Function at 0x4db5a8
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
xor eax, eax
push ebp
push 0x4db856
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00405de0
cmp byte [ebp - 5], 0
je 0x4db608
mov ebx, 0x23
jmp 0x4db60d
mov ebx, 0x1a
xor eax, eax
push ebp
push 0x4db64d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push ebx
lea eax, [ebp - 0x216]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x216]
call fcn.00405f8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4db65b
cmp byte [ebp - 0xd], 0
je 0x4db673
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040cfa0
test al, al
jne 0x4db830
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00405de0
xor eax, eax
push ebp
push 0x4db729
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x442894]
call fcn.004429d0
mov ebx, eax
mov dword [ebx + 0x18], 1
cmp byte [ebp - 5], 0
je 0x4db6c5
mov edx, 0x80000002
mov eax, ebx
call fcn.00442a70
lea eax, [ebp - 4]
mov edx, 0x4db870
call fcn.00405e34
jmp 0x4db6de
mov edx, 0x80000001
mov eax, ebx
call fcn.00442a70
lea eax, [ebp - 4]
mov edx, 0x4db89c
call fcn.00405e34
mov edx, 0x4db8b8
mov eax, ebx
call fcn.004430f0
test al, al
je 0x4db718
mov edx, 0x4db8b8
xor ecx, ecx
mov eax, ebx
call fcn.00442bb0
test al, al
je 0x4db718
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00442f24
mov byte [ebp - 0xd], 1
mov eax, ebx
call fcn.00442a40
mov eax, ebx
call fcn.00403ddc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4db733
cmp byte [ebp - 0xd], 0
je 0x4db74b
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040cfa0
test al, al
jne 0x4db830
mov eax, dword [0x540968]
cmp dword [eax], 5
jg 0x4db7b9
cmp byte [ebp - 5], 0
je 0x4db77e
lea eax, [ebp - 0x21c]
call fcn.004db520
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0xc]
mov ecx, 0x4db948
call fcn.0040629c
jmp 0x4db818
lea eax, [ebp - 0x220]
call fcn.004db520
push dword [ebp - 0x220]
push 0x4db9bc
lea eax, [ebp - 0x224]
call fcn.004db4dc
push dword [ebp - 0x224]
push 0x4db9fc
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.00406380
jmp 0x4db818
cmp byte [ebp - 5], 0
je 0x4db7df
lea eax, [ebp - 0x228]
call fcn.004db520
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp - 0xc]
mov ecx, 0x4dba2c
call fcn.0040629c
jmp 0x4db818
lea eax, [ebp - 0x22c]
call fcn.004db520
push dword [ebp - 0x22c]
push 0x4dba54
lea eax, [ebp - 0x230]
call fcn.004db4dc
push dword [ebp - 0x230]
push 0x4dba70
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.00406380
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040cfa0
test al, al
jne 0x4db830
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00405de0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4db85d
lea eax, [ebp - 0x230]
mov edx, 6
call fcn.00405dd8
lea eax, [ebp - 4]
call fcn.00405dd0
ret