Function at 0x500050
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x210], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x500371
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x560824
mov edx, 0x500388
call fcn.00405790
mov eax, 0x560828
mov edx, 0x5003a4
call fcn.00405790
mov eax, 0x56082c
mov edx, 0x5003cc
call fcn.00405790
mov eax, 0x560830
mov edx, 0x5003e0
call fcn.00405790
mov eax, 0x560834
mov edx, 0x5003fc
call fcn.00405790
push 0x201
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
test eax, eax
je 0x5000f0
mov eax, 0x560830
lea edx, [ebp - 0x20a]
mov ecx, 0x201
call fcn.004059ac
push 0x201
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
test eax, eax
je 0x50011a
mov eax, 0x56082c
lea edx, [ebp - 0x20a]
mov ecx, 0x201
call fcn.004059ac
mov dl, 1
mov eax, dword [0x42c3b0]
call fcn.0042c51c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x500344
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
call fcn.00537e94
test al, al
je 0x5001bd
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.0042c5f8
xor ecx, ecx
mov edx, 0x50042c
mov eax, dword [ebp - 8]
call fcn.0042c660
test al, al
je 0x5001bd
xor eax, eax
push ebp
push 0x50018c
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 4]
mov edx, 0x500478
mov eax, dword [ebp - 8]
call fcn.0042ccfc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x50019e
cmp dword [ebp - 4], 0
je 0x5001b5
mov byte [ebp - 9], 1
mov eax, 0x560834
mov edx, dword [ebp - 4]
call fcn.00405790
mov eax, dword [ebp - 8]
call fcn.0042c5c8
cmp byte [ebp - 9], 0
jne 0x500238
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.0042c5f8
xor ecx, ecx
mov edx, 0x50042c
mov eax, dword [ebp - 8]
call fcn.0042c660
test al, al
je 0x500238
xor eax, eax
push ebp
push 0x50020b
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 4]
mov edx, 0x500490
mov eax, dword [ebp - 8]
call fcn.0042ccfc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x50021d
cmp dword [ebp - 4], 0
je 0x500230
mov eax, 0x560834
mov edx, dword [ebp - 4]
call fcn.00405790
mov eax, dword [ebp - 8]
call fcn.0042c5c8
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.0042c5f8
xor ecx, ecx
mov edx, 0x5004a0
mov eax, dword [ebp - 8]
call fcn.0042c660
test al, al
je 0x50032e
xor eax, eax
push ebp
push 0x5002a8
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 4]
mov edx, 0x5004d4
mov eax, dword [ebp - 8]
call fcn.0042ccfc
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.0040aa44
cmp dword [ebp - 0x210], 0
je 0x50029e
mov eax, 0x560824
mov edx, dword [ebp - 4]
call fcn.00405790
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5002c1
xor eax, eax
push ebp
push 0x50030d
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 4]
mov edx, 0x5004ec
mov eax, dword [ebp - 8]
call fcn.0042ccfc
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.0040aa44
cmp dword [ebp - 0x214], 0
je 0x500303
mov eax, 0x560828
mov edx, dword [ebp - 4]
call fcn.00405790
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x500326
mov eax, dword [ebp - 8]
call fcn.0042c5c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50034b
mov eax, dword [ebp - 8]
call fcn.004047e0
ret