Function at 0x426c42
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push esi
push edi
lea eax, [ebp - 0x1c]
push eax
push 0x4c0e0c
mov edi, str.NTDLL.DLL
push edi
xor esi, esi
push str.RtlCreateUnicodeString
mov dword [ebp - 0x1c], esi
call fcn.004391ea
lea eax, [ebp - 0x1c]
push eax
push 0x4c0e10
push edi
push str.RtlFreeUnicodeString
call fcn.004391ea
xor eax, eax
mov word [ebp - 8], si
lea edi, [ebp - 6]
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 0x28]
and eax, 0x10
add esp, 0x20
cmp dword [0x4c0c94], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x14], eax
jne 0x426caa
push 3
pop eax
jmp 0x427167
cmp eax, esi
je 0x426ccb
mov ecx, dword [ebp + 0x20]
cmp ecx, esi
je 0x426ccb
mov ax, word [ecx]
cmp ax, 0x41
jb 0x426ccb
cmp ax, 0x5a
ja 0x426ccb
or ax, 0x20
mov word [ecx], ax
push ebx
push str.DeviceImDiskCtl
lea eax, [ebp - 8]
push eax
call dword [0x4c0c94]
mov edi, 0xc0000000
push edi
lea eax, [ebp - 8]
push eax
call dword [0x4c0f68]
cmp eax, 0xffffffff
mov dword [ebp + 0x28], eax
jne 0x426d33
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 2
jne 0x42715d
push str.ImDisk
call dword [0x4c0f78]
test eax, eax
je 0x427161
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
lea eax, [ebp - 8]
push eax
call dword [0x4c0f68]
cmp eax, 0xffffffff
mov dword [ebp + 0x28], eax
je 0x426cf3
jmp 0x426d39
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp + 0x28]
call fcn.00411e86
test eax, eax
pop ecx
jne 0x426d4e
push 5
pop esi
jmp 0x426fa1
mov esi, dword [ebp + 0x14]
mov eax, dword [ebp + 0x14]
xor ecx, ecx
and esi, 0xf000
and eax, 0xf00
cmp esi, 0x1000
sete cl
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], eax
mov esi, ecx
xor ecx, ecx
cmp eax, 0x100
sete cl
xor edx, edx
test eax, eax
sete dl
or ecx, edx
test esi, ecx
je 0x426f00
push str.DeviceAWEAlloc
lea eax, [ebp - 0x28]
push eax
call dword [0x4c0c94]
jmp 0x426dc3
call ebx
cmp eax, 2
jne 0x426df5
push str.AWEAlloc
call dword [0x4c0f78]
test eax, eax
je 0x426ef9
push str.AWEAlloc_driver_was_loaded_into_the_kernel.
call fcn.004937ed
pop ecx
lea eax, [ebp - 0x28]
push edi
push eax
call dword [0x4c0f68]
mov esi, eax
cmp esi, 0xffffffff
je 0x426d9e
push 0
push 0x4c0e14
push str.NTDLL.DLL
push str.NtClose
call fcn.004391ea
add esp, 0x10
push esi
call dword [0x4c0e14]
cmp dword [ebp + 0x18], 0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
jne 0x426f82
push 0
lea eax, [ebp - 8]
push eax
call dword [0x4c0c94]
movzx eax, word [ebp - 8]
lea eax, [eax + eax + 0x38]
push eax
lea ecx, [ebp - 0x18]
call fcn.0043dc74
movzx eax, word [ebp - 8]
mov ebx, dword [ebp - 0x18]
add eax, 0x38
push eax
push 0
push ebx
call fcn.00492e00
mov esi, dword [ebp + 0x20]
add esp, 0xc
test esi, esi
je 0x426e6e
cmp dword [ebp - 0x14], 0
jne 0x426e6e
push esi
call edi
cmp eax, 2
jne 0x426e54
cmp word [esi + 2], 0x3a
je 0x426e67
cmp eax, 3
jne 0x426e6e
cmp word [esi + 2], 0x3a
jne 0x426e6e
cmp word [esi + 4], 0x5c
jne 0x426e6e
mov ax, word [esi]
mov word [ebx + 0x2c], ax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
mov dword [ebx], eax
mov eax, dword [ebp + 0x10]
push 6
lea edi, [ebx + 8]
pop ecx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
mov dword [ebx + 0x20], ecx
mov eax, dword [eax + 4]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x28], eax
mov ax, word [ebp - 8]
xor esi, esi
mov word [ebx + 0x2e], ax
cmp word [ebp - 8], si
je 0x426ec2
movzx eax, word [ebp - 8]
push eax
push dword [ebp - 4]
lea eax, [ebx + 0x30]
push eax
call fcn.004934b0
add esp, 0xc
lea eax, [ebp - 8]
push eax
call dword [0x4c0e10]
movzx eax, word [ebx + 0x2e]
push esi
lea ecx, [ebp - 0x20]
push ecx
add eax, 0x38
push eax
push ebx
push eax
push ebx
push 0x8372e004
push dword [ebp + 0x28]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
push dword [ebp + 0x28]
jne 0x4270bb
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 3
pop esi
jmp 0x427150
call ebx
mov dword [ebp - 0x14], eax
jmp 0x426f57
xor ecx, ecx
cmp dword [ebp - 0xc], 0x2000
sete cl
xor edx, edx
or ecx, esi
cmp eax, 0x300
sete dl
test edx, ecx
je 0x426df5
mov edi, dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
push 0
mov esi, str..PIPEImDskSvc
push esi
call edi
test eax, eax
jne 0x426df5
call ebx
cmp eax, 2
jne 0x426df5
push str.ImDskSvc
call dword [0x4c0f78]
test eax, eax
jne 0x426f74
call ebx
mov dword [ebp - 0x14], eax
push 7
jmp 0x426d48
call ebx
cmp eax, 2
jne 0x426df5
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call edi
test eax, eax
je 0x426f5e
jmp 0x426df5
xor esi, esi
cmp dword [ebp + 0x1c], esi
je 0x426fb1
push dword [ebp + 0x18]
lea eax, [ebp - 8]
push eax
call dword [0x4c0e0c]
test eax, eax
jne 0x426e11
or esi, 0xffffffff
push dword [ebp + 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x427166
xor eax, eax
cmp dword [ebp - 0xc], 0x3000
push esi
sete al
xor ecx, ecx
cmp dword [ebp - 0x10], 0x300
sete cl
test ecx, eax
je 0x427082
push 0x80
push 3
push esi
push 1
push esi
push str._Global
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
call ebx
dec eax
dec eax
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp esi, 0xffffffff
sete cl
mov dword [ebp - 0xc], str.BaseNamedObjects_
test ecx, eax
jne 0x42700d
mov dword [ebp - 0xc], str.BaseNamedObjectsGlobal_
cmp esi, 0xffffffff
je 0x427019
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc]
call edi
push dword [ebp + 0x18]
mov ebx, eax
call edi
lea eax, [eax + ebx + 2]
push eax
lea ecx, [ebp - 0x10]
call fcn.0043dd9c
mov ebx, dword [ebp - 0x10]
test ebx, ebx
jne 0x427052
push dword [ebp + 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x10]
call fcn.00437e1a
or eax, 0xffffffff
jmp 0x427166
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp + 0x18]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push ebx
lea eax, [ebp - 8]
push eax
call dword [0x4c0e0c]
test eax, eax
je 0x427039
lea ecx, [ebp - 0x10]
call fcn.00437e1a
jmp 0x426e11
push 0x4c0e08
push str.NTDLL.DLL
push str.RtlDosPathNameToNtPathName_U
call fcn.004391ea
add esp, 0x10
push esi
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x18]
call dword [0x4c0e08]
test eax, eax
jne 0x426e11
push dword [ebp + 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42704a
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp + 0x20]
cmp edi, esi
mov eax, dword [ebx]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
je 0x42713d
push dword [ebx]
lea eax, [ebp - 0x230]
push str.DeviceImDisk_u
push 0x103
push eax
mov word [ebp - 0x230], si
call fcn.00493438
add esp, 0x10
cmp word [ebx + 0x2c], si
mov word [ebp - 0x2a], si
lea eax, [ebp - 0x230]
jne 0x42712f
push eax
push edi
call dword [0x4c0f7c]
test eax, eax
jne 0x42713d
call dword [sym.imp.KERNEL32.dll_GetLastError]
dec eax
je 0x42712a
sub eax, 0x56
je 0x42712a
sub eax, 0x3a
je 0x42712a
sub eax, 0x7a
je 0x42712a
sub eax, 0x101b
mov word [edi], si
jmp 0x42713d
push esi
push 1
push esi
push edi
push eax
call fcn.00449ef5
add esp, 0x14
cmp dword [ebp + 0x24], esi
je 0x427150
push dword [ebp + 0x24]
push edi
push dword [ebx]
call fcn.0041c303
add esp, 0xc
lea ecx, [ebp - 0x18]
call fcn.00437e1a
jmp 0x426faa
push 6
jmp 0x427165
call ebx
push 4
pop eax
pop ebx
pop edi
pop esi
leave
ret