0x4433f3
lea eax, [ebp - 0x228]
call fcn.00443134
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp - 0xc]
mov ecx, 0x443640
call fcn.00406750
jmp 0x44342c
lea eax, [ebp - 0x22c]
call fcn.00443134
push dword [ebp - 0x22c]
push 0x443668
lea eax, [ebp - 0x230]
call fcn.004430f0
push dword [ebp - 0x230]
push 0x443684
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.00406834
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040db14
test al, al
jne 0x443444
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.0040627c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443471
lea eax, [ebp - 0x230]
mov edx, 6
call fcn.00406274
lea eax, [ebp - 4]
call fcn.0040626c
ret