Function at 0x42d6a0
Capabilities:
Copy file
Get common file path
Persist via run registry key

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x410
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
call fcn.0042ccb0
mov edi, dword [esp + 0x428]
mov eax, dword [esp + 0x42c]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add eax, 3
movsx ecx, byte [edi]
mov dword [esi + 0x434], ecx
lea ecx, [esi + 0x444]
movsx edx, byte [eax - 3]
push eax
push ecx
mov dword [esi + 0x438], edx
call ebx
add edi, 3
lea ebp, [esi + 0x750]
push edi
push ebp
call ebx
lea edi, [esi + 0x444]
or ecx, 0xffffffff
xor eax, eax
mov dl, 0x5c
repne scasb al, byte es:[edi]
not ecx
dec ecx
dec ecx
js 0x42d71d
cmp byte [ecx + esi + 0x444], dl
jne 0x42d71d
mov byte [ecx + esi + 0x444], 0
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
dec ecx
js 0x42d73d
cmp byte [ecx + esi + 0x750], dl
jne 0x42d73d
mov byte [ecx + esi + 0x750], 0
lea eax, [esp + 0x31c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
movsx ecx, byte [esp + 0x31c]
lea edx, [esp + 0x31c]
lea eax, [esi + 0x64c]
push edx
push eax
mov dword [esi + 0x430], ecx
call ebx
mov eax, dword [esi + 0x970]
test eax, eax
je 0x42d9c0
mov eax, dword [esi]
lea ecx, [esp + 0x10]
push 0x103
push ecx
push str.Desktop
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
mov ecx, esi
call dword [eax]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
test eax, eax
jne 0x42d82b
lea edx, [esp + 0x31c]
lea eax, [esp + 0x10]
push edx
push eax
call ebx
mov eax, dword [esi + 0x3ac]
cmp eax, 2
jne 0x42d7f0
cmp dword [esi + 0x3a0], 5
jb 0x42d7db
lea ecx, [esp + 0x11]
push str.:Documents_and_SettingsAll_Users_
push ecx
call ebx
jmp 0x42d837
cmp eax, 2
jne 0x42d7f0
cmp dword [esi + 0x3a0], 4
jb 0x42d7f0
push str.ProfilesAll_Users_
jmp 0x42d830
cmp eax, 1
jne 0x42d801
lea eax, [esp + 0x10]
push str.Desktop_
push eax
jmp 0x42d835
mov edi, dword [esp + 0x424]
push 0x10010
push 0x4763e0
push 0x476514
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x430]
push ecx
jmp 0x42d9cf
push 0x474f8c
lea edx, [esp + 0x14]
push edx
call edi
lea ebx, [esi + 0xfe]
lea eax, [esp + 0x10]
push ebx
push eax
call edi
mov ecx, dword [esi + 0x438]
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esi + 0x444]
lea edx, [esp + 0x218]
push eax
push ecx
push 0x47650c
push edx
call ebp
add esp, 0x10
lea eax, [esp + 0x218]
push 0x474f8c
push eax
call edi
lea ecx, [esi + 0x1f8]
lea edx, [esp + 0x218]
push ecx
push edx
call edi
mov eax, dword [esp + 0x434]
test eax, eax
jne 0x42d89d
lea eax, [esp + 0x218]
push eax
lea eax, [esp + 0x14]
lea ecx, [esp + 0x21c]
push eax
push ecx
mov ecx, esi
call fcn.0042d410
test eax, eax
jne 0x42d8d3
mov edx, dword [esp + 0x424]
push 0x10010
push 0x4763e0
push 0x4764f8
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esi]
lea ecx, [esp + 0x114]
push 0x103
push ecx
push str.Programs
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
mov ecx, esi
call dword [eax]
test eax, eax
jne 0x42d970
mov eax, dword [esi + 0x3ac]
cmp eax, 2
jne 0x42d954
cmp dword [esi + 0x3a0], 5
jb 0x42d92a
movsx edx, byte [esi + 0x64c]
push ebx
push edx
lea eax, [esp + 0x11c]
push 0x4756e0
push eax
call ebp
add esp, 0x10
jmp 0x42d98a
cmp eax, 2
jne 0x42d954
cmp dword [esi + 0x3a0], 4
jb 0x42d954
lea eax, [esi + 0x64c]
push ebx
push eax
lea ecx, [esp + 0x11c]
push 0x4756b4
push ecx
call ebp
add esp, 0x10
jmp 0x42d98a
lea eax, [esi + 0x64c]
push ebx
push eax
lea edx, [esp + 0x11c]
push str._sStart_MenuPrograms_s
push edx
call ebp
add esp, 0x10
jmp 0x42d98a
lea eax, [esp + 0x114]
push 0x474f8c
push eax
call edi
lea ecx, [esp + 0x114]
push ebx
push ecx
call edi
lea edx, [esp + 0x114]
push 0
lea eax, [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x42d9c0
mov ecx, dword [esp + 0x424]
push 0x10010
push 0x4763e0
push 0x4764e0
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [esp + 0x430]
mov edi, dword [esp + 0x424]
push edx
push edi
mov ecx, esi
call fcn.0042cf10
push edi
mov ecx, esi
call fcn.0042d4e0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x410
ret 0x14