Function at 0x4cb57c
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
xor eax, eax
push ebp
push 0x4cb82a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00406070
cmp byte [ebp - 5], 0
je 0x4cb5dc
mov ebx, 0x23
jmp 0x4cb5e1
mov ebx, 0x1a
xor eax, eax
push ebp
push 0x4cb621
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push ebx
lea eax, [ebp - 0x216]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x216]
call fcn.0040621c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4cb62f
cmp byte [ebp - 0xd], 0
je 0x4cb647
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040d7fc
test al, al
jne 0x4cb804
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00406070
xor eax, eax
push ebp
push 0x4cb6fd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4335d4]
call fcn.00433710
mov ebx, eax
mov dword [ebx + 0x18], 1
cmp byte [ebp - 5], 0
je 0x4cb699
mov edx, 0x80000002
mov eax, ebx
call fcn.004337b0
lea eax, [ebp - 4]
mov edx, 0x4cb844
call fcn.004060c4
jmp 0x4cb6b2
mov edx, 0x80000001
mov eax, ebx
call fcn.004337b0
lea eax, [ebp - 4]
mov edx, 0x4cb870
call fcn.004060c4
mov edx, 0x4cb88c
mov eax, ebx
call fcn.00433d14
test al, al
je 0x4cb6ec
mov edx, 0x4cb88c
xor ecx, ecx
mov eax, ebx
call fcn.00433814
test al, al
je 0x4cb6ec
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00433b88
mov byte [ebp - 0xd], 1
mov eax, ebx
call fcn.00433780
mov eax, ebx
call fcn.00403dac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4cb707
cmp byte [ebp - 0xd], 0
je 0x4cb71f
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040d7fc
test al, al
jne 0x4cb804
mov eax, dword [0x522fe4]
cmp dword [eax], 5
jg 0x4cb78d
cmp byte [ebp - 5], 0
je 0x4cb752
lea eax, [ebp - 0x21c]
call fcn.004cb4f4
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0xc]
mov ecx, 0x4cb91c
call fcn.00406544
jmp 0x4cb7ec
lea eax, [ebp - 0x220]
call fcn.004cb4f4
push dword [ebp - 0x220]
push 0x4cb990
lea eax, [ebp - 0x224]
call fcn.004cb4b0
push dword [ebp - 0x224]
push 0x4cb9d0
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.00406628
jmp 0x4cb7ec
cmp byte [ebp - 5], 0
je 0x4cb7b3
lea eax, [ebp - 0x228]
call fcn.004cb4f4
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp - 0xc]
mov ecx, 0x4cba00
call fcn.00406544
jmp 0x4cb7ec
lea eax, [ebp - 0x22c]
call fcn.004cb4f4
push dword [ebp - 0x22c]
push 0x4cba28
lea eax, [ebp - 0x230]
call fcn.004cb4b0
push dword [ebp - 0x230]
push 0x4cba44
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.00406628
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040d7fc
test al, al
jne 0x4cb804
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00406070
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cb831
lea eax, [ebp - 0x230]
mov edx, 6
call fcn.00406068
lea eax, [ebp - 4]
call fcn.00406060
ret