Function at 0x4286a0
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x428abc
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41f88c]
call fcn.0041f95c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x428a71
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.0041f9fc
xor ecx, ecx
mov edx, 0x428ad4
mov eax, dword [ebp - 8]
call fcn.0041fa60
xor eax, eax
mov al, bl
cmp eax, 0x15
ja case.default.0x428706
jmp dword [eax*4 + 0x42870d]
mov ecx, dword [ebp - 4]
mov edx, 0x428b20
mov eax, dword [ebp - 8]
call fcn.0041fbfc
jmp case.default.0x428706
mov ecx, dword [ebp - 4]
mov edx, 0x428b30
mov eax, dword [ebp - 8]
call fcn.0041fbfc
jmp case.default.0x428706
mov ecx, dword [ebp - 4]
mov edx, 0x428b44
mov eax, dword [ebp - 8]
call fcn.0041fbfc
jmp case.default.0x428706
mov ecx, dword [ebp - 4]
mov edx, 0x428b58
mov eax, dword [ebp - 8]
call fcn.0041fbfc
jmp case.default.0x428706
mov ecx, dword [ebp - 4]
mov edx, 0x428b68
mov eax, dword [ebp - 8]
call fcn.0041fbfc
jmp case.default.0x428706
mov ecx, dword [ebp - 4]
mov edx, 0x428b7c
mov eax, dword [ebp - 8]
call fcn.0041fbfc
jmp case.default.0x428706
mov ecx, dword [ebp - 4]
mov edx, 0x428b8c
mov eax, dword [ebp - 8]
call fcn.0041fbfc
jmp case.default.0x428706
mov ecx, dword [ebp - 4]
mov edx, 0x428b9c
mov eax, dword [ebp - 8]
call fcn.0041fbfc
jmp case.default.0x428706
mov ecx, dword [ebp - 4]
mov edx, 0x428bac
mov eax, dword [ebp - 8]
call fcn.0041fbfc
jmp case.default.0x428706
mov ecx, dword [ebp - 4]
mov edx, 0x428bbc
mov eax, dword [ebp - 8]
call fcn.0041fbfc
jmp case.default.0x428706
mov ecx, dword [ebp - 4]
mov edx, 0x428bd0
mov eax, dword [ebp - 8]
call fcn.0041fbfc
jmp case.default.0x428706
mov ecx, dword [ebp - 4]
mov edx, 0x428be0
mov eax, dword [ebp - 8]
call fcn.0041fbfc
jmp case.default.0x428706
mov ecx, dword [ebp - 4]
mov edx, 0x428bf0
mov eax, dword [ebp - 8]
call fcn.0041fbfc
jmp case.default.0x428706
mov ecx, dword [ebp - 4]
mov edx, 0x428c00
mov eax, dword [ebp - 8]
call fcn.0041fbfc
jmp case.default.0x428706
mov ecx, dword [ebp - 4]
mov edx, 0x428c10
mov eax, dword [ebp - 8]
call fcn.0041fbfc
jmp case.default.0x428706
mov ecx, dword [ebp - 4]
mov edx, 0x428c24
mov eax, dword [ebp - 8]
call fcn.0041fbfc
jmp case.default.0x428706
mov ecx, dword [ebp - 4]
mov edx, 0x428c38
mov eax, dword [ebp - 8]
call fcn.0041fbfc
jmp case.default.0x428706
mov ecx, dword [ebp - 4]
mov edx, 0x428c50
mov eax, dword [ebp - 8]
call fcn.0041fbfc
jmp case.default.0x428706
mov eax, 0xff
call fcn.004026f8
mov esi, eax
push 0xfe
push esi
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00409918
mov eax, esi
call fcn.00402718
jmp case.default.0x428706
mov eax, 0xff
call fcn.004026f8
mov esi, eax
push 0xfe
push esi
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00409918
mov eax, esi
call fcn.00402718
jmp case.default.0x428706
mov eax, 0xff
call fcn.004026f8
mov esi, eax
push esi
push 0xfe
call sub.kernel32.dll_GetTempPathA
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00409918
mov eax, esi
call fcn.00402718
jmp case.default.0x428706
mov eax, 0xff
call fcn.004026f8
mov esi, eax
push 0xfe
push esi
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.00409918
mov eax, dword [ebp - 0xc]
mov ecx, 2
mov edx, 1
call fcn.00404c00
mov eax, esi
call fcn.00402718
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.0041f9fc
xor ecx, ecx
mov edx, 0x428c64
mov eax, dword [ebp - 8]
call fcn.0041fa60
xor eax, eax
mov al, bl
add eax, 0xffffffea
cmp eax, 5
ja case.default.0x4289ca
jmp dword [eax*4 + 0x4289d1]
mov ecx, dword [ebp - 4]
mov edx, 0x428c98
mov eax, dword [ebp - 8]
call fcn.0041fbfc
jmp case.default.0x4289ca
mov ecx, dword [ebp - 4]
mov edx, 0x428cb0
mov eax, dword [ebp - 8]
call fcn.0041fbfc
jmp case.default.0x4289ca
mov ecx, dword [ebp - 4]
mov edx, 0x428cc8
mov eax, dword [ebp - 8]
call fcn.0041fbfc
jmp case.default.0x4289ca
mov ecx, dword [ebp - 4]
mov edx, 0x428cdc
mov eax, dword [ebp - 8]
call fcn.0041fbfc
jmp case.default.0x4289ca
mov ecx, dword [ebp - 4]
mov edx, 0x428cf0
mov eax, dword [ebp - 8]
call fcn.0041fbfc
jmp case.default.0x4289ca
mov ecx, dword [ebp - 4]
mov edx, 0x428d04
mov eax, dword [ebp - 8]
call fcn.0041fbfc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x428a78
mov eax, dword [ebp - 8]
call fcn.0041f9cc
mov eax, dword [ebp - 8]
call fcn.004037c0
ret