Function at 0x401e10
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
sub esp, 0x51c
push ebx
mov ebx, dword [esp + 0x524]
push ebp
push esi
mov eax, dword [ebx + 0x110]
push edi
test eax, eax
je 0x401e41
push 0
push eax
mov eax, dword [ebx + 4]
lea ecx, [ebx + 0x118]
push eax
push ecx
call section..text
add esp, 0x10
mov edx, dword [ebx + 0x10c]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
and edx, 0xf
rep stosd dword es:[edi], eax
lea eax, [edx - 1]
lea esi, [ebx + 8]
cmp eax, 3
ja case.default.0x401e6c
jmp dword [eax*4 + 0x402480]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x3a
push esi
call fcn.004050f0
add esp, 0xc
test eax, eax
je 0x401e9b
lea eax, [esp + 0x18]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp case.default.0x401e6c
mov eax, dword [esp + 0x534]
cmp byte [eax], 0
je 0x401ebf
lea ecx, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x18]
push 0x40a168
push edx
call ebp
cmp byte [esi], 0x5c
jne 0x401ecc
mov al, byte [esi + 1]
inc esi
cmp al, 0x5c
je 0x401ec4
lea eax, [esp + 0x18]
push esi
push eax
jmp 0x401f5c
lea ecx, [esp + 0x18]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0x18]
push 0x40a168
push edx
call ebp
cmp byte [esi], 0x5c
jne 0x401f00
mov al, byte [esi + 1]
inc esi
cmp al, 0x5c
je 0x401ef8
lea eax, [esp + 0x18]
push esi
push eax
jmp 0x401f5c
lea ecx, [esp + 0x18]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x18]
push 0x40a168
push edx
call ebp
cmp byte [esi], 0x5c
jne 0x401f31
mov al, byte [esi + 1]
inc esi
cmp al, 0x5c
je 0x401f29
lea eax, [esp + 0x18]
push esi
push eax
jmp 0x401f5c
lea ecx, [esp + 0x18]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp byte [esi], 0x5c
jne 0x401f56
mov al, byte [esi + 1]
inc esi
cmp al, 0x5c
je 0x401f4e
lea edx, [esp + 0x18]
push esi
push edx
call ebp
lea eax, [esp + 0x18]
push 0x180
push eax
call fcn.004058a6
add esp, 8
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x18]
lea edx, [esp + 0x18]
cmp esi, edx
jbe 0x401f95
cmp byte [esi], 0x5c
je 0x401f9a
dec esi
lea eax, [esp + 0x18]
cmp esi, eax
ja 0x401f87
cmp byte [esi], 0x5c
jne 0x401fd9
cmp byte [esp + 0x18], 0x22
jne 0x401fb1
mov cl, byte [esi + 1]
mov byte [esi], 0x22
mov byte [esp + 0x13], cl
mov byte [esi + 1], 0
jmp 0x401fb4
mov byte [esi], 0
lea edx, [esp + 0x18]
push edx
call fcn.00406223
mov al, byte [esp + 0x1c]
add esp, 4
cmp al, 0x22
mov byte [esi], 0x5c
jne 0x401fd3
mov al, byte [esp + 0x13]
inc esi
mov byte [esi], al
cmp byte [esi], 0x5c
jne 0x401fd9
inc esi
mov eax, dword [ebx + 4]
test eax, eax
jg 0x401fef
lea ecx, [esp + 0x18]
push ecx
call fcn.0040589b
add esp, 4
jmp 0x402030
lea edx, [esp + 0x18]
push 0x8112
push edx
call fcn.0040558b
mov edi, eax
add esp, 8
cmp edi, 0xffffffff
mov dword [esp + 0x14], edi
je 0x402030
mov eax, dword [ebx + 4]
lea ecx, [ebx + 0x118]
push eax
push ecx
push edi
call fcn.00406033
mov edx, dword [ebx + 4]
push edx
push edi
call fcn.00405eb5
push edi
call fcn.00405195
add esp, 0x18
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x11c]
push str.SOFTWAREMicrosoftWindowsCurrentVersion
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x120]
push eax
call edi
mov ecx, dword [ebx + 0x10c]
and ecx, 0xf0
lea eax, [ecx - 0x10]
cmp eax, 0x30
ja case.0x402071.20
xor edx, edx
mov dl, byte [eax + 0x4024a4]
jmp dword [edx*4 + 0x402490]
push str.Run
jmp 0x4020a2
lea ecx, [esp + 0x1dc]
push str.RunServices
push ecx
jmp 0x4020aa
lea edx, [esp + 0x1dc]
push str.RunOnce
push edx
jmp 0x4020aa
push str.RunServicesOnce
lea eax, [esp + 0x1e0]
push eax
call edi
lea ecx, [esp + 0x18]
push 0x104
lea edx, [esp + 0x42c]
push ecx
push edx
call fcn.00405b80
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0xc
lea eax, [esp + 0x428]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x18]
sub eax, ecx
push edx
add esi, eax
call edi
sub eax, 4
mov eax, dword [esp + eax + 0x18]
cmp eax, 0x4558452e
je 0x4021b2
cmp eax, 0x4558652e
je 0x4021b2
cmp eax, 0x4578652e
je 0x4021b2
cmp eax, 0x6578652e
je 0x4021b2
cmp eax, 0x6578452e
je 0x4021b2
cmp eax, 0x6558452e
je 0x4021b2
cmp eax, 0x4c4c442e
je 0x402155
cmp eax, 0x4c4c642e
je 0x402155
cmp eax, 0x4c6c642e
je 0x402155
cmp eax, 0x6c6c642e
je 0x402155
cmp eax, 0x6c6c442e
je 0x402155
cmp eax, 0x6c4c442e
jne 0x4021b2
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x324]
push str.RunDLL32.Exe
rep stosd dword es:[edi], eax
lea eax, [esp + 0x328]
push eax
call ebp
lea ecx, [esp + 0x18]
lea edx, [esp + 0x324]
push ecx
push edx
call ebp
lea eax, [esp + 0x324]
push 0x40a0f0
push eax
call ebp
lea ecx, [esp + 0x324]
push 0x104
lea edx, [esp + 0x1c]
push ecx
push edx
call fcn.00405b80
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0xc
mov al, byte [esp + 0x1dc]
test al, al
je 0x40223c
lea eax, [esp + 0x1dc]
lea ecx, [esp + 0x11c]
push eax
push ecx
call ebp
mov eax, dword [ebx + 4]
test eax, eax
jle 0x402220
lea edx, [esp + 0x18]
push edx
call edi
inc eax
lea ecx, [esp + 0x18]
push eax
push 1
lea eax, [esp + 0x124]
push esi
push eax
push 0x80000002
push ecx
call fcn.004010d0
add esp, 0x18
test eax, eax
jge 0x40223c
lea edx, [esp + 0x18]
push edx
call edi
inc eax
lea ecx, [esp + 0x18]
push eax
push 1
lea eax, [esp + 0x124]
push esi
push eax
push 0x80000001
push ecx
jmp 0x402234
push 0
push 1
lea edx, [esp + 0x124]
push esi
push edx
push 0x80000002
push 0
call fcn.004010d0
add esp, 0x18
mov eax, dword [ebx + 0x10c]
test ah, 1
je 0x4022ea
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x220]
push 0x104
push 1
push str.Startup
rep stosd dword es:[edi], eax
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea eax, [esp + 0x230]
push 0x80000001
push eax
call fcn.00401050
add esp, 0x18
lea ecx, [esp + 0x220]
push 0x40a168
push ecx
call ebp
lea edx, [esp + 0x220]
push esi
push edx
call ebp
lea eax, [esp + 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [esp + eax + 0x21c], 0x4b4e4c2e
mov eax, dword [ebx + 4]
test eax, eax
jle 0x4022da
push 0
push 0
push 0
lea ecx, [esp + 0x24]
push 0
lea edx, [esp + 0x230]
push ecx
push edx
call fcn.00401180
add esp, 0x18
jmp 0x4022ea
lea eax, [esp + 0x220]
push eax
call fcn.0040589b
add esp, 4
mov eax, dword [ebx + 0x10c]
test ah, 2
je 0x40238f
lea ecx, [esp + 0x220]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0x220]
push str.WIN.INI
push edx
call ebp
mov eax, dword [ebx + 4]
test eax, eax
jle 0x402372
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea eax, [esp + 0x220]
lea ecx, [esp + 0x18]
push eax
push ecx
push str.load
push str.Windows
call edi
test eax, eax
jne 0x402360
lea edx, [esp + 0x220]
lea eax, [esp + 0x18]
push edx
push eax
push 0x40a084
push str.Windows
call edi
jmp 0x40238f
lea ecx, [esp + 0x220]
push ecx
push 0
push 0
push 0
call edi
jmp 0x40238f
lea edx, [esp + 0x220]
push edx
push 0x40ad10
push str.load
push str.Windows
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [ebx + 0x10c]
test ah, 4
je 0x40243d
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x220]
push 0x104
push 1
push str.Desktop
rep stosd dword es:[edi], eax
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea eax, [esp + 0x230]
push 0x80000001
push eax
call fcn.00401050
add esp, 0x18
lea ecx, [esp + 0x220]
push 0x40a168
push ecx
call ebp
lea edx, [esp + 0x220]
push esi
push edx
call ebp
lea eax, [esp + 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [esp + eax + 0x21c], 0x4b4e4c2e
mov eax, dword [ebx + 4]
test eax, eax
jle 0x40242d
push 0
push 0
push 0
lea ecx, [esp + 0x24]
push 0
lea edx, [esp + 0x230]
push ecx
push edx
call fcn.00401180
add esp, 0x18
jmp 0x40243d
lea eax, [esp + 0x220]
push eax
call fcn.0040589b
add esp, 4
mov ecx, dword [ebx + 0x10c]
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
test ch, 8
je 0x40246e
mov edx, dword [esp + 0x524]
lea ecx, [esp + 0x418]
push 0x104
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, 1
cmp dword [esp + 4], 0xffffffff
jne 0x402477
or al, 2
add esp, 0x51c
ret