Function at 0x59af5c
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
xor eax, eax
push ebp
push 0x59b20a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00406c64
cmp byte [ebp - 5], 0
je 0x59afbc
mov ebx, 0x23
jmp 0x59afc1
mov ebx, 0x1a
xor eax, eax
push ebp
push 0x59b001
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push ebx
lea eax, [ebp - 0x216]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x216]
call fcn.00406e10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x59b00f
cmp byte [ebp - 0xd], 0
je 0x59b027
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040e698
test al, al
jne 0x59b1e4
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00406c64
xor eax, eax
push ebp
push 0x59b0dd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x486fec]
call fcn.00487128
mov ebx, eax
mov dword [ebx + 0x18], 1
cmp byte [ebp - 5], 0
je 0x59b079
mov edx, 0x80000002
mov eax, ebx
call fcn.004871c8
lea eax, [ebp - 4]
mov edx, 0x59b224
call fcn.00406cb8
jmp 0x59b092
mov edx, 0x80000001
mov eax, ebx
call fcn.004871c8
lea eax, [ebp - 4]
mov edx, 0x59b250
call fcn.00406cb8
mov edx, 0x59b26c
mov eax, ebx
call fcn.0048789c
test al, al
je 0x59b0cc
mov edx, 0x59b26c
xor ecx, ecx
mov eax, ebx
call fcn.0048722c
test al, al
je 0x59b0cc
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004876d0
mov byte [ebp - 0xd], 1
mov eax, ebx
call fcn.00487198
mov eax, ebx
call fcn.0040461c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x59b0e7
cmp byte [ebp - 0xd], 0
je 0x59b0ff
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040e698
test al, al
jne 0x59b1e4
mov eax, dword [0x5d84f8]
cmp dword [eax], 5
jg 0x59b16d
cmp byte [ebp - 5], 0
je 0x59b132
lea eax, [ebp - 0x21c]
call fcn.0059aed4
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0xc]
mov ecx, 0x59b2fc
call fcn.00407078
jmp 0x59b1cc
lea eax, [ebp - 0x220]
call fcn.0059aed4
push dword [ebp - 0x220]
push 0x59b370
lea eax, [ebp - 0x224]
call fcn.0059ae90
push dword [ebp - 0x224]
push 0x59b3b0
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.0040715c
jmp 0x59b1cc
cmp byte [ebp - 5], 0
je 0x59b193
lea eax, [ebp - 0x228]
call fcn.0059aed4
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp - 0xc]
mov ecx, 0x59b3e0
call fcn.00407078
jmp 0x59b1cc
lea eax, [ebp - 0x22c]
call fcn.0059aed4
push dword [ebp - 0x22c]
push 0x59b408
lea eax, [ebp - 0x230]
call fcn.0059ae90
push dword [ebp - 0x230]
push 0x59b424
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.0040715c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040e698
test al, al
jne 0x59b1e4
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00406c64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59b211
lea eax, [ebp - 0x230]
mov edx, 6
call fcn.00406c5c
lea eax, [ebp - 4]
call fcn.00406c54
ret