Function at 0x403910
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1808
call fcn.00409f20
push ebx
push esi
mov eax, 0x41a9bc
mov dword [ebp - 0x1804], eax
mov edx, eax
mov ecx, 0x800
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
mov eax, dword [ebp - 0x1804]
mov ecx, eax
mov edx, dword [ebp + 8]
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x403949
pop eax
jmp 0x404157
push 0
push 0
push 0x41069f
push 0x41a9bc
call fcn.004018b0
add esp, 0x10
mov ebx, eax
push 0
lea eax, [ebx + 1]
push eax
push 0x41069f
push 0x41a9bc
call fcn.004018b0
add esp, 0x10
mov esi, eax
sub eax, ebx
inc eax
push eax
push ebx
push 0x41a9bc
call fcn.00401350
add esp, 0xc
lea ecx, [ebp - 0x800]
mov edx, eax
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x4039a8
pop eax
lea ecx, [ebp - 0x1800]
lea edx, [ebp - 0x800]
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x4039c2
pop eax
lea eax, [ebp - 0x800]
push eax
call fcn.00401700
pop ecx
lea ecx, [ebp - 0x800]
mov edx, eax
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x4039e5
pop eax
lea edx, [ebp - 0x800]
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x4039f9
test eax, eax
je 0x4040f7
push str.APPDIR
lea eax, [ebp - 0x800]
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x403a40
call fcn.00401870
lea ecx, [ebp - 0x1000]
mov edx, eax
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x403a30
pop eax
jmp 0x40402d
push str.BROWSEFORFOLDER
lea eax, [ebp - 0x800]
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x403abd
jmp 0x403abb
push 0
push 0x40
push str.Please_select_or_create_the_folder_where_you_would_like_to_extract_the_files_packed_in_this_executable.
call fcn.00402710
add esp, 0xc
lea ecx, [ebp - 0x1000]
mov edx, eax
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x403a76
pop eax
lea eax, [ebp - 0x1000]
push eax
call fcn.004013c0
pop ecx
mov edx, eax
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x403a93
test eax, eax
jne 0x403aa6
push 0x1c
call fcn.00404b70
pop ecx
lea eax, [ebp - 0x1000]
push eax
call fcn.00401a20
pop ecx
test eax, eax
jne 0x40402d
jmp 0x403a5a
push str.COMMAND
lea eax, [ebp - 0x800]
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x403b54
push 0xffffffffffffffff
call fcn.00401440
pop ecx
push eax
lea eax, [ebp - 0x1800]
push eax
push 0x41a9bc
call fcn.00402830
add esp, 0xc
lea ecx, [ebp - 0x1000]
mov edx, eax
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x403b01
pop eax
push 1
push 0
push str.COMMAND
lea eax, [ebp - 0x1000]
push eax
call fcn.004018b0
add esp, 0x10
test eax, eax
jne 0x40415c
lea eax, [ebp - 0x1000]
push eax
call fcn.00403910
pop ecx
lea ecx, [ebp - 0x1000]
mov edx, eax
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x403b44
pop eax
jmp 0x40402d
push str.CURDIR
lea eax, [ebp - 0x800]
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x403b83
lea eax, [ebp - 0x1000]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
jmp 0x40402d
push str.DESKTOP
lea eax, [ebp - 0x800]
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x403bcd
push str.Desktop
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call fcn.004027d0
add esp, 0xc
lea ecx, [ebp - 0x1000]
mov edx, eax
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x403bbd
pop eax
jmp 0x40402d
push str.DOCUMENTS
lea eax, [ebp - 0x800]
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x403c17
push str.Personal
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call fcn.004027d0
add esp, 0xc
lea ecx, [ebp - 0x1000]
mov edx, eax
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x403c07
pop eax
jmp 0x40402d
push str.FAVORITES
lea eax, [ebp - 0x800]
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x403c61
push str.Favorites
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call fcn.004027d0
add esp, 0xc
lea ecx, [ebp - 0x1000]
mov edx, eax
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x403c51
pop eax
jmp 0x40402d
push str.FONTS
lea eax, [ebp - 0x800]
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x403cab
push str.Fonts
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call fcn.004027d0
add esp, 0xc
lea ecx, [ebp - 0x1000]
mov edx, eax
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x403c9b
pop eax
jmp 0x40402d
push str.LOCALSETTINGS
lea eax, [ebp - 0x800]
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x403cf5
push str.Local_Settings
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call fcn.004027d0
add esp, 0xc
lea ecx, [ebp - 0x1000]
mov edx, eax
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x403ce5
pop eax
jmp 0x40402d
push str.MYMUSIC
lea eax, [ebp - 0x800]
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x403d3f
push str.My_Music
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call fcn.004027d0
add esp, 0xc
lea ecx, [ebp - 0x1000]
mov edx, eax
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x403d2f
pop eax
jmp 0x40402d
push str.MYPICTURES
lea eax, [ebp - 0x800]
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x403d89
push str.My_Pictures
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call fcn.004027d0
add esp, 0xc
lea ecx, [ebp - 0x1000]
mov edx, eax
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x403d79
pop eax
jmp 0x40402d
push str.MYVIDEO
lea eax, [ebp - 0x800]
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x403dd3
push str.My_Video
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call fcn.004027d0
add esp, 0xc
lea ecx, [ebp - 0x1000]
mov edx, eax
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x403dc3
pop eax
jmp 0x40402d
push str.PROGRAMFILES
lea eax, [ebp - 0x800]
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x403e1d
push str.ProgramFilesDir
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.004027d0
add esp, 0xc
lea ecx, [ebp - 0x1000]
mov edx, eax
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x403e0d
pop eax
jmp 0x40402d
push str.QUICKLAUNCH
lea eax, [ebp - 0x800]
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x403e77
push str.AppData
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call fcn.004027d0
add esp, 0xc
push str.MicrosoftInternet_ExplorerQuick_Launch
push eax
push 2
call fcn.004017f0
add esp, 0xc
lea ecx, [ebp - 0x1000]
mov edx, eax
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x403e67
pop eax
jmp 0x40402d
push str.ROOTDIR
lea eax, [ebp - 0x800]
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x403ecd
push 0x104
lea eax, [ebp - 0x1000]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push 3
lea eax, [ebp - 0x1000]
push eax
call fcn.004012b0
add esp, 8
lea ecx, [ebp - 0x1000]
mov edx, eax
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x403ebd
pop eax
jmp 0x40402d
push str.SENDTO
lea eax, [ebp - 0x800]
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x403f17
push str.SendTo
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call fcn.004027d0
add esp, 0xc
lea ecx, [ebp - 0x1000]
mov edx, eax
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x403f07
pop eax
jmp 0x40402d
push str.STARTMENU
lea eax, [ebp - 0x800]
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x403f61
push str.Programs
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call fcn.004027d0
add esp, 0xc
lea ecx, [ebp - 0x1000]
mov edx, eax
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x403f51
pop eax
jmp 0x40402d
push str.STARTUP
lea eax, [ebp - 0x800]
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x403fab
push str.Startup
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call fcn.004027d0
add esp, 0xc
lea ecx, [ebp - 0x1000]
mov edx, eax
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x403f9b
pop eax
jmp 0x40402d
push str.SYSDIR
lea eax, [ebp - 0x800]
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x403fd7
push 0x104
lea eax, [ebp - 0x1000]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
jmp 0x40402d
push str.TEMPDIR
lea eax, [ebp - 0x800]
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x404003
lea eax, [ebp - 0x1000]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
jmp 0x40402d
push str.WINDIR
lea eax, [ebp - 0x800]
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x40402d
push 0x104
lea eax, [ebp - 0x1000]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push str.COMMAND
lea eax, [ebp - 0x800]
push eax
call fcn.00401260
add esp, 8
test eax, eax
je 0x4040f7
lea eax, [ebp - 0x1000]
push eax
call fcn.00401a20
pop ecx
test eax, eax
jne 0x40406c
lea eax, [ebp - 0x1000]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
push 1
lea eax, [ebp - 0x1000]
push eax
call fcn.00401300
add esp, 8
mov dword [ebp - 0x1808], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x5c
call fcn.00401790
add esp, 0x28
push eax
mov eax, dword [ebp - 0x1808]
push eax
call fcn.00401260
add esp, 8
test eax, eax
je 0x4040f7
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x5c
call fcn.00401790
add esp, 0x28
push eax
lea eax, [ebp - 0x1000]
push eax
push 2
call fcn.004017f0
add esp, 0xc
lea ecx, [ebp - 0x1000]
mov edx, eax
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x4040ec
pop eax
lea eax, [ebp - 0x1000]
push eax
lea eax, [ebp - 0x1800]
push eax
push 0x41a9bc
call fcn.00402830
add esp, 0xc
mov ecx, 0x41a9bc
mov edx, eax
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x40411c
pop eax
xor ebx, ebx
xor esi, esi
mov byte [ebp - 0x800], 0
mov byte [ebp - 0x1800], 0
mov byte [ebp - 0x1000], 0
push 0x41069f
push 0x41a9bc
call fcn.00401ad0
add esp, 8
cmp eax, 2
jl 0x40415c
jmp 0x403959
push 0x41a9bc
call fcn.00403840
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret