Function at 0x5d28c0
Capabilities:
Get file size
Read file on windows
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3a8]
sub esp, 0x3a8
push 0xffffffffffffffff
push 0x667120
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x758898]
xor eax, ebp
mov dword [ebp + 0x3a4], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x18], edi
mov ebx, dword [ebp + 0x3b0]
mov dword [ebp - 0x2c], ebx
mov eax, dword [ebp + 0x3b4]
mov dword [ebp - 0x38], eax
mov dword [ebp - 4], 0
test ebx, ebx
je 0x5d2eba
call fcn.005cbb10
mov byte [ebp - 0x11], 1
mov byte [ebp - 0x12], 0
cmp dword [0x75f81c], 0
jne 0x5d2945
cmp dword [0x75f810], 0
je 0x5d2e76
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x28], esi
cmp esi, 0xffffffff
je 0x5d2e76
mov ebx, 0x100
mov dword [ebp - 0x24], ebx
push 0x101
push 0
lea ecx, [ebp + 0x2a0]
push ecx
call fcn.00620920
add esp, 0xc
mov dword [ebp - 0x1c], 0
push 0
lea edx, [ebp - 0x1c]
push edx
push ebx
lea eax, [ebp + 0x2a0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5d2e60
cmp dword [ebp - 0x1c], 0
jbe 0x5d2e60
cmp dword [0x75f81c], 0
je 0x5d2b2a
mov byte [ebp - 4], 1
mov dword [ebp - 0x20], 0
push 0
lea ecx, [ebp - 0x20]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x1c]
push edx
lea eax, [ebp + 0x2a0]
push eax
push 0
push 0
call dword [0x75f81c]
test eax, eax
jne 0x5d2b11
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x5d2b11
mov byte [ebp - 0x11], 0
push eax
lea ecx, [edi + 0xcc]
call fcn.0040e130
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov dword [ebp - 4], 1
jmp 0x5d2a36
mov esi, dword [ebp - 0x18]
add esi, 0xcc
mov eax, dword [esi]
push str.application_octet_stream
push eax
call fcn.00621d5e
add esp, 8
test eax, eax
je 0x5d2a7b
mov eax, dword [esi]
push 0x67e818
push eax
call fcn.00621d5e
add esp, 8
test eax, eax
je 0x5d2a7b
mov eax, dword [esi]
push str.text_html
push eax
call fcn.00621d5e
add esp, 8
test eax, eax
jne 0x5d2a88
cmp dword [0x75f810], 0
je 0x5d2a88
mov byte [ebp - 0x11], 1
mov eax, dword [esi]
push str.application_octet_stream
push eax
call fcn.00621d5e
add esp, 8
test eax, eax
jne 0x5d2b11
cmp dword [ebp - 0x1c], 7
jb 0x5d2b11
cmp byte [ebp + 0x2a0], 0x46
jne 0x5d2b11
cmp byte [ebp + 0x2a1], 0x4c
jne 0x5d2b11
cmp byte [ebp + 0x2a2], 0x56
jne 0x5d2b11
mov al, 1
mov cl, byte [ebp + 0x2a4]
test cl, cl
jns 0x5d2acb
xor al, al
test cl, 0x40
je 0x5d2ad2
xor al, al
test cl, 0x20
je 0x5d2ad9
xor al, al
test cl, 0x10
je 0x5d2ae0
xor al, al
test cl, 2
je 0x5d2ae7
xor al, al
mov cl, byte [ebp + 0x2a3]
test cl, cl
je 0x5d2b11
cmp cl, 2
ja 0x5d2b11
test al, al
je 0x5d2b11
push str.video_x_flv
push 0x678ea8
push esi
call fcn.00402f80
add esp, 0xc
mov byte [ebp - 0x11], 0
mov dword [ebp - 4], 0
jmp 0x5d2b2a
cmp dword [0x75f810], 0
je 0x5d2e60
cmp byte [ebp - 0x11], 0
je 0x5d2e60
push 0x2a0
push 0
lea edx, [ebp]
push edx
call fcn.00620920
add esp, 0xc
mov byte [ebp], 1
xor edi, edi
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x5d2b7d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x5d2c13
push 1
push 0
push 0
mov edx, dword [ebp - 0x24]
push edx
call fcn.00624b80
xor ecx, ecx
add eax, esi
adc edx, ecx
js 0x5d2c13
jg 0x5d2b9d
cmp eax, 0x100
jbe 0x5d2c13
test edx, edx
jg 0x5d2baf
jl 0x5d2baa
cmp eax, 0x1388
jae 0x5d2baf
mov dword [ebp - 0x30], edx
jmp 0x5d2bb7
mov eax, 0x1388
mov dword [ebp - 0x30], ecx
mov ebx, eax
push ebx
call fcn.005f4522
add esp, 4
mov esi, eax
test esi, esi
je 0x5d2c13
mov dword [ebp - 0x1c], edi
push 0
push 0
push 0
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x1c]
push eax
push ebx
push esi
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5d2c08
mov eax, dword [ebp - 0x1c]
test eax, eax
jbe 0x5d2c08
lea edx, [ebp]
push edx
push 0
push eax
push esi
call dword [0x75f810]
mov edi, eax
push esi
call fcn.005f4517
add esp, 4
jmp 0x5d2c2c
lea eax, [ebp]
push eax
push 0
mov ecx, dword [ebp - 0x1c]
push ecx
lea edx, [ebp + 0x2a0]
push edx
call dword [0x75f810]
mov edi, eax
test edi, edi
je 0x5d2c39
cmp edi, 0xffffffff
je 0x5d2c39
mov byte [ebp - 0x11], 0
cmp edi, 3
jne 0x5d2cb1
mov edi, dword [ebp - 0x18]
mov eax, dword [edi + 0x138]
mov edx, dword [edi + 0x13c]
mov ecx, dword [ebp - 0x1c]
xor esi, esi
cmp eax, ecx
jne 0x5d2c64
cmp edx, esi
jne 0x5d2c64
test edx, edx
jg 0x5d2c6c
jl 0x5d2c64
test eax, eax
ja 0x5d2c6c
cmp ebx, 0x1388
jb 0x5d2cc0
mov edi, 1
lea eax, [ebp + 0x12d]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5d2c80
sub eax, edx
je 0x5d2de4
push 0x6b6c40
lea eax, [ebp + 0x12d]
push eax
call fcn.00621d5e
add esp, 8
test eax, eax
jne 0x5d2cd9
push 0x67e818
jmp 0x5d2d87
cmp edi, 1
je 0x5d2c71
cmp edi, 2
je 0x5d2c71
jmp 0x5d2e60
mov byte [ebp - 0x12], 1
push 0x67997c
lea ecx, [edi + 0xcc]
call fcn.0054f250
jmp 0x5d2e60
push 0x67f8c0
lea edx, [ebp + 0x12d]
push edx
call fcn.00621d5e
add esp, 8
test eax, eax
je 0x5d2d82
push str.html
lea eax, [ebp + 0x12d]
push eax
call fcn.00621d5e
add esp, 8
test eax, eax
je 0x5d2d82
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebx + 0xa4]
cmp byte [esi], 0x2e
jne 0x5d2d1c
inc esi
cmp dword [0x75f814], 0
je 0x5d2d65
lea ecx, [ebp + 0x12d]
push ecx
push esi
call fcn.00621d5e
add esp, 8
test eax, eax
je 0x5d2d65
push 0
push esi
lea edx, [ebp + 0xc9]
push edx
call dword [0x75f814]
cmp eax, 1
jne 0x5d2d65
push esi
push str.idmcheckedtype__s
add ebx, 0xcc
push ebx
call fcn.00402f80
add esp, 0xc
jmp 0x5d2d99
lea eax, [ebp + 0x12d]
push eax
push str.idmcheckedtype__s
add ebx, 0xcc
push ebx
call fcn.00402f80
add esp, 0xc
jmp 0x5d2d99
push str.text_html
mov ecx, dword [ebp - 0x18]
add ecx, 0xcc
push ecx
call fcn.00402f80
add esp, 8
cmp edi, 2
jne 0x5d2e60
mov edx, dword [ebp - 0x18]
test dword [edx + 0x15c], 0x100
je 0x5d2e60
mov eax, dword [ebp + 0x160]
mov ecx, edx
mov dword [ecx + 0x374], eax
mov dword [ebp - 0x30], eax
push 4
lea eax, [ebp - 0x30]
push eax
push 4
push 0
push str.exLenToSkip
mov ecx, dword [ecx + 0x48c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x5d2e60
lea eax, [ebp + 0xc9]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5d2df0
sub eax, edx
je 0x5d2e60
push str.application_octet_stream
lea edx, [ebp + 0xc9]
push edx
call fcn.00621d5e
add esp, 8
test eax, eax
je 0x5d2e60
push 0x67e818
lea eax, [ebp + 0xc9]
push eax
call fcn.00621d5e
add esp, 8
test eax, eax
je 0x5d2e60
push str.text_html
lea ecx, [ebp + 0xc9]
push ecx
call fcn.00621d5e
add esp, 8
test eax, eax
je 0x5d2e60
lea edx, [ebp + 0xc9]
push edx
push 0x678ea8
mov eax, dword [ebp - 0x18]
add eax, 0xcc
push eax
call fcn.00402f80
add esp, 0xc
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x11], 0
je 0x5d2ee1
mov edi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
call fcn.005d61e0
mov byte [ebp - 4], 5
push ebx
lea ecx, [ebp - 0x24]
call fcn.005d6200
mov edx, dword [ebp - 0x38]
mov dword [edx], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.005d61f0
cmp byte [ebp - 0x12], 0
jne 0x5d2eb3
mov byte [edi + 0x33e], 1
mov dword [edi + 0xb0], 3
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x3a4]
xor ecx, ebp
call fcn.0062023e
add ebp, 0x3a8
mov esp, ebp
pop ebp
ret 8
cmp byte [ebp - 0x12], 0
jne 0x5d2eb3
mov edi, dword [ebp - 0x18]
mov edx, dword [edi + 0xcc]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5d2ef5
sub eax, esi
je 0x5d2ea2
push str.text_html
push edx
call fcn.00621d5e
add esp, 8
neg eax
sbb eax, eax
add eax, 1
mov ebx, dword [ebp - 0x38]
mov dword [ebx], eax
jne 0x5d2ea2
cmp dword [edi + 0x3c], 0
jne 0x5d2f2f
test byte [edi + 0x15c], 8
je 0x5d2ea2
mov esi, dword [edi + 0xa4]
mov eax, esi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5d2f40
sub eax, edx
je 0x5d2ea2
cmp byte [esi], 0x2e
jne 0x5d2f55
inc esi
push 0x100
push esi
lea eax, [ebp + 0x2a0]
push eax
call fcn.00405490
lea ecx, [ebp + 0x2a0]
push ecx
call fcn.00626ff1
add esp, 0x10
lea ecx, [ebp - 0x20]
call fcn.00402510
mov byte [ebp - 4], 6
lea edx, [ebp + 0x2a0]
push edx
push 0x6b5b68
lea eax, [ebp - 0x20]
push eax
call fcn.00402f80
push 0x6b6c40
push esi
call fcn.00621d5e
add esp, 0x14
test eax, eax
je 0x5d2fd9
mov ecx, dword [ebp - 0x20]
push ecx
push str._3GP_7Z_AAC_ACE_AIF_APK_ARJ_ASF_AVI_BIN_BZ2_DOC_DOCX_EXE_FLV_GZ_GZIP_IMG_ISO_LZH_M4A_M4V_MKV_MOV_MP3_MP4_MPA_MPE_MPEG_MPG_MSI_MSU_OGG_OGV_PDF_PLJ_PPS_PPT_QT_R0_R1_RA_RAR_RM_RMVB_SEA_SIT_SITX_TAR_TIF_TIFF_WAV_WEBM_WMA_WMV_Z_ZIP
call fcn.006218e0
add esp, 8
test eax, eax
je 0x5d2fd9
mov eax, dword [edi + 0xcc]
push 0x67e818
push eax
call fcn.00621d5e
add esp, 8
neg eax
sbb eax, eax
inc eax
mov dword [ebx], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00402580
jmp 0x5d2ea2