Function at 0x4fcd78
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
xor eax, eax
push ebp
push 0x4fd026
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00406278
cmp byte [ebp - 5], 0
je 0x4fcdd8
mov ebx, 0x23
jmp 0x4fcddd
mov ebx, 0x1a
xor eax, eax
push ebp
push 0x4fce1d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push ebx
lea eax, [ebp - 0x216]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x216]
call fcn.00406424
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4fce2b
cmp byte [ebp - 0xd], 0
je 0x4fce43
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040d650
test al, al
jne 0x4fd000
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00406278
xor eax, eax
push ebp
push 0x4fcef9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4378a8]
call fcn.00437b64
mov ebx, eax
mov dword [ebx + 0x18], 1
cmp byte [ebp - 5], 0
je 0x4fce95
mov edx, 0x80000002
mov eax, ebx
call fcn.00437c04
lea eax, [ebp - 4]
mov edx, 0x4fd040
call fcn.004062cc
jmp 0x4fceae
mov edx, 0x80000001
mov eax, ebx
call fcn.00437c04
lea eax, [ebp - 4]
mov edx, 0x4fd06c
call fcn.004062cc
mov edx, 0x4fd088
mov eax, ebx
call fcn.00438504
test al, al
je 0x4fcee8
mov edx, 0x4fd088
xor ecx, ecx
mov eax, ebx
call fcn.00437c68
test al, al
je 0x4fcee8
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00438088
mov byte [ebp - 0xd], 1
mov eax, ebx
call fcn.00437bd4
mov eax, ebx
call fcn.00403dac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4fcf03
cmp byte [ebp - 0xd], 0
je 0x4fcf1b
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040d650
test al, al
jne 0x4fd000
mov eax, dword [0x5668d8]
cmp dword [eax], 5
jg 0x4fcf89
cmp byte [ebp - 5], 0
je 0x4fcf4e
lea eax, [ebp - 0x21c]
call fcn.004fccf0
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0xc]
mov ecx, 0x4fd118
call fcn.0040674c
jmp 0x4fcfe8
lea eax, [ebp - 0x220]
call fcn.004fccf0
push dword [ebp - 0x220]
push 0x4fd18c
lea eax, [ebp - 0x224]
call fcn.004fccac
push dword [ebp - 0x224]
push 0x4fd1cc
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.00406830
jmp 0x4fcfe8
cmp byte [ebp - 5], 0
je 0x4fcfaf
lea eax, [ebp - 0x228]
call fcn.004fccf0
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp - 0xc]
mov ecx, 0x4fd1fc
call fcn.0040674c
jmp 0x4fcfe8
lea eax, [ebp - 0x22c]
call fcn.004fccf0
push dword [ebp - 0x22c]
push 0x4fd224
lea eax, [ebp - 0x230]
call fcn.004fccac
push dword [ebp - 0x230]
push 0x4fd240
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.00406830
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040d650
test al, al
jne 0x4fd000
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00406278
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fd02d
lea eax, [ebp - 0x230]
mov edx, 6
call fcn.00406270
lea eax, [ebp - 4]
call fcn.00406268
ret