Function at 0x48c0fc
Capabilities:
Check if file exists
Get common file path
Persist via run registry key
Set registry value

Disassembly:
push 0x2dc
mov eax, 0x5a95d4
call fcn.00462cd6
mov ebx, ecx
mov dword [ebp - 0x2d0], ebx
mov esi, dword [ebp + 8]
call fcn.0048afce
xor edi, edi
cmp dword [esi + 0x10], edi
je 0x48c4ab
xor eax, eax
mov dword [ebp - 0x2a0], edi
push str.Uninstall
lea ecx, [ebp - 0x2b0]
mov dword [ebp - 0x29c], 7
mov word [ebp - 0x2b0], ax
call fcn.004096b4
lea eax, [ebp - 0x2cc]
mov dword [ebp - 4], edi
push eax
push edi
push edi
push 0x5ee210
mov dword [ebp - 0x2cc], edi
call sub.SHELL32.dll_SHGetKnownFolderPath
mov edi, eax
test edi, edi
js 0x48c254
push dword [ebp - 0x2cc]
lea ecx, [ebp - 0x2e8]
call fcn.004094f1
push 0x5c24fc
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.004096dd
push eax
lea ecx, [ebp - 0x2c8]
call fcn.0040a8b7
lea ecx, [ebp - 0x2e8]
mov byte [ebp - 4], 3
call fcn.0040aa69
xor ebx, ebx
lea ecx, [ebp - 0x280]
push esi
mov dword [ebp - 0x270], ebx
mov dword [ebp - 0x26c], ebx
call fcn.00409706
push ebx
push dword [ebp - 0x2cc]
lea ecx, [ebp - 0x280]
mov byte [ebp - 4], 4
call fcn.00409453
push dword [ebp - 0x2cc]
mov ebx, eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp ebx, 0xffffffff
je 0x48c20d
mov ecx, dword [ebp - 0x2b8]
push 0x5effb0
inc ecx
push ecx
push ebx
lea ecx, [ebp - 0x280]
call 0x43c203
cmp dword [ebp - 0x26c], 8
lea eax, [ebp - 0x280]
push dword [ebp - 0x270]
cmovae eax, dword [ebp - 0x280]
lea ecx, [ebp - 0x2b0]
push eax
call fcn.00409829
lea ecx, [ebp - 0x280]
call fcn.0040aa69
lea ecx, [ebp - 0x2c8]
call fcn.0040aa69
mov ebx, dword [ebp - 0x2d0]
jmp 0x48c318
push 0x4e
lea eax, [ebp - 0x60]
push 0
push eax
call fcn.00463cc0
xor eax, eax
lea edi, [ebp - 0x278]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x278]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
mov edi, eax
test edi, edi
js 0x48c309
movzx eax, byte [ebp - 0x269]
push eax
movzx eax, byte [ebp - 0x26a]
push eax
movzx eax, byte [ebp - 0x26b]
push eax
movzx eax, byte [ebp - 0x26c]
push eax
movzx eax, byte [ebp - 0x26d]
push eax
movzx eax, byte [ebp - 0x26e]
push eax
movzx eax, byte [ebp - 0x26f]
push eax
movzx eax, byte [ebp - 0x270]
push eax
movzx eax, word [ebp - 0x272]
push eax
movzx eax, word [ebp - 0x274]
push eax
push dword [ebp - 0x278]
lea eax, [ebp - 0x60]
push 0x5c2488
push 0x27
push eax
call fcn.0041d5f6
add esp, 0x38
test eax, eax
jns 0x48c309
push eax
push str.ScheduleDirectoryRemovalOnNextLogon_StringCchPrintf___failed._hr0x_08X
push 0x5c21d4
push 1
call fcn.00484717
add esp, 0x10
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x2b0]
call fcn.004096dd
and dword [ebp - 0x288], 0
xor eax, eax
mov dword [ebp - 0x284], 7
mov word [ebp - 0x298], ax
mov byte [ebp - 4], 5
test edi, edi
js 0x48c48b
push 0x208
xor edi, edi
lea eax, [ebp - 0x268]
push edi
push eax
call fcn.00463cc0
add esp, 0xc
lea eax, [ebp - 0x268]
push eax
push edi
push edi
push 0x25
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
test edi, edi
js 0x48c48b
push 0
push str.cmd.exe
push 0x104
lea eax, [ebp - 0x268]
push eax
call fcn.00418c34
mov edi, eax
test edi, edi
js 0x48c48b
lea eax, [ebp - 0x268]
push eax
lea ecx, [ebp - 0x298]
call fcn.004096b4
push str.__q__c_rmdir__s__q__
lea ecx, [ebp - 0x298]
call fcn.004096dd
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x48c3bf
mov eax, dword [esi]
push eax
lea ecx, [ebp - 0x298]
call fcn.004096dd
push 0x5f789c
lea ecx, [ebp - 0x298]
call fcn.004096dd
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x48c3e5
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x48c48b
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x48c3fe
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x48c422
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x48c413
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x48c4ab
cmp dword [ebp - 0x284], 8
lea edx, [ebp - 0x298]
mov eax, dword [ebp - 0x288]
lea ecx, [ebp - 0x2b0]
cmovae edx, dword [ebp - 0x298]
cmp dword [ebp - 0x29c], 8
cmovae ecx, dword [ebp - 0x2b0]
add eax, eax
push eax
push edx
push 1
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push dword [esi + 0x18]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
je 0x48c477
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
js 0x48c48b
cmp dword [esi + 0x14], 8
jb 0x48c483
mov esi, dword [esi]
push esi
mov ecx, ebx
call fcn.0048914e
lea ecx, [ebp - 0x298]
call fcn.0040aa69
lea ecx, [ebp - 0x2b0]
call fcn.0040aa69
mov eax, edi
call fcn.00462c80
ret 4
push 0x80004005
call fcn.0040a96d
int3