Function at 0x544ff4
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
xor eax, eax
push ebp
push 0x5452a2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.0040634c
cmp byte [ebp - 5], 0
je 0x545054
mov ebx, 0x23
jmp 0x545059
mov ebx, 0x1a
xor eax, eax
push ebp
push 0x545099
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push ebx
lea eax, [ebp - 0x216]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x216]
call fcn.004064f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5450a7
cmp byte [ebp - 0xd], 0
je 0x5450bf
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040d8e4
test al, al
jne 0x54527c
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.0040634c
xor eax, eax
push ebp
push 0x545175
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4396b8]
call fcn.00439974
mov ebx, eax
mov dword [ebx + 0x18], 1
cmp byte [ebp - 5], 0
je 0x545111
mov edx, 0x80000002
mov eax, ebx
call fcn.00439a14
lea eax, [ebp - 4]
mov edx, 0x5452bc
call fcn.004063a0
jmp 0x54512a
mov edx, 0x80000001
mov eax, ebx
call fcn.00439a14
lea eax, [ebp - 4]
mov edx, 0x5452e8
call fcn.004063a0
mov edx, 0x545304
mov eax, ebx
call fcn.0043a314
test al, al
je 0x545164
mov edx, 0x545304
xor ecx, ecx
mov eax, ebx
call fcn.00439a78
test al, al
je 0x545164
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00439e98
mov byte [ebp - 0xd], 1
mov eax, ebx
call fcn.004399e4
mov eax, ebx
call fcn.00403e80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x54517f
cmp byte [ebp - 0xd], 0
je 0x545197
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040d8e4
test al, al
jne 0x54527c
mov eax, dword [0x5d460c]
cmp dword [eax], 5
jg 0x545205
cmp byte [ebp - 5], 0
je 0x5451ca
lea eax, [ebp - 0x21c]
call fcn.00544f6c
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0xc]
mov ecx, 0x545394
call fcn.00406820
jmp 0x545264
lea eax, [ebp - 0x220]
call fcn.00544f6c
push dword [ebp - 0x220]
push 0x545408
lea eax, [ebp - 0x224]
call fcn.00544f28
push dword [ebp - 0x224]
push 0x545448
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.00406904
jmp 0x545264
cmp byte [ebp - 5], 0
je 0x54522b
lea eax, [ebp - 0x228]
call fcn.00544f6c
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp - 0xc]
mov ecx, 0x545478
call fcn.00406820
jmp 0x545264
lea eax, [ebp - 0x22c]
call fcn.00544f6c
push dword [ebp - 0x22c]
push 0x5454a0
lea eax, [ebp - 0x230]
call fcn.00544f28
push dword [ebp - 0x230]
push 0x5454bc
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.00406904
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040d8e4
test al, al
jne 0x54527c
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.0040634c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5452a9
lea eax, [ebp - 0x230]
mov edx, 6
call fcn.00406344
lea eax, [ebp - 4]
call fcn.0040633c
ret