Function at 0x72d5c4
Capabilities:
Get common file path
Get startup folder
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x9c
push 0
push 0
dec ecx
jne 0x72d5cc
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 0x280]
mov edx, dword [0x41c09c]
call fcn.0040aea8
xor eax, eax
push ebp
push 0x72dc58
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48c]
push eax
push 0
push 0
push 7
push 0
call sub.shell32.dll_SHGetFolderPathW
lea eax, [ebp - 8]
lea edx, [ebp - 0x48c]
mov ecx, 0x104
call fcn.0040a6f8
mov eax, dword [ebp - 8]
test eax, eax
je 0x72d629
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x72d645
lea eax, [ebp - 8]
push eax
mov ecx, 0x72dc74
mov edx, 0x72dc90
mov eax, 0x80000001
call fcn.005b8330
mov eax, dword [ebp - 8]
test eax, eax
je 0x72d651
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x72d66d
lea eax, [ebp - 8]
push eax
mov ecx, 0x72dd20
mov edx, 0x72dc90
mov eax, 0x80000001
call fcn.005b8330
lea eax, [ebp - 0x48c]
push eax
push 0
push 0
push 0x18
push 0
call sub.shell32.dll_SHGetFolderPathW
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x48c]
mov ecx, 0x104
call fcn.0040a6f8
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x72d6a0
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x72d6bc
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x72dc74
mov edx, 0x72dc90
mov eax, 0x80000002
call fcn.005b8330
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x72d6c8
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x72d6e4
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x72dd44
mov edx, 0x72dc90
mov eax, 0x80000002
call fcn.005b8330
lea edx, [ebp - 0x490]
mov eax, dword [ebp - 8]
call fcn.0042c3c4
mov edx, dword [ebp - 0x490]
lea eax, [ebp - 8]
call fcn.00409f38
lea edx, [ebp - 0x494]
mov eax, dword [ebp - 0xc]
call fcn.0042c3c4
mov edx, dword [ebp - 0x494]
lea eax, [ebp - 0xc]
call fcn.00409f38
xor eax, eax
mov dword [0x7d05d4], eax
mov dl, 1
mov eax, dword [0x477334]
call fcn.004a1dec
mov esi, eax
mov ecx, esi
mov edx, 0x72dd70
mov eax, 0x80000001
call fcn.005b825c
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x72d7d5
inc eax
mov dword [ebp - 0x284], eax
xor ebx, ebx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x498]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x498]
mov edx, 0x72dd70
mov eax, 0x80000001
call fcn.005b8330
lea ecx, [ebp - 0x49c]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x49c]
test eax, eax
je 0x72d7a1
sub eax, 4
mov eax, dword [eax]
test eax, eax
je 0x72d7cc
lea ecx, [ebp - 0x4a0]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x4a0]
mov edx, dword [ebp - 4]
call fcn.0072d490
test al, al
jne 0x72d7cc
inc dword [0x7d05d4]
inc ebx
dec dword [ebp - 0x284]
jne 0x72d75b
mov ecx, esi
mov edx, 0x72dd70
mov eax, 0x80000002
call fcn.005b825c
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x72d879
inc eax
mov dword [ebp - 0x284], eax
xor ebx, ebx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x4a4]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x4a4]
mov edx, 0x72dd70
mov eax, 0x80000002
call fcn.005b8330
lea ecx, [ebp - 0x4a8]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x4a8]
test eax, eax
je 0x72d845
sub eax, 4
mov eax, dword [eax]
test eax, eax
je 0x72d870
lea ecx, [ebp - 0x4ac]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x4ac]
mov edx, dword [ebp - 4]
call fcn.0072d490
test al, al
jne 0x72d870
inc dword [0x7d05d4]
inc ebx
dec dword [ebp - 0x284]
jne 0x72d7ff
mov ecx, esi
mov edx, 0x72ddd8
mov eax, 0x80000001
call fcn.005b825c
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x72d91d
inc eax
mov dword [ebp - 0x284], eax
xor ebx, ebx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x4b0]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x4b0]
mov edx, 0x72ddd8
mov eax, 0x80000001
call fcn.005b8330
lea ecx, [ebp - 0x4b4]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x4b4]
test eax, eax
je 0x72d8e9
sub eax, 4
mov eax, dword [eax]
test eax, eax
je 0x72d914
lea ecx, [ebp - 0x4b8]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x4b8]
mov edx, dword [ebp - 4]
call fcn.0072d490
test al, al
jne 0x72d914
inc dword [0x7d05d4]
inc ebx
dec dword [ebp - 0x284]
jne 0x72d8a3
mov ecx, esi
mov edx, 0x72ddd8
mov eax, 0x80000002
call fcn.005b825c
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x72d9c1
inc eax
mov dword [ebp - 0x284], eax
xor ebx, ebx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x4bc]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x4bc]
mov edx, 0x72ddd8
mov eax, 0x80000002
call fcn.005b8330
lea ecx, [ebp - 0x4c0]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x4c0]
test eax, eax
je 0x72d98d
sub eax, 4
mov eax, dword [eax]
test eax, eax
je 0x72d9b8
lea ecx, [ebp - 0x4c4]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x4c4]
mov edx, dword [ebp - 4]
call fcn.0072d490
test al, al
jne 0x72d9b8
inc dword [0x7d05d4]
inc ebx
dec dword [ebp - 0x284]
jne 0x72d947
mov ecx, esi
mov edx, 0x72de48
mov eax, 0x80000002
call fcn.005b825c
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x72da65
inc eax
mov dword [ebp - 0x284], eax
xor ebx, ebx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x4c8]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x4c8]
mov edx, 0x72de48
mov eax, 0x80000002
call fcn.005b8330
lea ecx, [ebp - 0x4cc]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x4cc]
test eax, eax
je 0x72da31
sub eax, 4
mov eax, dword [eax]
test eax, eax
je 0x72da5c
lea ecx, [ebp - 0x4d0]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x4d0]
mov edx, dword [ebp - 4]
call fcn.0072d490
test al, al
jne 0x72da5c
inc dword [0x7d05d4]
inc ebx
dec dword [ebp - 0x284]
jne 0x72d9eb
mov ecx, esi
mov edx, 0x72dec8
mov eax, 0x80000002
call fcn.005b825c
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x72db09
inc eax
mov dword [ebp - 0x284], eax
xor ebx, ebx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x4d4]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x4d4]
mov edx, 0x72dec8
mov eax, 0x80000002
call fcn.005b8330
lea ecx, [ebp - 0x4d8]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x4d8]
test eax, eax
je 0x72dad5
sub eax, 4
mov eax, dword [eax]
test eax, eax
je 0x72db00
lea ecx, [ebp - 0x4dc]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x4dc]
mov edx, dword [ebp - 4]
call fcn.0072d490
test al, al
jne 0x72db00
inc dword [0x7d05d4]
inc ebx
dec dword [ebp - 0x284]
jne 0x72da8f
mov eax, esi
call fcn.00407e28
mov eax, dword [ebp - 8]
test eax, eax
je 0x72db1c
sub eax, 4
mov eax, dword [eax]
test eax, eax
je 0x72db95
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.00424aec
test al, al
je 0x72db95
lea eax, [ebp - 0x4e0]
mov ecx, 0x72df50
mov edx, dword [ebp - 8]
call fcn.0040a8a8
mov eax, dword [ebp - 0x4e0]
lea ecx, [ebp - 0x280]
mov edx, 0x1ff
call fcn.00424e18
test eax, eax
jne 0x72db95
mov eax, dword [0x7c84f4]
mov eax, dword [eax]
call fcn.005a9f84
mov eax, dword [ebp - 0x270]
and eax, 0x10
cmp eax, 0x10
je 0x72db7b
inc dword [0x7d05d4]
lea eax, [ebp - 0x280]
call fcn.00424e68
test eax, eax
je 0x72db5b
lea eax, [ebp - 0x280]
call fcn.00424e8c
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x72dba1
sub eax, 4
mov eax, dword [eax]
test eax, eax
je 0x72dc1a
mov dl, 1
mov eax, dword [ebp - 0xc]
call fcn.00424aec
test al, al
je 0x72dc1a
lea eax, [ebp - 0x4e4]
mov ecx, 0x72df50
mov edx, dword [ebp - 0xc]
call fcn.0040a8a8
mov eax, dword [ebp - 0x4e4]
lea ecx, [ebp - 0x280]
mov edx, 0x1ff
call fcn.00424e18
test eax, eax
jne 0x72dc1a
mov eax, dword [0x7c84f4]
mov eax, dword [eax]
call fcn.005a9f84
mov eax, dword [ebp - 0x270]
and eax, 0x10
cmp eax, 0x10
je 0x72dc00
inc dword [0x7d05d4]
lea eax, [ebp - 0x280]
call fcn.00424e68
test eax, eax
je 0x72dbe0
lea eax, [ebp - 0x280]
call fcn.00424e8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x72dc5f
lea eax, [ebp - 0x4e4]
mov edx, 0x16
call fcn.00409b60
lea eax, [ebp - 0x280]
mov edx, dword [0x41c09c]
call fcn.0040b274
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00409b60
pop eax
jmp eax