Function at 0x5ed90b
Capabilities:
Create directory
Write file on windows

Disassembly:
push ebp
sub esp, 0x68
mov eax, 0x6c478f
call fcn.00651da4
sub esp, 0x1a8
push ebx
push esi
mov esi, ecx
mov byte [ebp + 0x6b], 0
push edi
mov dword [ebp + 0x60], esi
lea edi, [esi + 0x16c]
push edi
call fcn.0048236a
push dword [0x7b790c]
mov ecx, edi
call fcn.0043637b
test eax, eax
jne 0x5ed986
call fcn.0060567b
test al, al
je 0x5ed986
push dword [ebp + 0x74]
push esi
call fcn.005ed303
cmp dword [edi + 0x14], 8
jb 0x5ed94d
mov edi, dword [edi]
add esi, 0xdc
cmp dword [esi + 0x14], 0x10
jb 0x5ed95b
mov esi, dword [esi]
push edi
call fcn.004793f4
push eax
push 0xffffffffffffffff
push esi
call fcn.004792b3
push eax
push 0x8020
push dword [0x7f9cc8]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, 0x666
jmp 0x5ee10f
push dword [0x7b7918]
mov ecx, edi
call fcn.0043637b
test eax, eax
je 0x5ed9b9
push dword [0x7b7920]
mov ecx, edi
call fcn.0043637b
test eax, eax
je 0x5ed9b9
push dword [0x7b791c]
mov ecx, edi
call fcn.0043637b
test eax, eax
jne 0x5ed9c8
push 0x2710
mov ecx, 0x7c6d20
call fcn.005010fb
push dword [0x7b7910]
mov ecx, edi
call fcn.0043637b
or dword [ebp + 0x40], 0xffffffff
xor ebx, ebx
inc ebx
test eax, eax
jne 0x5eda4f
call fcn.005e9130
test eax, eax
je 0x5eda01
mov ecx, dword [0x7d4808]
push 0x2710
call fcn.005e902e
test al, al
je 0x5ed97c
push dword [0x7b7910]
call fcn.00481ffe
mov dword [ebp + 0x5c], eax
test eax, eax
je 0x5edaf7
lea ecx, [esi + 0x7c]
cmp dword [ecx + 0x14], 0x10
jb 0x5eda22
mov ecx, dword [ecx]
push ecx
call fcn.00678742
pop ecx
mov ecx, dword [ebp + 0x5c]
mov ecx, dword [ecx + 0x80]
cmp ecx, 0x102
ja 0x5eda46
cmp eax, ecx
jbe 0x5eda46
mov byte [ebp + 0x6b], bl
jmp 0x5edaf7
mov byte [ebp + 0x6b], 0
jmp 0x5edaf7
lea eax, [esi + 0xf4]
cmp dword [eax + 0x10], 0
je 0x5edaf7
push eax
lea eax, [ebp + 0x44]
push eax
call fcn.0043b86a
and dword [ebp - 4], 0
cmp dword [ebp + 0x58], 8
mov eax, dword [ebp + 0x44]
jae 0x5eda79
lea eax, [ebp + 0x44]
mov dword [ebp], eax
lea eax, [ebp]
push eax
mov dword [ebp + 4], 0x72a64c
call fcn.0045f84d
test al, al
je 0x5edae8
push str.inprocess
lea ecx, [ebp + 0x10]
call fcn.0040f49f
push 0
add esi, 4
lea eax, [ebp + 0x10]
push esi
xor ebx, ebx
push eax
inc ebx
push 0
mov byte [ebp - 4], bl
call fcn.005ed599
push 0
push ebx
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 0
call fcn.0040facf
sub esp, 0x18
mov ecx, esp
push esi
call fcn.0042812e
mov ecx, 0x7f8c48
call fcn.005b4783
push 0
push ebx
lea ecx, [ebp + 0x44]
call fcn.004284eb
jmp 0x5ed97c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x44]
push 0
push ebx
call fcn.004284eb
lea ecx, [ebp - 0xe4]
call fcn.0062ff90
xor eax, eax
mov dword [ebp - 4], 2
push eax
push eax
push eax
push eax
push eax
push str.BtAppInstallTail
lea ecx, [ebp - 0xe4]
call fcn.00597eb0
lea ecx, [ebp - 0xe4]
call fcn.00630084
push 0x14
lea eax, [ebp - 0x98]
push eax
call fcn.00469b28
lea eax, [ebp - 0x98]
push eax
push 0x29
lea eax, [ebp - 0x140]
push eax
call fcn.0046da2d
lea eax, [esi + 0x34]
push eax
lea ecx, [ebp - 0x54]
call fcn.0042812e
cmp dword [ebp - 0x44], 0
mov byte [ebp - 4], 3
jne 0x5edba6
lea eax, [esi + 4]
cmp dword [eax + 0x14], 8
mov dword [ebp + 0x64], eax
jb 0x5edb72
mov eax, dword [eax]
push 0x5c
push eax
call fcn.0066cbdb
pop ecx
pop ecx
test eax, eax
je 0x5edb85
add eax, 2
jmp 0x5edb90
lea eax, [esi + 4]
cmp dword [eax + 0x14], 8
jb 0x5edb93
mov eax, dword [eax]
mov dword [ebp + 0x64], eax
push eax
call fcn.004287c6
pop ecx
push eax
push dword [ebp + 0x64]
lea ecx, [ebp - 0x54]
call fcn.004286de
cmp dword [edi + 0x14], 8
jb 0x5edbb0
mov eax, dword [edi]
jmp 0x5edbb2
mov eax, edi
cmp dword [ebp - 0x40], 8
mov ecx, dword [ebp - 0x54]
jae 0x5edbbe
lea ecx, [ebp - 0x54]
push eax
or eax, 0xffffffff
push eax
push eax
push ecx
lea eax, [ebp - 0x98]
push eax
call fcn.0047b807
lea eax, [esi + 0x10c]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.0043b86a
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 4
jb 0x5edbf0
mov eax, dword [eax]
push eax
push 0x7c1840
lea eax, [ebp - 0x24]
push 0x6d6aa0
push eax
call fcn.00462014
add esp, 0x10
push 0
push ebx
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 6
call fcn.004284eb
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x5edc25
lea eax, [ebp - 0x24]
push eax
call fcn.0045dc5a
test al, al
jne 0x5edca1
push str.createdir
lea ecx, [ebp + 0x44]
call fcn.0040f49f
push 0
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp + 0x44]
push eax
push 0
call fcn.005ed599
push 0
push ebx
lea ecx, [ebp + 0x44]
mov byte [ebp - 4], 6
call fcn.0040facf
sub esp, 0x18
lea eax, [esi + 4]
mov ecx, esp
push eax
call fcn.0042812e
mov ecx, 0x7f8c48
call fcn.005b4783
push 0
push ebx
lea ecx, [ebp - 0x24]
call fcn.004284eb
push 0
push ebx
lea ecx, [ebp - 0x54]
call fcn.004284eb
lea ecx, [ebp - 0xe4]
call fcn.0062ffd2
or eax, 0xffffffff
jmp 0x5ee10f
mov esi, dword [esi]
lea eax, [ebp - 0x30]
push eax
lea ecx, [esi + 0x24]
call fcn.00424fd8
lea eax, [ebp + 0x1c]
push eax
lea ecx, [esi + 0x24]
call fcn.00424fc0
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp + 0x60]
jmp 0x5ede5c
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x5edccf
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 4]
dec ecx
and ecx, edx
mov eax, dword [eax + ecx*4]
mov dword [ebp + 0x60], eax
cmp dword [eax + 0x14], 0x10
jb 0x5edce9
mov eax, dword [eax]
mov dword [ebp + 0x60], eax
push eax
lea eax, [ebp - 0xfc]
push eax
call fcn.0047aca8
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 8
jb 0x5edd02
mov eax, dword [eax]
cmp dword [ebp - 0x10], 8
mov ecx, dword [ebp - 0x24]
jae 0x5edd0e
lea ecx, [ebp - 0x24]
push eax
push ecx
lea eax, [ebp + 0x44]
push 0x6d6aa0
push eax
call fcn.00462014
add esp, 0x10
push 0
push ebx
lea ecx, [ebp - 0xfc]
mov byte [ebp - 4], 0xa
call fcn.004284eb
mov edx, dword [ebp + 0x60]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp + 0x64], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5edd3e
sub ecx, dword [ebp + 0x64]
push 0x2f
push edx
mov dword [ebp + 0x64], ecx
call fcn.0066ac30
sub eax, dword [ebp + 0x60]
pop ecx
pop ecx
mov ecx, dword [ebp + 0x64]
dec ecx
cmp eax, ecx
mov eax, dword [ebp + 0x44]
jne 0x5edd7a
cmp dword [ebp + 0x58], 8
jae 0x5edd6c
lea eax, [ebp + 0x44]
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
jmp 0x5ede49
cmp dword [ebp + 0x58], 8
jae 0x5edd83
lea eax, [ebp + 0x44]
xor ecx, ecx
push ecx
push 0x80
push 2
push ecx
push ecx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [ebp + 0x64], eax
cmp eax, 0xffffffff
jne 0x5eddde
push 0
lea eax, [ebp + 0x44]
push eax
call fcn.0045cacc
cmp dword [ebp + 0x58], 8
mov eax, dword [ebp + 0x44]
jae 0x5eddba
lea eax, [ebp + 0x44]
xor ecx, ecx
push ecx
push 0x80
push 2
push ecx
push ecx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [ebp + 0x64], eax
cmp eax, 0xffffffff
je 0x5ee123
mov eax, dword [esi]
push dword [ebp + 0x60]
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x6c]
push eax
call fcn.0047aca8
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 0xc
jb 0x5eddfb
mov eax, dword [eax]
lea ecx, [ebp + 8]
push ecx
push eax
push dword [ebp + 0xc]
call fcn.0047f670
push 0
push ebx
lea ecx, [ebp - 0x6c]
mov dword [ebp + 0x60], eax
mov byte [ebp - 4], 0xa
call fcn.004284eb
push 0
lea eax, [ebp + 4]
push eax
push dword [ebp + 8]
push dword [ebp + 0x60]
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x5ee17c
push ebx
push dword [ebp + 0x60]
call fcn.0045c46f
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0
push ebx
lea ecx, [ebp + 0x44]
mov byte [ebp - 4], 6
call fcn.004284eb
mov edx, dword [ebp + 0x5c]
inc edx
mov dword [ebp + 0x5c], edx
cmp edx, dword [ebp + 0x24]
jne 0x5edcc6
lea eax, [esi + 0x1c]
cmp dword [eax + 0x14], 8
jb 0x5ede73
mov eax, dword [eax]
lea ecx, [ebp - 0x140]
push ecx
push eax
lea eax, [ebp - 0x114]
push str.BTAPPS__s__PAIRINGKEY__S_
push eax
call fcn.00462014
add esp, 0x10
push dword [ebp + 0x74]
mov byte [ebp - 4], 0xe
push esi
call fcn.005ed303
call fcn.00472048
lea ecx, [ebp - 0xe4]
call fcn.006300cb
push dword [ebp - 0xe0]
call dword [sym.imp.USER32.dll_DestroyWindow]
cmp dword [edi + 0x14], 8
jb 0x5edec0
mov edi, dword [edi]
lea eax, [esi + 0xdc]
cmp dword [eax + 0x14], 0x10
mov dword [ebp + 0x74], eax
jb 0x5eded4
mov eax, dword [eax]
mov dword [ebp + 0x74], eax
push edi
call fcn.004793f4
push eax
or edi, 0xffffffff
push edi
push dword [ebp + 0x74]
call fcn.004792b3
push eax
push 0x8020
push dword [0x7f9cc8]
call dword [sym.imp.USER32.dll_PostMessageW]
push 0x6d2128
call fcn.004287c6
pop ecx
push eax
push 0x6d2128
lea ecx, [esi + 0x188]
call fcn.004286de
add esi, 4
cmp dword [esi + 0x14], 8
jb 0x5edf20
mov esi, dword [esi]
push esi
call fcn.0045c825
push eax
lea ecx, [ebp + 0x10]
call fcn.00428153
push str.install
lea ecx, [ebp + 0x28]
mov byte [ebp - 4], 0xf
call fcn.0040f49f
push 0
lea eax, [ebp + 0x10]
mov byte [ebp - 4], 0x10
push eax
lea eax, [ebp + 0x28]
push eax
push ebx
call fcn.005ed599
push 0
push ebx
lea ecx, [ebp + 0x28]
call fcn.0040facf
push 0
push ebx
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 0xe
call fcn.004284eb
cmp byte [ebp + 0x6b], 0
je 0x5ee0d9
push 0
lea eax, [ebp - 0x3c]
push eax
call fcn.005ec0f9
lea ecx, [ebp - 0x1b4]
mov byte [ebp - 4], 0x11
call fcn.00467158
cmp dword [ebp - 0x28], 0x10
mov eax, dword [ebp - 0x3c]
mov byte [ebp - 4], 0x12
jae 0x5edfa2
lea eax, [ebp - 0x3c]
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x1b4]
push eax
call fcn.004670f4
push eax
lea eax, [ebp - 0x84]
push 0x6df2e4
push eax
call fcn.00461fef
add esp, 0xc
and dword [ebp + 0x20], 0
mov dword [ebp + 0x24], 0xf
mov byte [ebp + 0x10], 0
push str.action
lea ecx, [ebp + 0x28]
mov byte [ebp - 4], 0x14
call fcn.0040f49f
push ebx
push str.kav_upgrade
lea eax, [ebp + 0x28]
mov byte [ebp - 4], 0x15
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.00428ecf
push eax
lea ecx, [ebp + 0x10]
call fcn.0040f0f2
push 0
push ebx
lea ecx, [ebp - 0x6c]
call fcn.0040facf
push 0
push ebx
lea ecx, [ebp + 0x28]
mov byte [ebp - 4], 0x14
call fcn.0040facf
push str.hlic
lea ecx, [ebp + 0x28]
call fcn.0040f49f
push ebx
sub esp, 0x18
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0x84]
mov ecx, esp
push eax
call fcn.0040fa4b
lea eax, [ebp + 0x28]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.004802bb
push edi
push 0
push eax
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 0x17
call fcn.0040f579
push 0
push ebx
lea ecx, [ebp - 0x6c]
call fcn.0040facf
push 0
push ebx
lea ecx, [ebp + 0x28]
mov byte [ebp - 4], 0x14
call fcn.0040facf
push str.client_antivirus
lea ecx, [ebp + 0x28]
call fcn.0040f49f
push ebx
push 0
mov byte [ebp - 4], 0x18
lea eax, [ebp + 0x28]
push 0
push eax
lea eax, [ebp + 0x10]
push eax
push 0x56
call fcn.004857ae
push 0
push ebx
lea ecx, [ebp + 0x28]
call fcn.0040facf
push 0
push ebx
lea ecx, [ebp + 0x10]
call fcn.0040facf
push 0
push ebx
lea ecx, [ebp - 0x84]
call fcn.0040facf
lea ecx, [ebp - 0x1b4]
call fcn.0040e854
push 0
push ebx
lea ecx, [ebp - 0x3c]
call fcn.0040facf
push 0
push ebx
lea ecx, [ebp - 0x114]
call fcn.004284eb
and dword [ebp + 0x40], 0
push 0
push ebx
lea ecx, [ebp - 0x24]
call fcn.004284eb
push 0
push ebx
lea ecx, [ebp - 0x54]
call fcn.004284eb
lea ecx, [ebp - 0xe4]
call fcn.0062ffd2
mov eax, dword [ebp + 0x40]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
lea esp, [ebp + 0x6c]
pop ebp
ret 4
push 0x6f709c
lea ecx, [ebp + 0x28]
call fcn.0040f49f
push 0
lea eax, [ebp + 0x44]
mov byte [ebp - 4], 0xb
push eax
lea eax, [ebp + 0x28]
push eax
push 0
call fcn.005ed599
push 0
push ebx
lea ecx, [ebp + 0x28]
mov byte [ebp - 4], 0xa
call fcn.0040facf
sub esp, 0x18
lea eax, [esi + 4]
mov ecx, esp
push eax
call fcn.0042812e
mov ecx, 0x7f8c48
call fcn.005b4783
push 0
push ebx
lea ecx, [ebp + 0x44]
call fcn.004284eb
jmp 0x5edc78
push 0x72a68c
lea ecx, [ebp + 0x28]
call fcn.0040f49f
push 0
lea eax, [ebp + 0x44]
mov byte [ebp - 4], 0xd
push eax
lea eax, [ebp + 0x28]
push eax
push 0
call fcn.005ed599
push 0
push ebx
lea ecx, [ebp + 0x28]
mov byte [ebp - 4], 0xa
call fcn.0040facf
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ebx
push dword [ebp + 0x60]
call fcn.0045c46f
sub esp, 0x18
lea eax, [esi + 4]
mov ecx, esp
push eax
call fcn.0042812e
mov ecx, 0x7f8c48
call fcn.005b4783
push 0
push ebx
lea ecx, [ebp + 0x44]
call fcn.004284eb
jmp 0x5ee0eb