Function at 0x439a70
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
xor eax, eax
push ebp
push 0x439d1e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00405c3c
cmp byte [ebp - 5], 0
je 0x439ad0
mov ebx, 0x23
jmp 0x439ad5
mov ebx, 0x1a
xor eax, eax
push ebp
push 0x439b15
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push ebx
lea eax, [ebp - 0x216]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x216]
call fcn.00405de8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x439b23
cmp byte [ebp - 0xd], 0
je 0x439b3b
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040c9e4
test al, al
jne 0x439cf8
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00405c3c
xor eax, eax
push ebp
push 0x439bf1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x42ec4c]
call fcn.0042ed88
mov ebx, eax
mov dword [ebx + 0x18], 1
cmp byte [ebp - 5], 0
je 0x439b8d
mov edx, 0x80000002
mov eax, ebx
call fcn.0042ee28
lea eax, [ebp - 4]
mov edx, 0x439d38
call fcn.00405c90
jmp 0x439ba6
mov edx, 0x80000001
mov eax, ebx
call fcn.0042ee28
lea eax, [ebp - 4]
mov edx, 0x439d64
call fcn.00405c90
mov edx, 0x439d80
mov eax, ebx
call fcn.0042f38c
test al, al
je 0x439be0
mov edx, 0x439d80
xor ecx, ecx
mov eax, ebx
call fcn.0042ee8c
test al, al
je 0x439be0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0042f200
mov byte [ebp - 0xd], 1
mov eax, ebx
call fcn.0042edf8
mov eax, ebx
call fcn.00403cec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x439bfb
cmp byte [ebp - 0xd], 0
je 0x439c13
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040c9e4
test al, al
jne 0x439cf8
mov eax, dword [0x4dabd4]
cmp dword [eax], 5
jg 0x439c81
cmp byte [ebp - 5], 0
je 0x439c46
lea eax, [ebp - 0x21c]
call fcn.004399e8
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0xc]
mov ecx, 0x439e10
call fcn.004060f8
jmp 0x439ce0
lea eax, [ebp - 0x220]
call fcn.004399e8
push dword [ebp - 0x220]
push 0x439e84
lea eax, [ebp - 0x224]
call fcn.004399a4
push dword [ebp - 0x224]
push 0x439ec4
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.004061dc
jmp 0x439ce0
cmp byte [ebp - 5], 0
je 0x439ca7
lea eax, [ebp - 0x228]
call fcn.004399e8
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp - 0xc]
mov ecx, 0x439ef4
call fcn.004060f8
jmp 0x439ce0
lea eax, [ebp - 0x22c]
call fcn.004399e8
push dword [ebp - 0x22c]
push 0x439f1c
lea eax, [ebp - 0x230]
call fcn.004399a4
push dword [ebp - 0x230]
push 0x439f38
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.004061dc
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040c9e4
test al, al
jne 0x439cf8
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00405c3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x439d25
lea eax, [ebp - 0x230]
mov edx, 6
call fcn.00405c34
lea eax, [ebp - 4]
call fcn.00405c2c
ret