Function at 0x4a1620
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x29
push 0
push 0
dec ecx
jne 0x4a1628
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004047fc
xor eax, eax
push ebp
push 0x4a1d93
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 1
mov dl, 1
mov eax, dword [0x477e04]
call fcn.00477f48
mov dword [ebp - 0x18], eax
cmp byte [ebp - 9], 1
jne 0x4a1cf5
mov byte [ebp - 9], 0
mov edx, dword [ebp - 4]
mov eax, 0x4a1dac
call fcn.00404950
test eax, eax
jle 0x4a1707
mov byte [ebp - 9], 1
mov edx, dword [ebp - 4]
mov eax, 0x4a1dac
call fcn.00404950
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
mov ecx, 6
mov edx, dword [ebp - 0x10]
call fcn.004048ac
mov eax, dword [ebp - 4]
call fcn.0040460c
cmp eax, dword [ebp - 0x10]
jge 0x4a16e3
lea eax, [ebp - 0x11c]
mov edx, dword [ebp - 4]
call fcn.00404c04
lea eax, [ebp - 0x11c]
mov edx, dword [0x4a72ec]
mov edx, dword [edx]
call fcn.00404c9c
mov edx, dword [ebp - 0x11c]
lea eax, [ebp - 4]
call fcn.004045d4
jmp 0x4a1707
lea eax, [ebp - 0x120]
mov edx, dword [0x4a72ec]
mov edx, dword [edx]
call fcn.004045d4
mov eax, dword [ebp - 0x120]
lea edx, [ebp - 4]
mov ecx, dword [ebp - 0x10]
call fcn.004048f4
mov edx, dword [ebp - 4]
mov eax, 0x4a1dbc
call fcn.00404950
test eax, eax
jle 0x4a186a
mov byte [ebp - 9], 1
mov edx, dword [ebp - 4]
mov eax, 0x4a1dbc
call fcn.00404950
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
mov ecx, 0xd
mov edx, dword [ebp - 0x10]
call fcn.004048ac
mov eax, dword [ebp - 4]
call fcn.0040460c
cmp eax, dword [ebp - 0x10]
jge 0x4a17e0
lea eax, [ebp - 0x128]
mov edx, dword [ebp - 4]
call fcn.00404c04
push dword [ebp - 0x128]
mov eax, dword [0x4a72ec]
push dword [eax]
push 0x4a1dd0
mov eax, 0x3e8
call fcn.00402e88
lea edx, [ebp - 0x130]
call fcn.004090dc
mov edx, dword [ebp - 0x130]
lea eax, [ebp - 0x12c]
call fcn.00404c04
push dword [ebp - 0x12c]
mov eax, 0x1c
call fcn.00402e88
mov edx, eax
add edx, 0x61
lea eax, [ebp - 0x134]
call fcn.00404b44
push dword [ebp - 0x134]
lea eax, [ebp - 0x124]
mov edx, 5
call fcn.00404d60
mov edx, dword [ebp - 0x124]
lea eax, [ebp - 4]
call fcn.004045d4
jmp 0x4a186a
mov eax, dword [0x4a72ec]
push dword [eax]
push 0x4a1dd0
mov eax, 0x3e8
call fcn.00402e88
lea edx, [ebp - 0x144]
call fcn.004090dc
mov edx, dword [ebp - 0x144]
lea eax, [ebp - 0x140]
call fcn.00404c04
push dword [ebp - 0x140]
mov eax, 0x1c
call fcn.00402e88
mov edx, eax
add edx, 0x61
lea eax, [ebp - 0x148]
call fcn.00404b44
push dword [ebp - 0x148]
lea eax, [ebp - 0x13c]
mov edx, 4
call fcn.00404d60
mov edx, dword [ebp - 0x13c]
lea eax, [ebp - 0x138]
call fcn.004045d4
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 4]
mov ecx, dword [ebp - 0x10]
call fcn.004048f4
mov edx, dword [ebp - 4]
mov eax, 0x4a1de4
call fcn.00404950
test eax, eax
jle 0x4a18e6
mov byte [ebp - 9], 1
mov edx, dword [ebp - 4]
mov eax, 0x4a1de4
call fcn.00404950
mov dword [ebp - 0x10], eax
push 0xff
lea eax, [ebp - 0x118]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x118]
call fcn.00409e58
lea eax, [ebp - 4]
mov ecx, 5
mov edx, dword [ebp - 0x10]
call fcn.004048ac
mov eax, dword [ebp - 4]
call fcn.0040460c
cmp eax, dword [ebp - 0x10]
jge 0x4a18d8
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x14]
call fcn.00404614
jmp 0x4a18e6
lea edx, [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.004048f4
mov edx, dword [ebp - 4]
mov eax, 0x4a1df4
call fcn.00404950
test eax, eax
jle 0x4a1962
mov byte [ebp - 9], 1
mov edx, dword [ebp - 4]
mov eax, 0x4a1df4
call fcn.00404950
mov dword [ebp - 0x10], eax
push 0xff
lea eax, [ebp - 0x118]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x118]
call fcn.00409e58
lea eax, [ebp - 4]
mov ecx, 5
mov edx, dword [ebp - 0x10]
call fcn.004048ac
mov eax, dword [ebp - 4]
call fcn.0040460c
cmp eax, dword [ebp - 0x10]
jge 0x4a1954
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x14]
call fcn.00404614
jmp 0x4a1962
lea edx, [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.004048f4
mov edx, dword [ebp - 4]
mov eax, 0x4a1e08
call fcn.00404950
test eax, eax
jle 0x4a1a17
mov byte [ebp - 9], 1
mov edx, dword [ebp - 4]
mov eax, 0x4a1e08
call fcn.00404950
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4a19d8
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0x18]
call fcn.00478024
push 0x20019
xor ecx, ecx
mov edx, 0x4a1e18
mov eax, dword [ebp - 0x18]
call fcn.004780d8
lea ecx, [ebp - 0x14]
mov edx, 0x4a1e4c
mov eax, dword [ebp - 0x18]
call fcn.004782ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a19df
ret
mov edx, dword [ebp - 4]
mov eax, 0x4a1e64
call fcn.00404950
test eax, eax
jle 0x4a1acc
mov byte [ebp - 9], 1
mov edx, dword [ebp - 4]
mov eax, 0x4a1e64
call fcn.00404950
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4a1a8d
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0x18]
call fcn.00478024
push 0x20019
xor ecx, ecx
mov edx, 0x4a1e18
mov eax, dword [ebp - 0x18]
call fcn.004780d8
lea ecx, [ebp - 0x14]
mov edx, 0x4a1e4c
mov eax, dword [ebp - 0x18]
call fcn.004782ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a1a94
ret
mov edx, dword [ebp - 4]
mov eax, 0x4a1e74
call fcn.00404950
test eax, eax
jle 0x4a1b81
mov byte [ebp - 9], 1
mov edx, dword [ebp - 4]
mov eax, 0x4a1e74
call fcn.00404950
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4a1b42
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 0x18]
call fcn.00478024
push 0x20019
xor ecx, ecx
mov edx, 0x4a1e84
mov eax, dword [ebp - 0x18]
call fcn.004780d8
lea ecx, [ebp - 0x14]
mov edx, 0x4a1ed0
mov eax, dword [ebp - 0x18]
call fcn.004782ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a1b49
ret
mov edx, dword [ebp - 4]
mov eax, 0x4a1ee4
call fcn.00404950
test eax, eax
jle 0x4a1c36
mov byte [ebp - 9], 1
mov edx, dword [ebp - 4]
mov eax, 0x4a1ee4
call fcn.00404950
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4a1bf7
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 0x18]
call fcn.00478024
push 0x20019
xor ecx, ecx
mov edx, 0x4a1e84
mov eax, dword [ebp - 0x18]
call fcn.004780d8
lea ecx, [ebp - 0x14]
mov edx, 0x4a1ef8
mov eax, dword [ebp - 0x18]
call fcn.004782ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a1bfe
ret
mov edx, dword [ebp - 4]
mov eax, 0x4a1f08
call fcn.00404950
test eax, eax
jle 0x4a1ceb
mov byte [ebp - 9], 1
mov edx, dword [ebp - 4]
mov eax, 0x4a1f08
call fcn.00404950
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4a1cac
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 0x18]
call fcn.00478024
push 0x20019
xor ecx, ecx
mov edx, 0x4a1e84
mov eax, dword [ebp - 0x18]
call fcn.004780d8
lea ecx, [ebp - 0x14]
mov edx, 0x4a1f18
mov eax, dword [ebp - 0x18]
call fcn.004782ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a1cb3
ret
cmp byte [ebp - 9], 1
je 0x4a1668
mov eax, dword [ebp - 0x18]
call fcn.004034ec
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404390
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a1d9d
lea eax, [ebp - 0x148]
call fcn.00404a2c
lea eax, [ebp - 0x144]
call fcn.0040433c
lea eax, [ebp - 0x140]
mov edx, 2
call fcn.00404a44
lea eax, [ebp - 0x138]
call fcn.0040433c
lea eax, [ebp - 0x134]
call fcn.00404a2c
lea eax, [ebp - 0x130]
call fcn.0040433c
lea eax, [ebp - 0x12c]
mov edx, 3
call fcn.00404a44
lea eax, [ebp - 0x120]
call fcn.0040433c
lea eax, [ebp - 0x11c]
call fcn.00404a2c
lea eax, [ebp - 0x14]
call fcn.0040433c
lea eax, [ebp - 4]
call fcn.0040433c
ret