Function at 0x56424a
Capabilities:
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1e4
xor eax, eax
push ebx
cmp dword [0x6b7010], eax
push esi
push edi
mov byte [ebp - 1], 0x20
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], eax
jne 0x564702
cmp word [0x6b2708], ax
jne 0x5643e3
cmp dword [ebp + 0x10], 5
jne 0x564702
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [0x6b2704]
test eax, eax
mov dword [ebp - 0x18], esi
je 0x5642bb
lea ecx, [ebp - 0x18]
push ecx
push eax
call fcn.005a4af7
pop ecx
test ax, ax
pop ecx
jne 0x5646a1
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x5646a1
mov ebx, dword [ebp + 0x18]
test ebx, ebx
jle 0x5646a1
xor eax, eax
test ebx, ebx
jle 0x5642e6
cmp byte [eax + edi], 0x20
jb 0x5646a1
inc eax
cmp eax, ebx
jl 0x5642d7
mov eax, dword [0x6b2700]
test eax, eax
je 0x564334
lea ecx, [ebp - 0x18]
push ecx
push eax
call fcn.005a4af7
mov esi, eax
pop ecx
test esi, esi
pop ecx
je 0x564334
xor edx, edx
test ebx, ebx
jle 0x56432d
mov cl, byte [edx + edi]
movzx ebx, byte [esi + 0x18]
movsx eax, cl
cmp eax, ebx
jne 0x56431b
mov byte [edx + edi], 0x20
jmp 0x564327
cmp cl, 0x20
jbe 0x564327
mov al, 0x20
sub al, cl
mov byte [edx + edi], al
inc edx
cmp edx, dword [ebp + 0x18]
jl 0x564307
mov eax, dword [esi]
jmp 0x564705
push dword [ebp + 0x1c]
call fcn.004fda80
movzx esi, ax
lea eax, [ebp - 0x28]
push 4
push eax
push str.technology
push dword [ebp + 8]
call sub.CoolType.dll_Ordinal_17
mov ebx, eax
add esp, 0x14
cmp ebx, 1
jne 0x5643b5
lea eax, [ebp - 0x90]
push 0x3c
push eax
push str.winlogfont
push dword [ebp + 8]
call sub.CoolType.dll_Ordinal_17
mov edi, dword [ebp - 0x28]
add esp, 0x10
test eax, eax
mov edx, 0x8c
je 0x564389
cmp esi, edx
jne 0x564389
cmp edi, ebx
je 0x5643b3
test eax, eax
mov ecx, 0x8a
je 0x56439a
cmp esi, ecx
jne 0x56439a
test edi, edi
je 0x5643b3
cmp esi, 0x88
je 0x5643aa
cmp esi, ecx
je 0x5643aa
cmp esi, edx
jne 0x5643b3
test edi, edi
je 0x5643b5
cmp edi, 1
je 0x5643b5
xor ebx, ebx
test ebx, ebx
jne 0x5643e3
cmp dword [0x6b2704], ebx
jne 0x5643c6
call fcn.00564722
cmp dword [0x6b2704], 0
mov dword [ebp - 0x38], 1
jne 0x5643db
call fcn.00564722
lea eax, [ebp - 0x38]
jmp 0x5646ef
call fcn.00593582
mov ecx, dword [eax]
xor ebx, ebx
mov dword [ebp - 0xe0], ecx
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0x34], eax
mov dword [eax], ecx
lea eax, [ebp - 0xd0]
push ebx
push eax
call fcn.005e81c8
pop ecx
test eax, eax
pop ecx
jne 0x5646a5
push dword [ebp + 0x1c]
call fcn.004fdb5a
mov edi, eax
pop ecx
cmp edi, ebx
mov dword [ebp - 8], edi
mov esi, 0x104
je 0x5644b9
cmp dword [edi + 0x80], ebx
je 0x564491
mov eax, dword [0x6ae1ac]
cmp eax, ebx
je 0x564479
push 0xc
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 1
pop ebx
cmp eax, ebx
jne 0x56447c
push dword [edi + 0x80]
call fcn.005968b1
cmp ax, 0x1a2
pop ecx
je 0x564491
push dword [edi + 0x80]
call fcn.005968b1
pop ecx
cmp ax, si
jmp 0x56448c
push 1
pop ebx
push dword [edi + 0x80]
call fcn.005968b1
pop ecx
cmp ax, 0x1a2
je 0x564491
mov dword [ebp - 0x1c], ebx
xor ebx, ebx
mov eax, dword [edi]
test eax, eax
je 0x5644a6
push eax
call fcn.005968b1
cmp ax, 0x1a2
pop ecx
je 0x5644b4
inc ebx
add edi, 4
cmp ebx, 0xff
jl 0x564493
jmp 0x5644b7
mov byte [ebp - 1], bl
xor ebx, ebx
cmp word [ebp - 0x1c], bx
je 0x5644ca
push 0x20030001
call fcn.00593610
pop ecx
cmp dword [0x6b2700], ebx
jne 0x5644d7
call fcn.0056470a
push esi
push 1
call fcn.0059b47d
mov edi, eax
push esi
push 1
mov dword [ebp - 0x10], edi
call fcn.0059b47d
add esp, 0x10
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1e4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov ebx, eax
push edi
push 0
lea eax, [ebp - 0x1e4]
push 0x68f67c
push eax
call esi
push dword [ebp - 0xc]
inc eax
push eax
lea eax, [ebp - 0x1e4]
push 0x68e744
push eax
call esi
push dword [ebp - 8]
add ebx, edi
lea eax, [ebp - 0x2a]
push ebx
push edi
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0056473a
add esp, 0x18
test ax, ax
jne 0x564555
push 0x20030001
call fcn.00593610
pop ecx
cmp dword [ebp - 8], 0
je 0x564564
push dword [ebp - 8]
call fcn.004fdc58
pop ecx
lea eax, [ebp - 0x90]
xor edi, edi
push 0x3c
push eax
mov dword [ebp - 8], edi
call fcn.0059ac37
lea eax, [ebp - 0x90]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.0053a878
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
add esp, 0x14
push 2
push dword [ebp - 0x10]
call esi
push 2
push dword [ebp - 0xc]
call esi
push 0x58
push 1
call fcn.0059b47d
mov ebx, eax
push 0xf
pop ecx
lea esi, [ebp - 0x90]
mov dword [ebx], 0x564208
mov dword [ebx + 0xc], edi
mov dword [ebx + 8], edi
lea edi, [ebx + 0x10]
rep movsd dword es:[edi], dword [esi]
push ebx
mov dword [ebp - 0x20], ebx
mov word [ebx + 0x4c], 0x7fff
call fcn.004ec9e8
mov esi, eax
add esp, 0xc
test esi, esi
mov dword [ebp - 0x24], esi
jne 0x5645eb
push 0x20030001
call fcn.00593610
pop ecx
mov eax, dword [ebp - 0xc]
push dword [ebp + 0x1c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x10]
xor edi, edi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ebx
call fcn.005005bb
mov bl, byte [ebp - 1]
cmp dword [0x6b2700], edi
pop ecx
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], bl
jne 0x564621
call fcn.0056470a
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [0x6b2700]
call fcn.005a4c2f
lea eax, [ebp - 0x90]
push eax
push str.winlogfont
push esi
call sub.CoolType.dll_Ordinal_12
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xe0]
push dword [ebp + 0x1c]
mov dword [eax], ecx
call fcn.005005bb
add esp, 0x1c
cmp eax, edi
je 0x56466a
push 1
push eax
call fcn.004ead64
pop ecx
pop ecx
mov edx, dword [ebp + 0x14]
cmp edx, edi
je 0x5646a1
cmp dword [ebp + 0x18], edi
jle 0x5646a1
xor ecx, ecx
cmp dword [ebp + 0x18], edi
jle 0x5646a1
movzx edi, bl
mov al, byte [ecx + edx]
movsx ebx, al
cmp ebx, edi
jne 0x564690
mov byte [ecx + edx], 0x20
jmp 0x56469b
cmp al, 0x20
jbe 0x56469b
mov bl, 0x20
sub bl, al
mov byte [ecx + edx], bl
inc ecx
cmp ecx, dword [ebp + 0x18]
jl 0x564680
mov eax, esi
jmp 0x564705
cmp dword [ebp - 8], ebx
je 0x5646b3
push dword [ebp - 8]
call fcn.004fdc58
pop ecx
push 1
lea eax, [ebp - 0x18]
pop esi
push esi
push eax
push dword [ebp - 0x10]
push dword [ebp - 0xc]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.0056411e
add esp, 0x18
cmp dword [0x6b2704], ebx
jne 0x5646dc
call fcn.00564722
cmp dword [0x6b2704], ebx
mov dword [ebp - 0x30], esi
jne 0x5646ec
call fcn.00564722
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [0x6b2704]
call fcn.005a4c2f
add esp, 0xc
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret