Function at 0x471e6c
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
xor eax, eax
push ebp
push 0x47211a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.0040562c
cmp byte [ebp - 5], 0
je 0x471ecc
mov ebx, 0x23
jmp 0x471ed1
mov ebx, 0x1a
xor eax, eax
push ebp
push 0x471f11
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push ebx
lea eax, [ebp - 0x216]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x216]
call fcn.004057a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x471f1f
cmp byte [ebp - 0xd], 0
je 0x471f37
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040b37c
test al, al
jne 0x4720f4
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.0040562c
xor eax, eax
push ebp
push 0x471fed
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x427684]
call fcn.004277c0
mov ebx, eax
mov dword [ebx + 0x18], 1
cmp byte [ebp - 5], 0
je 0x471f89
mov edx, 0x80000002
mov eax, ebx
call fcn.00427860
lea eax, [ebp - 4]
mov edx, 0x472134
call fcn.00405680
jmp 0x471fa2
mov edx, 0x80000001
mov eax, ebx
call fcn.00427860
lea eax, [ebp - 4]
mov edx, 0x472160
call fcn.00405680
mov edx, 0x47217c
mov eax, ebx
call fcn.00427fa0
test al, al
je 0x471fdc
mov edx, 0x47217c
xor ecx, ecx
mov eax, ebx
call fcn.004278c8
test al, al
je 0x471fdc
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00427e1c
mov byte [ebp - 0xd], 1
mov eax, ebx
call fcn.00427830
mov eax, ebx
call fcn.00403c8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x471ff7
cmp byte [ebp - 0xd], 0
je 0x47200f
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040b37c
test al, al
jne 0x4720f4
mov eax, dword [0x479e2c]
cmp dword [eax], 5
jg 0x47207d
cmp byte [ebp - 5], 0
je 0x472042
lea eax, [ebp - 0x21c]
call fcn.00471de4
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0xc]
mov ecx, 0x47220c
call fcn.004059b8
jmp 0x4720dc
lea eax, [ebp - 0x220]
call fcn.00471de4
push dword [ebp - 0x220]
push 0x472280
lea eax, [ebp - 0x224]
call fcn.00471da0
push dword [ebp - 0x224]
push 0x4722c0
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.00405a88
jmp 0x4720dc
cmp byte [ebp - 5], 0
je 0x4720a3
lea eax, [ebp - 0x228]
call fcn.00471de4
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp - 0xc]
mov ecx, 0x4722f0
call fcn.004059b8
jmp 0x4720dc
lea eax, [ebp - 0x22c]
call fcn.00471de4
push dword [ebp - 0x22c]
push 0x472318
lea eax, [ebp - 0x230]
call fcn.00471da0
push dword [ebp - 0x230]
push 0x472334
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.00405a88
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040b37c
test al, al
jne 0x4720f4
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.0040562c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472121
lea eax, [ebp - 0x230]
mov edx, 6
call fcn.00405624
lea eax, [ebp - 4]
call fcn.0040561c
ret