Function at 0x434a50
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x2b8
mov eax, dword [0x45d2b0]
xor eax, esp
mov dword [esp + 0x2b4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [esp + 0xb5]
mov edi, ecx
push 0
push eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], 0x208
mov byte [esp + 0xbc], 0
call fcn.0043d080
push 0x104
lea ecx, [esp + 0x1c9]
push 0
push ecx
mov byte [esp + 0x1d0], 0
call fcn.0043d080
add esp, 0x18
push 0x451608
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x434b72
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebp
push str.SHGetFolderPathA
push esi
call ebx
push str.SHGetSpecialFolderPathA
push esi
mov ebp, eax
call ebx
mov edi, eax
test ebp, ebp
jne 0x434b18
test edi, edi
jne 0x434b14
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.SHFolder.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x434b14
push str.SHGetFolderPathA
push esi
call ebx
push str.SHGetSpecialFolderPathA
push esi
mov ebp, eax
call ebx
mov edi, eax
test ebp, ebp
je 0x434b3e
lea edx, [esp + 0xb4]
push edx
push 0
push 0
push 0x19
push 0
call ebp
lea eax, [esp + 0x1bc]
push eax
push 0
push 0
push 0x10
push 0
call ebp
jmp 0x434b62
test edi, edi
je 0x434b62
push 0
push 0x19
lea ecx, [esp + 0xbc]
push ecx
push 0
call edi
push 0
push 0x10
lea edx, [esp + 0x1c4]
push edx
push 0
call edi
pop ebp
test esi, esi
je 0x434b6e
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x2c], 2
jne 0x434bd2
cmp byte [esp + 0xb0], 0
je 0x434baf
mov ecx, dword [esp + 0xc]
push ecx
lea edx, [esp + 0xb4]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
jmp 0x434c94
mov ebx, dword [esp + 0xc]
mov eax, edi
call fcn.00434e10
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2b4]
xor ecx, esp
call fcn.00437bf9
add esp, 0x2b8
ret
cmp byte [esp + 0x1b8], 0
je 0x434bf5
mov eax, dword [esp + 0xc]
push eax
lea ecx, [esp + 0x1bc]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
jmp 0x434c94
lea edx, [esp + 0x10]
push edx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x434c72
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push edi
lea ecx, [esp + 0x20]
push ecx
push 0
push 0x4541e8
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x434c72
cmp byte [edi], 0
je 0x434c72
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2b4]
xor ecx, esp
call fcn.00437bf9
add esp, 0x2b8
ret
mov ecx, dword [esp + 0xc]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [esp + 0xc]
cmp ecx, 0x7fffffff
ja 0x434c94
push str.Desktop
call fcn.00402040
mov ecx, dword [esp + 0x2c0]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00437bf9
add esp, 0x2b8
ret