Function at 0x437b40
Capabilities:
Get common file path
Persist via run registry key
Query environment variable
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x49da16
mov eax, dword fs:[0]
push eax
sub esp, 0x66c
mov eax, dword [0x4c1bd8]
xor eax, esp
mov dword [esp + 0x668], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c1bd8]
xor eax, esp
push eax
lea eax, [esp + 0x680]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x694]
mov esi, dword [esp + 0x690]
push 0x206
mov edi, ecx
xor ebp, ebp
lea ecx, [esp + 0x6a]
xor eax, eax
push ebp
push ecx
mov dword [esp + 0x28], ebx
mov word [esp + 0x70], ax
call fcn.00454ce0
push 0x206
lea eax, [esp + 0x486]
xor edx, edx
push ebp
push eax
mov word [esp + 0x48c], dx
call fcn.00454ce0
push 0x25
push esi
mov dword [esp + 0x40], 1
mov dword [esp + 0x38], 0x208
call fcn.00453ab2
add esp, 0x20
test eax, eax
jne 0x437c1d
cmp esi, ebp
jne 0x437bf6
push eax
push esi
mov ecx, ebx
call fcn.0040df70
jmp 0x438180
mov eax, esi
lea edx, [eax + 2]
jmp 0x437c00
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x437c00
sub eax, edx
sar eax, 1
push eax
push esi
mov ecx, ebx
call fcn.0040df70
jmp 0x438180
push 9
push str._install_
push esi
call fcn.0045600f
add esp, 0xc
test eax, eax
jne 0x437c89
add esi, 0x12
push esi
add edi, 8
lea ecx, [esp + 0x18]
push edi
push ecx
call fcn.00416660
add esp, 0xc
push eax
mov ecx, ebx
mov dword [esp + 0x68c], ebp
call fcn.0040e240
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0x688], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x438180
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x438180
push 8
push str._360safe
push esi
call fcn.0045600f
add esp, 0xc
test eax, eax
jne 0x437d4a
push 0x25
push esi
call fcn.004541d4
push 0x103
lea ecx, [esp + 0x480]
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_
push ecx
mov edi, eax
call fcn.00455578
mov edx, edi
sub edx, esi
sar edx, 1
dec edx
push edx
add esi, 2
lea eax, [esp + 0x48c]
push esi
push eax
call fcn.004555c2
add esp, 0x20
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push ebp
lea edx, [esp + 0x480]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x437e15
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x68]
push ecx
lea edx, [esp + 0x28]
push edx
push ebp
push 0x4a1228
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x64]
push edx
mov ecx, ebx
call fcn.0040ee40
add edi, 2
push edi
mov ecx, ebx
jmp 0x43817b
push 8
push str._Common
push esi
call fcn.0045600f
add esp, 0xc
test eax, eax
je 0x437fb9
push 6
push str._User
push esi
call fcn.0045600f
add esp, 0xc
test eax, eax
je 0x437fb9
push 7
push str._Group_
push esi
call fcn.0045600f
add esp, 0xc
test eax, eax
jne 0x437e1c
lea eax, [esp + 0x14]
push eax
push 0x17
push ebp
mov dword [esp + 0x20], ebp
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
cmp eax, ebp
jne 0x437e15
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x64]
push ecx
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x437e0a
lea eax, [esp + 0x64]
push eax
mov ecx, ebx
call fcn.0040ee40
add edi, 0x34
push edi
lea ecx, [esp + 0x20]
push 0x4a0e7c
push ecx
call fcn.00416a30
add esp, 0xc
push eax
mov ecx, ebx
mov dword [esp + 0x68c], 1
call fcn.00437b20
lea ecx, [esp + 0x1c]
call fcn.0040da70
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x438180
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor al, al
jmp 0x438182
push 0xb
push str._SMPROGRAMS
push esi
call fcn.0045600f
add esp, 0xc
test eax, eax
jne 0x437ecb
push 0x25
push esi
call fcn.004541d4
mov edi, eax
mov ecx, 0x25
sub cx, word [esi + 0x16]
add esp, 8
movzx eax, cx
neg eax
sbb eax, eax
and eax, 0xffffffeb
lea edx, [esp + 0x14]
push edx
add eax, 0x17
push eax
push ebp
mov dword [esp + 0x20], ebp
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x437e15
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x64]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x437e0a
lea eax, [esp + 0x64]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x437e87
sub eax, edx
sar eax, 1
mov edx, 0x104
sub edx, eax
push edx
add edi, 2
lea eax, [esp + 0x68]
push edi
push eax
call fcn.004555c2
add esp, 0xc
lea ecx, [esp + 0x64]
push ecx
mov ecx, ebx
call fcn.0040ee40
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x438180
push 6
push str._temp_
push esi
call fcn.0045600f
add esp, 0xc
test eax, eax
jne 0x437f80
push 0x206
lea edx, [esp + 0x272]
xor ecx, ecx
push ebp
push edx
mov word [esp + 0x278], cx
call fcn.00454ce0
add esp, 0xc
lea eax, [esp + 0x26c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x26c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x437f20
sub eax, edx
sar eax, 1
cmp eax, 0x104
jae 0x437f50
mov ecx, 0x5c
cmp cx, word [esp + eax*2 + 0x26a]
jne 0x437f50
xor edx, edx
mov word [esp + eax*2 + 0x26a], dx
dec eax
mov ecx, 0x104
sub ecx, eax
push ecx
add esi, 0xc
lea edx, [esp + 0x270]
push esi
push edx
call fcn.004555c2
add esp, 0xc
lea eax, [esp + 0x26c]
push eax
mov ecx, ebx
call fcn.0040ee40
jmp 0x438180
push 0x104
lea ecx, [esp + 0x68]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [esp + 0x18], eax
cmp eax, ebp
je 0x437e15
cmp word [esp + 0x64], bp
je 0x437e15
lea edx, [esp + 0x64]
push edx
mov ecx, ebx
call fcn.0040ee40
jmp 0x438180
push 0x25
push esi
xor bl, bl
call fcn.004541d4
push 6
push str._User
push esi
mov ebp, eax
call fcn.0045600f
add esp, 0x14
test eax, eax
lea edx, [esp + 0x474]
mov eax, ebp
jne 0x437ff0
sub eax, esi
sar eax, 1
mov bl, 1
sub eax, 6
lea ecx, [esi + 0xc]
jmp 0x437ff8
sub eax, esi
sar eax, 1
dec eax
lea ecx, [esi + 2]
push eax
push ecx
push edx
call fcn.00455578
add esp, 0xc
xor ecx, ecx
xor edi, edi
test bl, bl
lea eax, [esp + 0x14]
push eax
sete cl
push 0x20019
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov dword [esp + 0x24], edi
add ecx, 0x80000001
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43805f
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x68]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x28]
push ecx
push edi
lea edx, [esp + 0x484]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
cmp dx, word [esp + 0x64]
jne 0x438165
mov dword [esp + 0x24], str._COMMON_DESKTOP_
mov dword [esp + 0x28], str._COMMON_APPDATA_
mov dword [esp + 0x2c], str._COMMON_STARTMENU_
mov dword [esp + 0x30], str._COMMON_PROGRAMS_
mov dword [esp + 0x34], str._USER_DESKTOP_
mov dword [esp + 0x38], str._USER_APPDATA_
mov dword [esp + 0x3c], str._USER_STARTMENU_
mov dword [esp + 0x40], str._USER_PROGRAMS_
mov dword [esp + 0x44], 0x19
mov dword [esp + 0x48], 0x23
mov dword [esp + 0x4c], 0x16
mov dword [esp + 0x50], 0x17
mov dword [esp + 0x54], 0x10
mov dword [esp + 0x58], 0x1a
mov dword [esp + 0x5c], 0xb
mov dword [esp + 0x60], 2
lea esp, [esp]
mov edx, dword [esp + edi*4 + 0x24]
mov eax, edx
lea ebx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x438100
sub eax, ebx
sar eax, 1
push eax
push edx
push esi
call fcn.0045600f
add esp, 0xc
test eax, eax
je 0x438128
inc edi
cmp edi, 8
jb 0x4380f0
xor al, al
jmp 0x438182
cmp edi, 0xffffffff
je 0x437e15
cmp edi, 8
jae 0x437e15
mov ecx, dword [esp + edi*4 + 0x44]
lea eax, [esp + 0x64]
push eax
push 0
push 0
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x437e15
xor edx, edx
cmp dx, word [esp + 0x64]
je 0x437e15
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x64]
push eax
mov ecx, esi
call fcn.0040ee40
add ebp, 2
push ebp
mov ecx, esi
call fcn.00417d90
mov al, 1
mov ecx, dword [esp + 0x680]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x668]
xor ecx, esp
call fcn.00454cc7
add esp, 0x678
ret 8