Function at 0x522300
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
xor eax, eax
push ebp
push 0x5225ae
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00406a08
cmp byte [ebp - 5], 0
je 0x522360
mov ebx, 0x23
jmp 0x522365
mov ebx, 0x1a
xor eax, eax
push ebp
push 0x5223a5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push ebx
lea eax, [ebp - 0x216]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x216]
call fcn.00406bb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5223b3
cmp byte [ebp - 0xd], 0
je 0x5223cb
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0047141c
test al, al
jne 0x522588
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00406a08
xor eax, eax
push ebp
push 0x522481
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x49a69c]
call fcn.0049a7d8
mov ebx, eax
mov dword [ebx + 0x18], 1
cmp byte [ebp - 5], 0
je 0x52241d
mov edx, 0x80000002
mov eax, ebx
call fcn.0049a878
lea eax, [ebp - 4]
mov edx, 0x5225c8
call fcn.00406a5c
jmp 0x522436
mov edx, 0x80000001
mov eax, ebx
call fcn.0049a878
lea eax, [ebp - 4]
mov edx, 0x5225f4
call fcn.00406a5c
mov edx, 0x522610
mov eax, ebx
call fcn.0049addc
test al, al
je 0x522470
mov edx, 0x522610
xor ecx, ecx
mov eax, ebx
call fcn.0049a8dc
test al, al
je 0x522470
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0049ac50
mov byte [ebp - 0xd], 1
mov eax, ebx
call fcn.0049a848
mov eax, ebx
call fcn.0040437c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52248b
cmp byte [ebp - 0xd], 0
je 0x5224a3
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0047141c
test al, al
jne 0x522588
mov eax, dword [0x612c10]
cmp dword [eax], 5
jg 0x522511
cmp byte [ebp - 5], 0
je 0x5224d6
lea eax, [ebp - 0x21c]
call fcn.00522278
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0xc]
mov ecx, 0x5226a0
call fcn.00406edc
jmp 0x522570
lea eax, [ebp - 0x220]
call fcn.00522278
push dword [ebp - 0x220]
push 0x522714
lea eax, [ebp - 0x224]
call fcn.00522234
push dword [ebp - 0x224]
push 0x522754
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.00406fc0
jmp 0x522570
cmp byte [ebp - 5], 0
je 0x522537
lea eax, [ebp - 0x228]
call fcn.00522278
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp - 0xc]
mov ecx, 0x522784
call fcn.00406edc
jmp 0x522570
lea eax, [ebp - 0x22c]
call fcn.00522278
push dword [ebp - 0x22c]
push 0x5227ac
lea eax, [ebp - 0x230]
call fcn.00522234
push dword [ebp - 0x230]
push 0x5227c8
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.00406fc0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0047141c
test al, al
jne 0x522588
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00406a08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5225b5
lea eax, [ebp - 0x230]
mov edx, 6
call fcn.00406a00
lea eax, [ebp - 4]
call fcn.004069f8
ret