Function at 0x5d9190
Capabilities:
Check if file exists
Persist via app paths registry key
Set current directory
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x640c57
mov eax, dword fs:[0]
push eax
sub esp, 0x188
mov eax, dword [0x6ccc30]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xb4], ebx
push 0x80
mov edi, dword [eax]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0x2c], edi
call fcn.005d0220
mov esi, eax
add esp, 4
mov dword [ebp - 0x30], esi
mov dword [ebp - 4], ebx
test esi, esi
je 0x5d9210
push 0x80
push ebx
push esi
call fcn.0061e8c0
add esp, 0xc
mov ecx, esi
push edi
call fcn.0041090a
mov edi, dword [0x6d1ebc]
mov dword [ebp - 4], 0xffffffff
lea esi, [edi + 8]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x20], eax
push esi
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [eax + 4]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
test eax, eax
jne 0x5d925b
mov eax, 5
jmp 0x5da604
mov edi, dword [0x6d1ebc]
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x64689c]
mov ecx, edi
call esi
push 2
xor eax, eax
mov dword [ebp - 0xb8], 1
push 0x64e55c
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.005d2810
mov esi, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
mov dword [ebp - 4], 2
call fcn.00409a00
mov byte [ebp - 0xae], al
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 4], 3
cmp ecx, 8
jb 0x5d92d6
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.005d31d0
xor eax, eax
mov dword [ebp - 4], 0xffffffff
push 3
mov word [ebp - 0x28], ax
lea ecx, [ebp - 0x28]
push 0x64e234
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.005d2810
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 4
push eax
mov ecx, esi
call fcn.00409a00
mov byte [ebp - 0x99], al
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 4], 5
cmp ecx, 8
jb 0x5d9334
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.005d31d0
xor eax, eax
mov dword [ebp - 4], 0xffffffff
push 3
mov word [ebp - 0x28], ax
lea ecx, [ebp - 0x28]
push 0x64e324
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.005d2810
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 6
push eax
mov ecx, esi
call fcn.00409a00
mov byte [ebp - 0xbc], al
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 4], 7
cmp ecx, 8
jb 0x5d9392
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.005d31d0
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov word [ebp - 0x28], ax
cmp byte [ebp - 0x99], al
je 0x5d9445
lea eax, [ebp - 0x28]
push 0x64e38c
push eax
call fcn.0049eca0
mov edi, eax
mov ebx, 1
add esp, 8
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xb4], ebx
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
jb 0x5d93da
mov edi, dword [edi]
cmp eax, 0xd
jb 0x5d9445
add eax, 0xfffffff4
mov esi, edi
lfence
lea eax, [edi + eax*2]
mov dword [ebp - 0x34], eax
nop dword [eax]
mov ecx, eax
mov edx, 0
sub ecx, esi
sar ecx, 1
je 0x5d9414
cmp word [esi], 0x70
je 0x5d9412
cmp ecx, 1
je 0x5d9414
add esi, 2
dec ecx
cmp word [esi], 0x70
jne 0x5d9403
mov edx, esi
mov esi, edx
test esi, esi
je 0x5d9445
push 0xd
push 0x64e17c
push esi
call fcn.005ecb60
add esp, 0xc
test eax, eax
je 0x5d9436
mov eax, dword [ebp - 0x34]
add esi, 2
jmp 0x5d93f0
sub esi, edi
mov byte [ebp - 0x9a], bl
sar esi, 1
cmp esi, 0xffffffff
jne 0x5d944c
mov byte [ebp - 0x9a], 0
test bl, 1
je 0x5d9483
and ebx, 0xfffffffe
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xb4], ebx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 8
cmp eax, 8
jb 0x5d947c
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.005d31d0
mov dword [ebp - 4], 0xffffffff
push 2
xor eax, eax
mov dword [ebp - 0x18], 0
push 0x64e564
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.005d2810
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 4], 9
call fcn.00409a00
mov byte [ebp - 0xa1], al
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 4], 0xa
cmp ecx, 8
jb 0x5d94db
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.005d31d0
mov edi, dword [0x6d1ebc]
mov dword [ebp - 4], 0xffffffff
lea esi, [edi + 8]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov bl, byte [ebp - 0xae]
mov byte [edi + 0x40], bl
push esi
mov dword [ebp - 4], 0xb
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [0x6d1ebc]
mov dword [ebp - 4], 0xffffffff
lea esi, [edi + 8]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov al, byte [ebp - 0xbc]
mov byte [edi + 0x51], al
push esi
mov dword [ebp - 4], 0xc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [0x6d1ebc]
mov dword [ebp - 4], 0xffffffff
lea esi, [edi + 8]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov bh, byte [ebp - 0x99]
mov byte [edi + 0x41], bh
push esi
mov dword [ebp - 4], 0xd
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [0x6d1ebc]
mov dword [ebp - 4], 0xffffffff
lea esi, [edi + 8]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov al, byte [ebp - 0x9a]
mov byte [edi + 0x66], al
push esi
mov dword [ebp - 4], 0xe
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 4], 0xffffffff
call fcn.00406c70
cmp eax, 6
jl 0x5d9653
mov edi, dword [0x6d1ebc]
lea esi, [edi + 8]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov bl, byte [edi + 0x66]
push esi
mov dword [ebp - 4], 0xf
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 4], 0xffffffff
test bl, bl
jne 0x5d964d
mov edi, dword [0x6d1ebc]
lea esi, [edi + 8]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov bl, byte [edi + 0x41]
push esi
mov dword [ebp - 4], 0x10
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 4], 0xffffffff
test bl, bl
jne 0x5d964d
cmp byte [0x6cedac], bl
jne 0x5d964d
call fcn.00410ef0
test al, al
jne 0x5d9625
push 1
push str.bEnableAppContainerForDebugging
call fcn.005dff30
add esp, 8
test ax, ax
je 0x5d964d
push 1
push 0x64e608
call fcn.005d7000
mov ecx, dword [0x6d1ebc]
add esp, 8
test eax, eax
setne al
mov byte [0x6cef19], al
movzx eax, al
push eax
call fcn.005da890
mov bl, byte [ebp - 0xae]
call fcn.00406c70
cmp eax, 5
jl 0x5d9699
push 1
push str.bEnableStrictHandleCheckProtection
call fcn.005d7000
add esp, 8
test eax, eax
je 0x5d9699
mov edi, dword [0x6d1ebc]
lea esi, [edi + 8]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [edi + 0x6c], 1
push esi
mov dword [ebp - 4], 0x11
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 4], 0xffffffff
call fcn.005da8f0
test bl, bl
je 0x5d96d8
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, dword [0x6d1ebc]
mov ebx, eax
lea esi, [edi + 8]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [edi + 0x54], ebx
push esi
mov dword [ebp - 4], 0x12
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov bh, byte [ebp - 0x99]
mov dword [ebp - 4], 0xffffffff
xorps xmm0, xmm0
mov dword [ebp - 0x3c], 0
lea ecx, [ebp - 0x44]
movq qword [ebp - 0x44], xmm0
call fcn.00407480
cmp byte [ebp - 0xbc], 0
mov dword [ebp - 4], 0x13
mov dword [0x6c8024], 1
jne 0x5d975f
test bh, bh
jne 0x5d975f
push 0x20019
push 0x64e6b8
push 0x80000001
lea ecx, [ebp - 0x44]
mov byte [ebp - 0xa9], 1
call fcn.004074a0
test eax, eax
jne 0x5d9766
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x44]
lea eax, [ebp - 0x2c]
push eax
push 0x64e710
call fcn.00407520
mov ecx, dword [0x6c8024]
test eax, eax
cmove ecx, dword [ebp - 0x2c]
mov dword [0x6c8024], ecx
lea ecx, [ebp - 0x44]
call fcn.00410f60
jmp 0x5d9766
mov byte [ebp - 0xa9], 0
push 0x64d8cc
call fcn.004089c0
add esp, 4
test al, al
jne 0x5d984d
call fcn.00406c60
sub esp, 8
mov ecx, 0x65ca6f
mov edx, esp
mov esi, eax
lea edi, [ecx + 1]
mov dword [edx], 0x65ca6f
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5d9795
sub ecx, edi
lea eax, [ebp - 0x28]
mov dword [edx + 4], ecx
mov ecx, esi
push eax
call fcn.00408470
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x14
push 0x65b8e2
push eax
call fcn.005d6e00
add esp, 8
test al, al
jne 0x5d9830
lea eax, [ebp - 0x28]
push 0x65b8f6
push eax
call fcn.005d6e00
add esp, 8
test al, al
jne 0x5d9830
push 1
push str.bEnforceReadRestrictions
call fcn.005d7000
mov edx, dword [ebp - 0x14]
add esp, 8
test eax, eax
mov byte [ebp - 4], 0x13
setne bl
cmp edx, 0x10
jb 0x5d984f
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
mov byte [ebp - 4], 0x16
cmp edx, 0x1000
jb 0x5d9820
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5da620
push edx
push ecx
call fcn.005d319e
add esp, 8
mov byte [ebp - 4], 0x13
jmp 0x5d984f
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 0x15
cmp eax, 0x10
jb 0x5d9849
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.005f4370
mov byte [ebp - 4], 0x13
xor bl, bl
mov edi, dword [0x6d1ebc]
lea esi, [edi + 8]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [edi + 0x59], bl
push esi
mov byte [ebp - 4], 0x17
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [ebp - 4], 0x13
call fcn.00406c60
sub esp, 8
mov ecx, 0x65ca6f
mov edx, esp
mov esi, eax
lea edi, [ecx + 1]
mov dword [edx], 0x65ca6f
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5d9890
sub ecx, edi
lea eax, [ebp - 0x28]
mov dword [edx + 4], ecx
mov ecx, esi
push eax
call fcn.00408470
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x18
push 0x65b8e2
push eax
call fcn.005d6e00
add esp, 8
test al, al
jne 0x5d9927
lea eax, [ebp - 0x28]
push 0x65b8f6
push eax
call fcn.005d6e00
add esp, 8
test al, al
jne 0x5d9927
push 1
push str.bEnableGlobalAtomRestrictions
call fcn.005d7000
mov edx, dword [ebp - 0x14]
add esp, 8
test eax, eax
mov byte [ebp - 4], 0x13
setne bl
cmp edx, 0x10
jb 0x5d9946
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
mov byte [ebp - 4], 0x1a
cmp edx, 0x1000
jb 0x5d991b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5da625
push edx
push ecx
call fcn.005d319e
add esp, 8
jmp 0x5d9942
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 0x19
cmp eax, 0x10
jb 0x5d9940
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.005f4370
xor bl, bl
mov byte [ebp - 4], 0x13
mov edi, dword [0x6d1ebc]
lea esi, [edi + 8]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [edi + 0x60], bl
push esi
mov byte [ebp - 4], 0x1c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [0x6d1ebc]
mov byte [ebp - 4], 0x13
lea esi, [edi + 8]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [edi + 0x61], 0
push esi
mov byte [ebp - 4], 0x1d
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [ebp - 4], 0x13
call fcn.00406c60
sub esp, 8
mov ecx, 0x65ca6f
mov edx, esp
mov esi, eax
lea edi, [ecx + 1]
mov dword [edx], 0x65ca6f
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5d99a5
sub ecx, edi
lea eax, [ebp - 0x28]
mov dword [edx + 4], ecx
mov ecx, esi
push eax
call fcn.00408470
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x1e
push 0x65b8e2
push eax
call fcn.005d6e00
add esp, 8
test al, al
jne 0x5d9a3c
lea eax, [ebp - 0x28]
push 0x65b8f6
push eax
call fcn.005d6e00
add esp, 8
test al, al
jne 0x5d9a3c
push 1
push str.bPreventCreatingExecutables
call fcn.005d7000
mov edx, dword [ebp - 0x14]
add esp, 8
test eax, eax
mov byte [ebp - 4], 0x13
setne bl
cmp edx, 0x10
jb 0x5d9a5b
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
mov byte [ebp - 4], 0x20
cmp edx, 0x1000
jb 0x5d9a30
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5da62a
push edx
push ecx
call fcn.005d319e
add esp, 8
jmp 0x5d9a57
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 0x1f
cmp eax, 0x10
jb 0x5d9a55
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.005f4370
xor bl, bl
mov byte [ebp - 4], 0x13
mov edi, dword [0x6d1ebc]
lea esi, [edi + 8]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [edi + 0x62], bl
push esi
mov byte [ebp - 4], 0x22
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [ebp - 4], 0x13
call fcn.00406c60
sub esp, 8
mov ecx, 0x65ca6f
mov edx, esp
mov esi, eax
lea edi, [ecx + 1]
mov dword [edx], 0x65ca6f
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5d9a97
sub ecx, edi
lea eax, [ebp - 0x28]
mov dword [edx + 4], ecx
mov ecx, esi
push eax
call fcn.00408470
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x23
push 0x65cafc
push eax
call fcn.005d6e00
add esp, 8
test al, al
jne 0x5d9b34
lea eax, [ebp - 0x28]
push 0x65b8f6
push eax
call fcn.005d6e00
add esp, 8
test al, al
jne 0x5d9b34
push 1
push str.bEnableBinaryPlantingProtection
call fcn.005d7000
mov edx, dword [ebp - 0x14]
add esp, 8
test eax, eax
mov byte [ebp - 4], 0x13
setne bl
mov byte [ebp - 0xaa], bl
cmp edx, 0x10
jb 0x5d9b59
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
mov byte [ebp - 4], 0x25
cmp edx, 0x1000
jb 0x5d9b28
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5da62f
push edx
push ecx
call fcn.005d319e
add esp, 8
jmp 0x5d9b55
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 0x24
cmp eax, 0x10
jb 0x5d9b4d
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.005f4370
xor bl, bl
mov byte [ebp - 0xaa], bl
mov byte [ebp - 4], 0x13
mov edi, dword [0x6d1ebc]
lea esi, [edi + 8]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [edi + 0x63], bl
push esi
mov byte [ebp - 4], 0x27
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [ebp - 4], 0x13
mov byte [ebp - 0x9a], 0
call fcn.00410f90
mov edi, dword [0x6d1ebc]
mov bl, al
lea esi, [edi + 8]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [edi + 0x50], bl
push esi
mov byte [ebp - 4], 0x28
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [ebp - 4], 0x13
call fcn.00411120
mov edi, dword [0x6d1ebc]
mov bl, al
lea esi, [edi + 8]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [edi + 0x64], bl
push esi
mov byte [ebp - 4], 0x29
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [ebp - 4], 0x13
call fcn.00411580
push 1
push str.bEnableEnhancedPolicyRestrictions
mov byte [0x6c8020], al
call fcn.005d7000
mov edi, dword [0x6d1ebc]
add esp, 8
test eax, eax
setne bl
lea esi, [edi + 8]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [edi + 0x65], bl
push esi
mov byte [ebp - 4], 0x2a
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push str.bImproveSaveExperience
mov byte [ebp - 4], 0x13
call fcn.005d7000
mov edi, dword [0x6d1ebc]
add esp, 8
test eax, eax
setne bl
lea esi, [edi + 8]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [edi + 0x7c], bl
push esi
mov byte [ebp - 4], 0x2b
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xorps xmm0, xmm0
mov byte [ebp - 4], 0x13
push 0
lea ecx, [ebp - 0x64]
movlpd qword [ebp - 0x64], xmm0
call fcn.004117c0
mov bl, byte [ebp - 0xae]
test bl, bl
jne 0x5d9c71
mov byte [ebp - 0x9f], 1
test bh, bh
je 0x5d9c78
mov byte [ebp - 0x9f], 0
xor eax, eax
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 7
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7c]
mov byte [ebp - 4], 0x2d
push eax
call fcn.004118a0
add esp, 4
test al, al
jne 0x5d9cb7
cmp dword [ebp - 0x68], 8
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x6c], 0
cmovae eax, dword [ebp - 0x7c]
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0x64]
call fcn.005daaf0
mov edi, eax
mov dword [ebp - 0x2c], edi
test edi, edi
jne 0x5d9edc
xorps xmm0, xmm0
lea ecx, [ebp - 0x4c]
movlpd qword [ebp - 0x4c], xmm0
call fcn.005e1670
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x2e
call fcn.005e1690
mov edi, dword [ebp - 0x30]
mov eax, dword [edi]
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [0x64689c]
mov ecx, edi
call esi
xorps xmm0, xmm0
lea ecx, [ebp - 0x38]
mov esi, eax
movlpd qword [ebp - 0x38], xmm0
call fcn.005e18a0
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x2f
mov dword [0x6ceea0], esi
call fcn.005e18d0
test bl, bl
je 0x5d9d57
mov edi, dword [ebp - 0x34]
test edi, edi
je 0x5d9d57
mov ebx, dword [0x6d1ebc]
lea esi, [ebx + 8]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test edi, edi
jne 0x5d9d45
mov byte [ebp - 4], 0x30
jmp 0x5d9d4c
mov dword [ebx + 0x44], edi
mov byte [ebp - 4], 0x31
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x64]
call fcn.004736b0
test eax, eax
je 0x5d9d6f
lea ecx, [ebp - 0x64]
call fcn.004736d0
mov ebx, eax
jmp 0x5d9d71
xor ebx, ebx
mov edi, dword [0x6d1ebc]
lea esi, [edi + 8]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [edi + 0x34], ebx
push esi
mov byte [ebp - 4], 0x32
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp byte [ebp - 0x9f], 0
mov byte [ebp - 4], 0x2f
je 0x5d9dba
push 0x655ec0
push dword [ebp + 0xc]
mov ecx, 0x6cedb0
mov byte [0x6cedad], 1
push 0x6c8028
call fcn.005e1fa0
mov ebx, dword [ebp - 0x30]
mov eax, dword [ebx]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x64689c]
mov ecx, ebx
call esi
mov esi, dword [ebp - 0x98]
test esi, esi
je 0x5d9de2
lea ecx, [ebp - 0x64]
call fcn.005e8050
mov dword [esi], eax
mov edi, dword [0x6d1ebc]
lea esi, [edi + 8]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov bl, byte [edi + 0x48]
push esi
mov byte [ebp - 4], 0x33
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [ebp - 4], 0x2f
test bl, bl
jne 0x5d9ebd
push 0
call fcn.00410ec0
add esp, 4
test al, al
je 0x5d9ea7
push 0
call fcn.00410ec0
add esp, 4
push 0
test al, al
jne 0x5d9e3e
call fcn.00410ec0
mov ebx, dword [ebp - 0xa8]
add esp, 4
jmp 0x5d9e77
push 0x439
push 0x64e424
lea ecx, [ebp - 0x194]
call fcn.0041f9f0
mov ebx, dword [ebp - 0xa8]
add eax, 0x10
push str.Handshake_with_Sandbox_Process_Failed
or ebx, 2
mov byte [ebp - 4], 0x34
push eax
mov dword [ebp - 0xb4], ebx
call fcn.005df800
add esp, 8
mov dword [ebp - 4], 0x2f
test bl, 2
je 0x5d9ead
and ebx, 0xfffffffd
lea ecx, [ebp - 0x194]
mov dword [ebp - 0xb4], ebx
call fcn.00424810
mov dword [ebp - 0x2c], 0x43
mov byte [ebp - 0x9a], 1
jmp 0x5d9ec3
mov ebx, dword [ebp - 0xa8]
mov dword [ebp - 0x2c], 0x43
mov byte [ebp - 0x9a], 1
jmp 0x5d9ec3
mov ebx, dword [ebp - 0xa8]
lea ecx, [ebp - 0x38]
call fcn.005e8150
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x2d
call fcn.005e8200
jmp 0x5d9fcd
push 0
call fcn.00410ec0
add esp, 4
test al, al
je 0x5d9fc0
push 0
call fcn.00410ec0
add esp, 4
push 0
test al, al
jne 0x5d9f0e
call fcn.00410ec0
mov ebx, dword [ebp - 0xa8]
add esp, 4
jmp 0x5d9f7e
push 0x440
push 0x64e64c
lea ecx, [ebp - 0x194]
call fcn.0041f9f0
mov ebx, dword [ebp - 0xa8]
add eax, 0x10
push str.Sandbox_Process_Initialization_Failed___error:
or ebx, 4
mov byte [ebp - 4], 0x35
push eax
mov dword [ebp - 0xb4], ebx
call fcn.005df800
add esp, 8
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x28]
push 0x64e23c
push eax
call fcn.0043b100
push eax
or ebx, 8
mov dword [ebp - 4], 0x36
push esi
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xb4], ebx
call fcn.004a29e0
add esp, 0x14
test bl, 8
je 0x5d9f9a
and ebx, 0xfffffff7
lea ecx, [ebp - 0x28]
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xb4], ebx
call fcn.005d4a10
mov dword [ebp - 4], 0x2d
test bl, 4
je 0x5d9fc0
and ebx, 0xfffffffb
lea ecx, [ebp - 0x194]
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xb4], ebx
call fcn.00424810
mov ebx, dword [ebp - 0xa8]
mov byte [ebp - 0x9a], 1
mov esi, dword [ebp - 0x98]
test esi, esi
je 0x5d9fe7
mov esi, dword [esi]
mov dword [ebp - 0xa8], esi
mov esi, dword [ebp - 0x98]
jmp 0x5d9ff1
mov dword [ebp - 0xa8], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [ebp - 0x9a], 0
mov dword [ebp - 0x34], eax
je 0x5da367
cmp byte [0x6cef19], 0
mov cl, byte [ebp - 0x99]
mov al, byte [ebp - 0xa1]
je 0x5da15c
test cl, cl
jne 0x5da15c
test al, al
jne 0x5da15c
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], 0
push eax
call fcn.005f31f0
add esp, 4
test al, al
je 0x5da150
mov esi, dword [ebp - 0x98]
xor edi, edi
cmp esi, 2
jne 0x5da13f
mov ecx, dword [0x6d1ebc]
push edi
push edi
push 0x5f0500
push 0x7d
call fcn.005f15d0
mov edi, eax
cmp edi, esi
jne 0x5da144
push 0x20006
push 0x64e198
xorps xmm0, xmm0
mov dword [ebp - 0x48], 0
push 0x80000001
lea ecx, [ebp - 0x50]
movq qword [ebp - 0x50], xmm0
call fcn.004098d0
cmp dword [ebp - 0x50], 0
mov byte [ebp - 4], 0x37
je 0x5da0bf
push 0
push 0x64e1f0
lea ecx, [ebp - 0x50]
call fcn.0049b0f0
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x2d
call fcn.004080a0
cmp esi, 1
mov dword [ebp - 0xb8], 7
mov byte [0x6cef19], 0
sete byte [0x6cedac]
mov dword [0x6cef1c], 0
call fcn.005f4f90
lea eax, [ebp - 0x98]
push eax
push str.iPMAppContainerLaunchFailureFallback
call fcn.005f2d40
add esp, 8
movzx eax, byte [0x6cef19]
push 0
push dword [ebp - 0xae]
push edi
push dword [ebp - 0x2c]
push dword [ebp - 0xbc]
push dword [ebp - 0x34]
push dword [ebp - 0xa8]
push eax
call fcn.005f2eb0
mov edi, dword [ebp - 0xb8]
add esp, 0x20
jmp 0x5da36c
cmp esi, 1
je 0x5da0cb
mov dword [ebp - 0xb8], 6
jmp 0x5da109
mov al, byte [ebp - 0xa1]
mov cl, byte [ebp - 0x99]
cmp byte [ebp - 0xae], 0
jne 0x5da347
test cl, cl
jne 0x5da367
test al, al
jne 0x5da367
mov dword [ebp - 0xb8], 5
test esi, esi
je 0x5da18d
mov dword [esi], 1
xor eax, eax
xor edi, edi
mov word [ebp - 0xa0], ax
lea eax, [ebp - 0xa0]
push eax
push 1
push edi
push str.bPMSandboxFallback
call fcn.005d4510
add esp, 0x10
movzx eax, ax
cmp word [ebp - 0xa0], di
je 0x5da1d4
lea eax, [ebp - 0xa0]
push eax
push edi
push edi
push str.bPMSandboxFallback
call fcn.005d4510
add esp, 0x10
movzx eax, ax
test ax, ax
je 0x5da2a1
push 0x80000000
push 0x64e248
xor esi, esi
lea ecx, [ebp - 0x50]
xorps xmm0, xmm0
mov dword [ebp - 0x30], esi
push 0x80000002
movq qword [ebp - 0x50], xmm0
mov dword [ebp - 0x48], esi
call fcn.004098d0
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0x38
push eax
push 0x64e404
lea ecx, [ebp - 0x50]
call fcn.00407520
test eax, eax
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x50]
cmove esi, dword [ebp - 0x30]
call fcn.004080a0
test esi, esi
je 0x5da27d
xor eax, eax
mov word [ebp - 0xa0], ax
lea eax, [ebp - 0xa0]
push eax
push 1
push 1
push str.bAllowFallbackForAdminEnforcedSandbox
call fcn.005d4510
add esp, 0x10
movzx eax, ax
cmp word [ebp - 0xa0], 0
je 0x5da278
lea eax, [ebp - 0xa0]
push eax
push 0
push 1
push str.bAllowFallbackForAdminEnforcedSandbox
call fcn.005d4510
add esp, 0x10
movzx eax, ax
test ax, ax
je 0x5da2a1
mov ecx, dword [0x6d1ebc]
push 0
push 0
push 0x5f0500
push 0x6b
call fcn.005f15d0
mov edi, eax
mov ecx, edi
sub ecx, 2
je 0x5da2dd
sub ecx, 1
jne 0x5da2ab
mov dword [ebp - 0xb8], 6
movzx eax, byte [0x6cef19]
push 0
push 0
push edi
push dword [ebp - 0x2c]
push dword [ebp - 0xbc]
push dword [ebp - 0x34]
push dword [ebp - 0xa8]
push eax
call fcn.005f2eb0
mov edi, dword [ebp - 0xb8]
add esp, 0x20
jmp 0x5da36c
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], 0
push eax
push 0x64e758
push 0x80000001
mov dword [ebp - 0x30], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x5da2ab
push 4
lea eax, [ebp - 0x30]
push eax
push 4
push 0
push 0x64e7b0
push dword [ebp - 0x98]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [0x6c8024]
test eax, eax
push dword [ebp - 0x98]
cmove ecx, dword [ebp - 0x30]
mov dword [0x6c8024], ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x5da2ab
cmp byte [ebp - 0xbc], 0
je 0x5da367
mov edi, 6
mov dword [ebp - 0xb8], edi
test esi, esi
je 0x5da36c
mov dword [esi], 0xff
jmp 0x5da36c
mov edi, 1
cmp byte [ebp - 0xa9], 0
je 0x5da3ab
push 0x20006
push 0x64e7d0
push 0x80000001
lea ecx, [ebp - 0x44]
call fcn.004074a0
test eax, eax
jne 0x5da3ab
push dword [0x6c8024]
lea ecx, [ebp - 0x44]
push 0x64e828
call fcn.0049b0f0
lea ecx, [ebp - 0x44]
call fcn.00410f60
cmp byte [ebp - 0xaa], 0
je 0x5da3d9
cmp edi, 5
jne 0x5da3d9
cmp dword [ebp - 0x6c], 0
je 0x5da3d1
cmp dword [ebp - 0x68], 8
lea eax, [ebp - 0x7c]
cmovae eax, dword [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
push 0xf003f
push 0x64e848
push 0x80000001
lea ecx, [ebp - 0x44]
call fcn.004074a0
test eax, eax
jne 0x5da42b
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x44]
lea eax, [ebp - 0x34]
push eax
push 0x64e2bc
call fcn.00407520
test eax, eax
jne 0x5da423
mov eax, dword [ebp - 0x34]
cmp eax, 0xffffffff
jae 0x5da423
inc eax
lea ecx, [ebp - 0x44]
push eax
push str.iNumSessions
call fcn.0049b0f0
lea ecx, [ebp - 0x44]
call fcn.00410f60
mov edi, dword [0x6d1ebc]
cmp byte [edi + 4], 0
je 0x5da5b0
push 4
xor eax, eax
mov byte [ebp - 4], 0x39
push 0x64df8c
lea ecx, [ebp - 0xd4]
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xc0], 7
mov word [ebp - 0xd4], ax
call fcn.005d2810
push 0x40
xor eax, eax
mov byte [ebp - 4], 0x3a
push str.softwareMicrosoftWindowsCurrentVersionApp_PathsAcroRd32.exe
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 7
mov word [ebp - 0x5c], ax
call fcn.005d2810
lea eax, [ebp - 0xd4]
mov byte [ebp - 4], 0x3b
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x94]
push 0x64e00c
push eax
call fcn.00416320
or ebx, 0x10
add esp, 0x10
mov dword [ebp - 0xb4], ebx
mov eax, dword [ebp - 0x48]
mov byte [ebp - 4], 0x3c
cmp eax, 8
jb 0x5da4da
inc eax
lea ecx, [ebp - 0x5c]
push eax
push dword [ebp - 0x5c]
call fcn.005d31d0
xor eax, eax
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 7
mov word [ebp - 0x5c], ax
mov eax, dword [ebp - 0xc0]
mov byte [ebp - 4], 0x3d
cmp eax, 8
jb 0x5da510
inc eax
lea ecx, [ebp - 0xd4]
push eax
push dword [ebp - 0xd4]
call fcn.005d31d0
xor eax, eax
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xc0], 7
mov word [ebp - 0xd4], ax
mov byte [ebp - 4], 0x39
cmp dword [ebp - 0x84], eax
je 0x5da587
cmp dword [ebp - 0x80], 8
lea eax, [ebp - 0x94]
cmovae eax, dword [ebp - 0x94]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5da587
cmp dword [ebp - 0x80], 8
lea eax, [ebp - 0x94]
push 0
cmovae eax, dword [ebp - 0x94]
push 0
push 0
push str.exefile
push 0
push 5
push 0
push eax
push 0x64e394
push 0
call fcn.004b7be0
add esp, 0x28
mov eax, dword [ebp - 0x80]
mov byte [ebp - 4], 0x3e
cmp eax, 8
jb 0x5da5a6
inc eax
lea ecx, [ebp - 0x94]
push eax
push dword [ebp - 0x94]
call fcn.005d31d0
mov edi, dword [0x6d1ebc]
mov byte [ebp - 4], 0x2d
mov eax, dword [edi]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x64689c]
mov ecx, edi
call esi
mov eax, dword [ebp - 0x68]
mov byte [ebp - 4], 0x3f
cmp eax, 8
jb 0x5da5da
inc eax
lea ecx, [ebp - 0x7c]
push eax
push dword [ebp - 0x7c]
call fcn.005d31d0
xor eax, eax
mov dword [ebp - 0x6c], 0
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x68], 7
mov word [ebp - 0x7c], ax
call fcn.00436760
lea ecx, [ebp - 0x44]
call fcn.004080a0
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ce525
mov esp, ebp
pop ebp
ret
call fcn.006207e0
call fcn.006207e0
call fcn.006207e0
call fcn.006207e0
int3