Function at 0x48db60
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
xor eax, eax
push ebp
push 0x48de0e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.004061c0
cmp byte [ebp - 5], 0
je 0x48dbc0
mov ebx, 0x23
jmp 0x48dbc5
mov ebx, 0x1a
xor eax, eax
push ebp
push 0x48dc05
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push ebx
lea eax, [ebp - 0x216]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x216]
call fcn.0040636c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48dc13
cmp byte [ebp - 0xd], 0
je 0x48dc2b
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0046f3a4
test al, al
jne 0x48dde8
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.004061c0
xor eax, eax
push ebp
push 0x48dce1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x48d124]
call fcn.0048d260
mov ebx, eax
mov dword [ebx + 0x18], 1
cmp byte [ebp - 5], 0
je 0x48dc7d
mov edx, 0x80000002
mov eax, ebx
call fcn.0048d300
lea eax, [ebp - 4]
mov edx, 0x48de28
call fcn.00406214
jmp 0x48dc96
mov edx, 0x80000001
mov eax, ebx
call fcn.0048d300
lea eax, [ebp - 4]
mov edx, 0x48de54
call fcn.00406214
mov edx, 0x48de70
mov eax, ebx
call fcn.0048d85c
test al, al
je 0x48dcd0
mov edx, 0x48de70
xor ecx, ecx
mov eax, ebx
call fcn.0048d364
test al, al
je 0x48dcd0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0048d6d8
mov byte [ebp - 0xd], 1
mov eax, ebx
call fcn.0048d2d0
mov eax, ebx
call fcn.004041e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48dceb
cmp byte [ebp - 0xd], 0
je 0x48dd03
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0046f3a4
test al, al
jne 0x48dde8
mov eax, dword [0x529cb0]
cmp dword [eax], 5
jg 0x48dd71
cmp byte [ebp - 5], 0
je 0x48dd36
lea eax, [ebp - 0x21c]
call fcn.0048dad8
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0xc]
mov ecx, 0x48df00
call fcn.00406594
jmp 0x48ddd0
lea eax, [ebp - 0x220]
call fcn.0048dad8
push dword [ebp - 0x220]
push 0x48df74
lea eax, [ebp - 0x224]
call fcn.0048da94
push dword [ebp - 0x224]
push 0x48dfb4
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.00406664
jmp 0x48ddd0
cmp byte [ebp - 5], 0
je 0x48dd97
lea eax, [ebp - 0x228]
call fcn.0048dad8
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp - 0xc]
mov ecx, 0x48dfe4
call fcn.00406594
jmp 0x48ddd0
lea eax, [ebp - 0x22c]
call fcn.0048dad8
push dword [ebp - 0x22c]
push 0x48e00c
lea eax, [ebp - 0x230]
call fcn.0048da94
push dword [ebp - 0x230]
push 0x48e028
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.00406664
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0046f3a4
test al, al
jne 0x48dde8
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.004061c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48de15
lea eax, [ebp - 0x230]
mov edx, 6
call fcn.004061b8
lea eax, [ebp - 4]
call fcn.004061b0
ret