Function at 0x470650
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0xcb0
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push 0x208
lea eax, [esp + 0x276]
push ebp
push eax
mov word [esp + 0x27c], bp
call fcn.0047b0b0
push 0x208
lea ecx, [esp + 0x492]
push ebp
push ecx
mov word [esp + 0x498], bp
call fcn.0047b0b0
push 0x208
lea edx, [esp + 0x6ae]
push ebp
push edx
mov word [esp + 0x6b4], bp
call fcn.0047b0b0
push 0x208
lea eax, [esp + 0x8ca]
push ebp
push eax
mov word [esp + 0x8d0], bp
call fcn.0047b0b0
push 0x208
lea ecx, [esp + 0xae6]
push ebp
push ecx
mov word [esp + 0xaec], bp
call fcn.0047b0b0
add esp, 0x3c
cmp dword [0x48ba20], ebp
jne 0x470712
mov ebx, str.shell32.dll
call fcn.004651a0
cmp eax, ebp
mov dword [0x48ba20], eax
je 0x470712
push str.SHGetSpecialFolderPathW
push eax
call dword [0x47c188]
mov dword [0x48ba1c], eax
cmp dword [0x48ba1c], ebp
mov edi, dword [0x47c0c0]
mov esi, dword [0x47c014]
je 0x470756
cmp dword [0x48b90c], ebp
jne 0x47073f
push 0x48b908
mov dword [0x48b908], 0x114
call edi
push ebp
push 0x1a
lea edx, [esp + 0x278]
push edx
push ebp
call dword [0x48ba1c]
jmp 0x470815
push 0x206
lea eax, [esp + 0x66]
push ebp
push eax
mov word [esp + 0x6c], bp
call fcn.0047b0b0
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push ebp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call esi
cmp eax, ebp
jne 0x4707f2
xor eax, eax
jmp 0x470790
movzx ecx, word [eax + str.AppData]
mov word [esp + eax + 0x20], cx
add eax, 2
cmp cx, bp
jne 0x470790
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x64]
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x24]
push ecx
push ebp
lea edx, [esp + 0x30]
push edx
push eax
mov dword [esp + 0x2c], 0x208
call dword [0x47c008]
test eax, eax
jne 0x4707e7
mov eax, dword [esp + 0x14]
cmp eax, 2
jb 0x4707e2
shr eax, 1
mov word [esp + eax*2 + 0x60], bp
jmp 0x4707e7
mov word [esp + 0x60], bp
mov ecx, dword [esp + 0x18]
push ecx
call dword [section..rdata]
xor eax, eax
jmp 0x470800
movzx ecx, word [esp + eax + 0x60]
mov word [esp + eax + 0x270], cx
add eax, 2
cmp cx, bp
jne 0x470800
cmp dword [0x48ba20], ebp
jne 0x470841
mov ebx, str.shell32.dll
call fcn.004651a0
cmp eax, ebp
mov dword [0x48ba20], eax
je 0x470841
push str.SHGetSpecialFolderPathW
push eax
call dword [0x47c188]
mov dword [0x48ba1c], eax
cmp dword [0x48ba1c], ebp
je 0x470879
cmp dword [0x48b90c], ebp
jne 0x470862
push 0x48b908
mov dword [0x48b908], 0x114
call edi
push ebp
push 0x1c
lea edx, [esp + 0x488]
push edx
push ebp
call dword [0x48ba1c]
jmp 0x470915
push 0x206
lea eax, [esp + 0x66]
push ebp
push eax
mov word [esp + 0x6c], bp
call fcn.0047b0b0
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push ebp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call esi
cmp eax, ebp
jne 0x4708fa
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x64]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x24]
push ecx
push ebp
lea edx, [esp + 0x30]
push edx
push eax
mov dword [esp + 0x30], 0x208
call dword [0x47c008]
test eax, eax
jne 0x4708ef
mov eax, dword [esp + 0x18]
cmp eax, 2
jb 0x4708ea
shr eax, 1
mov word [esp + eax*2 + 0x60], bp
jmp 0x4708ef
mov word [esp + 0x60], bp
mov ecx, dword [esp + 0x14]
push ecx
call dword [section..rdata]
xor eax, eax
lea esp, [esp]
movzx ecx, word [esp + eax + 0x60]
mov word [esp + eax + 0x480], cx
add eax, 2
cmp cx, bp
jne 0x470900
push 0x104
push str.MozillaFirefoxProfiles
lea eax, [esp + 0x698]
lea ecx, [esp + 0x278]
call 0x465830
push 0x104
push str.MozillaFirefoxProfiles
lea eax, [esp + 0x8b0]
lea ecx, [esp + 0x490]
call 0x465830
push 0x104
push str.MozillaFirefox
lea eax, [esp + 0xac8]
lea ecx, [esp + 0x288]
call 0x465830
mov edi, dword [esp + 0xcdc]
add esp, 0x18
push 1
push edi
lea edx, [esp + 0x698]
push edx
call fcn.00470410
push 1
push edi
lea eax, [esp + 0x8a8]
push eax
call fcn.00470410
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0xab4]
push edx
mov dword [esp + 0x3c], 0x400
mov dword [esp + 0x40], 0x100
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], ebp
mov dword [esp + 0x44], ebp
mov dword [esp + 0x30], ebp
call fcn.004701b0
mov esi, dword [esp + 0x3c]
xor ebx, ebx
cmp esi, ebp
mov dword [esp + 0x14], ebx
jle 0x470aa0
jmp 0x4709f7
mov edi, dword [esp + 0xcc4]
push 0x208
lea eax, [esp + 0x66]
push ebp
push eax
mov word [esp + 0x6c], bp
call fcn.0047b0b0
add esp, 0xc
cmp ebx, ebp
jl 0x470a27
cmp ebx, esi
jge 0x470a27
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + ebx*4]
mov eax, dword [esp + 0x30]
lea edx, [eax + edx*2]
jmp 0x470a29
xor edx, edx
mov eax, edx
lea esi, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x470a30
sub eax, esi
sar eax, 1
cmp eax, 0x104
jl 0x470a4b
mov eax, 0x103
lea esi, [eax + eax]
push esi
push edx
lea ecx, [esp + 0x68]
push ecx
call fcn.0047b0b6
add esp, 0xc
mov word [esp + esi + 0x60], bp
cmp word [esp + 0x60], bp
je 0x470a8d
push 1
lea ebx, [esp + 0x64]
call 0x462e30
cmp eax, 0xffffffff
jne 0x470a89
push eax
mov eax, dword [esp + 0xcc8]
mov edx, ebx
push edx
call 0x463510
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x3c]
add ebx, 1
cmp ebx, esi
mov dword [esp + 0x14], ebx
jl 0x4709f0
mov eax, dword [esp + 0x30]
push eax
call fcn.00401aae
mov ecx, dword [esp + 0x30]
push ecx
call fcn.00401aae
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcb0
ret 4