Function at 0x4325a3
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
sub esp, 0x104
lea ebp, [esp - 4]
mov eax, dword [0x4a946c]
xor eax, ebp
mov dword [ebp + 0x104], eax
push 0x1c
mov eax, 0x473169
call fcn.004550bc
mov edi, ecx
lea ecx, [ebp - 0x20]
call fcn.00435c47
and dword [ebp - 4], 0
push 0xffffffffffffffff
lea esi, [edi + 0x1450]
push 0
mov ecx, esi
call fcn.0044a148
lea ebx, [edi + 0x144c]
push 0x477979
mov ecx, ebx
call fcn.00401759
push 0x80000001
lea ecx, [ebp - 0x20]
call fcn.00435a09
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.00401c93
lea ecx, [ebp - 0x20]
call fcn.00436002
test eax, eax
je 0x4326d0
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x477979
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.Local_Settings
mov byte [ebp - 4], 1
call fcn.00401c93
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0
call fcn.00436249
push eax
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.0040170c
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.004010af
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
je 0x4326d0
push str.Temp
lea eax, [ebp - 0x10]
push ebx
push eax
call fcn.0040177e
add esp, 0xc
push eax
mov ecx, ebx
mov byte [ebp - 4], 3
call fcn.0040170c
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.004010af
mov eax, dword [esi + 8]
push ebx
push eax
mov ecx, esi
call fcn.0044a503
lea ecx, [edi + 0x147c]
push 0x48d730
call fcn.00401759
push 3
mov ecx, edi
call fcn.0041f334
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.0044a148
push 0x477979
mov ecx, ebx
call fcn.00401759
push 0x104
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x43273a
lea eax, [ebp]
push str.Temp
push eax
call fcn.00457470
pop ecx
pop ecx
lea eax, [ebp]
push eax
mov ecx, ebx
call fcn.00401759
mov eax, dword [esi + 8]
push ebx
push eax
mov ecx, esi
call fcn.0044a503
lea ecx, [edi + 0x147c]
push 0x48d730
call fcn.00401759
push 3
mov ecx, edi
call fcn.0041f334
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.0044a148
push 0x477979
mov ecx, ebx
call fcn.00401759
lea eax, [ebp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x432794
lea eax, [ebp]
push eax
mov ecx, ebx
call fcn.00401759
mov eax, dword [esi + 8]
push ebx
push eax
mov ecx, esi
call fcn.0044a503
lea ecx, [edi + 0x147c]
push 0x48d730
call fcn.00401759
push 3
mov ecx, edi
call fcn.0041f334
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.0044a148
push 0x477979
mov ecx, ebx
call fcn.00401759
push str.TEMP
call fcn.00459582
pop ecx
push eax
mov ecx, ebx
call fcn.00401759
mov eax, dword [esi + 8]
push ebx
push eax
mov ecx, esi
call fcn.0044a503
lea ecx, [edi + 0x147c]
push 0x48d730
call fcn.00401759
push 3
mov ecx, edi
call fcn.0041f334
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.0044a148
push 0x477979
mov ecx, ebx
call fcn.00401759
push 0x48d724
call fcn.00459582
pop ecx
push eax
mov ecx, ebx
call fcn.00401759
mov eax, dword [esi + 8]
push ebx
push eax
mov ecx, esi
call fcn.0044a503
push 0x48d730
lea ecx, [edi + 0x147c]
call fcn.00401759
push 3
mov ecx, edi
call fcn.0041f334
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00435c67
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x104]
xor ecx, ebp
call fcn.004550ad
add ebp, 0x108
leave
ret