Function at 0x4caff8
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
xor eax, eax
push ebp
push 0x4cb2a6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00405df4
cmp byte [ebp - 5], 0
je 0x4cb058
mov ebx, 0x23
jmp 0x4cb05d
mov ebx, 0x1a
xor eax, eax
push ebp
push 0x4cb09d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push ebx
lea eax, [ebp - 0x216]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x216]
call fcn.00405fa0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4cb0ab
cmp byte [ebp - 0xd], 0
je 0x4cb0c3
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040d4e8
test al, al
jne 0x4cb280
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00405df4
xor eax, eax
push ebp
push 0x4cb179
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x433050]
call fcn.0043318c
mov ebx, eax
mov dword [ebx + 0x18], 1
cmp byte [ebp - 5], 0
je 0x4cb115
mov edx, 0x80000002
mov eax, ebx
call fcn.0043322c
lea eax, [ebp - 4]
mov edx, 0x4cb2c0
call fcn.00405e48
jmp 0x4cb12e
mov edx, 0x80000001
mov eax, ebx
call fcn.0043322c
lea eax, [ebp - 4]
mov edx, 0x4cb2ec
call fcn.00405e48
mov edx, 0x4cb308
mov eax, ebx
call fcn.00433790
test al, al
je 0x4cb168
mov edx, 0x4cb308
xor ecx, ecx
mov eax, ebx
call fcn.00433290
test al, al
je 0x4cb168
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00433604
mov byte [ebp - 0xd], 1
mov eax, ebx
call fcn.004331fc
mov eax, ebx
call fcn.00403d58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4cb183
cmp byte [ebp - 0xd], 0
je 0x4cb19b
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040d4e8
test al, al
jne 0x4cb280
mov eax, dword [0x50a5f4]
cmp dword [eax], 5
jg 0x4cb209
cmp byte [ebp - 5], 0
je 0x4cb1ce
lea eax, [ebp - 0x21c]
call fcn.004caf70
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0xc]
mov ecx, 0x4cb398
call fcn.004062c8
jmp 0x4cb268
lea eax, [ebp - 0x220]
call fcn.004caf70
push dword [ebp - 0x220]
push 0x4cb40c
lea eax, [ebp - 0x224]
call fcn.004caf2c
push dword [ebp - 0x224]
push 0x4cb44c
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.004063ac
jmp 0x4cb268
cmp byte [ebp - 5], 0
je 0x4cb22f
lea eax, [ebp - 0x228]
call fcn.004caf70
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp - 0xc]
mov ecx, 0x4cb47c
call fcn.004062c8
jmp 0x4cb268
lea eax, [ebp - 0x22c]
call fcn.004caf70
push dword [ebp - 0x22c]
push 0x4cb4a4
lea eax, [ebp - 0x230]
call fcn.004caf2c
push dword [ebp - 0x230]
push 0x4cb4c0
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.004063ac
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040d4e8
test al, al
jne 0x4cb280
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00405df4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cb2ad
lea eax, [ebp - 0x230]
mov edx, 6
call fcn.00405dec
lea eax, [ebp - 4]
call fcn.00405de4
ret