Function at 0x5cf9f0
Capabilities:
Accept command line arguments
Check if file exists
Get file attributes
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [0x7ec06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x244], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp + 0x18]
push 0
mov dword [ebp - 0x230], eax
mov eax, dword [ebp + 0x20]
push 0
push edi
mov dword [ebp - 0x240], eax
call fcn.005cfe90
add esp, 0xc
lea esi, [eax + 1]
lea eax, [esi + esi]
call fcn.0053bfc0
mov eax, esp
push esi
push eax
push edi
mov dword [ebp - 0x238], eax
call fcn.005cfe90
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add esp, 0xc
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call edi
test eax, eax
mov esi, 1
cmovg esi, eax
lea eax, [esi + esi]
call fcn.0053bfc0
mov eax, esp
push esi
push eax
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
mov dword [ebp - 0x23c], eax
call edi
push 0
push 0
push dword [ebp + 0x1c]
push dword [ebp - 0x230]
call fcn.005cfda0
add esp, 0x10
mov ebx, eax
mov dword [ebp - 0x228], ebx
push 0
push 0
push 0xffffffffffffffff
push dword [ebp - 0x22c]
push 0
push 0xfde9
call edi
test eax, eax
jle 0x5cfad4
lea esi, [eax - 1]
jmp 0x5cfad6
xor esi, esi
test ebx, ebx
je 0x5cfae3
mov ebx, 0x6ea0b4
test esi, esi
jne 0x5cfae8
mov ebx, 0x7347ca
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call edi
test eax, eax
jle 0x5cfaff
dec eax
jmp 0x5cfb01
xor eax, eax
mov edi, dword [ebp - 0x228]
add eax, esi
inc edi
add edi, eax
lea eax, [edi + edi]
call fcn.0053bfc0
mov eax, esp
push edi
push eax
push dword [ebp + 0x1c]
mov dword [ebp - 0x228], eax
push dword [ebp - 0x230]
call fcn.005cfda0
add esp, 0x10
mov esi, eax
mov eax, dword [ebp - 0x228]
mov ecx, edi
sub ecx, esi
push ecx
lea ecx, [eax + esi*2]
push ecx
push 0xffffffffffffffff
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0xfde9
call ebx
test eax, eax
jle 0x5cfb59
dec eax
jmp 0x5cfb5b
xor eax, eax
add esi, eax
mov eax, dword [ebp - 0x228]
sub edi, esi
push edi
lea eax, [eax + esi*2]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x22c]
push 0
push 0xfde9
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
call edi
test eax, eax
jne 0x5cfc0d
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 2
push 0x6ea094
push 0x6ea028
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x5cfc09
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 0x22c], 0
mov esi, eax
jle 0x5cfbe9
mov ecx, dword [esi]
jmp 0x5cfbef
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp ebx, 0xffffffff
je 0x5cfc09
test bl, 0x10
je 0x5cfc0d
xor bl, bl
jmp 0x5cfc0f
mov bl, 1
push 0x5c
lea eax, [ebp - 0x2b4]
mov dword [ebp - 0x258], 1
push 0
push eax
mov dword [ebp - 0x254], str.Exit
mov dword [ebp - 0x250], 5
mov dword [ebp - 0x24c], str.Ignore
mov dword [ebp - 0x224], 1
mov dword [ebp - 0x220], str.Exit
mov dword [ebp - 0x21c], 4
mov dword [ebp - 0x218], str.Debug
mov dword [ebp - 0x214], 5
mov dword [ebp - 0x210], str.Ignore
mov dword [ebp - 0x2b8], 0x60
call fcn.005530b0
add esp, 0xc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x2b4], eax
lea ecx, [ebp - 0x258]
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x2a4], eax
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x29c], eax
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x298], eax
movzx eax, bl
add eax, 2
mov dword [ebp - 0x2ac], 0x1000008
mov dword [ebp - 0x294], eax
test bl, bl
mov ebx, dword [ebp - 0x240]
lea eax, [ebp - 0x224]
cmove eax, ecx
mov dword [ebp - 0x2a0], 0xfffe
mov dword [ebp - 0x290], eax
test ebx, ebx
mov eax, str.Do_not_show_this_message_again
mov dword [ebp - 0x28c], 1
cmove eax, dword [ebp - 0x27c]
mov dword [ebp - 0x27c], eax
lea eax, [ebp - 0x248]
push eax
push 0
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x2b8]
push eax
call dword [ebp - 0x244]
mov eax, dword [ebp - 0x234]
cmp eax, 2
jne 0x5cfd52
call edi
neg eax
sbb eax, eax
add eax, 5
mov dword [ebp - 0x234], eax
cmp eax, 1
jne 0x5cfd6c
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x234]
test ebx, ebx
je 0x5cfd7c
cmp dword [ebp - 0x248], 0
je 0x5cfd7c
mov byte [ebx], 1
cmp eax, 4
sete al
lea esp, [ebp - 0x2c4]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053bd3e
mov esp, ebp
pop ebp
ret