Function at 0x5e7730
Capabilities:
Create process on windows
Enumerate files on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x641958
mov eax, dword fs:[0]
push eax
sub esp, 0x558
mov eax, dword [0x6ccc30]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0061e8c0
add esp, 0xc
mov dword [ebp - 0x524], 0
lea eax, [ebp - 0x524]
push eax
push fcn.005f76d0
push 6
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x5e7e3b
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x524]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
dec eax
cmp eax, 0x102
ja 0x5e7e3b
xor eax, eax
mov dword [ebp - 0x220], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5e77e3
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x230]
call fcn.005d2810
push 0xffffffffffffffff
push 0x650764
lea ecx, [ebp - 0x230]
call fcn.005e7e60
mov esi, eax
mov ecx, dword [ebp - 0x21c]
mov dword [ebp - 4], 0
cmp ecx, 8
jb 0x5e783e
inc ecx
push ecx
push dword [ebp - 0x230]
lea ecx, [ebp - 0x230]
call fcn.005d31d0
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov word [ebp - 0x230], ax
cmp esi, 0xffffffff
je 0x5e7e3b
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], 7
lea edx, [ecx + 2]
mov word [ebp - 0x230], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5e7877
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x230]
call fcn.005d2810
push esi
push 0
lea eax, [ebp - 0x2d0]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebp - 0x230]
call fcn.005e7ff0
mov eax, dword [ebp - 0x21c]
mov byte [ebp - 4], 4
cmp eax, 8
jb 0x5e78d7
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.005d31d0
push 7
xor eax, eax
mov byte [ebp - 4], 3
push str.cef_
lea ecx, [ebp - 0x2d0]
mov word [ebp - 0x230], ax
call fcn.005d7ff0
push eax
lea ecx, [ebp - 0x288]
call fcn.005d2ed0
cmp dword [ebp - 0x274], 8
lea ecx, [ebp - 0x520]
lea eax, [ebp - 0x288]
mov byte [ebp - 4], 5
cmovae eax, dword [ebp - 0x288]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x5e7dc8
lea eax, [ebp - 0x520]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push esi
test eax, eax
je 0x5e7dc2
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
xorps xmm0, xmm0
movups xmmword [ebp - 0x270], xmm0
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x264], eax
mov dword [ebp - method.PDFHandlerSwitcher.virtual_0], vtable.PDFHandlerBrowserSwitcher.0
push str._CLEANUP_CEFFOLDER1_DISABLE_FIU_CHECK1
lea ecx, [ebp - 0x2a0]
mov byte [ebp - 4], 7
call fcn.005d49c0
push 3
push 0x6507d4
lea ecx, [ebp - 0x2a0]
mov byte [ebp - 4], 8
call fcn.005d7ff0
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x270]
call fcn.005fa890
test al, al
je 0x5e7c56
push 0x6507dc
lea ecx, [ebp - 0x2b8]
call fcn.005d49c0
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push dword [ebp - 0x220]
cmovae eax, dword [ebp - 0x230]
lea ecx, [ebp - 0x2b8]
push eax
mov byte [ebp - 4], 9
call fcn.005d7ff0
cmp dword [ebp - 0x28c], 8
lea eax, [ebp - 0x2a0]
push dword [ebp - 0x290]
cmovae eax, dword [ebp - 0x2a0]
lea ecx, [ebp - 0x2b8]
push eax
call fcn.005d7ff0
xor eax, eax
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 7
mov word [ebp - 0x260], ax
push eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x260]
push 0x105
lfence
call fcn.005fa4d0
cmp dword [ebp - 0x24c], 8
lea eax, [ebp - 0x260]
cmovae eax, dword [ebp - 0x260]
push eax
push dword [ebp - 0x250]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x5e7d6c
cmp eax, dword [ebp - 0x250]
ja 0x5e7d6c
xor eax, eax
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 7
mov word [ebp - 0x248], ax
push eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x248]
push 0x105
lfence
call fcn.005fa4d0
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
push dword [ebp - 0x238]
cmovae eax, dword [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x5e7d24
cmp eax, dword [ebp - 0x238]
ja 0x5e7d24
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x5e7d24
push 0x38
lea eax, [ebp - 0x55c]
mov dword [ebp - 0x560], 0x3c
push 0
push eax
call fcn.0061e8c0
add esp, 0xc
mov dword [ebp - 0x544], 0
cmp dword [ebp - 0x2a4], 8
lea eax, [ebp - 0x2b8]
mov dword [ebp - 0x550], 0x6507e4
cmovae eax, dword [ebp - 0x2b8]
cmp dword [ebp - 0x234], 8
mov dword [ebp - 0x54c], eax
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
mov dword [ebp - 0x548], eax
lea eax, [ebp - 0x560]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp dword [ebp - 0x24c], 8
lea ecx, [ebp - 0x260]
mov esi, eax
cmovae ecx, dword [ebp - 0x260]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test esi, esi
je 0x5e7bcd
mov byte [ebp - 0x561], 1
jmp 0x5e7d2b
mov eax, dword [ebp - 0x234]
mov byte [ebp - 4], 0x1b
cmp eax, 8
jb 0x5e7bef
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.005d31d0
xor eax, eax
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 7
mov word [ebp - 0x248], ax
mov eax, dword [ebp - 0x24c]
mov byte [ebp - 4], 0x1c
cmp eax, 8
jb 0x5e7c2e
inc eax
lea ecx, [ebp - 0x260]
push eax
push dword [ebp - 0x260]
call fcn.005d31d0
xor eax, eax
mov dword [ebp - 0x250], 0
lea ecx, [ebp - 0x2b8]
mov dword [ebp - 0x24c], 7
mov word [ebp - 0x260], ax
call fcn.005d4a10
mov byte [ebp - 0x561], 0
mov eax, dword [ebp - 0x28c]
mov byte [ebp - 4], 0x1d
cmp eax, 8
jb 0x5e7c7f
inc eax
lea ecx, [ebp - 0x2a0]
push eax
push dword [ebp - 0x2a0]
call fcn.005d31d0
mov dword [ebp - method.PDFHandlerSwitcher.virtual_0], vtable.PDFHandlerSwitcher.0
mov esi, dword [ebp - 0x26c]
mov byte [ebp - 4], 0x1e
test esi, esi
je 0x5e7cf9
mov edi, dword [ebp - 0x268]
cmp esi, edi
je 0x5e7cb5
mov ecx, esi
call fcn.005d6b70
add esi, 0x30
cmp esi, edi
jne 0x5e7ca1
mov esi, dword [ebp - 0x26c]
mov ecx, dword [ebp - 0x264]
mov eax, 0x2aaaaaab
sub ecx, esi
imul ecx
lea ecx, [ebp - 0x26c]
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push esi
call fcn.005fa680
mov dword [ebp - 0x26c], 0
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x264], 0
mov eax, dword [ebp - 0x21c]
mov byte [ebp - 4], 0x1f
cmp eax, 8
jb 0x5e7dcf
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.005d31d0
jmp 0x5e7dcf
mov byte [ebp - 0x561], 0
mov eax, dword [ebp - 0x234]
mov byte [ebp - 4], 0x17
cmp eax, 8
jb 0x5e7d4d
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.005d31d0
xor eax, eax
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 7
mov word [ebp - 0x248], ax
jmp 0x5e7d73
mov byte [ebp - 0x561], 0
mov eax, dword [ebp - 0x24c]
mov byte [ebp - 4], 0x18
cmp eax, 8
jb 0x5e7d95
inc eax
lea ecx, [ebp - 0x260]
push eax
push dword [ebp - 0x260]
call fcn.005d31d0
xor eax, eax
mov dword [ebp - 0x250], 0
lea ecx, [ebp - 0x2b8]
mov dword [ebp - 0x24c], 7
mov word [ebp - 0x260], ax
call fcn.005d4a10
jmp 0x5e7c5d
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 0x561], 0
mov eax, dword [ebp - 0x274]
mov byte [ebp - 4], 0x20
cmp eax, 8
jb 0x5e7df1
inc eax
lea ecx, [ebp - 0x288]
push eax
push dword [ebp - 0x288]
call fcn.005d31d0
xor eax, eax
mov dword [ebp - 0x278], 0
mov dword [ebp - 0x274], 7
mov word [ebp - 0x288], ax
mov ecx, dword [ebp - 0x2bc]
mov dword [ebp - 4], 0x21
cmp ecx, 8
jb 0x5e7e33
inc ecx
push ecx
push dword [ebp - 0x2d0]
lea ecx, [ebp - 0x2d0]
call fcn.005d31d0
mov al, byte [ebp - 0x561]
jmp 0x5e7e3d
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ce525
mov esp, ebp
pop ebp
ret