Function at 0x5b6da0
Capabilities:
Delete file
Get thread local storage value

Disassembly:
mov eax, dword [0x6eecc0]
sub esp, 0xcc
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call edi
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jne 0x5b6dfc
call fcn.005b6b30
test eax, eax
jne 0x5b6ddb
pop edi
pop esi
pop ebp
mov eax, 4
pop ebx
add esp, 0xcc
ret 4
mov ecx, dword [0x6eecc0]
push ecx
call edi
mov esi, eax
cmp esi, ebx
jne 0x5b6dfc
pop edi
pop esi
pop ebp
mov eax, 4
pop ebx
add esp, 0xcc
ret 4
cmp dword [esi + 0x8a], ebx
je 0x5b6e37
mov edx, dword [esp + 0xe0]
mov dword [esi + 0x3c16], ebx
push esi
mov eax, dword [edx + 0x2c]
push eax
push 0x6a1e40
push 1
call fcn.005baba0
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret 4
mov edi, dword [esp + 0xe0]
mov dword [esi + 0x8a], 1
mov dword [esi + 0x3c16], ebx
mov dword [esi + 0x8e], ebx
mov dword [esi + 0x92], ebx
mov dword [esi + 0x1a2], ebx
mov dword [esi + 0x1a6], ebx
mov dword [esi + 0x1ae], ebx
mov dword [esi + 0x1aa], ebx
mov dword [esi + 0x1b6], ebx
mov dword [esi + 0x1b2], ebx
mov dword [esi + 0x1ba], ebx
mov dword [esi + 0x1be], ebx
mov dword [esi + 0x1de], ebx
mov dword [esi + 0x1e2], ebx
mov dword [esi + 0x1e6], ebx
mov dword [esi + 0x1ea], ebx
mov dword [esi + 0x1ee], ebx
mov dword [esi + 0x1f6], 0xffffffff
mov dword [esi + 0xb28], ebx
mov dword [esi + 0xb2c], ebx
mov ecx, dword [edi + 0x88]
push edi
mov dword [esi + 0xb38], ecx
call fcn.005b7b90
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 4
lea edx, [esi + 0xa0c]
push 0x6a1e40
push edx
call ebp
lea eax, [esi + 0x908]
push 0x6a1e40
push eax
call ebp
mov eax, dword [edi]
sub eax, 0x94
je 0x5b6f1e
sub eax, 0xc
je 0x5b6f12
sub eax, 0x1c
mov dword [esi + 0xb3c], 0x12c
jmp 0x5b6f28
mov dword [esi + 0xb3c], 0xc8
jmp 0x5b6f28
mov dword [esi + 0xb3c], 0x64
lea ecx, [esp + 0x20]
push edi
push ecx
mov dword [esp + 0x28], 0xbc
call fcn.005b6c30
add esp, 8
test eax, eax
je 0x5b6f48
mov edx, dword [edi + 0x2c]
push esi
jmp 0x5b6f78
mov eax, dword [esp + 0xb4]
mov dword [esi + 0xb28], eax
mov ecx, dword [esp + 0xb8]
mov dword [esi + 0xb2c], ecx
mov eax, dword [esp + 0x24]
cmp eax, 6
mov eax, dword [esp + 0x28]
je 0x5b6fa0
cmp eax, ebx
jne 0x5b6fa0
mov edx, dword [esp + 0x4c]
push esi
push edx
push 0x6a1e40
push 0x10
call fcn.005baba0
add esp, 0x10
mov dword [esi + 0x8a], ebx
mov eax, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret 4
lea ebp, [esi + 0x5fc]
push eax
push ebp
call fcn.005ba770
mov ax, word [esp + 0xc4]
lea edi, [esi + 0x804]
mov word [esi + 0xdf0], ax
mov ecx, dword [esp + 0xc6]
shr ecx, 1
and ecx, 1
push edi
mov dword [esi + 0x92], ecx
mov edx, dword [esp + 0xca]
shr edx, 4
and edx, 1
mov dword [esp + 0x1c], edi
mov dword [esi + 0xe9c], edx
mov eax, dword [esp + 0xca]
shr eax, 5
and eax, 1
mov dword [esi + 0xea0], eax
mov ecx, dword [esp + 0xca]
shr ecx, 6
and ecx, 1
mov dword [esi + 0x1de], ecx
mov edx, dword [esp + 0xca]
shr edx, 7
and edx, 1
mov dword [esi + 0x1e2], edx
mov eax, dword [esp + 0xca]
shr eax, 9
and eax, 1
mov dword [esi + 0x1e6], eax
mov ecx, dword [esp + 0xca]
shr ecx, 0xa
and ecx, 1
mov dword [esi + 0x1ea], ecx
mov edx, dword [esp + 0xca]
shr edx, 8
and edx, 1
mov dword [esi + 0x1ee], edx
mov eax, dword [esp + 0xca]
shr eax, 0xe
and eax, 1
mov dword [esi + 0x1f2], eax
call fcn.005b7580
mov al, byte [esp + 0xca]
add esp, 0xc
test al, 1
je 0x5b7090
mov dword [esi + 0x5f4], 1
jmp 0x5b7096
mov dword [esi + 0x5f4], ebx
mov eax, dword [esp + 0xbc]
test ah, 0x80
je 0x5b7175
push ebp
call fcn.005be7a0
mov ebp, eax
push esi
push ebp
call fcn.005bdd10
add esp, 0xc
test eax, eax
jne 0x5b70d4
push esi
push 0x6a1e40
push ebx
push ebx
push ebx
push 5
call fcn.005bef50
mov ecx, dword [esp + 0x64]
push esi
push ecx
jmp 0x5b7115
cmp dword [esp + 0x24], 4
jne 0x5b7142
cmp dword [esp + 0x58], ebx
jne 0x5b7142
cmp dword [esp + 0x5c], ebx
jne 0x5b7142
cmp dword [esp + 0x68], ebx
jne 0x5b7142
mov edx, dword [esp + 0x2c]
push edx
push ebp
call fcn.005be850
add esp, 8
test eax, eax
je 0x5b7175
push esi
push 0x6a1e40
push ebx
push ebx
push ebx
push 6
call fcn.005bef50
mov eax, dword [esp + 0x64]
push esi
push eax
push 0x6a1e40
push 0x14
call fcn.005baba0
push edi
mov dword [esi + 0x8a], ebx
call fcn.005b75e0
add esp, 0x2c
mov eax, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret 4
mov ecx, dword [esp + 0x4c]
push esi
push ecx
push 0x6a1e40
push 0x14
call fcn.005baba0
push edi
mov dword [esi + 0x8a], ebx
call fcn.005b75e0
add esp, 0x14
mov eax, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret 4
push esi
call fcn.005bd8f0
mov ebp, 1
mov dword [esi + 0xb10], ebx
mov dword [esi + 0xb1c], ebx
mov dword [esi + 0xb30], ebp
mov edx, dword [esp + 0xcc]
add esp, 4
mov dword [esi + 0x1fa], edx
mov eax, dword [esp + 0xcc]
mov dword [esi + 0x1fe], eax
mov eax, dword [esp + 0xd0]
cmp eax, ebx
je 0x5b71d5
push 0x12c
lea ecx, [esi + 0x382]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov byte [esi + 0x4ad], bl
jmp 0x5b71e7
lea edx, [esi + 0x382]
push str.Compress_Progress
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esp + 0x38]
mov dword [esi + 0xb14], eax
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0xb18], ecx
mov edx, dword [esp + 0x30]
mov dword [esi + 0xb20], edx
mov eax, dword [esp + 0x34]
mov dword [esi + 0xb24], eax
mov eax, dword [esp + 0x24]
cmp eax, ebx
jle 0x5b7549
cmp eax, 7
jg 0x5b7549
test byte [esi + 0xdf1], 0x80
je 0x5b737d
cmp dword [esp + 0x50], ebx
je 0x5b737d
cmp dword [esp + 0x54], ebx
je 0x5b737d
mov dword [esi + 0x96], 0xffffffff
mov ecx, dword [esp + 0x54]
lea ebp, [esi + 0x700]
push ecx
push ebp
call fcn.005ba770
push ebp
call fcn.005be7a0
push esi
push eax
call fcn.005bdd10
add esp, 0x14
test eax, eax
jne 0x5b733c
push esi
push ebp
call fcn.005bdd90
add esp, 8
cmp eax, 0x200000
jl 0x5b733c
lea edi, [esi + 0x9a]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
call ebp
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [eax + esi + 0x99], 0x5c
je 0x5b72ba
push 0x6723a0
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x14]
push str.__XXXXXX
push edx
call ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edx, edx
mov ebp, 0x25
mov ecx, eax
div ebp
mov al, byte [edx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_]
mov byte [esp + 0x14], al
mov eax, 0xbacf914d
mul ecx
mov eax, ecx
mov ecx, ebp
sub eax, edx
shr eax, 1
add eax, edx
xor edx, edx
shr eax, 5
div ecx
lea eax, [esp + 0x14]
push eax
push edi
mov dl, byte [edx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_]
mov byte [esp + 0x1d], dl
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
call fcn.005e7567
add esp, 4
test eax, eax
je 0x5b7338
push ebx
push 0x8000080
push 2
push ebx
push ebx
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x96], eax
mov edi, dword [esp + 0x10]
cmp dword [esi + 0x96], 0xffffffff
jne 0x5b7378
mov ecx, dword [esp + 0x4c]
push esi
push ecx
push 0x6a1e40
push 0xa
call fcn.005baba0
push edi
mov dword [esi + 0x8a], ebx
call fcn.005b75e0
add esp, 0x14
mov eax, 0xa
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret 4
mov ebp, 1
cmp dword [esp + 0xd8], ebx
jl 0x5b73c2
cmp dword [esp + 0xd4], ebx
je 0x5b73c2
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x5b73c2
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x5b73c2
mov dword [esi + 0x1a2], ebp
mov edx, dword [esp + 0xd8]
mov dword [esi + 0x1ae], edx
mov eax, dword [esp + 0xd4]
mov dword [esi + 0x1b2], eax
mov eax, dword [esp + 0xc0]
cmp eax, ebx
je 0x5b73e6
mov ecx, dword [eax + 4]
mov dword [esi + 0x1d6], ecx
mov edx, dword [esp + 0xc0]
mov eax, dword [edx + 8]
mov dword [esi + 0x1da], eax
cmp dword [esp + 0x24], 6
jne 0x5b7427
mov eax, dword [esi + 0x1a2]
mov dword [esi + 0x1be], ebp
cmp eax, ebx
jne 0x5b741c
mov ecx, dword [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jg 0x5b741c
mov eax, dword [esp + 0xc0]
cmp eax, ebx
je 0x5b741c
cmp dword [eax + 4], ebx
jne 0x5b7427
mov edx, dword [esp + 0x4c]
push esi
push edx
jmp 0x5b754f
cmp dword [esp + 0x24], 7
jne 0x5b7463
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x5b74a3
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x5b74a3
mov eax, dword [esp + 0xc0]
cmp eax, ebx
je 0x5b74a3
cmp dword [eax + 4], ebx
je 0x5b74a3
mov dword [esi + 0x1a2], ebp
mov dword [esi + 0x1a6], ebp
mov dword [esi + 0x1ae], ebx
test byte [esp + 0xbe], 4
je 0x5b748c
mov dword [esi + 0x37a], ebx
mov dword [esi + 0x376], ebp
mov ecx, dword [esp + 0xbe]
and ecx, 8
push ecx
call fcn.005b8930
add esp, 4
mov eax, dword [esi + 0x1be]
push esi
cmp eax, ebx
je 0x5b74ae
lea edx, [esp + 0x24]
push edx
call fcn.005bd9f0
jmp 0x5b74b8
mov eax, dword [esp + 0x4c]
push esi
push eax
jmp 0x5b754f
lea eax, [esp + 0x24]
push eax
call fcn.005bbb50
mov ebp, eax
mov eax, dword [esi + 0x372]
add esp, 8
cmp eax, ebx
mov dword [esi + 0x376], ebx
je 0x5b74d8
call fcn.005b8a60
mov dword [esi + 0x37a], ebx
mov eax, dword [esi + 0x96]
cmp eax, 0xffffffff
je 0x5b7501
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esi + 0x9a]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [esi + 0x96], 0xffffffff
mov edx, dword [esp + 0x4c]
push esi
push edx
push 0x6a1e40
push ebp
call fcn.005baba0
push edi
mov dword [esi + 0x8a], ebx
call fcn.005b75e0
mov eax, dword [esi + 0xde0]
add esp, 0x14
cmp eax, ebx
je 0x5b753a
push eax
call fcn.005cebb0
add esp, 4
mov dword [esi + 0xde0], ebx
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret 4
mov ecx, dword [esp + 0x4c]
push esi
push ecx
push 0x6a1e40
push 0x10
call fcn.005baba0
push edi
mov dword [esi + 0x8a], ebx
call fcn.005b75e0
add esp, 0x14
mov eax, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret 4