Function at 0x57f024
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 0x230], ecx
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x57f2d2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00406edc
cmp byte [ebp - 5], 0
je 0x57f084
mov ebx, 0x23
jmp 0x57f089
mov ebx, 0x1a
xor eax, eax
push ebp
push 0x57f0c9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push ebx
lea eax, [ebp - 0x216]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x216]
call fcn.00407088
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x57f0d7
cmp byte [ebp - 0xd], 0
je 0x57f0ef
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.004717dc
test al, al
jne 0x57f2ac
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00406edc
xor eax, eax
push ebp
push 0x57f1a5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x49f730]
call fcn.0049f9ec
mov ebx, eax
mov dword [ebx + 0x18], 1
cmp byte [ebp - 5], 0
je 0x57f141
mov edx, 0x80000002
mov eax, ebx
call fcn.0049fa8c
lea eax, [ebp - 4]
mov edx, 0x57f2ec
call fcn.00406f30
jmp 0x57f15a
mov edx, 0x80000001
mov eax, ebx
call fcn.0049fa8c
lea eax, [ebp - 4]
mov edx, 0x57f318
call fcn.00406f30
mov edx, 0x57f334
mov eax, ebx
call fcn.004a0610
test al, al
je 0x57f194
mov edx, 0x57f334
xor ecx, ecx
mov eax, ebx
call fcn.0049faf4
test al, al
je 0x57f194
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004a019c
mov byte [ebp - 0xd], 1
mov eax, ebx
call fcn.0049fa5c
mov eax, ebx
call fcn.004047c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x57f1af
cmp byte [ebp - 0xd], 0
je 0x57f1c7
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.004717dc
test al, al
jne 0x57f2ac
mov eax, dword [0x67ce18]
cmp dword [eax], 5
jg 0x57f235
cmp byte [ebp - 5], 0
je 0x57f1fa
lea eax, [ebp - 0x21c]
call fcn.0057ef9c
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0xc]
mov ecx, 0x57f3c4
call fcn.004072b0
jmp 0x57f294
lea eax, [ebp - 0x220]
call fcn.0057ef9c
push dword [ebp - 0x220]
push 0x57f438
lea eax, [ebp - 0x224]
call fcn.0057ef58
push dword [ebp - 0x224]
push 0x57f478
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.00407380
jmp 0x57f294
cmp byte [ebp - 5], 0
je 0x57f25b
lea eax, [ebp - 0x228]
call fcn.0057ef9c
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp - 0xc]
mov ecx, 0x57f4a8
call fcn.004072b0
jmp 0x57f294
lea eax, [ebp - 0x22c]
call fcn.0057ef9c
push dword [ebp - 0x22c]
push 0x57f4d0
lea eax, [ebp - 0x230]
call fcn.0057ef58
push dword [ebp - 0x230]
push 0x57f4ec
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.00407380
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.004717dc
test al, al
jne 0x57f2ac
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00406edc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57f2d9
lea eax, [ebp - 0x230]
mov edx, 6
call fcn.00406ed4
lea eax, [ebp - 4]
call fcn.00406ecc
ret