Function at 0x57d070
Capabilities:
Check os version
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x728
mov eax, dword [0x64e0a0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x728], eax
mov eax, dword [0x60e86c]
mov dword [ebp - 0x20c], eax
mov eax, dword [0x60e870]
mov dword [ebp - 0x208], eax
mov eax, dword [0x60e874]
push ebx
mov dword [ebp - 0x204], eax
mov eax, dword [0x60e878]
push esi
push edi
mov dword [ebp - 0x200], eax
mov eax, dword [0x60e87c]
push 0x1ec
mov dword [ebp - 0x1fc], eax
lea eax, [ebp - 0x1f8]
push 0
push eax
mov dword [ebp - 0x724], ecx
mov dword [ebp - 0x720], 0
call fcn.00546fa0
add esp, 0xc
xor ebx, ebx
call fcn.0057d420
mov esi, eax
test esi, esi
je 0x57d13c
push esi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x57d131
push ebx
push ebx
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
test eax, eax
je 0x57d131
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
lea esp, [esp]
test esi, esi
je 0x57d13c
push 0x32
call edi
call fcn.0057d420
mov esi, eax
jmp 0x57d120
mov ecx, dword [0x65be2c]
jmp 0x57d3f2
lea eax, [ebp - 0x324]
push eax
mov dword [ebp - 0x324], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x320], 6
lea eax, [ebp - 0x20c]
jb 0x57d169
push str.Computer_
jmp 0x57d16e
push str.My_Computer_
push 0x100
push eax
call fcn.00543349
mov edi, dword [ebp - 0x724]
add esp, 0xc
xor esi, esi
add edi, 0xb4
lea ebx, [ebx]
test ebx, ebx
jne 0x57d2aa
push dword [edi]
mov eax, dword [ebp - 0x728]
push dword [eax + 4]
call fcn.005433a5
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x57d1b5
inc esi
add edi, 8
cmp esi, 5
jl 0x57d190
mov edi, dword [ebp - 0x724]
test ebx, ebx
je 0x57d3ec
mov ecx, dword [edi + esi*8 + 0xb4]
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x57d1d2
sub ecx, esi
sar ecx, 1
mov edx, 0x100
lea eax, [ebx + ecx*2]
push eax
lea ecx, [ebp - 0x20c]
call fcn.005c1c80
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
add esp, 4
lea eax, [ebp - 0x720]
push eax
push 0x60e8b0
push closesocket
call esi
test eax, eax
je 0x57d22c
lea eax, [ebp - 0x720]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionAppletsRegedit
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov edx, dword [ebp - 0x720]
test edx, edx
jne 0x57d257
lea eax, [ebp - 0x720]
push eax
push 0x60e9a8
push closesocket
call esi
test eax, eax
jne 0x57d3ec
mov edx, dword [ebp - 0x720]
lea ecx, [ebp - 0x20c]
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x57d260
sub ecx, esi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push 0
push str.LastKey
push edx
call dword [0x649140]
test eax, eax
je 0x57d2d8
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp - 0x720]
call dword [0x649028]
jmp 0x57d3ec
cmp esi, 5
jge 0x57d1ba
mov edi, dword [ebp - 0x724]
mov edx, 0x100
push dword [edi + esi*8 + 0xb8]
lea ecx, [ebp - 0x20c]
call fcn.005c1c80
add esp, 4
jmp 0x57d1c0
push dword [ebp - 0x720]
call dword [0x649028]
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 1
push 0
push 0
push 0x60ea2c
push 0x60e924
push 0
call esi
cmp eax, 0x20
jae 0x57d405
push 0x104
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [ebp - 0x61c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x57d322
sub ecx, edx
sar ecx, 1
lea eax, [ebp - 0x61c]
cmp ecx, 0x104
jae 0x57d356
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.00543349
add esp, 0xc
jmp 0x57d379
push 0x103
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.00543d6d
add esp, 0x10
xor eax, eax
mov word [ebp - 0x20e], ax
push 0x60e9a4
mov edx, 0x104
lea ecx, [ebp - 0x414]
call fcn.005c1c80
add esp, 4
mov edx, 0x104
push 0x60ea44
lea ecx, [ebp - 0x414]
call fcn.005c1c80
add esp, 4
lea eax, [ebp - 0x61c]
push 1
push eax
push 0
push str.regedit.exe
push str.open
push 0
call esi
push 0
push 0
push 0x100
mov esi, eax
lea eax, [ebp - 0x71c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x414]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp esi, 0x20
ja 0x57d405
mov ecx, dword [0x65be28]
sub esp, 8
xor dl, dl
push dword [0x65be50]
call fcn.00593d10
add esp, 0xc
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00541b41
mov esp, ebp
pop ebp
ret 4