Function at 0x410f20
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x638
mov eax, dword [0x445080]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x414]
mov dword [ebp - 0x620], 0
push 0
push eax
call fcn.00414fa0
call fcn.0040fe90
mov esi, eax
lea eax, [ebp - 0x414]
push esi
push str._sSoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
test esi, esi
je 0x410f79
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
lea eax, [ebp - 0x638]
mov dword [ebp - 0x624], 0
push eax
push 0x20019
lea eax, [ebp - 0x414]
mov dword [ebp - 0x638], 0
push eax
push 0x80000003
call fcn.00431dc0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
js 0x410fd4
lea eax, [ebp - 0x624]
push eax
push str.AppData
push dword [ebp - 0x638]
call fcn.00431ee0
push dword [ebp - 0x638]
call ebx
mov esi, dword [ebp - 0x624]
test esi, esi
je 0x410ff4
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410fe3
sub ecx, edx
sar ecx, 1
jne 0x411041
push 0x208
lea eax, [ebp - 0x61c]
push 0
push eax
call fcn.00414fa0
add esp, 0xc
lea eax, [ebp - 0x61c]
push eax
push 1
push 0
push 0x801a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x41103b
push 0
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x624]
push eax
call fcn.0040e3d0
mov esi, dword [ebp - 0x624]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00414fa0
push esi
lea eax, [ebp - 0x20c]
push str._sYandexui
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00411300
test eax, eax
js 0x4110a5
mov ecx, dword [ebp - 0x620]
test ecx, ecx
je 0x4110a5
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411090
sub ecx, edx
sar ecx, 1
jne 0x411245
push str.UI_is_not_found__trying_to_create_one_r_n
call fcn.00410b90
lea eax, [ebp - 0x628]
mov dword [ebp - 0x634], 0
push 0
push eax
mov dword [ebp - 0x628], 0
call fcn.00410910
add esp, 0xc
lea eax, [ebp - 0x628]
push 0
push str.UICreated_
push eax
call fcn.0040e2a0
mov dword [ebp - 0x62c], 0
call fcn.00410d90
cmp dword [0x445e18], 0
jne 0x411145
lea eax, [ebp - 0x630]
mov dword [ebp - 0x630], 0
push eax
push 0x20019
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call fcn.00431dc0
test eax, eax
js 0x411145
push 0x445e18
push str.CurrentVersion
push dword [ebp - 0x630]
call fcn.00431ee0
push dword [ebp - 0x630]
call ebx
push 0
push 0x434274
push dword [0x445e18]
call fcn.00411430
add esp, 0xc
lea ecx, [ebp - 0x62c]
test eax, eax
mov edx, str.SoftwareYandex
push ecx
push 0x2001f
mov ecx, str.SoftwareAppDataLowYandex
cmovs ecx, edx
push ecx
push 0x80000001
call fcn.00431d60
test eax, eax
js 0x41119c
lea eax, [ebp - 0x634]
push eax
push dword [ebp - 0x628]
push dword [ebp - 0x62c]
call fcn.00431e30
cmp dword [ebp - 0x634], 0
jne 0x41121b
push 1
call fcn.00411520
mov ecx, eax
add esp, 4
mov dword [ebp - 0x620], ecx
test ecx, ecx
je 0x411228
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4111c0
sub ecx, edx
sar ecx, 1
je 0x411228
lea eax, [ebp - 0x20c]
push eax
call fcn.00411280
add esp, 4
lea eax, [ebp - 0x20c]
push 1
push dword [ebp - 0x620]
push 0
push eax
call fcn.0040eeb0
test eax, eax
js 0x411214
mov eax, dword [ebp - 0x62c]
test eax, eax
je 0x411228
push 1
push dword [ebp - 0x628]
push eax
call fcn.00432060
jmp 0x411228
push str.Failed_to_create_ui
jmp 0x411220
push str.UI_is_protected__
call fcn.00410b90
add esp, 4
mov eax, dword [ebp - 0x628]
test eax, eax
je 0x411238
push eax
call fcn.0040e720
mov eax, dword [ebp - 0x62c]
test eax, eax
je 0x411245
push eax
call ebx
pop ebx
test esi, esi
je 0x411250
push esi
call fcn.0040e720
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x620]
xor ecx, ebp
pop esi
call fcn.00412b32
mov esp, ebp
pop ebp
ret