Function at 0x512d58
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
xor eax, eax
push ebp
push 0x513006
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00406ba8
cmp byte [ebp - 5], 0
je 0x512db8
mov ebx, 0x23
jmp 0x512dbd
mov ebx, 0x1a
xor eax, eax
push ebp
push 0x512dfd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push ebx
lea eax, [ebp - 0x216]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x216]
call fcn.00406d64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x512e0b
cmp byte [ebp - 0xd], 0
je 0x512e23
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00471a74
test al, al
jne 0x512fe0
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00406ba8
xor eax, eax
push ebp
push 0x512ed9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4a1a70]
call fcn.004a1d2c
mov ebx, eax
mov dword [ebx + 0x18], 1
cmp byte [ebp - 5], 0
je 0x512e75
mov edx, 0x80000002
mov eax, ebx
call fcn.004a1dcc
lea eax, [ebp - 4]
mov edx, 0x513020
call fcn.00406bfc
jmp 0x512e8e
mov edx, 0x80000001
mov eax, ebx
call fcn.004a1dcc
lea eax, [ebp - 4]
mov edx, 0x51304c
call fcn.00406bfc
mov edx, 0x513068
mov eax, ebx
call fcn.004a28d0
test al, al
je 0x512ec8
mov edx, 0x513068
xor ecx, ecx
mov eax, ebx
call fcn.004a1e34
test al, al
je 0x512ec8
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004a2434
mov byte [ebp - 0xd], 1
mov eax, ebx
call fcn.004a1d9c
mov eax, ebx
call fcn.00404490
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x512ee3
cmp byte [ebp - 0xd], 0
je 0x512efb
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00471a74
test al, al
jne 0x512fe0
mov eax, dword [0x6939b0]
cmp dword [eax], 5
jg 0x512f69
cmp byte [ebp - 5], 0
je 0x512f2e
lea eax, [ebp - 0x21c]
call fcn.00512cd0
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0xc]
mov ecx, 0x5130f8
call fcn.00406f8c
jmp 0x512fc8
lea eax, [ebp - 0x220]
call fcn.00512cd0
push dword [ebp - 0x220]
push 0x51316c
lea eax, [ebp - 0x224]
call fcn.00512c8c
push dword [ebp - 0x224]
push 0x5131ac
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.0040705c
jmp 0x512fc8
cmp byte [ebp - 5], 0
je 0x512f8f
lea eax, [ebp - 0x228]
call fcn.00512cd0
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp - 0xc]
mov ecx, 0x5131dc
call fcn.00406f8c
jmp 0x512fc8
lea eax, [ebp - 0x22c]
call fcn.00512cd0
push dword [ebp - 0x22c]
push 0x513204
lea eax, [ebp - 0x230]
call fcn.00512c8c
push dword [ebp - 0x230]
push 0x513220
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.0040705c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00471a74
test al, al
jne 0x512fe0
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00406ba8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51300d
lea eax, [ebp - 0x230]
mov edx, 6
call fcn.00406ba0
lea eax, [ebp - 4]
call fcn.00406b98
ret