Function at 0x56a848
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x28
push 0
push 0
dec ecx
jne 0x56a850
push ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x56ab40
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x115]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x115]
mov ecx, 0x105
call fcn.00405030
mov eax, dword [ebp - 4]
cmp eax, 0xd
ja case.default.0x56a89c
jmp dword [eax*4 + 0x56a8a3]
lea eax, [ebp - 0x10]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.004052e0
jmp case.default.0x56a89c
lea eax, [ebp - 0x10]
mov ecx, 0x56ab54
mov edx, dword [ebp - 0xc]
call fcn.004050cc
jmp case.default.0x56a89c
lea eax, [ebp - 0x10]
mov ecx, 0x56ab60
mov edx, dword [ebp - 0xc]
call fcn.004050cc
jmp case.default.0x56a89c
lea eax, [ebp - 0x10]
mov ecx, 0x56ab74
mov edx, dword [ebp - 0xc]
call fcn.004050cc
jmp case.default.0x56a89c
lea eax, [ebp - 0x10]
mov ecx, 0x56ab90
mov edx, dword [ebp - 0xc]
call fcn.004050cc
jmp case.default.0x56a89c
lea edx, [ebp - 0x11c]
xor eax, eax
call fcn.0056a848
push dword [ebp - 0x11c]
push 0x56aba0
lea eax, [ebp - 0x120]
call fcn.0056a7d8
push dword [ebp - 0x120]
push 0x56abc0
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405140
jmp case.default.0x56a89c
lea eax, [ebp - 0x10]
mov ecx, 0x56abe0
mov edx, dword [ebp - 0xc]
call fcn.004050cc
jmp case.default.0x56a89c
lea edx, [ebp - 0x124]
xor eax, eax
call fcn.0056a848
mov edx, dword [ebp - 0x124]
lea eax, [ebp - 0x10]
mov ecx, 0x56abf0
call fcn.004050cc
jmp case.default.0x56a89c
lea edx, [ebp - 0x128]
xor eax, eax
call fcn.0056a848
push dword [ebp - 0x128]
push 0x56aba0
lea eax, [ebp - 0x12c]
call fcn.0056a7d8
push dword [ebp - 0x12c]
push 0x56ac34
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405140
jmp case.default.0x56a89c
lea edx, [ebp - 0x130]
xor eax, eax
call fcn.0056a848
push dword [ebp - 0x130]
push 0x56aba0
lea eax, [ebp - 0x134]
call fcn.0056a7d8
push dword [ebp - 0x134]
push 0x56ac58
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405140
jmp case.default.0x56a89c
lea edx, [ebp - 0x138]
xor eax, eax
call fcn.0056a848
push dword [ebp - 0x138]
push 0x56aba0
lea eax, [ebp - 0x13c]
call fcn.0056a7d8
push dword [ebp - 0x13c]
push 0x56ac6c
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405140
jmp case.default.0x56a89c
lea eax, [ebp - 0x10]
mov ecx, 0x56ac80
mov edx, dword [ebp - 0xc]
call fcn.004050cc
jmp case.default.0x56a89c
lea edx, [ebp - 0x140]
xor eax, eax
call fcn.0056a848
push dword [ebp - 0x140]
push 0x56aba0
lea eax, [ebp - 0x144]
call fcn.0056a7d8
push dword [ebp - 0x144]
push 0x56ab54
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405140
jmp case.default.0x56a89c
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x56ac94
mov edx, 0x56aca4
mov eax, 0x80000001
call fcn.00569a88
mov eax, dword [ebp - 0x10]
call fcn.00405080
mov edx, dword [ebp - 0x10]
cmp byte [edx + eax - 1], 0x5c
je case.default.0x56a89c
lea eax, [ebp - 0x10]
mov edx, 0x56ab54
call fcn.00405088
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00404e14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56ab47
lea eax, [ebp - 0x144]
mov edx, 0xb
call fcn.00404de4
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404de4
ret