Function at 0x5e006638
Capabilities:
Create directory
Get common file path
Hide graphical window
Persist via run registry key
Read .ini file
Set file attributes
Set registry value
Terminate process

Disassembly:
sub esp, 0xe40
and byte [esp + 0x828], 0
push ebx
push ebp
push esi
mov edx, 0x81
push edi
mov ecx, edx
xor eax, eax
lea edi, [esp + 0x839]
and byte [esp + 0x630], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [esp + 0x631]
and byte [esp + 0xa40], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [esp + 0xa41]
and dword [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
or esi, 0xffffffff
stosb byte es:[edi], al
call 0x5e007124
test eax, eax
jne 0x5e0066ab
push dword [0x5e01ede4]
jmp 0x5e0070de
mov edi, 0x208
mov ebx, 0x5e020220
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x5e0066cf
push 0x40
push 0x5e001888
push 0x5e001854
jmp 0x5e0066f3
push ebx
call fcn.5e008aba
pop ecx
mov ebp, 0x5e020000
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x5e006700
push 0x40
push 0x5e001888
push 0x5e001820
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x5e0070ed
push ebp
call fcn.5e008aba
pop ecx
call fcn.5e002f87
mov esi, dword [esp + 0xe54]
xor eax, eax
cmp dword [0x5e01c4f4], eax
je 0x5e00672b
push eax
push eax
push 0x721
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
call fcn.5e005fb1
cmp eax, 1
jne 0x5e007000
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ebp, 0x5e01f4c0
push edi
push ebp
push 0xfffffffffffffffa
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x5e006766
push dword [0x5e01f000]
jmp 0x5e0070de
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x630]
push ebp
push eax
call edi
push 0x5c
push ebp
call fcn.5e005af8
and byte [eax + 1], 0
push ebx
call fcn.5e00450b
add esp, 0xc
test eax, eax
je 0x5e007000
push dword [0x5e01f268]
call fcn.5e0044c2
cmp eax, 0xfffffffe
pop ecx
je 0x5e007000
lea eax, [esp + 0x630]
push eax
lea eax, [esp + 0x83c]
push eax
call edi
lea eax, [esp + 0x838]
push 0x2e
push eax
call fcn.5e005af8
and byte [eax + 1], 0
lea eax, [esp + 0x840]
push 0x5c
push eax
call fcn.5e005af8
add esp, 0x10
inc eax
push eax
lea eax, [esp + 0xa44]
push eax
call edi
mov esi, 0x5e01fde0
push ebp
push esi
call edi
lea eax, [esp + 0xa40]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x5e00181c
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
call fcn.5e005a22
test eax, eax
pop ecx
jne 0x5e006876
and byte [esp + 0x220], al
mov ecx, 0x81
lea edi, [esp + 0x221]
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x5e001338
push dword [0x5e01fb84]
stosb byte es:[edi], al
call fcn.5e0031db
push eax
lea eax, [esp + 0x230]
push 0x5e0013d0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [esp + 0x220]
push 0x40
push 0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.5e010d37
push 0x5e0015a0
push ebp
mov ebp, 0x5e0013b8
push ebp
push 0x5e01fbc0
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x5e0015a0
push ebx
push ebp
mov ebp, 0x5e01f6e0
push ebp
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x20
call fcn.5e005409
test eax, eax
je 0x5e0068d0
push dword [0x5e01f8fc]
push 0x5e0015a0
push 0x5e00158c
push 1
pop esi
push esi
push 0x10
push esi
call fcn.5e0047be
add esp, 0x18
jmp 0x5e0070ed
push ebp
mov ebp, 0x5e01c934
push ebp
call edi
push ebp
push esi
call edi
push esi
lea eax, [esp + 0x224]
push 0x208
push eax
push 0
push 0x5e001814
push 0x5e0015ac
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ebp, 0x5e01f2a0
push 0x5e01ee00
push ebp
call edi
lea eax, [esp + 0x220]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push esi
lea eax, [esp + 0xc4c]
push 0x208
push eax
push 0
push 0x5e00180c
push 0x5e0015ac
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ebp, 0x5e020440
push ebx
push ebp
call edi
lea eax, [esp + 0xc48]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov al, byte [0x5e001314]
mov ecx, 0x81
mov byte [esp + 0x220], al
xor eax, eax
lea edi, [esp + 0x221]
lea edx, [esp + 0x220]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, 0x5e01f2a0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x220]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x5e00130c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x220]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x5e001648
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.5e006023
test eax, eax
pop ecx
je 0x5e007000
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x5e0017fc
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x18]
and ecx, 3
push eax
push 0x5e0017ec
push ebp
rep movsb byte es:[edi], byte [esi]
call fcn.5e0074ba
add esp, 0xc
lea eax, [esp + 0x18]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x5e0017e0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x18]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 0x5e0017d4
push ebp
call fcn.5e0074ba
add esp, 0xc
lea eax, [esp + 0x18]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x5e0017c4
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x18]
and ecx, 3
push eax
push 0x5e0017b4
push ebp
rep movsb byte es:[edi], byte [esi]
call fcn.5e0074ba
add esp, 0xc
lea eax, [esp + 0x18]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x5e0017a8
push 0x5e00179c
push 0x5e0015a0
call fcn.5e0051bb
mov edx, eax
add esp, 0xc
test edx, edx
je 0x5e006c4b
or ecx, 0xffffffff
mov edi, ebx
xor eax, eax
lea esi, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x10], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x10]
lea ebx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ax, word [0x5e001654]
and ecx, 3
lea ebx, [esp + 0x428]
rep movsb byte es:[edi], byte [esi]
mov word [esp + 0x428], ax
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x18]
mov ecx, edx
push eax
lea eax, [esp + 0x42c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push ebp
call fcn.5e0074ba
add esp, 0xc
lea eax, [esp + 0x18]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x5e001794
push 0x5e00179c
push 0x5e0015a0
call fcn.5e0051bb
mov edi, eax
add esp, 0xc
test edi, edi
je 0x5e006d91
mov esi, 0x5e00178c
mov ecx, edi
mov dl, byte [ecx]
mov al, dl
cmp dl, byte [esi]
jne 0x5e006c95
test al, al
je 0x5e006c91
mov al, byte [ecx + 1]
mov dl, al
cmp al, byte [esi + 1]
jne 0x5e006c95
inc ecx
inc ecx
inc esi
inc esi
test dl, dl
jne 0x5e006c73
xor ecx, ecx
jmp 0x5e006c9a
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
je 0x5e006cd4
mov esi, 0x5e001784
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x5e006cc7
test cl, cl
je 0x5e006cc3
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x5e006cc7
inc eax
inc eax
inc esi
inc esi
test cl, cl
jne 0x5e006ca5
xor eax, eax
jmp 0x5e006ccc
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x5e006d91
mov ebx, 0x5e020000
or ecx, 0xffffffff
mov edi, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x5e001778
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov ax, word [0x5e001654]
and ecx, 3
mov word [esp + 0x428], ax
rep movsb byte es:[edi], byte [esi]
mov edi, 0x5e001778
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x428]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x18]
mov ecx, edx
push eax
lea eax, [esp + 0x42c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push ebp
call fcn.5e0074ba
add esp, 0xc
lea eax, [esp + 0x18]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x5e006d96
mov ebx, 0x5e020000
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x5e001768
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x18]
and ecx, 3
push eax
push 0x5e001754
push ebp
rep movsb byte es:[edi], byte [esi]
call fcn.5e0074ba
add esp, 0xc
lea eax, [esp + 0x18]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x5e001744
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x18]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 0x5e001734
push ebp
call fcn.5e0074ba
add esp, 0xc
lea eax, [esp + 0x18]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edi, ebx
or ebx, 0xffffffff
mov ecx, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, 0x5e001720
mov ecx, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
mov ecx, ebx
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x1c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x5e001744
mov ecx, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
mov ecx, ebx
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x1c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.5e0088f3
pop ecx
cmp eax, ebx
pop ecx
jne 0x5e007000
push 0x5e001638
mov edi, 0x5e0015a0
push 0x5e0015ac
push edi
call fcn.5e0051bb
add esp, 0xc
test eax, eax
je 0x5e006f36
push eax
push 0x5e01c72c
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, 0x5e001718
push esi
push 0x5e001710
push edi
call fcn.5e0051bb
add esp, 0xc
test eax, eax
je 0x5e0070d8
push 0x208
push eax
lea eax, [esp + 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
and byte [esp + 0x427], 0
lea eax, [esp + 0x220]
push eax
call fcn.5e0031af
push eax
push esi
call fcn.5e0044d7
add esp, 0xc
cmp eax, 0xfffffffe
je 0x5e007000
call fcn.5e007898
test eax, eax
jne 0x5e007000
cmp dword [0x5e01c50c], eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, 0x5e001704
je 0x5e007008
lea eax, [esp + 0x10]
push eax
push 0x5e0016d0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x5e007000
lea eax, [esp + 0x630]
push eax
call fcn.5e0031af
pop ecx
mov edx, eax
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
pop esi
push esi
push eax
push ebp
push dword [esp + 0x24]
call ebx
test eax, eax
jne 0x5e0070ed
push eax
call fcn.5e002fb9
test eax, eax
pop ecx
jne 0x5e00700b
jmp 0x5e0070ed
push 1
pop esi
jmp 0x5e0070ed
push 1
pop esi
call fcn.5e0076ec
test eax, eax
jne 0x5e0070ed
cmp dword [0x5e01c50c], eax
je 0x5e007076
lea eax, [esp + 0x10]
push eax
push 0x5e0016d0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x5e0070ed
lea eax, [esp + 0x630]
push eax
call fcn.5e0031af
pop ecx
mov edx, eax
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push esi
push eax
push ebp
push dword [esp + 0x24]
call ebx
test eax, eax
jne 0x5e0070ed
push eax
call fcn.5e002fb9
test eax, eax
pop ecx
je 0x5e0070ed
push dword [0x5e01c500]
mov dword [esp + 0x18], esi
call fcn.5e00636c
push dword [0x5e01fb88]
call fcn.5e0044c2
pop ecx
cmp eax, 0xfffffffe
pop ecx
je 0x5e0070ed
cmp byte [0x5e01c72c], 0
je 0x5e0070ae
call fcn.5e005b20
mov esi, eax
neg esi
sbb esi, esi
inc esi
jmp 0x5e0070ed
push 0
push dword [0x5e01c4f8]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x5e01edcc]
push 0x5e001460
push esi
push 0
push 2
call fcn.5e0047be
add esp, 0x14
xor esi, esi
jmp 0x5e0070ed
push dword [0x5e01f4a8]
push 1
pop esi
push esi
push 0x30
push esi
call fcn.5e0047be
add esp, 0x10
call fcn.5e00447a
cmp esi, 0xffffffff
jne 0x5e0070f9
xor esi, esi
xor edi, edi
cmp dword [0x5e01c4ec], edi
je 0x5e00710f
xor eax, eax
cmp esi, edi
sete al
mov dword [0x5e01c4f0], eax
cmp dword [esp + 0x14], edi
jne 0x5e007117
xor esi, esi
push esi
call fcn.5e005da0
pop ecx
push edi
call fcn.5e010d37
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x5e01d774]
test eax, eax
jne 0x5e007140
call fcn.5e008870
mov dword [0x5e01d774], eax
test al, 2
jne 0x5e0071e7
lea eax, [ebp - 0x114]
mov dword [ebp - 0x114], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x5e0071ec
cmp dword [ebp - 0x110], 4
jb 0x5e0071ec
push 1
pop eax
jne 0x5e0071ee
push esi
push edi
lea edi, [ebp - 0x100]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x80]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x80]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.5e009772
push eax
call fcn.5e003116
pop ecx
lea edi, [ebp - 0x80]
pop ecx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
pop esi
je 0x5e0071ec
lea eax, [ebp - 0x80]
push 0x5e0018ac
push eax
call fcn.5e011fd0
pop ecx
test eax, eax
pop ecx
jne 0x5e0071ec
lea eax, [ebp - 0x80]
push 0x5e00189c
push eax
call fcn.5e011fd0
pop ecx
test eax, eax
pop ecx
jne 0x5e0071ec
push 1
pop eax
leave
ret
xor eax, eax
leave
ret