Function at 0x473640
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
xor eax, eax
push ebp
push 0x4738ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00405bc4
cmp byte [ebp - 5], 0
je 0x4736a0
mov ebx, 0x23
jmp 0x4736a5
mov ebx, 0x1a
xor eax, eax
push ebp
push 0x4736e5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push ebx
lea eax, [ebp - 0x216]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x216]
call fcn.00405d70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4736f3
cmp byte [ebp - 0xd], 0
je 0x47370b
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040cbec
test al, al
jne 0x4738c8
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00405bc4
xor eax, eax
push ebp
push 0x4737c1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x430960]
call fcn.00430a9c
mov ebx, eax
mov dword [ebx + 0x18], 1
cmp byte [ebp - 5], 0
je 0x47375d
mov edx, 0x80000002
mov eax, ebx
call fcn.00430b3c
lea eax, [ebp - 4]
mov edx, 0x473908
call fcn.00405c18
jmp 0x473776
mov edx, 0x80000001
mov eax, ebx
call fcn.00430b3c
lea eax, [ebp - 4]
mov edx, 0x473934
call fcn.00405c18
mov edx, 0x473950
mov eax, ebx
call fcn.004310a0
test al, al
je 0x4737b0
mov edx, 0x473950
xor ecx, ecx
mov eax, ebx
call fcn.00430ba0
test al, al
je 0x4737b0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00430f14
mov byte [ebp - 0xd], 1
mov eax, ebx
call fcn.00430b0c
mov eax, ebx
call fcn.00403d70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4737cb
cmp byte [ebp - 0xd], 0
je 0x4737e3
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040cbec
test al, al
jne 0x4738c8
mov eax, dword [0x502654]
cmp dword [eax], 5
jg 0x473851
cmp byte [ebp - 5], 0
je 0x473816
lea eax, [ebp - 0x21c]
call fcn.004735b8
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0xc]
mov ecx, 0x4739e0
call fcn.00406080
jmp 0x4738b0
lea eax, [ebp - 0x220]
call fcn.004735b8
push dword [ebp - 0x220]
push 0x473a54
lea eax, [ebp - 0x224]
call fcn.00473574
push dword [ebp - 0x224]
push 0x473a94
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.00406164
jmp 0x4738b0
cmp byte [ebp - 5], 0
je 0x473877
lea eax, [ebp - 0x228]
call fcn.004735b8
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp - 0xc]
mov ecx, 0x473ac4
call fcn.00406080
jmp 0x4738b0
lea eax, [ebp - 0x22c]
call fcn.004735b8
push dword [ebp - 0x22c]
push 0x473aec
lea eax, [ebp - 0x230]
call fcn.00473574
push dword [ebp - 0x230]
push 0x473b08
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.00406164
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040cbec
test al, al
jne 0x4738c8
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00405bc4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4738f5
lea eax, [ebp - 0x230]
mov edx, 6
call fcn.00405bbc
lea eax, [ebp - 4]
call fcn.00405bb4
ret