Function at 0x4dbf98
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
xor eax, eax
push ebp
push 0x4dc246
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00405ec8
cmp byte [ebp - 5], 0
je 0x4dbff8
mov ebx, 0x23
jmp 0x4dbffd
mov ebx, 0x1a
xor eax, eax
push ebp
push 0x4dc03d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push ebx
lea eax, [ebp - 0x216]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x216]
call fcn.00406074
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4dc04b
cmp byte [ebp - 0xd], 0
je 0x4dc063
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040d5e0
test al, al
jne 0x4dc220
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00405ec8
xor eax, eax
push ebp
push 0x4dc119
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x435d90]
call fcn.00435ecc
mov ebx, eax
mov dword [ebx + 0x18], 1
cmp byte [ebp - 5], 0
je 0x4dc0b5
mov edx, 0x80000002
mov eax, ebx
call fcn.00435f6c
lea eax, [ebp - 4]
mov edx, 0x4dc260
call fcn.00405f1c
jmp 0x4dc0ce
mov edx, 0x80000001
mov eax, ebx
call fcn.00435f6c
lea eax, [ebp - 4]
mov edx, 0x4dc28c
call fcn.00405f1c
mov edx, 0x4dc2a8
mov eax, ebx
call fcn.004364d0
test al, al
je 0x4dc108
mov edx, 0x4dc2a8
xor ecx, ecx
mov eax, ebx
call fcn.00435fd0
test al, al
je 0x4dc108
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00436344
mov byte [ebp - 0xd], 1
mov eax, ebx
call fcn.00435f3c
mov eax, ebx
call fcn.00403dcc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4dc123
cmp byte [ebp - 0xd], 0
je 0x4dc13b
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040d5e0
test al, al
jne 0x4dc220
mov eax, dword [0x54632c]
cmp dword [eax], 5
jg 0x4dc1a9
cmp byte [ebp - 5], 0
je 0x4dc16e
lea eax, [ebp - 0x21c]
call fcn.004dbf10
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0xc]
mov ecx, 0x4dc338
call fcn.0040639c
jmp 0x4dc208
lea eax, [ebp - 0x220]
call fcn.004dbf10
push dword [ebp - 0x220]
push 0x4dc3ac
lea eax, [ebp - 0x224]
call fcn.004dbecc
push dword [ebp - 0x224]
push 0x4dc3ec
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.00406480
jmp 0x4dc208
cmp byte [ebp - 5], 0
je 0x4dc1cf
lea eax, [ebp - 0x228]
call fcn.004dbf10
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp - 0xc]
mov ecx, 0x4dc41c
call fcn.0040639c
jmp 0x4dc208
lea eax, [ebp - 0x22c]
call fcn.004dbf10
push dword [ebp - 0x22c]
push 0x4dc444
lea eax, [ebp - 0x230]
call fcn.004dbecc
push dword [ebp - 0x230]
push 0x4dc460
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.00406480
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040d5e0
test al, al
jne 0x4dc220
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00405ec8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dc24d
lea eax, [ebp - 0x230]
mov edx, 6
call fcn.00405ec0
lea eax, [ebp - 4]
call fcn.00405eb8
ret