Function at 0x59ac30
Capabilities:
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ff43c
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov dword [ebp - 0xa4], ebx
mov edi, ecx
mov dword [ebp - 0x18], edi
test ebx, ebx
je 0x59b400
mov eax, dword [ebx + 8]
mov dword [ebx + 8], 0
test eax, eax
jne 0x59b400
call fcn.005d8790
movsd xmm1, qword [0x6edab8]
comisd xmm1, xmm0
movsd qword [ebp - 0x34], xmm0
jbe 0x59aca4
mov esi, 0x30
jmp 0x59acbd
movsd xmm1, qword [0x6edac8]
mov esi, 0x1c0
comisd xmm1, xmm0
mov eax, 0x7e
cmova esi, eax
lea edx, [ebp - 0x7c]
mov ecx, 0x628668
call fcn.005d1960
test al, al
je 0x59b400
push 0xffffffffffffffff
push dword [ebp + 8]
mov edx, esi
mov ecx, ebx
push esi
call fcn.005d2bc0
mov esi, eax
mov dword [ebp - 0x88], esi
xor bl, bl
mov dword [ebp - 4], 0
test esi, esi
je 0x59b035
xorps xmm0, xmm0
mov byte [ebp - 0x89], bl
lea ecx, [ebp - 0x40]
movq qword [ebp - 0x40], xmm0
mov dword [ebp - 0x38], 0
call fcn.005dc5e0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
movsd xmm0, qword [ebp - 0x34]
comisd xmm0, xmmword [0x6edab8]
jb 0x59b392
push 0
push 0
push 0x400
call fcn.005db9a0
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.QUM_new_pic.bmp
lea ecx, [ebp - 0x40]
call fcn.005da780
lea ecx, [ebp - 0x40]
call fcn.005dc190
mov edx, 2
mov ecx, eax
call fcn.005e4c40
lea ecx, [ebp - 0x40]
call fcn.005dc190
push 0
lea ecx, [ebp - 0x7c]
push ecx
push eax
push dword [esi + 4]
call dword [sym.imp.gdiplus.dll_GdipSaveImageToFile]
test eax, eax
je 0x59ada6
mov dword [esi + 8], eax
jmp 0x59b025
xorps xmm0, xmm0
xor edi, edi
movlpd qword [ebp - 0x84], xmm0
push 0x62786c
mov dword [ebp - 0x80], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
mov dword [ebp - 0x84], ebx
test ebx, ebx
je 0x59adde
push 0x106
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
mov dword [ebp - 0x80], edi
mov byte [ebp - 4], 2
test ebx, ebx
je 0x59ae03
test edi, edi
je 0x59ae03
lea ecx, [ebp - 0x40]
call fcn.005dc190
push eax
push 0
push dword [ebp - 0x18]
call edi
test eax, eax
sete byte [ebp - 0x89]
movsd xmm0, qword [ebp - 0x34]
comisd xmm0, xmmword [0x6edac8]
jb 0x59b014
lea edx, [ebp - 0x7c]
mov ecx, str..jpg
call fcn.005d1960
test al, al
je 0x59b014
movsd xmm0, qword [ebp - 0x34]
xor eax, eax
comisd xmm0, xmmword [0x6edaf8]
mov edi, 4
mov ecx, 0xffffffff
xorps xmm0, xmm0
movlpd qword [ebp - 0x48], xmm0
seta al
lea eax, [eax*2 + 5]
mov dword [ebp - 0xa0], eax
mul edi
cmovb eax, ecx
push eax
call fcn.0041e7cf
mov dword [ebp - 0x48], eax
add esp, 4
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x44], eax
mul edi
xorps xmm0, xmm0
mov ecx, 0xffffffff
mov byte [ebp - 4], 3
movlpd qword [ebp - 0x34], xmm0
cmovb eax, ecx
push eax
call fcn.0041e7cf
mov ecx, dword [ebp - 0xa0]
mov edi, eax
add esp, 4
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x48]
mov dword [eax], 0x1c0
mov dword [eax + 4], 0xf0
mov dword [eax + 0xc], 0x60
mov dword [edi], str.Image448
mov dword [edi + 4], str.Image240
mov dword [edi + 0xc], str.Image96
cmp ecx, 5
jne 0x59aef1
mov dword [eax + 8], 0xc8
mov dword [eax + 0x10], 0x28
mov dword [edi + 8], str.Image200
mov dword [edi + 0x10], str.Image40
jmp 0x59af29
mov dword [eax + 8], 0xc0
mov dword [eax + 0x10], 0x30
mov dword [eax + 0x14], 0x28
mov dword [eax + 0x18], 0x20
mov dword [edi + 8], str.Image192
mov dword [edi + 0x10], str.Image48
mov dword [edi + 0x14], str.Image40
mov dword [edi + 0x18], str.Image32
xorps xmm0, xmm0
mov dword [ebp - 0x64], 0
lea ecx, [ebp - 0x6c]
movq qword [ebp - 0x6c], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x24]
movq qword [ebp - 0x24], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x4c], 0
lea ecx, [ebp - 0x54]
movq qword [ebp - 0x54], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x58], 0
lea ecx, [ebp - 0x60]
movq qword [ebp - 0x60], xmm0
call fcn.005dc5e0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.AccountPictures_
push 0
push 1
push str._Public_
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 8
call fcn.005dc260
mov ecx, eax
call fcn.005dbc20
mov ecx, eax
call fcn.005da780
push 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x54]
push 0x200
call fcn.005db9a0
mov ecx, eax
call fcn.0059c620
test al, al
jne 0x59b03c
lea ecx, [ebp - 0x60]
call fcn.005dc430
lea ecx, [ebp - 0x54]
call fcn.005dc430
lea ecx, [ebp - 0x24]
call fcn.005dc430
lea ecx, [ebp - 0x6c]
call fcn.005dc430
push edi
call fcn.0041e1c3
add esp, 4
push dword [ebp - 0x48]
call fcn.0041e1c3
add esp, 4
test ebx, ebx
je 0x59b01f
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov bl, byte [ebp - 0x89]
lea ecx, [ebp - 0x40]
call fcn.005dc430
mov edx, dword [esi]
mov ecx, esi
push 1
call dword [edx]
mov al, bl
jmp 0x59b402
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x54]
call fcn.005dc190
push eax
push str.HKLM64SOFTWAREMicrosoftWindowsCurrentVersionAccountPictureUsers_
lea ecx, [ebp - 0x6c]
call fcn.005dc200
mov ecx, 0x62edb8
call fcn.005cc080
mov edi, eax
mov dword [ebp - 0x94], edi
mov ecx, edi
mov dword [ebp - 0x28], edi
mov ebx, edi
mov dword [ebp - 0xa8], edi
mov edx, edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x9c], edi
mov dword [ebp - 0x90], edi
mov dword [ebp - 0x98], edi
test edi, edi
jne 0x59b0d1
or edi, 0xffffffff
or eax, edi
mov dword [ebp - 0x94], edi
or ecx, edi
mov dword [ebp - 0x9c], eax
or eax, edi
mov dword [ebp - 0x28], edi
or ebx, edi
mov dword [ebp - 0xa8], ecx
mov dword [ebp - 0x18], edi
or edx, edi
mov dword [ebp - 0x90], edi
mov dword [ebp - 0x98], edi
mov byte [ebp - 4], 9
cmp ecx, 0xffffffff
je 0x59b0e3
cmp dword [ebp - 0x18], 0
jne 0x59b13e
cmp ecx, 0xffffffff
cmove eax, dword [ebp - 0x98]
mov ecx, str.Wininit.exe
mov dword [ebp - 0x98], eax
call fcn.005cc080
cmp dword [ebp - 0xa8], 0xffffffff
mov ebx, eax
mov eax, dword [ebp - 0x9c]
cmove eax, dword [ebp - 0x90]
cmp eax, 0xffffffff
je 0x59b125
cmp dword [ebp - 0x98], 0
je 0x59b125
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, ebx
mov edx, ebx
mov dword [ebp - 0x94], edi
mov dword [ebp - 0x28], edi
test ebx, ebx
jne 0x59b13e
or edi, 0xffffffff
mov dword [ebp - 0x28], edi
jmp 0x59b147
cmp ebx, 0xffffffff
je 0x59b147
test edx, edx
jne 0x59b178
mov ecx, str.Services.exe
call fcn.005cc080
mov ebx, eax
cmp edi, 0xffffffff
je 0x59b163
test edi, edi
je 0x59b163
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
mov edi, ebx
mov eax, 0xffffffff
cmove edi, eax
mov dword [ebp - 0x94], edi
mov dword [ebp - 0x28], edi
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x18], 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x18]
call fcn.005d6a80
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0xa
call fcn.005dc190
push eax
lea ecx, [ebp - 0x60]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x24]
call fcn.005dc200
lea ecx, [ebp - 0x24]
call fcn.005dc190
or ecx, 0xffffffff
mov edx, ecx
mov ecx, eax
call fcn.005e0f30
mov edx, dword [ebp - 0x48]
xor eax, eax
mov ebx, dword [ebp - 0x34]
sub edx, ebx
mov edi, dword [ebp - 0xa4]
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x9c], edx
test eax, eax
je 0x59b22a
mov edx, dword [ebx + edx]
mov ecx, edi
push 0xffffffffffffffff
push dword [ebp + 8]
push edx
call fcn.005d2bc0
mov dword [ebp - 0xa4], eax
test esi, esi
je 0x59b222
mov edx, dword [esi]
mov ecx, esi
push 1
call dword [edx]
mov eax, dword [ebp - 0xa4]
mov esi, eax
mov dword [ebp - 0x88], esi
lea eax, [ebp - 0x24]
push eax
push dword [ebx]
lea ecx, [ebp - 0x18]
call fcn.005d6740
test al, al
je 0x59b25e
lea ecx, [ebp - 0x24]
call fcn.005dbeb0
test al, al
jne 0x59b25e
push 0
push 1
push 0xffffffffffffffff
push 0
push str..jpg
call fcn.005daa70
test eax, eax
jne 0x59b2c3
push ecx
lea ecx, [ebp - 0x24]
call fcn.005d9af0
mov ecx, eax
call fcn.005da010
push 0
push 0
push 0
push 0
push 0
push str..jpg
push dword [ebx]
lea ecx, [ebp - 0x24]
push 0x627968
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x54]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x60]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x24]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x24]
call fcn.005dc190
push eax
push 1
push dword [ebx]
lea ecx, [ebp - 0x18]
call fcn.005d5f20
lea ecx, [ebp - 0x24]
call fcn.005dc190
mov edx, 2
mov ecx, eax
call fcn.005e4c40
lea ecx, [ebp - 0x24]
call fcn.005dc190
push 0
lea ecx, [ebp - 0x7c]
push ecx
push eax
push dword [esi + 4]
call dword [sym.imp.gdiplus.dll_GdipSaveImageToFile]
test eax, eax
je 0x59b2f6
mov dword [esi + 8], eax
push 6
lea ecx, [ebp - 0x24]
call fcn.005dc190
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [ebp - 0x90]
add ebx, 4
mov edx, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x90], eax
cmp eax, dword [ebp - 0xa0]
jb 0x59b1f6
mov edi, dword [ebp - 0x94]
test edi, edi
je 0x59b339
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
lea ecx, [ebp - 0x18]
call fcn.005d69e0
cmp edi, 0xffffffff
je 0x59b351
test edi, edi
je 0x59b351
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x60]
call fcn.005dc430
lea ecx, [ebp - 0x54]
call fcn.005dc430
lea ecx, [ebp - 0x24]
call fcn.005dc430
lea ecx, [ebp - 0x6c]
call fcn.005dc430
push dword [ebp - 0x34]
call fcn.0041e1c3
add esp, 4
push dword [ebp - 0x48]
call fcn.0041e1c3
mov ebx, dword [ebp - 0x84]
add esp, 4
jmp 0x59b014
call fcn.0059ceb0
test al, al
je 0x59b025
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x628668
push edi
lea ecx, [ebp - 0x40]
call fcn.005da780
lea ecx, [ebp - 0x40]
call fcn.005dc190
mov edx, 2
mov ecx, eax
call fcn.005e4c40
test eax, eax
je 0x59b3f9
push ecx
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x40]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.004018d0
test eax, eax
jne 0x59b3f9
mov bl, 1
jmp 0x59b025
xor bl, bl
jmp 0x59b025
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 4