Function at 0x4dc64c
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
xor eax, eax
push ebp
push 0x4dc8fa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.004062bc
cmp byte [ebp - 5], 0
je 0x4dc6ac
mov ebx, 0x23
jmp 0x4dc6b1
mov ebx, 0x1a
xor eax, eax
push ebp
push 0x4dc6f1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push ebx
lea eax, [ebp - 0x216]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x216]
call fcn.00406468
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4dc6ff
cmp byte [ebp - 0xd], 0
je 0x4dc717
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0046f374
test al, al
jne 0x4dc8d4
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.004062bc
xor eax, eax
push ebp
push 0x4dc7cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x491f54]
call fcn.00492210
mov ebx, eax
mov dword [ebx + 0x18], 1
cmp byte [ebp - 5], 0
je 0x4dc769
mov edx, 0x80000002
mov eax, ebx
call fcn.004922b0
lea eax, [ebp - 4]
mov edx, 0x4dc914
call fcn.00406310
jmp 0x4dc782
mov edx, 0x80000001
mov eax, ebx
call fcn.004922b0
lea eax, [ebp - 4]
mov edx, 0x4dc940
call fcn.00406310
mov edx, 0x4dc95c
mov eax, ebx
call fcn.00492ba8
test al, al
je 0x4dc7bc
mov edx, 0x4dc95c
xor ecx, ecx
mov eax, ebx
call fcn.00492314
test al, al
je 0x4dc7bc
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00492734
mov byte [ebp - 0xd], 1
mov eax, ebx
call fcn.00492280
mov eax, ebx
call fcn.00404224
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4dc7d7
cmp byte [ebp - 0xd], 0
je 0x4dc7ef
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0046f374
test al, al
jne 0x4dc8d4
mov eax, dword [0x550d78]
cmp dword [eax], 5
jg 0x4dc85d
cmp byte [ebp - 5], 0
je 0x4dc822
lea eax, [ebp - 0x21c]
call fcn.004dc5c4
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0xc]
mov ecx, 0x4dc9ec
call fcn.00406690
jmp 0x4dc8bc
lea eax, [ebp - 0x220]
call fcn.004dc5c4
push dword [ebp - 0x220]
push 0x4dca60
lea eax, [ebp - 0x224]
call fcn.004dc580
push dword [ebp - 0x224]
push 0x4dcaa0
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.00406760
jmp 0x4dc8bc
cmp byte [ebp - 5], 0
je 0x4dc883
lea eax, [ebp - 0x228]
call fcn.004dc5c4
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp - 0xc]
mov ecx, 0x4dcad0
call fcn.00406690
jmp 0x4dc8bc
lea eax, [ebp - 0x22c]
call fcn.004dc5c4
push dword [ebp - 0x22c]
push 0x4dcaf8
lea eax, [ebp - 0x230]
call fcn.004dc580
push dword [ebp - 0x230]
push 0x4dcb14
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.00406760
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0046f374
test al, al
jne 0x4dc8d4
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.004062bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dc901
lea eax, [ebp - 0x230]
mov edx, 6
call fcn.004062b4
lea eax, [ebp - 4]
call fcn.004062ac
ret