Function at 0x524c84
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x80
push 0
push 0
dec ecx
jne 0x524c8c
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0xec], eax
lea eax, [ebp - 0xe8]
mov edx, dword [0x40b508]
call fcn.00406b84
xor eax, eax
push ebp
push 0x5258da
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x433df0]
call fcn.00433fa4
mov ebx, eax
mov edx, 0x80000001
mov eax, ebx
call fcn.00434080
xor ecx, ecx
mov edx, 0x5258f4
mov eax, ebx
call fcn.004340e8
test al, al
je 0x524d5e
lea ecx, [ebp - 0x32c]
mov edx, 0x525984
mov eax, ebx
call fcn.00434814
mov edx, dword [ebp - 0x32c]
lea eax, [ebp - 0x14]
mov ecx, 0x5259a0
call fcn.004064cc
lea ecx, [ebp - 0x330]
mov edx, 0x5259b0
mov eax, ebx
call fcn.00434814
mov edx, dword [ebp - 0x330]
lea eax, [ebp - 0x18]
mov ecx, 0x5259a0
call fcn.004064cc
lea ecx, [ebp - 0x334]
mov edx, 0x5259d4
mov eax, ebx
call fcn.00434814
mov edx, dword [ebp - 0x334]
lea eax, [ebp - 0x1c]
mov ecx, 0x5259a0
call fcn.004064cc
mov eax, ebx
call fcn.00434050
mov eax, ebx
call fcn.00404228
lea eax, [ebp - 0x338]
call fcn.004f3918
mov edx, dword [ebp - 0x338]
lea eax, [ebp - 8]
mov ecx, 0x5259a0
call fcn.004064cc
push 0xff
lea eax, [ebp - 0x328]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
lea edx, [ebp - 0x33c]
lea eax, [ebp - 0x328]
call fcn.0040d6ac
mov edx, dword [ebp - 0x33c]
lea eax, [ebp - 4]
mov ecx, 0x5259a0
call fcn.004064cc
lea eax, [ebp - 0xd4]
mov edx, 0x5259f0
call fcn.0040617c
mov word [ebp - 0xe0], 0x2f
mov word [ebp - 0xde], 0x3a
lea eax, [ebp - 8]
call fcn.004f3918
push 0xff
lea eax, [ebp - 0x328]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
lea edx, [ebp - 4]
lea eax, [ebp - 0x328]
call fcn.0040d6ac
mov eax, dword [ebp - 0xec]
mov eax, dword [eax + 0x40]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x52557f
inc eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0xec]
mov eax, dword [eax + 0x40]
mov edx, dword [ebp - 0xf0]
call fcn.0042353c
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0xf4]
cmp dword [eax + 0x34], 0
jne 0x524f2f
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.0040617c
mov eax, dword [ebp - 0xf4]
cmp dword [eax + 0xc], 0
je 0x524ee0
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0xf4]
mov edx, dword [edx + 0xc]
call fcn.0040617c
jmp 0x524ecd
lea eax, [ebp - 0x340]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x5259a0
call fcn.00406abc
mov ecx, eax
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.0040674c
mov edx, dword [ebp - 0x340]
mov eax, dword [ebp - 0xf4]
add eax, 0x34
call fcn.0040644c
mov edx, dword [ebp - 0xc]
mov eax, 0x5259a0
call fcn.00406abc
mov ecx, eax
lea eax, [ebp - 0xc]
mov edx, 1
call fcn.0040681c
mov edx, dword [ebp - 0xc]
mov eax, 0x5259a0
call fcn.00406abc
test eax, eax
jg 0x524e7a
jmp 0x524f08
lea edx, [ebp - 0x344]
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax + 0x28]
call fcn.0051fd00
mov edx, dword [ebp - 0x344]
mov eax, dword [ebp - 0xf4]
add eax, 0x34
call fcn.00406128
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax + 0x34]
test eax, eax
je 0x524f1a
sub eax, 4
mov eax, dword [eax]
cmp eax, 4
jge 0x524f2f
mov eax, dword [ebp - 0xf4]
add eax, 0x34
xor edx, edx
call fcn.00406128
mov eax, dword [ebp - 0xf4]
cmp dword [eax + 0x10], 0
jne 0x525022
lea edx, [ebp - 0x348]
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax + 0x28]
call fcn.0040bcd8
mov eax, dword [ebp - 0x348]
push eax
lea edx, [ebp - 0x34c]
mov eax, 0x525a14
call fcn.0040bcd8
mov eax, dword [ebp - 0x34c]
pop edx
call fcn.00406abc
test eax, eax
jle 0x525022
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x350]
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax + 0x28]
call fcn.0040bcd8
mov eax, dword [ebp - 0x350]
push eax
lea edx, [ebp - 0x354]
mov eax, 0x525a14
call fcn.0040bcd8
mov eax, dword [ebp - 0x354]
pop edx
call fcn.00406abc
mov ecx, eax
add ecx, 3
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax + 0x28]
mov edx, 1
call fcn.0040674c
mov edx, dword [ebp - 0x10]
mov eax, 0x525a2c
call fcn.00406abc
test eax, eax
jle 0x524ff4
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.0040681c
mov eax, dword [ebp - 0x10]
call fcn.0040cd44
test al, al
je 0x525022
lea edx, [ebp - 0x358]
mov eax, dword [ebp - 0x10]
call fcn.00522a10
mov edx, dword [ebp - 0x358]
mov eax, dword [ebp - 0xf4]
add eax, 0x10
call fcn.00406128
mov eax, dword [ebp - 0xf4]
cmp dword [eax + 0x34], 0
jne 0x525079
mov eax, dword [ebp - 0xf4]
cmp dword [eax + 0x38], 0
je 0x525079
mov eax, dword [ebp - 0xf4]
add eax, 0x34
mov edx, dword [ebp - 0xf4]
mov edx, dword [edx + 0x38]
call fcn.00406128
lea edx, [ebp - 0x35c]
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax + 0x34]
call fcn.0051fb5c
mov edx, dword [ebp - 0x35c]
mov eax, dword [ebp - 0xf4]
add eax, 0x34
call fcn.00406128
xor ebx, ebx
lea edx, [ebp - 0x360]
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax + 0x34]
call fcn.0040bcd8
mov eax, dword [ebp - 0x360]
push eax
lea edx, [ebp - 0x364]
mov eax, dword [ebp - 0x20]
call fcn.0040bcd8
mov edx, dword [ebp - 0x364]
pop eax
call fcn.00406744
jne 0x5250b9
mov bl, 1
jmp 0x525202
lea edx, [ebp - 0x368]
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax + 0x34]
call fcn.0040bcd8
mov eax, dword [ebp - 0x368]
push eax
lea edx, [ebp - 0x36c]
mov eax, dword [ebp - 8]
call fcn.0040bcd8
mov edx, dword [ebp - 0x36c]
pop eax
call fcn.00406744
jne 0x5250f7
mov bl, 1
jmp 0x525202
lea edx, [ebp - 0x370]
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax + 0x34]
call fcn.0040bcd8
mov eax, dword [ebp - 0x370]
push eax
lea edx, [ebp - 0x374]
mov eax, dword [ebp - 4]
call fcn.0040bcd8
mov edx, dword [ebp - 0x374]
pop eax
call fcn.00406744
jne 0x525135
mov bl, 1
jmp 0x525202
lea edx, [ebp - 0x378]
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax + 0x34]
call fcn.0040bcd8
mov eax, dword [ebp - 0x378]
push eax
lea edx, [ebp - 0x37c]
mov eax, dword [ebp - 0x14]
call fcn.0040bcd8
mov edx, dword [ebp - 0x37c]
pop eax
call fcn.00406744
jne 0x525173
mov bl, 1
jmp 0x525202
lea edx, [ebp - 0x380]
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax + 0x34]
call fcn.0040bcd8
mov eax, dword [ebp - 0x380]
push eax
lea edx, [ebp - 0x384]
mov eax, dword [ebp - 0x18]
call fcn.0040bcd8
mov edx, dword [ebp - 0x384]
pop eax
call fcn.00406744
jne 0x5251ae
mov bl, 1
jmp 0x525202
lea edx, [ebp - 0x388]
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax + 0x34]
call fcn.0040bcd8
mov eax, dword [ebp - 0x388]
push eax
lea edx, [ebp - 0x38c]
mov eax, dword [ebp - 0x1c]
call fcn.0040bcd8
mov edx, dword [ebp - 0x38c]
pop eax
call fcn.00406744
jne 0x5251e9
mov bl, 1
jmp 0x525202
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax + 0x34]
test eax, eax
je 0x5251fb
sub eax, 4
mov eax, dword [eax]
cmp eax, 3
jne 0x525202
mov bl, 1
test bl, bl
je 0x525216
mov eax, dword [ebp - 0xf4]
add eax, 0x34
xor edx, edx
call fcn.00406128
xor edx, edx
push ebp
push 0x525563
push dword fs:[edx]
mov dword fs:[edx], esp
xor eax, eax
push ebp
push 0x5252b6
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x390]
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax + 0x34]
call fcn.0040c358
cmp dword [ebp - 0x390], 0
je 0x5252ac
lea eax, [ebp - 0x128]
push eax
push 0
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax + 0x34]
call fcn.004061b4
push eax
call sub.kernel32.dll_GetFileAttributesExW
test eax, eax
je 0x5252ac
lea eax, [ebp - 0x124]
call fcn.005228ac
add esp, 0xfffffff8
fstp qword [esp]
wait
lea ecx, [ebp - 0x394]
lea edx, [ebp - 0xe8]
mov eax, 0x5259f0
call fcn.00410e88
mov edx, dword [ebp - 0x394]
mov eax, dword [ebp - 0xf4]
add eax, 0x1c
call fcn.00406128
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5252c0
mov eax, dword [ebp - 0xf4]
mov byte [eax + 0x49], 0
mov eax, dword [ebp - 0xec]
mov eax, dword [eax + 0x44]
mov eax, dword [eax + 8]
test eax, eax
jle 0x52546e
mov esi, eax
dec esi
test esi, esi
jl 0x52546e
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0xec]
mov eax, dword [eax + 0x44]
mov edx, ebx
call fcn.0042353c
mov edi, eax
lea edx, [ebp - 0x398]
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
call fcn.0040bcd8
mov eax, dword [ebp - 0x398]
push eax
lea edx, [ebp - 0x39c]
mov eax, dword [edi]
call fcn.0040bcd8
mov eax, dword [ebp - 0x39c]
pop edx
call fcn.00406abc
test eax, eax
jg 0x525394
lea edx, [ebp - 0x3a4]
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax + 0x34]
call fcn.0040d268
mov eax, dword [ebp - 0x3a4]
lea edx, [ebp - 0x3a0]
call fcn.0040bcd8
mov eax, dword [ebp - 0x3a0]
push eax
lea edx, [ebp - 0x3ac]
mov eax, dword [edi + 4]
call fcn.0040d268
mov eax, dword [ebp - 0x3ac]
lea edx, [ebp - 0x3a8]
call fcn.0040bcd8
mov eax, dword [ebp - 0x3a8]
pop edx
call fcn.00406abc
test eax, eax
jle 0x525466
lea edx, [ebp - 0x3b0]
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
call fcn.0040bcd8
mov eax, dword [ebp - 0x3b0]
push eax
lea edx, [ebp - 0x3b4]
mov eax, dword [edi]
call fcn.0040bcd8
mov eax, dword [ebp - 0x3b4]
pop edx
call fcn.00406abc
test eax, eax
jg 0x52543a
lea edx, [ebp - 0x3b8]
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
call fcn.0040bcd8
mov eax, dword [ebp - 0x3b8]
push eax
lea edx, [ebp - 0x3bc]
mov eax, 0x525a3c
call fcn.0040bcd8
mov eax, dword [ebp - 0x3bc]
pop edx
call fcn.00406abc
test eax, eax
jg 0x52543a
lea edx, [ebp - 0x3c0]
mov eax, dword [edi + 4]
call fcn.0040bcd8
mov eax, dword [ebp - 0x3c0]
push eax
lea edx, [ebp - 0x3c4]
mov eax, 0x525a3c
call fcn.0040bcd8
mov eax, dword [ebp - 0x3c4]
pop edx
call fcn.00406abc
test eax, eax
jle 0x525466
mov eax, dword [ebp - 0xf4]
mov byte [eax + 0x49], 1
mov eax, dword [ebp - 0xf4]
add eax, 0x2c
mov edx, dword [edi + 0xc]
call fcn.00406128
inc dword [edi + 0x10]
mov byte [edi + 0x14], 0
mov eax, dword [ebp - 0xf4]
mov byte [eax + 0x4a], 0
inc ebx
dec esi
jne 0x5252ec
mov eax, dword [ebp - 0xf4]
cmp dword [eax + 0x45], 0
jne 0x525482
cmp dword [eax + 0x41], 0
jbe 0x5254d8
jmp 0x525484
jle 0x5254d8
push 0
push 0x400
mov eax, dword [ebp - 0xf4]
mov edx, dword [eax + 0x45]
mov eax, dword [eax + 0x41]
call fcn.00407220
mov ecx, dword [ebp - 0xf4]
mov dword [ecx + 0x41], eax
mov dword [ecx + 0x45], edx
mov eax, dword [ebp - 0xf4]
push dword [eax + 0x45]
push dword [eax + 0x41]
lea eax, [ebp - 0x3c8]
call fcn.004f2a04
mov edx, dword [ebp - 0x3c8]
mov eax, dword [ebp - 0xf4]
add eax, 0x20
call fcn.00406128
jmp 0x525559
mov eax, dword [ebp - 0xf4]
cmp dword [eax + 0x34], 0
je 0x525559
mov eax, dword [ebp - 0xf4]
mov edx, dword [eax + 0x34]
mov eax, dword [ebp - 0xec]
call fcn.00525aec
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xfc], edx
mov eax, dword [ebp - 0xf4]
mov edx, dword [ebp - 0x100]
mov dword [eax + 0x41], edx
mov edx, dword [ebp - 0xfc]
mov dword [eax + 0x45], edx
cmp dword [ebp - 0xfc], 0
jne 0x52552c
cmp dword [ebp - 0x100], 0
je 0x525559
push dword [ebp - 0xfc]
push dword [ebp - 0x100]
lea eax, [ebp - 0x3cc]
call fcn.004f2a04
mov edx, dword [ebp - 0x3cc]
mov eax, dword [ebp - 0xf4]
add eax, 0x20
call fcn.00406128
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52556d
inc dword [ebp - 0xf0]
dec dword [ebp - 0x104]
jne 0x524e27
mov eax, dword [ebp - 0xec]
mov eax, dword [eax + 0x44]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x52589e
inc eax
mov dword [ebp - 0x104], eax
xor esi, esi
mov eax, dword [ebp - 0xec]
mov eax, dword [eax + 0x44]
mov edx, esi
call fcn.0042353c
mov edi, eax
cmp byte [edi + 0x14], 0
je 0x525891
mov edx, dword [0x51d1bc]
mov eax, 0x4b
call fcn.00407144
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0xf4]
mov edx, dword [edi]
call fcn.00406128
xor ebx, ebx
lea edx, [ebp - 0x3d0]
mov eax, dword [edi + 4]
call fcn.0040bcd8
mov eax, dword [ebp - 0x3d0]
push eax
lea edx, [ebp - 0x3d4]
mov eax, dword [ebp - 0x20]
call fcn.0040bcd8
mov edx, dword [ebp - 0x3d4]
pop eax
call fcn.00406744
jne 0x525616
mov bl, 1
jmp 0x525738
lea edx, [ebp - 0x3d8]
mov eax, dword [edi + 4]
call fcn.0040bcd8
mov eax, dword [ebp - 0x3d8]
push eax
lea edx, [ebp - 0x3dc]
mov eax, dword [ebp - 8]
call fcn.0040bcd8
mov edx, dword [ebp - 0x3dc]
pop eax
call fcn.00406744
jne 0x52564e
mov bl, 1
jmp 0x525738
lea edx, [ebp - 0x3e0]
mov eax, dword [edi + 4]
call fcn.0040bcd8
mov eax, dword [ebp - 0x3e0]
push eax
lea edx, [ebp - 0x3e4]
mov eax, dword [ebp - 4]
call fcn.0040bcd8
mov edx, dword [ebp - 0x3e4]
pop eax
call fcn.00406744
jne 0x525686
mov bl, 1
jmp 0x525738
lea edx, [ebp - 0x3e8]
mov eax, dword [edi + 4]
call fcn.0040bcd8
mov eax, dword [ebp - 0x3e8]
push eax
lea edx, [ebp - 0x3ec]
mov eax, dword [ebp - 0x14]
call fcn.0040bcd8
mov edx, dword [ebp - 0x3ec]
pop eax
call fcn.00406744
jne 0x5256bb
mov bl, 1
jmp 0x525738
lea edx, [ebp - 0x3f0]
mov eax, dword [edi + 4]
call fcn.0040bcd8
mov eax, dword [ebp - 0x3f0]
push eax
lea edx, [ebp - 0x3f4]
mov eax, dword [ebp - 0x18]
call fcn.0040bcd8
mov edx, dword [ebp - 0x3f4]
pop eax
call fcn.00406744
jne 0x5256f0
mov bl, 1
jmp 0x525738
lea edx, [ebp - 0x3f8]
mov eax, dword [edi + 4]
call fcn.0040bcd8
mov eax, dword [ebp - 0x3f8]
push eax
lea edx, [ebp - 0x3fc]
mov eax, dword [ebp - 0x1c]
call fcn.0040bcd8
mov edx, dword [ebp - 0x3fc]
pop eax
call fcn.00406744
jne 0x525725
mov bl, 1
jmp 0x525738
mov eax, dword [edi + 4]
test eax, eax
je 0x525731
sub eax, 4
mov eax, dword [eax]
cmp eax, 3
jne 0x525738
mov bl, 1
test bl, bl
jne 0x52574f
mov eax, dword [ebp - 0xf4]
add eax, 0x34
mov edx, dword [edi + 4]
call fcn.00406128
jmp 0x525760
mov eax, dword [ebp - 0xf4]
add eax, 0x34
mov edx, dword [edi + 8]
call fcn.00406128
mov eax, dword [ebp - 0xf4]
add eax, 0x2c
mov edx, dword [edi + 0xc]
call fcn.00406128
mov eax, dword [ebp - 0xf4]
cmp dword [eax + 0x34], 0
je 0x525853
lea eax, [ebp - 0x128]
push eax
push 0
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax + 0x34]
call fcn.004061b4
push eax
call sub.kernel32.dll_GetFileAttributesExW
test eax, eax
je 0x5257de
lea eax, [ebp - 0x124]
call fcn.005228ac
add esp, 0xfffffff8
fstp qword [esp]
wait
lea ecx, [ebp - 0x400]
lea edx, [ebp - 0xe8]
mov eax, 0x5259f0
call fcn.00410e88
mov edx, dword [ebp - 0x400]
mov eax, dword [ebp - 0xf4]
add eax, 0x1c
call fcn.00406128
mov eax, dword [ebp - 0xf4]
mov edx, dword [eax + 0x34]
mov eax, dword [ebp - 0xec]
call fcn.00525aec
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xfc], edx
mov eax, dword [ebp - 0xf4]
mov edx, dword [ebp - 0x100]
mov dword [eax + 0x41], edx
mov edx, dword [ebp - 0xfc]
mov dword [eax + 0x45], edx
cmp dword [ebp - 0xfc], 0
jne 0x525826
cmp dword [ebp - 0x100], 0
je 0x525853
push dword [ebp - 0xfc]
push dword [ebp - 0x100]
lea eax, [ebp - 0x404]
call fcn.004f2a04
mov edx, dword [ebp - 0x404]
mov eax, dword [ebp - 0xf4]
add eax, 0x20
call fcn.00406128
mov eax, dword [ebp - 0xf4]
mov byte [eax + 0x49], 1
mov eax, dword [ebp - 0xf4]
mov byte [eax + 0x4a], 1
mov eax, dword [ebp - 0xec]
mov eax, dword [eax + 0x40]
mov edx, dword [ebp - 0xf4]
call fcn.00423394
mov eax, dword [ebp - 0xec]
mov eax, dword [eax + 0x40]
mov eax, dword [eax + 8]
dec eax
mov edx, dword [ebp - 0xf4]
mov dword [edx + 0x3d], eax
inc esi
dec dword [ebp - 0x104]
jne 0x52559d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5258e1
lea eax, [ebp - 0x404]
mov edx, 0x37
call fcn.00406120
lea eax, [ebp - 0xe8]
mov edx, dword [0x40b508]
call fcn.00406c5c
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00406120
ret