Function at 0x511450
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f6a56
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 0xc]
lea ecx, [ebp - 0x2c]
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x70], ebx
movq qword [ebp - 0x2c], xmm0
mov dword [ebp - 0x24], 0
call fcn.005dc5e0
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.005dbeb0
test al, al
je 0x5114f0
mov ecx, ebx
call fcn.005d8c40
test eax, eax
je 0x51154c
mov eax, dword [esi + 0x1c68]
inc eax
movd xmm2, eax
lea eax, [ebp - 0x2c]
cvtdq2pd xmm2, xmm2
push eax
call fcn.0050fda0
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
push ebx
push 0
mov ecx, esi
call fcn.00510ff0
mov bl, al
jmp 0x5118d5
mov ecx, edi
call fcn.005dc3a0
cmp eax, 2
jle 0x51153a
push 0
mov ecx, edi
call fcn.005dc440
cmp word [eax], 0x5c
jne 0x51153a
push 1
mov ecx, edi
call fcn.005dc440
cmp word [eax], 0x5c
je 0x51153a
sub esp, 0xc
mov ecx, edi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esi + 0x1a8]
call fcn.005da510
mov ecx, edi
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x511553
xor bl, bl
jmp 0x5118d5
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x38]
movq qword [ebp - 0x38], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x54], 0
lea ecx, [ebp - 0x5c]
movq qword [ebp - 0x5c], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x60], 0
lea ecx, [ebp - 0x68]
movq qword [ebp - 0x68], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x3c], 0
lea ecx, [ebp - 0x44]
movq qword [ebp - 0x44], xmm0
call fcn.005dc5e0
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 4
push eax
mov ecx, edi
call fcn.005dc190
lea edx, [ebp - 0x68]
mov ecx, eax
call fcn.005e65a0
add esp, 4
test eax, eax
jne 0x5115f4
push eax
push 1
push 1
push eax
lea ecx, [ebp - 0x44]
call fcn.005dc190
push eax
lea ecx, [esi + 0x360]
call fcn.005daa70
test eax, eax
je 0x511603
xor bl, bl
jmp 0x5118b5
cmp eax, 0x800b0100
jne 0x511603
lea ecx, [ebp - 0x44]
call fcn.005dc400
mov ecx, edi
call fcn.005dc190
mov ecx, eax
call fcn.005e0e70
test edx, edx
jl 0x511625
jg 0x51161e
cmp eax, 0x8000000
jbe 0x511625
xor bl, bl
jmp 0x5118b5
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x20]
movq qword [ebp - 0x20], xmm0
call fcn.005dc5e0
mov ecx, edi
mov byte [ebp - 4], 5
call fcn.005dc190
push eax
lea ecx, [esi + 0x2f8]
call fcn.0050b3b0
xor ecx, ecx
test eax, eax
setg cl
test eax, eax
jle 0x51172d
cmp dword [esi + 0x304], ecx
ja 0x511674
mov dword [esi + 0x304], 2
mov eax, dword [esi + 0x30c]
lea ecx, [ebp - 0x20]
add eax, 0xc
push eax
call fcn.005dc4e0
xorps xmm0, xmm0
mov dword [ebp - 0x48], 0
lea ecx, [ebp - 0x50]
movq qword [ebp - 0x50], xmm0
call fcn.005dc5e0
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc4e0
push eax
push str.Malware
lea ecx, [esi + 0x33c]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.00511a00
test al, al
je 0x511771
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x5c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
call fcn.00511900
mov ebx, eax
lea ecx, [ebx - 1]
cmp ecx, 0xa
ja 0x511714
cmp ebx, 0xa
lea eax, [ebp - 0x20]
sbb ecx, ecx
neg ecx
inc ecx
push ecx
push eax
mov ecx, esi
call fcn.00510e90
cmp ebx, 0xa
jb 0x5118a3
cmp ebx, dword [esi + 0x1c68]
jl 0x51176e
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
push dword [ebp - 0x70]
jmp 0x511821
push 0
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x6c], 0x100
push eax
push 0
push 0
push 0x100
lea ecx, [ebp - 0x20]
call fcn.005db9a0
push eax
mov ecx, edi
call fcn.005dc190
mov edx, 0x8003
mov ecx, eax
call fcn.005e6320
test al, al
jne 0x511686
xor bl, bl
jmp 0x5118ad
mov ebx, dword [ebp - 0x70]
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
lea ecx, [esi + 0x248]
call fcn.005a9cd0
test eax, eax
je 0x511834
push 1
lea ecx, [ebp - 0x50]
call fcn.005dc190
push eax
lea ecx, [esi + 0x1b8]
call fcn.005aeac0
cmp eax, 1
jne 0x511834
movsd xmm2, qword [esi + 0x1f8]
comisd xmm2, xmmword [0x6edb08]
jb 0x5118a3
lea eax, [ebp - 0x2c]
push eax
call fcn.0050fda0
movsd xmm0, qword [esi + 0x1f8]
comisd xmm0, xmmword [0x6edb20]
jb 0x5117e8
call fcn.005e9c20
jmp 0x5117ed
mov eax, 1
push eax
lea eax, [ebp - 0x20]
mov ecx, esi
push eax
call fcn.00510e90
movd xmm1, dword [esi + 0x1c68]
movsd xmm0, qword [esi + 0x1f8]
cvtdq2pd xmm1, xmm1
comisd xmm0, xmm1
jb 0x5118a3
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
push ebx
mov ecx, edi
call fcn.005dc190
push eax
mov ecx, esi
call fcn.00510ff0
mov bl, al
jmp 0x5118a5
lea ecx, [ebp - 0x20]
call fcn.005dc3a0
test eax, eax
je 0x5118a3
sub esp, 0x14
lea ecx, [ebp - 0x20]
push ebx
call fcn.005dc190
push eax
mov ecx, edi
call fcn.005dc190
push eax
lea ecx, [esi + 0x2f8]
call fcn.0050b410
push 1
push ebx
lea ecx, [ebp - 0x38]
call fcn.005dc260
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
push 2
push 1
push 1
push 0
push 0x62f440
lea ecx, [ebp - 0x38]
call fcn.005daa70
neg eax
lea ecx, [esi + 0x248]
sbb eax, eax
and eax, ebx
push eax
lea eax, [esi + 0x230]
push eax
push edi
call fcn.005accd0
xor bl, bl
lea ecx, [ebp - 0x50]
call fcn.005dc430
lea ecx, [ebp - 0x20]
call fcn.005dc430
lea ecx, [ebp - 0x44]
call fcn.005dc430
lea ecx, [ebp - 0x68]
call fcn.005dc430
lea ecx, [ebp - 0x5c]
call fcn.005dc430
lea ecx, [ebp - 0x38]
call fcn.005dc430
lea ecx, [ebp - 0x2c]
call fcn.005dc430
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 0xc