Function at 0x43b444
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
xor eax, eax
push ebp
push 0x43b6f2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00405be4
cmp byte [ebp - 5], 0
je 0x43b4a4
mov ebx, 0x23
jmp 0x43b4a9
mov ebx, 0x1a
xor eax, eax
push ebp
push 0x43b4e9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push ebx
lea eax, [ebp - 0x216]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x216]
call fcn.00405d90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43b4f7
cmp byte [ebp - 0xd], 0
je 0x43b50f
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040cab4
test al, al
jne 0x43b6cc
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00405be4
xor eax, eax
push ebp
push 0x43b5c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x42f72c]
call fcn.0042f868
mov ebx, eax
mov dword [ebx + 0x18], 1
cmp byte [ebp - 5], 0
je 0x43b561
mov edx, 0x80000002
mov eax, ebx
call fcn.0042f908
lea eax, [ebp - 4]
mov edx, 0x43b70c
call fcn.00405c38
jmp 0x43b57a
mov edx, 0x80000001
mov eax, ebx
call fcn.0042f908
lea eax, [ebp - 4]
mov edx, 0x43b738
call fcn.00405c38
mov edx, 0x43b754
mov eax, ebx
call fcn.0042fe6c
test al, al
je 0x43b5b4
mov edx, 0x43b754
xor ecx, ecx
mov eax, ebx
call fcn.0042f96c
test al, al
je 0x43b5b4
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0042fce0
mov byte [ebp - 0xd], 1
mov eax, ebx
call fcn.0042f8d8
mov eax, ebx
call fcn.00403d10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43b5cf
cmp byte [ebp - 0xd], 0
je 0x43b5e7
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040cab4
test al, al
jne 0x43b6cc
mov eax, dword [0x4ebc34]
cmp dword [eax], 5
jg 0x43b655
cmp byte [ebp - 5], 0
je 0x43b61a
lea eax, [ebp - 0x21c]
call fcn.0043b3bc
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0xc]
mov ecx, 0x43b7e4
call fcn.004060a0
jmp 0x43b6b4
lea eax, [ebp - 0x220]
call fcn.0043b3bc
push dword [ebp - 0x220]
push 0x43b858
lea eax, [ebp - 0x224]
call fcn.0043b378
push dword [ebp - 0x224]
push 0x43b898
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.00406184
jmp 0x43b6b4
cmp byte [ebp - 5], 0
je 0x43b67b
lea eax, [ebp - 0x228]
call fcn.0043b3bc
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp - 0xc]
mov ecx, 0x43b8c8
call fcn.004060a0
jmp 0x43b6b4
lea eax, [ebp - 0x22c]
call fcn.0043b3bc
push dword [ebp - 0x22c]
push 0x43b8f0
lea eax, [ebp - 0x230]
call fcn.0043b378
push dword [ebp - 0x230]
push 0x43b90c
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.00406184
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040cab4
test al, al
jne 0x43b6cc
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00405be4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43b6f9
lea eax, [ebp - 0x230]
mov edx, 6
call fcn.00405bdc
lea eax, [ebp - 4]
call fcn.00405bd4
ret