Function at 0x4c9a18
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
xor eax, eax
push ebp
push 0x4c9cc6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.004061f0
cmp byte [ebp - 5], 0
je 0x4c9a78
mov ebx, 0x23
jmp 0x4c9a7d
mov ebx, 0x1a
xor eax, eax
push ebp
push 0x4c9abd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push ebx
lea eax, [ebp - 0x216]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x216]
call fcn.0040639c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c9acb
cmp byte [ebp - 0xd], 0
je 0x4c9ae3
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040d2e0
test al, al
jne 0x4c9ca0
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.004061f0
xor eax, eax
push ebp
push 0x4c9b99
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4319dc]
call fcn.00431c68
mov ebx, eax
mov dword [ebx + 0x18], 1
cmp byte [ebp - 5], 0
je 0x4c9b35
mov edx, 0x80000002
mov eax, ebx
call fcn.00431d08
lea eax, [ebp - 4]
mov edx, 0x4c9ce0
call fcn.00406244
jmp 0x4c9b4e
mov edx, 0x80000001
mov eax, ebx
call fcn.00431d08
lea eax, [ebp - 4]
mov edx, 0x4c9d0c
call fcn.00406244
mov edx, 0x4c9d28
mov eax, ebx
call fcn.0043261c
test al, al
je 0x4c9b88
mov edx, 0x4c9d28
xor ecx, ecx
mov eax, ebx
call fcn.00431d6c
test al, al
je 0x4c9b88
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00432210
mov byte [ebp - 0xd], 1
mov eax, ebx
call fcn.00431cd8
mov eax, ebx
call fcn.00403f64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c9ba3
cmp byte [ebp - 0xd], 0
je 0x4c9bbb
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040d2e0
test al, al
jne 0x4c9ca0
mov eax, dword [0x547674]
cmp dword [eax], 5
jg 0x4c9c29
cmp byte [ebp - 5], 0
je 0x4c9bee
lea eax, [ebp - 0x21c]
call fcn.004c9990
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0xc]
mov ecx, 0x4c9db8
call fcn.004065c4
jmp 0x4c9c88
lea eax, [ebp - 0x220]
call fcn.004c9990
push dword [ebp - 0x220]
push 0x4c9e2c
lea eax, [ebp - 0x224]
call fcn.004c994c
push dword [ebp - 0x224]
push 0x4c9e6c
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.00406694
jmp 0x4c9c88
cmp byte [ebp - 5], 0
je 0x4c9c4f
lea eax, [ebp - 0x228]
call fcn.004c9990
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp - 0xc]
mov ecx, 0x4c9e9c
call fcn.004065c4
jmp 0x4c9c88
lea eax, [ebp - 0x22c]
call fcn.004c9990
push dword [ebp - 0x22c]
push 0x4c9ec4
lea eax, [ebp - 0x230]
call fcn.004c994c
push dword [ebp - 0x230]
push 0x4c9ee0
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.00406694
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040d2e0
test al, al
jne 0x4c9ca0
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.004061f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c9ccd
lea eax, [ebp - 0x230]
mov edx, 6
call fcn.004061e8
lea eax, [ebp - 4]
call fcn.004061e0
ret