Function at 0x40257c
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov dl, byte [ecx]
lea eax, [ebp - 0x108]
test dl, dl
je 0x4025bc
lea esi, [ebp - 0x108]
sub ecx, esi
cmp dl, 0x22
je 0x4025bc
mov dl, byte [eax + ecx]
cmp dl, 0x2c
je 0x4025bc
cmp dl, 0x20
jbe 0x4025bc
mov byte [eax], dl
mov dl, byte [eax + ecx + 1]
inc eax
test dl, dl
jne 0x40259f
and byte [eax], 0
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp + 0x10], eax
lea edi, [ebp - 0x20c]
mov al, byte [eax]
test al, al
je 0x4025e2
cmp al, 0x25
je 0x4025e2
mov byte [edi], al
inc edi
inc dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
jmp 0x4025cd
and byte [edi], 0
push 6
push str._WORK_
push dword [ebp + 0x10]
call fcn.00402400
test eax, eax
mov esi, 0x100
jne 0x40260b
push edi
push esi
call fcn.0040248d
push 6
jmp 0x402772
push 8
push str._WinDir_
push dword [ebp + 0x10]
call fcn.00402400
test eax, eax
jne 0x40262d
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 8
jmp 0x402772
push 9
push str._WinRoot_
push dword [ebp + 0x10]
call fcn.00402400
test eax, eax
jne 0x402654
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
and byte [ebp - 0x20a], 0
jmp 0x402770
push 0xb
push str._SystemDir_
push dword [ebp + 0x10]
call fcn.00402400
test eax, eax
jne 0x4026af
push 0xb
pop ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp + 0x10]
add ebx, eax
push esi
push ebx
push edi
call fcn.00401a0e
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
call fcn.00401900
cmp dword [ebp + 0x14], 0
je 0x4026a8
push 0x5c
push dword [ebp + 8]
call fcn.004023cc
pop edi
pop esi
pop ebx
leave
ret 0x10
push 0xe
push str._ProgramFiles_
push dword [ebp + 0x10]
call fcn.00402400
test eax, eax
jne 0x4026fc
and byte [edi], al
cmp dword [0x409868], eax
je 0x4026e7
push esi
push edi
push 0x409820
push str.ProgramFilesDir
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.004022e1
cmp byte [edi], 0
jne 0x4026f8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
and byte [edi + 2], 0
push 0xe
jmp 0x402772
push 0xb
push str._Documents_
push dword [ebp + 0x10]
call fcn.00402400
test eax, eax
jne 0x402738
and byte [edi], al
cmp dword [0x409868], eax
je 0x402734
push esi
push edi
push 0x409820
push str.Personal
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_folders
push 0x80000001
call fcn.004022e1
push 0xb
jmp 0x402772
push 9
push str._Desktop_
push dword [ebp + 0x10]
call fcn.00402400
test eax, eax
jne 0x402778
and byte [edi], al
cmp dword [0x409868], eax
je 0x402770
push esi
push edi
push 0x409820
push 0x408048
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_folders
push 0x80000001
call fcn.004022e1
push 9
pop ebx
jmp 0x402672
push 8
push str._Search_
push dword [ebp + 0x10]
call fcn.00402400
test eax, eax
jne 0x402672
cmp byte [ebp - 0x108], al
je 0x402672
push 8
lea eax, [ebp - 4]
pop ebx
push eax
push edi
push esi
lea eax, [ebp - 0x108]
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathA]
test eax, eax
jbe 0x40266a
mov eax, dword [ebp - 4]
and byte [eax - 1], 0
jmp 0x402672