Function at 0x406d70
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43ee67
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
mov eax, dword [0x4804ec]
push esi
push edi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x14], eax
mov esi, dword [ebp + 0xc]
mov edi, 1
cmp esi, 0x23
mov dword [ebp - 4], edi
jne 0x406e48
push str.Common_AppData_Path
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x20], edi
call fcn.00436ae0
mov ecx, dword [0x4804ec]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push edx
push 0x452b74
push reloc.OLEAUT32.dll_SysReAllocString
push eax
mov byte [ebp - 4], 2
call fcn.00411bc0
mov ecx, dword [ebp - 0x10]
add esp, 0x10
mov eax, dword [ecx - 8]
test eax, eax
jne 0x406e15
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push edx
push 0x452b94
push SysReAllocString
push eax
call fcn.00411bc0
add esp, 0x10
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx - 8]
test eax, eax
je 0x406e3c
mov esi, dword [ebp + 8]
lea edx, [ebp - 0x10]
push edx
mov ecx, esi
call fcn.00436750
mov dword [ebp - 0x1c], edi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
jmp 0x4070d7
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.004368f0
mov eax, dword [0x4804ec]
mov dword [ebp + 0xc], eax
mov byte [ebp - 4], 3
call fcn.00413350
test eax, eax
je 0x406f34
xor eax, eax
cmp esi, 0x2e
ja case.0x406e74.17
xor ecx, ecx
mov cl, byte [esi + 0x407144]
jmp dword [ecx*4 + 0x4070fc]
mov eax, 0x442e78
jmp case.0x406e74.17
mov eax, 0x442e68
jmp case.0x406e74.17
mov eax, 0x442e38
jmp case.0x406e74.17
mov eax, 0x442e58
jmp case.0x406e74.17
mov eax, 0x442e28
jmp case.0x406e74.17
mov eax, 0x442e18
jmp case.0x406e74.17
mov eax, 0x442e08
jmp case.0x406e74.17
mov eax, 0x442df8
jmp case.0x406e74.17
mov eax, 0x442de8
jmp case.0x406e74.17
mov eax, 0x442dd8
jmp case.0x406e74.17
mov eax, 0x442dc8
jmp case.0x406e74.17
mov eax, 0x442db8
jmp case.0x406e74.17
mov eax, 0x442e48
jmp case.0x406e74.17
mov eax, 0x442da8
jmp case.0x406e74.17
mov eax, 0x442d98
jmp case.0x406e74.17
mov eax, 0x442d88
jmp case.0x406e74.17
mov eax, 0x442d78
mov edx, dword [0x4804ec]
mov dword [ebp - 0x10], edx
test eax, eax
mov byte [ebp - 4], 4
je 0x406f28
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.00407180
add esp, 8
test eax, eax
je 0x406f28
mov edx, dword [ebp - 0x10]
mov eax, dword [edx - 8]
test eax, eax
je 0x406f28
lea eax, [ebp - 0x10]
lea ecx, [ebp + 0xc]
push eax
call fcn.00436a80
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.004368f0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x406fcb
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push ecx
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov dl, byte [0x483ef4]
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x123]
mov byte [ebp - 0x124], dl
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x10]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x124]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push edx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x406fb4
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x406fb4
mov edx, dword [ebp - 0x10]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea edx, [ebp - 0x124]
lea ecx, [ebp + 0xc]
push edx
call fcn.00436ae0
mov eax, dword [ebp + 0xc]
mov edi, 1
cmp esi, 0x1a
jne 0x406ff0
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x407071
push str.AppData
push 0x452bbc
lea eax, [ebp + 0xc]
push SysReAllocString
push eax
jmp 0x407069
cmp esi, 0x23
jne 0x407008
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x407071
push str.Common_AppData
push 0x452c10
jmp 0x407060
cmp esi, 0x17
jne 0x407029
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x407071
push str.Common_Programs
push 0x452c64
lea edx, [ebp + 0xc]
push reloc.OLEAUT32.dll_SysReAllocString
push edx
jmp 0x407069
cmp esi, 2
jne 0x40704a
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x407071
push str.Programs
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea eax, [ebp + 0xc]
push SysReAllocString
push eax
jmp 0x407069
cmp esi, 0x26
jne 0x407071
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x407071
push str.ProgramFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
lea ecx, [ebp + 0xc]
push reloc.OLEAUT32.dll_SysReAllocString
push ecx
call fcn.00411bc0
add esp, 0x10
lea edx, [ebp + 0xc]
push edx
call fcn.004067a0
mov eax, dword [ebp - 0x20]
add esp, 4
test eax, eax
je 0x4070bf
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x4070bf
mov ecx, dword [ebp - 0x14]
lea edx, [ebp + 0xc]
push ecx
push 0x452d34
push reloc.OLEAUT32.dll_SysReAllocString
push edx
call fcn.00411930
mov eax, dword [ebp - 0x14]
lea ecx, [ebp + 0xc]
push eax
push 0x452d54
push SysReAllocString
push ecx
call fcn.00411930
add esp, 0x20
mov esi, dword [ebp + 8]
lea edx, [ebp + 0xc]
push edx
mov ecx, esi
call fcn.00436750
mov dword [ebp - 0x1c], edi
mov byte [ebp - 4], 1
lea ecx, [ebp + 0xc]
call fcn.004368f0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.004368f0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret