Function at 0x60539c0
Capabilities:
Check if file exists
Copy file
Delete file
Get file attributes
Get file size
Move file
Query environment variable
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x60a2c
call fcn.060ee370
mov eax, dword [0x613b150]
xor eax, esp
mov dword [esp + 0x60a28], eax
push ebx
push esi
push edi
call fcn.060537b0
test al, al
jne 0x6053a0f
push 0
push str.SymCorpUIMainWindowClass
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x6053a0f
mov dword [0x613ff00], 0xf
push 0x6132fa0
jmp 0x605453b
xor eax, eax
push 0x206
push eax
mov word [esp + 0x20], ax
lea eax, [esp + 0x22]
push eax
call fcn.060eefa0
add esp, 0xc
xor eax, eax
push 0x206
push eax
mov word [esp + 0x430], ax
lea eax, [esp + 0x432]
push eax
call fcn.060eefa0
add esp, 0xc
xor eax, eax
push 0x206
push eax
mov word [esp + 0x228], ax
lea eax, [esp + 0x22a]
push eax
call fcn.060eefa0
add esp, 0xc
push 0x104
push 0x6140730
push str.windir
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x605452c
cmp eax, 0x104
jge 0x605452c
cmp word [0x6140118], 0x5c
jne 0x6053afb
cmp word [0x614011c], 0x3f
je 0x6053afb
push 8
lea eax, [esp + 0x1c]
push str._UNC
push eax
call fcn.060eda85
add esp, 0xc
lea eax, [esp + 0x18]
push 0x614011a
push 0x104
push eax
call fcn.060ed2fe
add esp, 0xc
push 1
push 0x613292c
push 0x6140118
call fcn.060eda85
add esp, 0xc
lea eax, [esp + 0x18]
push eax
push 0x104
push 0x6140118
call fcn.060ed2fe
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x6140118
call edi
cmp eax, 0xffffffff
jne 0x6053b21
mov dword [0x613ff00], 0xb
push str.The_selected_Sylink_file_does_not_exist.
jmp 0x605453b
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocString
push 0x6140118
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x6053b59
mov dword [0x613ff00], 0xa
push str.Could_not_open_the_selected_Sylink_file.
jmp 0x605453b
push 0
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0x1ffff
jbe 0x6053ba6
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, str.The_selected_Sylink_file_is_to_large.
mov ecx, 9
call fcn.06052db0
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60a28]
xor ecx, esp
call fcn.060eb877
mov esp, ebp
pop ebp
ret
push 0
lea eax, [esp + 0x18]
push eax
push esi
lea eax, [esp + 0xa3c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x60544ff
xor ecx, ecx
test esi, esi
jle 0x6053be6
lea esp, [esp]
movsx ax, byte [esp + ecx + 0xa30]
mov word [esp + ecx*2 + 0x20a30], ax
inc ecx
cmp ecx, esi
jl 0x6053bd0
add esi, esi
cmp esi, 0x40000
jae 0x6054564
xor eax, eax
push ebx
mov word [esp + esi + 0x20a34], ax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x20a30]
xor bl, bl
push eax
mov byte [esp + 0x17], bl
call fcn.060edc65
add esp, 4
push str._serversettings
push eax
call fcn.060ed3c6
lea ecx, [esp + 0x20a38]
sub ecx, eax
movzx ebx, bl
lea eax, [esp + 0x20a38]
test ecx, 0xfffffffe
mov esi, 1
push eax
cmovle ebx, esi
call fcn.060edc65
add esp, 0xc
push str.__serversettings_
push eax
call fcn.060ed3c6
lea ecx, [esp + 0x20a38]
sub ecx, eax
movzx eax, byte [esp + 0x1b]
add esp, 8
test ecx, 0xfffffffe
cmovle eax, esi
test bl, bl
je 0x60544d9
test al, al
je 0x60544d9
push str.ImagePath
mov edx, str.SYSTEMCurrentControlSetServicesSmcService
call fcn.06053120
add esp, 4
push eax
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.060ed36a
add esp, 0xc
lea ecx, [esp + 0x18]
call fcn.06055e00
cmp eax, 2
jbe 0x6053d4b
lea eax, [esp + 0x18]
push 0x6132ebc
push eax
call fcn.060ed3c6
mov esi, eax
lea ecx, [esp + 0x20]
sub ecx, esi
add esp, 8
test ecx, 0xfffffffe
jne 0x6053cfe
mov ecx, 0x6132ebc
call fcn.06055e00
lea eax, [esi + eax*2]
push eax
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.060ed36a
add esp, 0xc
lea eax, [esp + 0x18]
push eax
call fcn.060edc65
add esp, 4
push str.smc.exe
push eax
call fcn.060ed3c6
lea ecx, [esp + 0x20]
sub eax, ecx
and eax, 0xfffffffe
add esp, 8
cmp eax, 0x208
jae 0x6054564
xor ecx, ecx
mov word [esp + eax + 0x18], cx
lea eax, [esp + 0x18]
push eax
push 0x104
push 0x6140528
call fcn.060ed36a
add esp, 0xc
mov ecx, 0x6140528
call fcn.06055e00
cmp eax, 3
jae 0x6053d7f
push str.smc_install_path
mov edx, str.SOFTWARESymantecSymantec_Endpoint_ProtectionSMC
call fcn.06053120
add esp, 4
push eax
push 0x104
push 0x6140528
call fcn.060ed36a
add esp, 0xc
mov ecx, 0x6140528
call fcn.06055e00
cmp eax, 3
jae 0x6053db3
push str.smc_install_path
mov edx, str.SOFTWARESygate_Technologies__Inc.Sygate_Personal_Firewall
call fcn.06053120
add esp, 4
push eax
push 0x104
push 0x6140528
call fcn.060ed36a
add esp, 0xc
mov ecx, 0x6140528
call fcn.06055e00
cmp eax, 3
jae 0x6053de8
mov edx, str.The_Symantec_client_is_not_installed_on_this_system.
mov ecx, 7
call fcn.06052db0
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60a28]
xor ecx, esp
call fcn.060eb877
mov esp, ebp
pop ebp
ret
call fcn.060537b0
test al, al
je 0x6053f6b
call fcn.06053590
test al, al
jne 0x6053e2f
mov cl, 1
call fcn.06053640
test al, al
jne 0x6053e2f
mov edx, str.Could_not_restart_the_Symantec_client.
mov ecx, 4
call fcn.06052db0
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60a28]
xor ecx, esp
call fcn.060eb877
mov esp, ebp
pop ebp
ret
push 2
lea eax, [esp + 0x1c]
push 0x6132ebc
push eax
call fcn.060eda85
add esp, 0xc
lea eax, [esp + 0x18]
push 0x6140528
push 0x104
push eax
call fcn.060ed2fe
add esp, 0xc
lea eax, [esp + 0x18]
push 0x6132ec0
push 0x104
push eax
call fcn.060ed2fe
add esp, 0xc
cmp byte [0x613ff08], 0
je 0x6053ebf
push str.__p__
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.060ed2fe
add esp, 0xc
lea eax, [esp + 0x18]
push 0x6140320
push 0x104
push eax
call fcn.060ed2fe
add esp, 0xc
lea eax, [esp + 0x18]
push 0x6132ebc
push 0x104
push eax
call fcn.060ed2fe
add esp, 0xc
push str.__importSylink__
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.060ed2fe
add esp, 0xc
lea eax, [esp + 0x18]
push 0x6140118
push 0x104
push eax
call fcn.060ed2fe
add esp, 0xc
lea eax, [esp + 0x18]
push 0x6132ebc
push 0x104
push eax
call fcn.060ed2fe
add esp, 0xc
lea ecx, [esp + 0x18]
call fcn.06052f10
test eax, eax
je 0x605447d
cmp eax, 0xffffffff
jne 0x6053f28
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error____d___launching_SMC_process_to_import_Sylink_file.
jmp 0x6053f2e
push eax
push str.Error____d___in_smc__importSylink.
lea eax, [esp + 0x638]
push 0x200
push eax
call fcn.06055be0
add esp, 0x10
lea edx, [esp + 0x630]
mov ecx, 0xe
call fcn.06052db0
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60a28]
xor ecx, esp
call fcn.060eb877
mov esp, ebp
pop ebp
ret
call fcn.06053590
test al, al
je 0x60540b8
push 2
lea eax, [esp + 0x1c]
push 0x6132ebc
push eax
mov byte [0x613ff07], 1
call fcn.060eda85
add esp, 0xc
lea eax, [esp + 0x18]
push 0x6140730
push 0x104
push eax
call fcn.060ed2fe
add esp, 0xc
lea eax, [esp + 0x18]
push str._system32_net
push 0x104
push eax
call fcn.060ed2fe
add esp, 0xc
lea eax, [esp + 0x18]
push str.__stop_smcservice
push 0x104
push eax
call fcn.060ed2fe
add esp, 0xc
lea ecx, [esp + 0x18]
call fcn.06052f10
push 2
lea eax, [esp + 0x1c]
push 0x6132ebc
push eax
call fcn.060eda85
add esp, 0xc
lea eax, [esp + 0x18]
push 0x6140528
push 0x104
push eax
call fcn.060ed2fe
add esp, 0xc
lea eax, [esp + 0x18]
push 0x6132ec0
push 0x104
push eax
call fcn.060ed2fe
add esp, 0xc
cmp byte [0x613ff08], 0
je 0x6054071
push str.__p__
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.060ed2fe
add esp, 0xc
lea eax, [esp + 0x18]
push 0x6140320
push 0x104
push eax
call fcn.060ed2fe
add esp, 0xc
lea eax, [esp + 0x18]
push 0x6132ebc
push 0x104
push eax
call fcn.060ed2fe
add esp, 0xc
push str.__stop
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.060ed2fe
add esp, 0xc
lea ecx, [esp + 0x18]
call fcn.06052f10
xor esi, esi
call fcn.06053590
test al, al
je 0x60540b8
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 0x50
jge 0x60540b8
push 0x1f4
inc esi
call ebx
call fcn.06053590
test al, al
jne 0x60540a2
call fcn.06053590
test al, al
je 0x60540e7
mov edx, str.Could_not_stop_the_Smc_service.
mov ecx, 6
call fcn.06052db0
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60a28]
xor ecx, esp
call fcn.060eb877
mov esp, ebp
pop ebp
ret
xor eax, eax
push 0x206
push eax
mov word [esp + 0x638], ax
lea eax, [esp + 0x63a]
push eax
call fcn.060eefa0
add esp, 0xc
mov edx, str.SOFTWARESymantecSymantec_Endpoint_ProtectionInstalledApps
push 0x104
push str.SEPAppDataDir
call fcn.06053120
add esp, 4
push eax
lea eax, [esp + 0x638]
push eax
call fcn.060eda85
lea ecx, [esp + 0x63c]
add esp, 0xc
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x6054140
sub ecx, edx
sar ecx, 1
lea eax, [esp + 0x630]
je 0x605416a
push str.DataConfig_
push 0x104
push eax
call fcn.060ed2fe
jmp 0x605417a
push 0x104
push 0x6140528
push eax
call fcn.060eda85
add esp, 0xc
lea eax, [esp + 0x220]
push 4
push 0x6133498
push eax
xor esi, esi
call fcn.060eda85
add esp, 0xc
lea eax, [esp + 0x630]
push eax
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.060ed36a
add esp, 0xc
lea eax, [esp + 0x18]
push str.sylink.
push 0x104
push eax
call fcn.060ed2fe
add esp, 0xc
lea eax, [esp + 0x220]
push eax
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.060ed2fe
add esp, 0xc
lea eax, [esp + 0x18]
push eax
call edi
cmp eax, 0xffffffff
je 0x6054255
cmp esi, 0x3e7
jge 0x6054255
inc esi
cmp esi, 0xa
jge 0x6054204
push 3
push 0x6133504
jmp 0x6054219
cmp esi, 0x64
jge 0x6054212
push 2
push 0x613350c
jmp 0x6054219
push 1
push 0x613292c
lea eax, [esp + 0x228]
push eax
call fcn.060eda85
add esp, 0xc
lea eax, [esp + 0x18]
push 0xa
push eax
push esi
call fcn.060ede04
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x224]
push 0x104
push eax
call fcn.060ed2fe
jmp 0x6054193
lea eax, [esp + 0x630]
push eax
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.060ed36a
add esp, 0xc
lea eax, [esp + 0x18]
push 0x6133510
push 0x104
push eax
call fcn.060ed2fe
add esp, 0xc
lea eax, [esp + 0x630]
push eax
lea eax, [esp + 0x42c]
push 0x104
push eax
call fcn.060ed36a
add esp, 0xc
lea eax, [esp + 0x428]
push str.sylink.
push 0x104
push eax
call fcn.060ed2fe
add esp, 0xc
lea eax, [esp + 0x220]
push eax
lea eax, [esp + 0x42c]
push 0x104
push eax
call fcn.060ed2fe
add esp, 0xc
lea eax, [esp + 0x428]
push eax
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x60542ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
lea eax, [esp + 0x18]
push eax
call edi
cmp eax, 0xffffffff
je 0x6054344
mov cl, byte [0x613ff07]
call fcn.06053640
test al, al
je 0x6053e09
mov edx, str.Unable_to_backup_the_current_Sylink_file.
mov ecx, 5
call fcn.06052db0
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60a28]
xor ecx, esp
call fcn.060eb877
mov esp, ebp
pop ebp
ret
push 1
lea eax, [esp + 0x1c]
push eax
push 0x6140118
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x6054393
mov cl, byte [0x613ff07]
call fcn.06053640
test al, al
je 0x6053e09
mov edx, str.Could_not_copy_new_Sylink.xml_file.
mov ecx, 3
call fcn.06052db0
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60a28]
xor ecx, esp
call fcn.060eb877
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x630]
push eax
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.060ed36a
add esp, 0xc
lea eax, [esp + 0x18]
push 0x6133510
push 0x104
push eax
call fcn.060ed2fe
add esp, 0xc
lea eax, [esp + 0x18]
push eax
call edi
cmp eax, 0xffffffff
je 0x605435a
lea eax, [esp + 0x630]
push eax
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.060ed36a
add esp, 0xc
lea eax, [esp + 0x18]
push str.sylink.bak
push 0x104
push eax
call fcn.060ed2fe
add esp, 0xc
lea eax, [esp + 0x630]
push eax
lea eax, [esp + 0x42c]
push 0x104
push eax
call fcn.060ed36a
add esp, 0xc
lea eax, [esp + 0x428]
push str.sylinkex.bak
push 0x104
push eax
call fcn.060ed2fe
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0xc
lea eax, [esp + 0x18]
push eax
call esi
lea eax, [esp + 0x428]
push eax
call esi
lea eax, [esp + 0x18]
push eax
call edi
cmp eax, 0xffffffff
jne 0x60544a0
lea eax, [esp + 0x428]
push eax
call edi
cmp eax, 0xffffffff
jne 0x60544a0
mov cl, byte [0x613ff07]
call fcn.06053640
test al, al
je 0x6053e09
mov edx, str.Sylink_file_has_been_successfully_replaced.
xor ecx, ecx
call fcn.06052db0
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60a28]
xor ecx, esp
call fcn.060eb877
mov esp, ebp
pop ebp
ret
mov cl, byte [0x613ff07]
call fcn.06053640
test al, al
je 0x6053e09
mov edx, str.Could_not_remove_backup_Sylink_files.
mov ecx, 2
call fcn.06052db0
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60a28]
xor ecx, esp
call fcn.060eb877
mov esp, ebp
pop ebp
ret
mov edx, str.The_selected_Sylink_file_is_not_a_valid_Sylink_file.
mov ecx, 8
call fcn.06052db0
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60a28]
xor ecx, esp
call fcn.060eb877
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, str.Could_not_open_the_selected_Sylink_file.
mov ecx, 0xa
call fcn.06052db0
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60a28]
xor ecx, esp
call fcn.060eb877
mov esp, ebp
pop ebp
ret
mov dword [0x613ff00], 0xd
push str.The_Symantec_Endpoint_Protection_client_cannot_get_window_path.
push 0x1ff
push 0x613fb00
call fcn.060ed36a
mov ecx, dword [esp + 0x60a40]
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.060eb877
mov esp, ebp
pop ebp
ret
call fcn.060ed793
int3