Function at 0x4dbd94
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
xor eax, eax
push ebp
push 0x4dc042
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00405d6c
cmp byte [ebp - 5], 0
je 0x4dbdf4
mov ebx, 0x23
jmp 0x4dbdf9
mov ebx, 0x1a
xor eax, eax
push ebp
push 0x4dbe39
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push ebx
lea eax, [ebp - 0x216]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x216]
call fcn.00405f28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4dbe47
cmp byte [ebp - 0xd], 0
je 0x4dbe5f
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040d690
test al, al
jne 0x4dc01c
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00405d6c
xor eax, eax
push ebp
push 0x4dbf15
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4368f4]
call fcn.00436a30
mov ebx, eax
mov dword [ebx + 0x18], 1
cmp byte [ebp - 5], 0
je 0x4dbeb1
mov edx, 0x80000002
mov eax, ebx
call fcn.00436ad0
lea eax, [ebp - 4]
mov edx, 0x4dc05c
call fcn.00405dc0
jmp 0x4dbeca
mov edx, 0x80000001
mov eax, ebx
call fcn.00436ad0
lea eax, [ebp - 4]
mov edx, 0x4dc088
call fcn.00405dc0
mov edx, 0x4dc0a4
mov eax, ebx
call fcn.004371a4
test al, al
je 0x4dbf04
mov edx, 0x4dc0a4
xor ecx, ecx
mov eax, ebx
call fcn.00436b34
test al, al
je 0x4dbf04
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00436fd8
mov byte [ebp - 0xd], 1
mov eax, ebx
call fcn.00436aa0
mov eax, ebx
call fcn.00403d24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4dbf1f
cmp byte [ebp - 0xd], 0
je 0x4dbf37
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040d690
test al, al
jne 0x4dc01c
mov eax, dword [0x55e2dc]
cmp dword [eax], 5
jg 0x4dbfa5
cmp byte [ebp - 5], 0
je 0x4dbf6a
lea eax, [ebp - 0x21c]
call fcn.004dbd0c
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0xc]
mov ecx, 0x4dc134
call fcn.00406250
jmp 0x4dc004
lea eax, [ebp - 0x220]
call fcn.004dbd0c
push dword [ebp - 0x220]
push 0x4dc1a8
lea eax, [ebp - 0x224]
call fcn.004dbcc8
push dword [ebp - 0x224]
push 0x4dc1e8
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.00406334
jmp 0x4dc004
cmp byte [ebp - 5], 0
je 0x4dbfcb
lea eax, [ebp - 0x228]
call fcn.004dbd0c
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp - 0xc]
mov ecx, 0x4dc218
call fcn.00406250
jmp 0x4dc004
lea eax, [ebp - 0x22c]
call fcn.004dbd0c
push dword [ebp - 0x22c]
push 0x4dc240
lea eax, [ebp - 0x230]
call fcn.004dbcc8
push dword [ebp - 0x230]
push 0x4dc25c
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.00406334
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040d690
test al, al
jne 0x4dc01c
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00405d6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dc049
lea eax, [ebp - 0x230]
mov edx, 6
call fcn.00405d64
lea eax, [ebp - 4]
call fcn.00405d5c
ret