Function at 0x513164
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
xor eax, eax
push ebp
push 0x513412
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00406ba8
cmp byte [ebp - 5], 0
je 0x5131c4
mov ebx, 0x23
jmp 0x5131c9
mov ebx, 0x1a
xor eax, eax
push ebp
push 0x513209
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push ebx
lea eax, [ebp - 0x216]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x216]
call fcn.00406d64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x513217
cmp byte [ebp - 0xd], 0
je 0x51322f
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00471a8c
test al, al
jne 0x5133ec
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00406ba8
xor eax, eax
push ebp
push 0x5132e5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4a1e7c]
call fcn.004a2138
mov ebx, eax
mov dword [ebx + 0x18], 1
cmp byte [ebp - 5], 0
je 0x513281
mov edx, 0x80000002
mov eax, ebx
call fcn.004a21d8
lea eax, [ebp - 4]
mov edx, 0x51342c
call fcn.00406bfc
jmp 0x51329a
mov edx, 0x80000001
mov eax, ebx
call fcn.004a21d8
lea eax, [ebp - 4]
mov edx, 0x513458
call fcn.00406bfc
mov edx, 0x513474
mov eax, ebx
call fcn.004a2cdc
test al, al
je 0x5132d4
mov edx, 0x513474
xor ecx, ecx
mov eax, ebx
call fcn.004a2240
test al, al
je 0x5132d4
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004a2840
mov byte [ebp - 0xd], 1
mov eax, ebx
call fcn.004a21a8
mov eax, ebx
call fcn.00404490
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5132ef
cmp byte [ebp - 0xd], 0
je 0x513307
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00471a8c
test al, al
jne 0x5133ec
mov eax, dword [0x6999e0]
cmp dword [eax], 5
jg 0x513375
cmp byte [ebp - 5], 0
je 0x51333a
lea eax, [ebp - 0x21c]
call fcn.005130dc
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0xc]
mov ecx, 0x513504
call fcn.00406f8c
jmp 0x5133d4
lea eax, [ebp - 0x220]
call fcn.005130dc
push dword [ebp - 0x220]
push 0x513578
lea eax, [ebp - 0x224]
call fcn.00513098
push dword [ebp - 0x224]
push 0x5135b8
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.0040705c
jmp 0x5133d4
cmp byte [ebp - 5], 0
je 0x51339b
lea eax, [ebp - 0x228]
call fcn.005130dc
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp - 0xc]
mov ecx, 0x5135e8
call fcn.00406f8c
jmp 0x5133d4
lea eax, [ebp - 0x22c]
call fcn.005130dc
push dword [ebp - 0x22c]
push 0x513610
lea eax, [ebp - 0x230]
call fcn.00513098
push dword [ebp - 0x230]
push 0x51362c
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.0040705c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00471a8c
test al, al
jne 0x5133ec
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00406ba8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x513419
lea eax, [ebp - 0x230]
mov edx, 6
call fcn.00406ba0
lea eax, [ebp - 4]
call fcn.00406b98
ret