Function at 0x5298d4
Capabilities:
Get common file path
Get program files directory
Get session user name
Get startup folder
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x33
push 0
push 0
dec ecx
jne 0x5298dc
push ecx
push ebx
xor eax, eax
push ebp
push 0x52a39b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x12c]
xor eax, eax
call fcn.00402a8c
mov eax, dword [ebp - 0x12c]
lea edx, [ebp - 0x128]
call fcn.0040a0b8
mov edx, dword [ebp - 0x128]
mov eax, 0x567988
call fcn.004043e0
mov dword [ebp - 0x20], 0x103
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x20]
call fcn.004049e8
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x18]
call fcn.0040485c
push eax
call sub.advapi32.dll_GetUserNameA
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x20]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x18]
call fcn.004048bc
mov byte [0x567971], 1
push 0
mov ecx, 0x52a3b0
mov edx, 0x52a3cc
mov eax, 0x80000001
call fcn.005271ac
test al, al
je 0x52999c
mov edx, 0x52a3cc
mov ecx, 0x52a3b0
mov eax, 0x80000001
call fcn.00526d4c
test al, al
je 0x52999c
mov byte [0x567971], 0
jmp 0x5299b2
push 1
mov edx, 0x52a3cc
mov ecx, 0x52a3b0
mov eax, 0x80000001
call fcn.00526fc4
push 0x104
lea eax, [ebp - 0x124]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x130]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.0040460c
mov eax, dword [ebp - 0x130]
lea edx, [ebp - 8]
call fcn.0040a10c
mov eax, 0x567990
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.0040460c
lea edx, [ebp - 0x134]
mov eax, dword [0x567990]
call fcn.0040f990
mov edx, dword [ebp - 0x134]
mov eax, 0x567990
call fcn.004043e0
push 0x104
lea eax, [ebp - 0x124]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, 0x567994
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.0040460c
lea edx, [ebp - 0x138]
mov eax, dword [0x567994]
call fcn.0040f990
mov edx, dword [ebp - 0x138]
mov eax, 0x567994
call fcn.004043e0
lea eax, [ebp - 0x124]
push eax
push 0
push 0
push 0x26
push 0
call sub.SHFolder.dll_SHGetFolderPathA
mov eax, 0x567998
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.0040460c
lea edx, [ebp - 0x13c]
mov eax, dword [0x567998]
call fcn.0040f990
mov edx, dword [ebp - 0x13c]
mov eax, 0x567998
call fcn.004043e0
lea edx, [ebp - 0x140]
mov eax, dword [0x567998]
call fcn.00408f24
mov edx, dword [ebp - 0x140]
mov eax, 0x52a3ec
call fcn.004049a0
test eax, eax
jle 0x529ad8
mov byte [0x567954], 1
jmp 0x529adf
mov byte [0x567954], 0
lea eax, [ebp - 0x124]
push eax
push 0
push 0
push 0x1a
push 0
call sub.SHFolder.dll_SHGetFolderPathA
mov eax, 0x56799c
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.0040460c
lea edx, [ebp - 0x144]
mov eax, dword [0x56799c]
call fcn.0040f990
mov edx, dword [ebp - 0x144]
mov eax, 0x56799c
call fcn.004043e0
cmp dword [0x567950], 5
jne 0x529b4d
push dword [ebp - 8]
push 0x52a3fc
push dword [ebp - 4]
mov eax, 0x5679a0
mov edx, 3
call fcn.0040471c
jmp 0x529b67
push dword [ebp - 8]
push 0x52a420
push dword [ebp - 4]
mov eax, 0x5679a0
mov edx, 3
call fcn.0040471c
lea edx, [ebp - 0x148]
mov eax, dword [0x5679a0]
call fcn.0040f990
mov edx, dword [ebp - 0x148]
mov eax, 0x5679a0
call fcn.004043e0
lea eax, [ebp - 0x124]
push eax
push 0
push 0
push 0x1c
push 0
call sub.SHFolder.dll_SHGetFolderPathA
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.0040460c
mov eax, 0x5679e8
mov ecx, 0x52a430
mov edx, dword [ebp - 0xc]
call fcn.004046a8
mov eax, dword [0x5679e8]
call fcn.00409dc4
test al, al
jne 0x529bd8
mov eax, 0x5679e8
call fcn.0040438c
mov eax, 0x5679a8
mov ecx, 0x52a45c
mov edx, dword [0x56799c]
call fcn.004046a8
mov eax, 0x56798c
mov ecx, 0x52a480
mov edx, dword [0x56799c]
call fcn.004046a8
mov eax, dword [0x56798c]
call fcn.00409dc4
test al, al
jne 0x529c1a
mov eax, dword [0x56798c]
call fcn.0040a334
lea eax, [ebp - 0x124]
push eax
push 0
push 0
push 8
push 0
call sub.SHFolder.dll_SHGetFolderPathA
mov eax, 0x5679a4
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.0040460c
lea edx, [ebp - 0x14c]
mov eax, dword [0x5679a4]
call fcn.0040f990
mov edx, dword [ebp - 0x14c]
mov eax, 0x5679a4
call fcn.004043e0
lea eax, [ebp - 0x124]
push eax
push 0
push 0
push 0
push 0
call sub.SHFolder.dll_SHGetFolderPathA
mov eax, 0x5679b4
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.0040460c
lea edx, [ebp - 0x150]
mov eax, dword [0x5679b4]
call fcn.0040f990
mov edx, dword [ebp - 0x150]
mov eax, 0x5679b4
call fcn.004043e0
mov eax, 0x5679b8
mov ecx, 0x52a498
mov edx, dword [0x56799c]
call fcn.004046a8
lea eax, [ebp - 0x124]
push eax
push 0
push 0
push 2
push 0
call sub.SHFolder.dll_SHGetFolderPathA
mov eax, 0x5679bc
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.0040460c
lea edx, [ebp - 0x154]
mov eax, dword [0x5679bc]
call fcn.0040f990
mov edx, dword [ebp - 0x154]
mov eax, 0x5679bc
call fcn.004043e0
lea eax, [ebp - 0x124]
push eax
push 0
push 0
push 0x17
push 0
call sub.SHFolder.dll_SHGetFolderPathA
mov eax, 0x5679c0
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.0040460c
lea edx, [ebp - 0x158]
mov eax, dword [0x5679c0]
call fcn.0040f990
mov edx, dword [ebp - 0x158]
mov eax, 0x5679c0
call fcn.004043e0
lea eax, [ebp - 0x124]
push eax
push 0
push 0
push 7
push 0
call sub.SHFolder.dll_SHGetFolderPathA
mov eax, 0x567980
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.0040460c
mov eax, dword [0x567980]
call fcn.0040465c
test eax, eax
jne 0x529db7
push 0
lea eax, [ebp - 0x15c]
push eax
mov ecx, 0x52a4cc
mov edx, 0x52a4dc
mov eax, 0x80000001
call fcn.00526980
mov edx, dword [ebp - 0x15c]
mov eax, 0x567980
call fcn.004043e0
mov eax, dword [0x567980]
call fcn.0040465c
test eax, eax
jne 0x529df2
push 0
lea eax, [ebp - 0x160]
push eax
mov ecx, 0x52a528
mov edx, 0x52a4dc
mov eax, 0x80000001
call fcn.00526980
mov edx, dword [ebp - 0x160]
mov eax, 0x567980
call fcn.004043e0
lea eax, [ebp - 0x124]
push eax
push 0
push 0
push 0x18
push 0
call sub.SHFolder.dll_SHGetFolderPathA
mov eax, 0x567984
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.0040460c
mov eax, dword [0x567984]
call fcn.0040465c
test eax, eax
jne 0x529e56
push 0
lea eax, [ebp - 0x164]
push eax
mov ecx, 0x52a4cc
mov edx, 0x52a4dc
mov eax, 0x80000002
call fcn.00526980
mov edx, dword [ebp - 0x164]
mov eax, 0x567984
call fcn.004043e0
mov eax, dword [0x567984]
call fcn.0040465c
test eax, eax
jne 0x529e91
push 0
lea eax, [ebp - 0x168]
push eax
mov ecx, 0x52a53c
mov edx, 0x52a4dc
mov eax, 0x80000002
call fcn.00526980
mov edx, dword [ebp - 0x168]
mov eax, 0x567984
call fcn.004043e0
lea eax, [ebp - 0x124]
push eax
push 0
push 0
push 0x20
push 0
call sub.SHFolder.dll_SHGetFolderPathA
mov eax, 0x5679c4
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.0040460c
lea eax, [ebp - 0x124]
push eax
push 0
push 0
push 0x22
push 0
call sub.SHFolder.dll_SHGetFolderPathA
mov eax, 0x5679cc
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.0040460c
lea eax, [ebp - 0x124]
push eax
push 0
push 0
push 0x21
push 0
call sub.SHFolder.dll_SHGetFolderPathA
mov eax, 0x5679c8
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.0040460c
lea edx, [ebp - 0x16c]
mov eax, dword [0x5679c4]
call fcn.0040f990
mov edx, dword [ebp - 0x16c]
mov eax, 0x5679c4
call fcn.004043e0
mov edx, dword [0x5679c4]
mov eax, 0x52a554
call fcn.004049a0
test eax, eax
jne 0x529f4f
mov eax, 0x5679c4
mov edx, 0x52a564
call fcn.00404664
lea edx, [ebp - 0x170]
mov eax, dword [0x5679cc]
call fcn.0040f990
mov edx, dword [ebp - 0x170]
mov eax, 0x5679cc
call fcn.004043e0
lea edx, [ebp - 0x174]
mov eax, dword [0x5679c8]
call fcn.0040f990
mov edx, dword [ebp - 0x174]
mov eax, 0x5679c8
call fcn.004043e0
mov eax, 0x5679d0
mov ecx, 0x52a57c
mov edx, dword [0x56799c]
call fcn.004046a8
lea eax, [ebp - 0x178]
mov ecx, 0x52a598
mov edx, dword [0x5679d0]
call fcn.004046a8
mov ecx, dword [ebp - 0x178]
mov dl, 1
mov eax, dword [0x43a2e4]
call fcn.0043a394
mov dword [ebp - 0x1c], eax
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x52a5b0
mov edx, 0x52a5c0
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax]
call dword [ebx]
mov al, byte [0x52a5cc]
push eax
lea eax, [ebp - 0x17c]
push eax
mov ecx, 0x52a5d8
mov edx, 0x52a5e4
mov eax, dword [ebp - 0x18]
call fcn.00410510
mov edx, dword [ebp - 0x17c]
lea eax, [ebp - 0x18]
call fcn.00404424
mov eax, 0x5679d0
mov edx, dword [ebp - 0x18]
call fcn.00404664
mov eax, dword [ebp - 0x1c]
call fcn.0040353c
mov eax, 0x5679dc
mov ecx, 0x52a5f0
mov edx, dword [0x5679d0]
call fcn.004046a8
mov eax, 0x5679e0
mov ecx, 0x52a608
mov edx, dword [0x5679d0]
call fcn.004046a8
mov eax, 0x5679e4
mov ecx, 0x52a624
mov edx, dword [0x5679d0]
call fcn.004046a8
lea edx, [ebp - 0x180]
mov eax, dword [ebp - 0xc]
call fcn.0040f990
push dword [ebp - 0x180]
push 0x52a57c
push dword [ebp - 0x18]
push 0x52a640
mov eax, 0x5679d4
mov edx, 4
call fcn.0040471c
lea edx, [ebp - 0x184]
mov eax, dword [ebp - 0xc]
call fcn.0040f990
push dword [ebp - 0x184]
push 0x52a57c
push dword [ebp - 0x18]
push 0x52a650
mov eax, 0x5679d8
mov edx, 4
call fcn.0040471c
lea edx, [ebp - 0x188]
mov eax, dword [ebp - 0xc]
call fcn.0040f990
mov edx, dword [ebp - 0x188]
mov eax, 0x5679e8
mov ecx, 0x52a664
call fcn.004046a8
mov eax, 0x5679ec
mov ecx, 0x52a690
mov edx, dword [0x5679e8]
call fcn.004046a8
mov eax, 0x5679f0
mov ecx, 0x52a6a0
mov edx, dword [0x5679e8]
call fcn.004046a8
mov eax, 0x5679f4
mov ecx, 0x52a6b8
mov edx, dword [0x5679e8]
call fcn.004046a8
mov eax, 0x5679f8
mov ecx, 0x52a6c8
mov edx, dword [0x5679e8]
call fcn.004046a8
mov eax, 0x5679fc
mov ecx, 0x52a6e0
mov edx, dword [0x5679e8]
call fcn.004046a8
mov eax, 0x567a00
mov ecx, 0x52a6f8
mov edx, dword [0x5679e8]
call fcn.004046a8
mov eax, 0x567a04
mov ecx, 0x52a70c
mov edx, dword [0x5679e8]
call fcn.004046a8
mov eax, 0x567a08
mov ecx, 0x52a724
mov edx, dword [0x5679e8]
call fcn.004046a8
mov eax, 0x567a0c
mov ecx, 0x52a73c
mov edx, dword [0x5679a0]
call fcn.004046a8
mov eax, 0x567a10
mov ecx, 0x52a788
mov edx, dword [0x567a0c]
call fcn.004046a8
mov eax, 0x567a14
mov ecx, 0x52a7a8
mov edx, dword [0x567a0c]
call fcn.004046a8
mov eax, 0x567a18
mov ecx, 0x52a7cc
mov edx, dword [0x567a0c]
call fcn.004046a8
cmp dword [0x567950], 5
jne 0x52a203
mov eax, 0x5679ac
mov ecx, 0x52a7f0
mov edx, dword [ebp - 8]
call fcn.004046a8
jmp 0x52a215
mov eax, 0x5679ac
mov ecx, 0x52a804
mov edx, dword [ebp - 8]
call fcn.004046a8
lea edx, [ebp - 0x18c]
mov eax, 0x52a81c
call fcn.00410d4c
mov eax, dword [ebp - 0x18c]
lea edx, [ebp - 0x10]
call fcn.005290dc
lea edx, [ebp - 0x190]
mov eax, 0x52a828
call fcn.00410d4c
mov eax, dword [ebp - 0x190]
lea edx, [ebp - 0x14]
call fcn.005290dc
mov eax, dword [ebp - 0x10]
call fcn.0040465c
cmp eax, 3
jle 0x52a27c
mov eax, dword [ebp - 0x10]
call fcn.00409dc4
test al, al
je 0x52a27c
mov eax, 0x5679b0
mov edx, dword [ebp - 0x10]
call fcn.004043e0
jmp 0x52a370
mov eax, dword [ebp - 0x14]
call fcn.0040465c
cmp eax, 3
jle 0x52a2a7
mov eax, dword [ebp - 0x14]
call fcn.00409dc4
test al, al
je 0x52a2a7
mov eax, 0x5679b0
mov edx, dword [ebp - 0x14]
call fcn.004043e0
jmp 0x52a370
cmp dword [0x567950], 5
jne 0x52a2d0
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x52a5d8
call fcn.0040a034
mov ecx, eax
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.004048bc
lea edx, [ebp - 0x194]
mov eax, dword [ebp - 0xc]
call fcn.0040f990
mov edx, dword [ebp - 0x194]
lea eax, [ebp - 0xc]
call fcn.00404424
mov eax, dword [ebp - 0x10]
call fcn.0040465c
cmp eax, 3
jge 0x52a32f
lea eax, [ebp - 0x198]
mov ecx, 0x52a838
mov edx, dword [ebp - 0xc]
call fcn.004046a8
mov eax, dword [ebp - 0x198]
call fcn.00409dc4
test al, al
je 0x52a32f
mov eax, 0x5679b0
mov ecx, 0x52a838
mov edx, dword [ebp - 0xc]
call fcn.004046a8
jmp 0x52a370
mov eax, dword [ebp - 0x14]
call fcn.0040465c
cmp eax, 3
jge 0x52a370
lea eax, [ebp - 0x19c]
mov ecx, 0x52a848
mov edx, dword [ebp - 0xc]
call fcn.004046a8
mov eax, dword [ebp - 0x19c]
call fcn.00409dc4
test al, al
je 0x52a370
mov eax, 0x5679b0
mov ecx, 0x52a848
mov edx, dword [ebp - 0xc]
call fcn.004046a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52a3a2
lea eax, [ebp - 0x19c]
mov edx, 0x1e
call fcn.004043b0
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004043b0
ret