Function at 0x4cccec
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
xor eax, eax
push ebp
push 0x4ccf9a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.0040624c
cmp byte [ebp - 5], 0
je 0x4ccd4c
mov ebx, 0x23
jmp 0x4ccd51
mov ebx, 0x1a
xor eax, eax
push ebp
push 0x4ccd91
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push ebx
lea eax, [ebp - 0x216]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x216]
call fcn.004063f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ccd9f
cmp byte [ebp - 0xd], 0
je 0x4ccdb7
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040da2c
test al, al
jne 0x4ccf74
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.0040624c
xor eax, eax
push ebp
push 0x4cce6d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x433b00]
call fcn.00433c3c
mov ebx, eax
mov dword [ebx + 0x18], 1
cmp byte [ebp - 5], 0
je 0x4cce09
mov edx, 0x80000002
mov eax, ebx
call fcn.00433cdc
lea eax, [ebp - 4]
mov edx, 0x4ccfb4
call fcn.004062a0
jmp 0x4cce22
mov edx, 0x80000001
mov eax, ebx
call fcn.00433cdc
lea eax, [ebp - 4]
mov edx, 0x4ccfe0
call fcn.004062a0
mov edx, 0x4ccffc
mov eax, ebx
call fcn.00434240
test al, al
je 0x4cce5c
mov edx, 0x4ccffc
xor ecx, ecx
mov eax, ebx
call fcn.00433d40
test al, al
je 0x4cce5c
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004340b4
mov byte [ebp - 0xd], 1
mov eax, ebx
call fcn.00433cac
mov eax, ebx
call fcn.00403dbc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4cce77
cmp byte [ebp - 0xd], 0
je 0x4cce8f
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040da2c
test al, al
jne 0x4ccf74
mov eax, dword [0x554538]
cmp dword [eax], 5
jg 0x4ccefd
cmp byte [ebp - 5], 0
je 0x4ccec2
lea eax, [ebp - 0x21c]
call fcn.004ccc64
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0xc]
mov ecx, 0x4cd08c
call fcn.00406720
jmp 0x4ccf5c
lea eax, [ebp - 0x220]
call fcn.004ccc64
push dword [ebp - 0x220]
push 0x4cd100
lea eax, [ebp - 0x224]
call fcn.004ccc20
push dword [ebp - 0x224]
push 0x4cd140
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.00406804
jmp 0x4ccf5c
cmp byte [ebp - 5], 0
je 0x4ccf23
lea eax, [ebp - 0x228]
call fcn.004ccc64
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp - 0xc]
mov ecx, 0x4cd170
call fcn.00406720
jmp 0x4ccf5c
lea eax, [ebp - 0x22c]
call fcn.004ccc64
push dword [ebp - 0x22c]
push 0x4cd198
lea eax, [ebp - 0x230]
call fcn.004ccc20
push dword [ebp - 0x230]
push 0x4cd1b4
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.00406804
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040da2c
test al, al
jne 0x4ccf74
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.0040624c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ccfa1
lea eax, [ebp - 0x230]
mov edx, 6
call fcn.00406244
lea eax, [ebp - 4]
call fcn.0040623c
ret