Function at 0x53b71c
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
xor eax, eax
push ebp
push 0x53b9ca
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.004069b0
cmp byte [ebp - 5], 0
je 0x53b77c
mov ebx, 0x23
jmp 0x53b781
mov ebx, 0x1a
xor eax, eax
push ebp
push 0x53b7c1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push ebx
lea eax, [ebp - 0x216]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x216]
call fcn.00406b5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x53b7cf
cmp byte [ebp - 0xd], 0
je 0x53b7e7
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00470fa0
test al, al
jne 0x53b9a4
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.004069b0
xor eax, eax
push ebp
push 0x53b89d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4976d4]
call fcn.00497810
mov ebx, eax
mov dword [ebx + 0x18], 1
cmp byte [ebp - 5], 0
je 0x53b839
mov edx, 0x80000002
mov eax, ebx
call fcn.004978b0
lea eax, [ebp - 4]
mov edx, 0x53b9e4
call fcn.00406a04
jmp 0x53b852
mov edx, 0x80000001
mov eax, ebx
call fcn.004978b0
lea eax, [ebp - 4]
mov edx, 0x53ba10
call fcn.00406a04
mov edx, 0x53ba2c
mov eax, ebx
call fcn.00497e44
test al, al
je 0x53b88c
mov edx, 0x53ba2c
xor ecx, ecx
mov eax, ebx
call fcn.00497914
test al, al
je 0x53b88c
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00497c88
mov byte [ebp - 0xd], 1
mov eax, ebx
call fcn.00497880
mov eax, ebx
call fcn.00404358
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x53b8a7
cmp byte [ebp - 0xd], 0
je 0x53b8bf
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00470fa0
test al, al
jne 0x53b9a4
mov eax, dword [0x62f3a0]
cmp dword [eax], 5
jg 0x53b92d
cmp byte [ebp - 5], 0
je 0x53b8f2
lea eax, [ebp - 0x21c]
call fcn.0053b694
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0xc]
mov ecx, 0x53babc
call fcn.00406e84
jmp 0x53b98c
lea eax, [ebp - 0x220]
call fcn.0053b694
push dword [ebp - 0x220]
push 0x53bb30
lea eax, [ebp - 0x224]
call fcn.0053b650
push dword [ebp - 0x224]
push 0x53bb70
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.00406f68
jmp 0x53b98c
cmp byte [ebp - 5], 0
je 0x53b953
lea eax, [ebp - 0x228]
call fcn.0053b694
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp - 0xc]
mov ecx, 0x53bba0
call fcn.00406e84
jmp 0x53b98c
lea eax, [ebp - 0x22c]
call fcn.0053b694
push dword [ebp - 0x22c]
push 0x53bbc8
lea eax, [ebp - 0x230]
call fcn.0053b650
push dword [ebp - 0x230]
push 0x53bbe4
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.00406f68
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00470fa0
test al, al
jne 0x53b9a4
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.004069b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53b9d1
lea eax, [ebp - 0x230]
mov edx, 6
call fcn.004069a8
lea eax, [ebp - 4]
call fcn.004069a0
ret