Function at 0x564c80
Capabilities:
Delete file
Get thread local storage value

Disassembly:
mov eax, dword [0x685140]
sub esp, 0xcc
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call edi
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jne 0x564cdc
call fcn.00564a10
test eax, eax
jne 0x564cbb
pop edi
pop esi
pop ebp
mov eax, 4
pop ebx
add esp, 0xcc
ret 4
mov ecx, dword [0x685140]
push ecx
call edi
mov esi, eax
cmp esi, ebx
jne 0x564cdc
pop edi
pop esi
pop ebp
mov eax, 4
pop ebx
add esp, 0xcc
ret 4
cmp dword [esi + 0x8a], ebx
je 0x564d17
mov edx, dword [esp + 0xe0]
mov dword [esi + 0x3c16], ebx
push esi
mov eax, dword [edx + 0x2c]
push eax
push 0x638420
push 1
call fcn.00568a80
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret 4
mov edi, dword [esp + 0xe0]
mov dword [esi + 0x8a], 1
mov dword [esi + 0x3c16], ebx
mov dword [esi + 0x8e], ebx
mov dword [esi + 0x92], ebx
mov dword [esi + 0x1a2], ebx
mov dword [esi + 0x1a6], ebx
mov dword [esi + 0x1ae], ebx
mov dword [esi + 0x1aa], ebx
mov dword [esi + 0x1b6], ebx
mov dword [esi + 0x1b2], ebx
mov dword [esi + 0x1ba], ebx
mov dword [esi + 0x1be], ebx
mov dword [esi + 0x1de], ebx
mov dword [esi + 0x1e2], ebx
mov dword [esi + 0x1e6], ebx
mov dword [esi + 0x1ea], ebx
mov dword [esi + 0x1ee], ebx
mov dword [esi + 0x1f6], 0xffffffff
mov dword [esi + 0xb28], ebx
mov dword [esi + 0xb2c], ebx
mov ecx, dword [edi + 0x88]
push edi
mov dword [esi + 0xb38], ecx
call fcn.00565a70
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 4
lea edx, [esi + 0xa0c]
push 0x638420
push edx
call ebp
lea eax, [esi + 0x908]
push 0x638420
push eax
call ebp
mov eax, dword [edi]
sub eax, 0x94
je 0x564dfe
sub eax, 0xc
je 0x564df2
sub eax, 0x1c
mov dword [esi + 0xb3c], 0x12c
jmp 0x564e08
mov dword [esi + 0xb3c], 0xc8
jmp 0x564e08
mov dword [esi + 0xb3c], 0x64
lea ecx, [esp + 0x20]
push edi
push ecx
mov dword [esp + 0x28], 0xbc
call fcn.00564b10
add esp, 8
test eax, eax
je 0x564e28
mov edx, dword [edi + 0x2c]
push esi
jmp 0x564e58
mov eax, dword [esp + 0xb4]
mov dword [esi + 0xb28], eax
mov ecx, dword [esp + 0xb8]
mov dword [esi + 0xb2c], ecx
mov eax, dword [esp + 0x24]
cmp eax, 6
mov eax, dword [esp + 0x28]
je 0x564e80
cmp eax, ebx
jne 0x564e80
mov edx, dword [esp + 0x4c]
push esi
push edx
push 0x638420
push 0x10
call fcn.00568a80
add esp, 0x10
mov dword [esi + 0x8a], ebx
mov eax, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret 4
lea ebp, [esi + 0x5fc]
push eax
push ebp
call fcn.00568650
mov ax, word [esp + 0xc4]
lea edi, [esi + 0x804]
mov word [esi + 0xdf0], ax
mov ecx, dword [esp + 0xc6]
shr ecx, 1
and ecx, 1
push edi
mov dword [esi + 0x92], ecx
mov edx, dword [esp + 0xca]
shr edx, 4
and edx, 1
mov dword [esp + 0x1c], edi
mov dword [esi + 0xe9c], edx
mov eax, dword [esp + 0xca]
shr eax, 5
and eax, 1
mov dword [esi + 0xea0], eax
mov ecx, dword [esp + 0xca]
shr ecx, 6
and ecx, 1
mov dword [esi + 0x1de], ecx
mov edx, dword [esp + 0xca]
shr edx, 7
and edx, 1
mov dword [esi + 0x1e2], edx
mov eax, dword [esp + 0xca]
shr eax, 9
and eax, 1
mov dword [esi + 0x1e6], eax
mov ecx, dword [esp + 0xca]
shr ecx, 0xa
and ecx, 1
mov dword [esi + 0x1ea], ecx
mov edx, dword [esp + 0xca]
shr edx, 8
and edx, 1
mov dword [esi + 0x1ee], edx
mov eax, dword [esp + 0xca]
shr eax, 0xe
and eax, 1
mov dword [esi + 0x1f2], eax
call fcn.00565460
mov al, byte [esp + 0xca]
add esp, 0xc
test al, 1
je 0x564f70
mov dword [esi + 0x5f4], 1
jmp 0x564f76
mov dword [esi + 0x5f4], ebx
mov eax, dword [esp + 0xbc]
test ah, 0x80
je 0x565055
push ebp
call fcn.0056c680
mov ebp, eax
push esi
push ebp
call fcn.0056bbf0
add esp, 0xc
test eax, eax
jne 0x564fb4
push esi
push 0x638420
push ebx
push ebx
push ebx
push 5
call fcn.0056ce30
mov ecx, dword [esp + 0x64]
push esi
push ecx
jmp 0x564ff5
cmp dword [esp + 0x24], 4
jne 0x565022
cmp dword [esp + 0x58], ebx
jne 0x565022
cmp dword [esp + 0x5c], ebx
jne 0x565022
cmp dword [esp + 0x68], ebx
jne 0x565022
mov edx, dword [esp + 0x2c]
push edx
push ebp
call fcn.0056c730
add esp, 8
test eax, eax
je 0x565055
push esi
push 0x638420
push ebx
push ebx
push ebx
push 6
call fcn.0056ce30
mov eax, dword [esp + 0x64]
push esi
push eax
push 0x638420
push 0x14
call fcn.00568a80
push edi
mov dword [esi + 0x8a], ebx
call fcn.005654c0
add esp, 0x2c
mov eax, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret 4
mov ecx, dword [esp + 0x4c]
push esi
push ecx
push 0x638420
push 0x14
call fcn.00568a80
push edi
mov dword [esi + 0x8a], ebx
call fcn.005654c0
add esp, 0x14
mov eax, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret 4
push esi
call fcn.0056b7d0
mov ebp, 1
mov dword [esi + 0xb10], ebx
mov dword [esi + 0xb1c], ebx
mov dword [esi + 0xb30], ebp
mov edx, dword [esp + 0xcc]
add esp, 4
mov dword [esi + 0x1fa], edx
mov eax, dword [esp + 0xcc]
mov dword [esi + 0x1fe], eax
mov eax, dword [esp + 0xd0]
cmp eax, ebx
je 0x5650b5
push 0x12c
lea ecx, [esi + 0x382]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov byte [esi + 0x4ad], bl
jmp 0x5650c7
lea edx, [esi + 0x382]
push str.Compress_Progress
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esp + 0x38]
mov dword [esi + 0xb14], eax
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0xb18], ecx
mov edx, dword [esp + 0x30]
mov dword [esi + 0xb20], edx
mov eax, dword [esp + 0x34]
mov dword [esi + 0xb24], eax
mov eax, dword [esp + 0x24]
cmp eax, ebx
jle 0x565429
cmp eax, 7
jg 0x565429
test byte [esi + 0xdf1], 0x80
je 0x56525d
cmp dword [esp + 0x50], ebx
je 0x56525d
cmp dword [esp + 0x54], ebx
je 0x56525d
mov dword [esi + 0x96], 0xffffffff
mov ecx, dword [esp + 0x54]
lea ebp, [esi + 0x700]
push ecx
push ebp
call fcn.00568650
push ebp
call fcn.0056c680
push esi
push eax
call fcn.0056bbf0
add esp, 0x14
test eax, eax
jne 0x56521c
push esi
push ebp
call fcn.0056bc70
add esp, 8
cmp eax, 0x200000
jl 0x56521c
lea edi, [esi + 0x9a]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
call ebp
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [eax + esi + 0x99], 0x5c
je 0x56519a
push 0x60b360
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x14]
push str.__XXXXXX
push edx
call ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edx, edx
mov ebp, 0x25
mov ecx, eax
div ebp
mov al, byte [edx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_]
mov byte [esp + 0x14], al
mov eax, 0xbacf914d
mul ecx
mov eax, ecx
mov ecx, ebp
sub eax, edx
shr eax, 1
add eax, edx
xor edx, edx
shr eax, 5
div ecx
lea eax, [esp + 0x14]
push eax
push edi
mov dl, byte [edx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_]
mov byte [esp + 0x1d], dl
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
call fcn.00594e57
add esp, 4
test eax, eax
je 0x565218
push ebx
push 0x8000080
push 2
push ebx
push ebx
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x96], eax
mov edi, dword [esp + 0x10]
cmp dword [esi + 0x96], 0xffffffff
jne 0x565258
mov ecx, dword [esp + 0x4c]
push esi
push ecx
push 0x638420
push 0xa
call fcn.00568a80
push edi
mov dword [esi + 0x8a], ebx
call fcn.005654c0
add esp, 0x14
mov eax, 0xa
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret 4
mov ebp, 1
cmp dword [esp + 0xd8], ebx
jl 0x5652a2
cmp dword [esp + 0xd4], ebx
je 0x5652a2
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x5652a2
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x5652a2
mov dword [esi + 0x1a2], ebp
mov edx, dword [esp + 0xd8]
mov dword [esi + 0x1ae], edx
mov eax, dword [esp + 0xd4]
mov dword [esi + 0x1b2], eax
mov eax, dword [esp + 0xc0]
cmp eax, ebx
je 0x5652c6
mov ecx, dword [eax + 4]
mov dword [esi + 0x1d6], ecx
mov edx, dword [esp + 0xc0]
mov eax, dword [edx + 8]
mov dword [esi + 0x1da], eax
cmp dword [esp + 0x24], 6
jne 0x565307
mov eax, dword [esi + 0x1a2]
mov dword [esi + 0x1be], ebp
cmp eax, ebx
jne 0x5652fc
mov ecx, dword [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jg 0x5652fc
mov eax, dword [esp + 0xc0]
cmp eax, ebx
je 0x5652fc
cmp dword [eax + 4], ebx
jne 0x565307
mov edx, dword [esp + 0x4c]
push esi
push edx
jmp 0x56542f
cmp dword [esp + 0x24], 7
jne 0x565343
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x565383
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x565383
mov eax, dword [esp + 0xc0]
cmp eax, ebx
je 0x565383
cmp dword [eax + 4], ebx
je 0x565383
mov dword [esi + 0x1a2], ebp
mov dword [esi + 0x1a6], ebp
mov dword [esi + 0x1ae], ebx
test byte [esp + 0xbe], 4
je 0x56536c
mov dword [esi + 0x37a], ebx
mov dword [esi + 0x376], ebp
mov ecx, dword [esp + 0xbe]
and ecx, 8
push ecx
call fcn.00566810
add esp, 4
mov eax, dword [esi + 0x1be]
push esi
cmp eax, ebx
je 0x56538e
lea edx, [esp + 0x24]
push edx
call fcn.0056b8d0
jmp 0x565398
mov eax, dword [esp + 0x4c]
push esi
push eax
jmp 0x56542f
lea eax, [esp + 0x24]
push eax
call fcn.00569a30
mov ebp, eax
mov eax, dword [esi + 0x372]
add esp, 8
cmp eax, ebx
mov dword [esi + 0x376], ebx
je 0x5653b8
call fcn.00566940
mov dword [esi + 0x37a], ebx
mov eax, dword [esi + 0x96]
cmp eax, 0xffffffff
je 0x5653e1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esi + 0x9a]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [esi + 0x96], 0xffffffff
mov edx, dword [esp + 0x4c]
push esi
push edx
push 0x638420
push ebp
call fcn.00568a80
push edi
mov dword [esi + 0x8a], ebx
call fcn.005654c0
mov eax, dword [esi + 0xde0]
add esp, 0x14
cmp eax, ebx
je 0x56541a
push eax
call fcn.0057c9af
add esp, 4
mov dword [esi + 0xde0], ebx
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret 4
mov ecx, dword [esp + 0x4c]
push esi
push ecx
push 0x638420
push 0x10
call fcn.00568a80
push edi
mov dword [esi + 0x8a], ebx
call fcn.005654c0
add esp, 0x14
mov eax, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret 4