Function at 0x401d78
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
lea ebp, [esp - 0x8b0]
sub esp, 0x930
mov eax, dword [0x422320]
xor eax, ebp
mov dword [ebp + 0x8ac], eax
mov eax, dword [ebp + 0x8b8]
push ebx
push esi
mov dword [ebp - 0x80], eax
lea eax, [ebp + 0x190]
push edi
push eax
call fcn.00408e90
push eax
xor esi, esi
lea eax, [ebp + 0x190]
push esi
push eax
call fcn.00408e10
lea eax, [ebp - 0x78]
push eax
call fcn.00408e90
push eax
lea eax, [ebp - 0x78]
push esi
push eax
call fcn.00408e10
lea eax, [ebp + 0x8c]
push eax
call fcn.00408e90
push eax
lea eax, [ebp + 0x8c]
push esi
push eax
call fcn.00408e10
lea eax, [ebp + 0x6a4]
push eax
call fcn.00408e90
push eax
lea eax, [ebp + 0x6a4]
push esi
push eax
call fcn.00408e10
lea eax, [ebp + 0x7a8]
add esp, 0x40
push eax
call fcn.00408e90
push eax
lea eax, [ebp + 0x7a8]
push esi
push eax
call fcn.00408e10
lea eax, [ebp + 0x49c]
push eax
call fcn.00408e90
push eax
lea eax, [ebp + 0x49c]
push esi
push eax
call fcn.00408e10
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
add esp, 0x20
push esi
push 0x25
lea eax, [ebp - 0x78]
push eax
push esi
call edi
push esi
push 0x25
lea eax, [ebp + 0x8c]
push eax
push esi
call edi
lea eax, [ebp + 0x8c]
push str.dy_m32_cn.ico
push eax
call fcn.00408d20
lea eax, [ebp - 0x78]
push str.yx_m32_cn.ico
push eax
call fcn.00408d20
push 0x104
call fcn.00409397
mov dword [ebp - 0x7c], eax
push eax
push str.Favorites
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call fcn.004080c3
push dword [ebp - 0x7c]
lea eax, [ebp + 0x190]
push eax
call fcn.00408d10
lea eax, [ebp + 0x190]
push eax
lea eax, [ebp + 0x49c]
push eax
call fcn.00408d20
lea eax, [ebp + 0x190]
push eax
lea eax, [ebp + 0x7a8]
push eax
call fcn.00408d20
lea eax, [ebp + 0x190]
push eax
lea eax, [ebp + 0x6a4]
push eax
call fcn.00408d20
add esp, 0x44
lea eax, [ebp + 0x49c]
push 0x41b510
push eax
call fcn.00408d20
lea eax, [ebp + 0x49c]
push 0x41b508
push eax
call fcn.00408d20
lea eax, [ebp + 0x49c]
push 0x41b500
push eax
call fcn.00408d20
lea eax, [ebp + 0x49c]
push str..url
push eax
call fcn.00408d20
lea eax, [ebp + 0x7a8]
push 0x41b4f0
push eax
call fcn.00408d20
lea eax, [ebp + 0x7a8]
push 0x41b4ec
push eax
call fcn.00408d20
lea eax, [ebp + 0x7a8]
push 0x41b4e4
push eax
call fcn.00408d20
lea eax, [ebp + 0x7a8]
push 0x41b4dc
push eax
call fcn.00408d20
add esp, 0x40
lea eax, [ebp + 0x6a4]
push 0x41b4d8
push eax
call fcn.00408d20
mov ebx, 0x41b4d0
lea eax, [ebp + 0x6a4]
push ebx
push eax
call fcn.00408d20
mov edi, 0x41b4cc
lea eax, [ebp + 0x6a4]
push edi
push eax
call fcn.00408d20
lea eax, [ebp + 0x6a4]
push 0x41b4c4
push eax
call fcn.00408d20
lea eax, [ebp + 0x5a0]
push eax
call fcn.00408e90
push eax
push esi
lea eax, [ebp + 0x5a0]
push eax
call fcn.00408e10
lea eax, [ebp + 0x398]
push eax
call fcn.00408e90
push eax
lea eax, [ebp + 0x398]
push esi
push eax
call fcn.00408e10
lea eax, [ebp + 0x294]
add esp, 0x40
push eax
call fcn.00408e90
push eax
lea eax, [ebp + 0x294]
push esi
push eax
call fcn.00408e10
lea eax, [ebp + 0x5a0]
push 0x41b4c0
push eax
call fcn.00408d20
lea eax, [ebp + 0x5a0]
push 0x41b4bc
push eax
call fcn.00408d20
lea eax, [ebp + 0x5a0]
push 0x41b4b8
push eax
call fcn.00408d20
lea eax, [ebp + 0x5a0]
push 0x41b500
push eax
call fcn.00408d20
lea eax, [ebp + 0x5a0]
push 0x41b4b4
push eax
call fcn.00408d20
lea eax, [ebp + 0x398]
push 0x41b4b0
push eax
call fcn.00408d20
add esp, 0x40
lea eax, [ebp + 0x398]
push ebx
push eax
call fcn.00408d20
lea eax, [ebp + 0x398]
push edi
push eax
call fcn.00408d20
lea eax, [ebp + 0x398]
push 0x41b4ac
push eax
call fcn.00408d20
lea eax, [ebp + 0x294]
push 0x41b4a8
push eax
call fcn.00408d20
lea eax, [ebp + 0x294]
push 0x41b4a0
push eax
call fcn.00408d20
lea eax, [ebp + 0x294]
push 0x41b498
push eax
call fcn.00408d20
lea eax, [ebp + 0x294]
push 0x41b494
push eax
call fcn.00408d20
push esi
push esi
lea eax, [ebp + 0x5a0]
push eax
lea eax, [ebp + 0x49c]
push eax
push dword [ebp - 0x80]
call fcn.00401613
add esp, 0x4c
push esi
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x398]
push eax
lea eax, [ebp + 0x6a4]
push eax
push str.http:__game.14164.com
call fcn.00401613
push esi
lea eax, [ebp + 0x8c]
push eax
lea eax, [ebp + 0x294]
push eax
lea eax, [ebp + 0x7a8]
push eax
push 0x41b448
call fcn.00401613
add esp, 0x28
cmp dword [ebp - 0x7c], esi
pop edi
pop esi
pop ebx
je 0x40214c
push dword [ebp - 0x7c]
call fcn.00409371
pop ecx
mov ecx, dword [ebp + 0x8ac]
xor ecx, ebp
call fcn.00408f1b
add ebp, 0x8b0
leave
ret