Function at 0x53ef00
Capabilities:
Check if file exists
Copy file
Create directory
Get file attributes
Get file size
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5aeba4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x33a08
call fcn.0056c9b0
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], esi
mov edx, dword [esi + 0x400]
mov dword [ebp - 4], 0
test edx, edx
jne 0x53f1f9
mov al, byte [esi + 0x88a]
test al, al
je 0x53f1f9
mov eax, dword [0x65ec1c]
mov dword [ebp - 0x20], eax
mov ecx, dword [esi + 0x4c]
lea edx, [ebp - 0x20]
push ecx
push 0x638fa8
push edx
mov byte [ebp - 4], 1
call fcn.0058148b
mov eax, dword [ebp - 0x20]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x53f07f
mov edi, 2
inc edi
lea ecx, [ebp - 0x20]
push edi
push 0x5c
call fcn.00588b2f
mov edi, eax
cmp edi, 0xffffffff
je 0x53f07f
lea ecx, [ebp - 0x24]
push edi
push ecx
lea ecx, [ebp - 0x20]
call fcn.0058108d
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
lea ecx, [ebp - 0x24]
sete bl
call fcn.005886c0
test bl, bl
je 0x53ef8a
lea edx, [ebp - 0x14]
push edi
push edx
lea ecx, [ebp - 0x20]
call fcn.0058108d
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
lea ecx, [ebp - 0x14]
sete bl
call fcn.005886c0
test bl, bl
je 0x53ef8a
mov eax, dword [0x65ec1c]
mov dword [ebp - 0x14], eax
push 0
lea ecx, [ebp - 0x18]
push 0
push ecx
push 0x400
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, dword [ebp - 0x18]
mov eax, dword [0x6643bc]
push edx
lea ecx, [ebp - 0x14]
push eax
push ecx
call fcn.0058148b
mov edx, dword [ebp - 0x18]
add esp, 0xc
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
push 0x30
push eax
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.005886c0
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0
call fcn.005886c0
mov eax, 0x7546
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x880]
xor ebx, ebx
cmp eax, ebx
je 0x53f1eb
cmp dword [esi + 0x884], ebx
je 0x53f1eb
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x18]
push edx
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push eax
push ebx
push 0xf003f
push ebx
push 0x663188
push ebx
push str.SoftwareDownloadManagerGrabberStsProjects_
push reloc.WSOCK32.dll_accept
call edi
cmp eax, ebx
jne 0x53f1eb
mov ecx, dword [ebp - 0x18]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call ebx
mov edx, dword [0x65ec1c]
mov dword [ebp - 0x14], edx
mov eax, dword [esi + 0x880]
lea ecx, [ebp - 0x14]
push eax
push str.SoftwareDownloadManagerGrabberStsProjects_ld_
push ecx
mov byte [ebp - 4], 3
call fcn.0058148b
add esp, 0xc
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push 0xf003f
push 0
push 0x663188
push 0
push ecx
push reloc.WSOCK32.dll_accept
call edi
test eax, eax
jne 0x53f1dd
mov edx, dword [ebp - 0x18]
push edx
call ebx
mov eax, dword [esi + 0x884]
mov ecx, dword [esi + 0x880]
push eax
push ecx
lea edx, [ebp - 0x14]
push str.SoftwareDownloadManagerGrabberStsProjects_ld_ld_
push edx
call fcn.0058148b
add esp, 0x10
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0x663188
push 0
push edx
push reloc.WSOCK32.dll_accept
call edi
test eax, eax
jne 0x53f1dd
mov edx, dword [esi + 0x50]
or ecx, 0xffffffff
mov edi, edx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
mov eax, dword [ebp - 0x18]
push str.LocalFileName
push eax
call ebx
mov edx, dword [esi + 0x4c]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [ebp - 0x18]
push edx
push 1
push eax
push str.LocalPath
push ecx
call ebx
lea edx, [esi + 0x430]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [ebp - 0x18]
push 1
push eax
push str.LogFileName
push edx
call ebx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.005886c0
xor ebx, ebx
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0
call fcn.005886c0
jmp 0x53f22f
mov al, byte [esi + 0x870]
test al, al
je 0x53f20b
mov ecx, dword [esi + 0x884]
jmp 0x53f20d
xor ecx, ecx
test al, al
je 0x53f219
mov eax, dword [esi + 0x880]
jmp 0x53f21b
xor eax, eax
push ecx
push eax
push edx
lea ecx, [esi + 0x20]
call fcn.00548200
mov byte [esi + 0x88a], 1
xor ebx, ebx
mov edx, dword [esi + 0x400]
lea ecx, [esi + 0x20]
push edx
call fcn.005479c0
mov eax, dword [esi + 0x18]
cmp eax, ebx
je 0x53f25d
mov ecx, dword [esi + 0x400]
push ecx
push 0x13cd
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 1
mov ecx, esi
mov dword [esi + 0x86c], ebx
mov dword [esi + 0x87c], ebx
call fcn.0053e5c0
lea ecx, [esi + 0x42c]
call fcn.004fbe90
mov edi, dword [esi + 0x38]
cmp edi, ebx
je 0x53f297
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x24], ecx
jne 0x53f3a8
mov eax, dword [esi + 0x44]
cmp eax, 2
je 0x53f2a8
cmp eax, 1
jne 0x53f3a8
mov eax, dword [esi + 0x24]
cmp eax, ebx
je 0x53f2da
push str._simtelnet_
push eax
call fcn.0056c6b0
add esp, 8
test eax, eax
je 0x53f2da
mov edx, dword [esi + 0x20]
push str.simtel.net
push edx
call fcn.0056c6b0
add esp, 8
test eax, eax
je 0x53f3a8
cmp dword [esi + 0x874], ebx
jne 0x53f3a8
mov eax, dword [0x65ec1c]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x34]
mov byte [ebp - 4], 4
cmp eax, 0x50
jne 0x53f300
cmp dword [esi + 0x44], 1
je 0x53f30d
cmp eax, 0x1bb
jne 0x53f320
cmp dword [esi + 0x44], 2
jne 0x53f320
lea ecx, [ebp - 0x28]
push 0x663188
push ecx
call fcn.0056d05a
add esp, 8
jmp 0x53f332
push eax
lea edx, [ebp - 0x28]
push str.:_ld
push edx
call fcn.0056d05a
add esp, 0xc
mov eax, dword [esi + 0x24]
cmp eax, ebx
mov edx, eax
jne 0x53f340
mov edx, 0x663188
cmp eax, ebx
je 0x53f350
mov cl, byte [eax]
cmp cl, 0x2f
mov ecx, 0x663188
je 0x53f355
mov ecx, 0x63addc
mov eax, dword [esi + 0x44]
cmp eax, 1
mov eax, 0x63925c
je 0x53f367
mov eax, 0x639174
push edx
mov edx, dword [esi + 0x20]
push ecx
lea ecx, [ebp - 0x28]
push ecx
push edx
push eax
lea eax, [ebp - 0x14]
push str._s:___s_s_s_s
push eax
call fcn.0058148b
mov ecx, dword [ebp - 0x14]
add esp, 0x1c
push ecx
mov ecx, esi
call fcn.00540df0
lea ecx, [ebp - 0x14]
mov byte [esi + 0x2dc], 1
mov byte [esi + 0x2dd], 1
mov byte [ebp - 4], 0
call fcn.005886c0
mov edx, dword [esi + 0x898]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
mov byte [esi + 0x2db], 0
mov dword [esi + 0xcc], ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp - 0x19], 0
je 0x53f629
push ebx
push ebx
push 3
push ebx
push 1
push closesocket
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x53f629
lea edx, [ebp - 0x24]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x408], eax
mov dword [esi + 0x40c], ebx
cmp dword [esi + 0x408], 0xffffffff
jne 0x53f42d
mov eax, ebx
cmp eax, ebx
jne 0x53f42d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
je 0x53f42d
mov dword [esi + 0x408], ebx
mov dword [esi + 0x40c], ebx
jmp 0x53f456
mov eax, dword [ebp - 0x24]
push 1
push ebx
push ebx
push eax
call fcn.0056ee00
mov ecx, dword [esi + 0x408]
add ecx, eax
mov dword [esi + 0x408], ecx
mov eax, dword [esi + 0x40c]
adc eax, edx
mov dword [esi + 0x40c], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x508770
push fcn.005084e0
push 0x10
lea ecx, [ebp - 0x33a18]
push 0x3320
push ecx
call fcn.0056d1f3
mov edx, dword [esi]
lea eax, [esi + 0x42c]
push edx
push eax
lea eax, [esi + 0x20]
lea ecx, [esi + 0x750]
push eax
lea eax, [ebp - 0x33a18]
push eax
push ecx
lea ecx, [ebp - 0x818]
mov byte [ebp - 4], 5
call fcn.00515a60
mov ecx, dword [esi + 0x878]
lea eax, [esi + 0x18]
mov dword [ebp - 0x804], eax
mov eax, dword [esi + 0x874]
lea edx, [esi + 0x1c]
push eax
mov eax, dword [esi + 0x880]
mov dword [ebp - 0x800], edx
mov edx, dword [esi + 0x884]
push ecx
push edx
mov edx, dword [esi + 0x400]
push eax
mov al, byte [esi + 0x870]
xor ecx, ecx
lea ebx, [esi + 0x14]
test al, al
sete cl
push ecx
push edx
lea ecx, [ebp - 0x818]
mov byte [ebp - 4], 6
mov dword [ebp - 0x808], ebx
mov dword [ebp - 0x760], ebx
call fcn.00537ee0
mov eax, dword [esi + 0x40c]
mov ecx, dword [esi + 0x408]
push 1
push eax
push ecx
lea ecx, [ebp - 0x818]
call fcn.005383b0
mov al, byte [esi + 0x870]
test al, al
je 0x53f53a
xor edi, edi
mov bl, 1
mov dword [esi + 0x86c], edi
jmp 0x53f5f8
mov edx, dword [esi + 0x50]
mov eax, dword [esi + 0x898]
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x53f5e2
mov edx, dword [esi + 0x408]
mov ecx, dword [esi + 0x40c]
mov eax, edx
mov dword [ebp - 0x6cc], ecx
mov dword [ebp - 0x6d0], eax
or eax, ecx
jne 0x53f587
mov dword [ebp - 0x6f8], 0
mov dword [ebp - 0x6f4], 0
mov dword [esi + 0x410], edx
mov dword [esi + 0x414], ecx
lea ecx, [ebp - 0x818]
mov dword [esi + 0x86c], 0
call fcn.00538180
mov dword [esi + 0x748], 3
mov eax, dword [esi + 0x5c]
xor edi, edi
mov byte [ebp - 0x19], 1
test eax, eax
je 0x53f5e5
mov eax, dword [ebx]
test eax, eax
je 0x53f5d7
push edi
push 0x138a
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 1
mov ecx, esi
call fcn.0053e050
jmp 0x53f5e5
mov edi, dword [ebp - 0x2c]
push 0x663188
lea ecx, [esi + 0x898]
call fcn.00588849
mov bl, byte [ebp - 0x19]
lea ecx, [ebp - 0x818]
mov byte [ebp - 4], 5
call fcn.00515b20
push 0x508770
push 0x10
lea eax, [ebp - 0x33a18]
push 0x3320
push eax
mov byte [ebp - 4], 0
call fcn.0056c0d8
test bl, bl
jne case.default.0x53f634
jmp 0x53f62c
mov edi, dword [ebp - 0x2c]
mov eax, dword [esi + 0x44]
cmp eax, 4
ja case.default.0x53f634
jmp dword [eax*4 + 0x53f6dc]
mov ecx, esi
call fcn.0053af80
jmp 0x53f65d
mov ecx, esi
call fcn.00539dd0
jmp 0x53f65d
mov ecx, esi
call fcn.0053a3a0
jmp 0x53f65d
mov ecx, esi
call fcn.0053a8e0
mov edi, eax
mov byte [esi + 0x2e1], 0
mov byte [esi + 0x178], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret