Function at 0x408920
Capabilities:
Create thread
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
push edi
push 0
push 0x1a
lea eax, [ebp - 0x140]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [ebp - 0x140]
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x148], 0x412c48
mov edx, dword [ebp - 0x148]
mov dword [ebp - 0x14c], edx
mov eax, dword [ebp - 0x144]
mov cl, byte [eax]
mov byte [ebp - 0x14d], cl
mov edx, dword [ebp - 0x148]
mov al, byte [ebp - 0x14d]
mov byte [edx], al
mov ecx, dword [ebp - 0x144]
add ecx, 1
mov dword [ebp - 0x144], ecx
mov edx, dword [ebp - 0x148]
add edx, 1
mov dword [ebp - 0x148], edx
cmp byte [ebp - 0x14d], 0
jne 0x40895f
mov eax, 0x412c48
add eax, 0xffffffff
mov dword [ebp - 0x154], eax
mov ecx, dword [ebp - 0x154]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x155], dl
add dword [ebp - 0x154], 1
cmp byte [ebp - 0x155], 0
jne 0x4089b0
mov edi, dword [ebp - 0x154]
mov eax, dword [0x402590]
mov dword [edi], eax
mov ecx, dword [0x402594]
mov dword [edi + 4], ecx
mov edx, dword [0x402598]
mov dword [edi + 8], edx
mov eax, dword [0x40259c]
mov dword [edi + 0xc], eax
mov cx, word [0x4025a0]
mov word [edi + 0x10], cx
mov dl, byte [0x4025a2]
mov byte [edi + 0x12], dl
lea eax, [ebp - 0x140]
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x160], 0x412200
mov ecx, dword [ebp - 0x160]
mov dword [ebp - 0x164], ecx
mov edx, dword [ebp - 0x15c]
mov al, byte [edx]
mov byte [ebp - 0x165], al
mov ecx, dword [ebp - 0x160]
mov dl, byte [ebp - 0x165]
mov byte [ecx], dl
mov eax, dword [ebp - 0x15c]
add eax, 1
mov dword [ebp - 0x15c], eax
mov ecx, dword [ebp - 0x160]
add ecx, 1
mov dword [ebp - 0x160], ecx
cmp byte [ebp - 0x165], 0
jne 0x408a2c
mov edx, 0x412200
add edx, 0xffffffff
mov dword [ebp - 0x16c], edx
mov eax, dword [ebp - 0x16c]
mov cl, byte [eax + 1]
mov byte [ebp - 0x16d], cl
add dword [ebp - 0x16c], 1
cmp byte [ebp - 0x16d], 0
jne 0x408a7d
mov edi, dword [ebp - 0x16c]
mov edx, dword [0x4025a4]
mov dword [edi], edx
mov eax, dword [0x4025a8]
mov dword [edi + 4], eax
mov dword [ebp - 0x174], 0x412c48
mov ecx, dword [ebp - 0x174]
add ecx, 1
mov dword [ebp - 0x178], ecx
mov edx, dword [ebp - 0x174]
mov al, byte [edx]
mov byte [ebp - 0x179], al
add dword [ebp - 0x174], 1
cmp byte [ebp - 0x179], 0
jne 0x408acb
mov ecx, dword [ebp - 0x174]
sub ecx, dword [ebp - 0x178]
mov dword [ebp - 0x180], ecx
mov edx, dword [ebp - 0x180]
mov dword [0x412830], edx
mov dword [ebp - 0x184], 0x412200
mov eax, dword [ebp - 0x184]
add eax, 1
mov dword [ebp - 0x188], eax
mov ecx, dword [ebp - 0x184]
mov dl, byte [ecx]
mov byte [ebp - 0x189], dl
add dword [ebp - 0x184], 1
cmp byte [ebp - 0x189], 0
jne 0x408b20
mov eax, dword [ebp - 0x184]
sub eax, dword [ebp - 0x188]
mov dword [ebp - 0x190], eax
mov ecx, dword [ebp - 0x190]
mov dword [0x412414], ecx
mov dword [0x412828], 0x80000001
mov dword [0x41282c], 0x4025ac
mov dword [0x412620], 0x80000001
mov dword [0x412624], 0x4025dc
mov dword [0x41240c], 0x80000002
mov dword [0x412410], 0x402610
mov dword [0x412c40], 0x80000002
mov dword [0x412c44], 0x402640
lea edx, [ebp - 0xc]
push edx
push 0
push 0x412828
push 0x4087c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0x412620
push 0x4087c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0x41240c
push 0x4087c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x28], eax
lea edx, [ebp - 8]
push edx
push 0
push 0x412c40
push 0x4087c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x24], eax
call fcn.004083e0
mov dword [ebp - 0x18], eax
push 0x412308
push 1
mov eax, dword [ebp - 0x18]
push eax
call fcn.00408580
add esp, 0xc
push 0x4120b0
push 0
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00408580
add esp, 0xc
lea edx, [ebp - 4]
push edx
push 0
push 0x412308
push 0x408420
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x4120b0
push 0x408420
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x1c], eax
push 0xffffffffffffffff
push 1
lea ecx, [ebp - 0x30]
push ecx
push 6
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
pop edi
mov esp, ebp
pop ebp
ret