Function at 0x4712f0
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
xor eax, eax
push ebp
push 0x47159e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.004012b8
cmp byte [ebp - 5], 0
je 0x471350
mov ebx, 0x23
jmp 0x471355
mov ebx, 0x1a
xor eax, eax
push ebp
push 0x471395
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push ebx
lea eax, [ebp - 0x216]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x216]
call fcn.004012e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4713a3
cmp byte [ebp - 0xd], 0
je 0x4713bb
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00406fb0
test al, al
jne 0x471578
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.004012b8
xor eax, eax
push ebp
push 0x471471
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4f3154]
call fcn.00407670
mov ebx, eax
mov dword [ebx + 0x18], 1
cmp byte [ebp - 5], 0
je 0x47140d
mov edx, 0x80000002
mov eax, ebx
call fcn.00407680
lea eax, [ebp - 4]
mov edx, 0x4715b8
call fcn.004012c0
jmp 0x471426
mov edx, 0x80000001
mov eax, ebx
call fcn.00407680
lea eax, [ebp - 4]
mov edx, 0x4715e4
call fcn.004012c0
mov edx, 0x471600
mov eax, ebx
call fcn.004076a0
test al, al
je 0x471460
mov edx, 0x471600
xor ecx, ecx
mov eax, ebx
call fcn.00407688
test al, al
je 0x471460
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00407698
mov byte [ebp - 0xd], 1
mov eax, ebx
call fcn.00407678
mov eax, ebx
call fcn.004010c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47147b
cmp byte [ebp - 0xd], 0
je 0x471493
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00406fb0
test al, al
jne 0x471578
mov eax, dword [0x4f2dd0]
cmp dword [eax], 5
jg 0x471501
cmp byte [ebp - 5], 0
je 0x4714c6
lea eax, [ebp - 0x21c]
call fcn.00471268
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0xc]
mov ecx, 0x471690
call fcn.00401338
jmp 0x471560
lea eax, [ebp - 0x220]
call fcn.00471268
push dword [ebp - 0x220]
push 0x471704
lea eax, [ebp - 0x224]
call fcn.00471224
push dword [ebp - 0x224]
push 0x471744
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.00401340
jmp 0x471560
cmp byte [ebp - 5], 0
je 0x471527
lea eax, [ebp - 0x228]
call fcn.00471268
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp - 0xc]
mov ecx, 0x471774
call fcn.00401338
jmp 0x471560
lea eax, [ebp - 0x22c]
call fcn.00471268
push dword [ebp - 0x22c]
push 0x47179c
lea eax, [ebp - 0x230]
call fcn.00471224
push dword [ebp - 0x230]
push 0x4717b8
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.00401340
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00406fb0
test al, al
jne 0x471578
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.004012b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4715a5
lea eax, [ebp - 0x230]
mov edx, 6
call fcn.004012b0
lea eax, [ebp - 4]
call fcn.004012a8
ret