Function at 0x44ca50
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4653bb
push eax
mov dword fs:[0], esp
sub esp, 0x62c
push ebx
mov ebx, dword [esp + 0x640]
push ebp
push esi
test ebx, ebx
push edi
je 0x44cf17
mov eax, dword [esp + 0x650]
test eax, eax
je 0x44cf17
mov word [eax], 0
mov ecx, dword [0x4759c8]
mov eax, dword [str.CLSID:]
mov edx, dword [0x4759cc]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov ax, word [0x4759d0]
push 6
push ecx
push ebx
mov dword [esp + 0x30], edx
mov word [esp + 0x34], ax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x44cbb2
lea esi, [ebx + 0xc]
mov ebp, 0x208
push esi
push str.CLSID_sInprocServer32
lea edx, [esp + 0x23c]
push ebp
push edx
call fcn.00401c00
add esp, 0x10
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x2c]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
lea eax, [esp + 0x240]
push 0
mov ebx, 1
push eax
push SysReAllocString
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebp
call edi
test eax, eax
jne 0x44cb35
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
jne 0x44cb8f
push esi
push str.CLSID_sLocalServer32
lea edx, [esp + 0x23c]
push ebp
push edx
call fcn.00401c00
add esp, 0x10
lea eax, [esp + 0x14]
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x18]
push eax
push ecx
push edx
lea eax, [esp + 0x240]
push 0
push eax
push SysReAllocString
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebp
call edi
test eax, eax
jne 0x44cf17
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
je 0x44cf17
lea edx, [esp + 0x2c]
mov ecx, dword [esp + 0x650]
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x30]
push eax
push ecx
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
mov eax, ebx
jmp 0x44cf19
mov edi, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
xor ebp, ebp
mov esi, 0x475468
mov edx, dword [esi]
push ebx
push edx
call edi
test eax, eax
je 0x44cc01
add esi, 8
inc ebp
cmp esi, 0x475518
jb 0x44cbbf
mov esi, dword [esp + 0x650]
push str.Windows
push ebx
call edi
test eax, eax
jne 0x44cc29
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
neg eax
jmp 0x44cf19
mov eax, dword [ebp*8 + 0x47546c]
mov esi, dword [esp + 0x650]
push 0
push eax
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x44cbdc
mov eax, 1
jmp 0x44cf19
push str.System
push ebx
call edi
test eax, eax
jne 0x44cc4e
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor edx, edx
cmp edx, eax
sbb eax, eax
neg eax
jmp 0x44cf19
push str.SystemRoot
push ebx
call edi
test eax, eax
jne 0x44cc7a
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x44cf17
push esi
call dword [sym.imp.SHLWAPI.dll_PathStripToRootW]
jmp 0x44cf19
push str.Temp
push ebx
call edi
test eax, eax
jne 0x44cc9f
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
neg eax
jmp 0x44cf19
lea edx, [esp + 0x14]
lea eax, [esp + 0x18]
push edx
push esi
push eax
push ebx
mov ebp, 0x208
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push SysReAllocString
mov dword [esp + 0x30], 1
mov dword [esp + 0x2c], ebp
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x44ccda
mov eax, 1
jmp 0x44cf19
push str.ProgramFiles
push ebx
call edi
test eax, eax
jne 0x44ccf3
mov ecx, dword [esp + 0x14]
push ecx
push esi
push str.ProgramFilesDir
jmp 0x44cd0a
push str.CommonFiles
push ebx
call edi
test eax, eax
jne 0x44cd21
mov edx, dword [esp + 0x14]
push edx
push esi
push str.CommonFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0044cf40
add esp, 0x14
jmp 0x44cf19
mov eax, dword [0x46f42c]
mov ecx, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_
mov dword [esp + 0x14], ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
test ecx, ecx
mov dword [esp + 0x18], 1
mov dword [esp + 0x10], eax
je 0x44ce19
mov edx, ecx
shr edx, 0x10
jne 0x44cddc
xor edi, edi
mov eax, ecx
lea ecx, [esp + 0x43c]
mov di, ax
push 0x100
push ecx
push edi
call fcn.00408450
mov edx, 0x100
sub edx, eax
cmp edx, 1
jle 0x44cd90
lea eax, [esp + 0x43c]
lea ecx, [esp + 0x10]
push eax
call fcn.00407430
jmp 0x44ce19
push 0x1ff
lea ecx, [esp + 0x14]
mov esi, 0x200
call fcn.00407e80
test eax, eax
je 0x44cdcf
push esi
push eax
push edi
call fcn.00408450
mov ecx, esi
sub ecx, eax
cmp ecx, 1
jg 0x44cdcf
add esi, 0x100
lea ecx, [esp + 0x10]
lea edx, [esi - 1]
push edx
call fcn.00407e80
test eax, eax
jne 0x44cda7
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
call fcn.00407f40
jmp 0x44ce19
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_
call ebp
mov esi, eax
test esi, esi
je 0x44ce19
push esi
lea ecx, [esp + 0x14]
call fcn.00408040
test eax, eax
je 0x44ce19
lea ecx, [esi + esi]
lea eax, [esi + esi + 2]
cmp eax, ecx
jb 0x44ce19
mov edi, dword [esp + 0x10]
mov edx, ecx
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebx
mov dword [esp + 0x648], 0
call ebp
mov esi, eax
test esi, esi
je 0x44ce94
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 0xc]
lea edi, [eax - 0xc]
cmp ecx, 1
jg 0x44ce7a
mov ecx, dword [eax - 8]
mov edx, dword [eax - 4]
lea ebp, [ecx + esi]
cmp ebp, edx
jg 0x44ce7a
lea edi, [esi + esi]
lea edx, [edx + edx + 2]
push edi
push ebx
lea eax, [eax + ecx*2]
push edx
push eax
call fcn.00407060
mov eax, dword [esp + 0x20]
add esp, 0x10
mov ecx, dword [eax - 8]
add ecx, esi
mov dword [eax - 8], ecx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 8]
mov word [eax + ecx*2], 0
jmp 0x44ce94
mov edx, dword [eax - 8]
push ebx
push esi
push eax
push edx
lea ecx, [esp + 0x20]
call fcn.00413d20
test eax, eax
je 0x44ce94
push edi
call fcn.00408420
mov ecx, dword [esp + 0x650]
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push edx
push str.Path
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov edx, dword [0x46f430]
test eax, eax
mov eax, dword [esp + 0x10]
lea ecx, [eax - 0xc]
jne 0x44cef5
cmp ecx, edx
je 0x44ceee
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x44ceee
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.004535f0
add esp, 4
mov eax, 1
jmp 0x44cf19
cmp ecx, edx
je 0x44cf17
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x44cf17
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.004535f0
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x63c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x638
ret