Function at 0x431010
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push r14
push r13
push rdi
push rsi
push rbx
sub rsp, 0x2b8
mov rbp, rsp
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x80], 0
nop
xor rdi, rdi
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax + 0x18]
call fcn.0043b960
mov rbx, rax
mov rcx, rbx
call fcn.00422b70
mov dword [rbp + 0x40], eax
mov eax, dword [rbp + 0x40]
cmp eax, 0x104
jl 0x4310b2
mov rax, qword [0x00448898]
mov dword [rax], 0x233f
xor rax, rax
mov dword [rbp + 0x44], eax
jmp 0x4318cf
mov rax, qword [0x00448428]
cmp byte [rax], 0
je 0x4310e7
mov rcx, rbx
lea rdx, [0x00431928]
mov r8d, 4
call fcn.0041ae70
test eax, eax
jne 0x4310e7
lea rcx, [0x00431932]
call fcn.00425460
mov rbx, rax
lea rcx, [rbp + 0x9a]
xor rdx, rdx
mov r8d, 0x104
call fcn.00422d00
lea rcx, [rbp + 0x9a]
mov rdx, rbx
call fcn.00422b90
lea rcx, [rbp + 0x9a]
mov dx, 0x2f
call fcn.00428370
mov word [rbp + 0x2aa], 0x5c
mov word [rbp + 0x2ac], 0x3a
mov word [rbp + 0x2ae], 0
lea rcx, [rbp + 0x9a]
lea rdx, [rbp + 0x2aa]
call fcn.00422bd0
mov ecx, dword [rbp + 0x40]
cmp eax, ecx
setl al
mov byte [rbp + 0x37], al
mov word [rbp + 0x2ac], 0
movzx rax, byte [rbp + 0x37]
test al, al
je 0x431198
lea rcx, [rbp + 0x9a]
mov dx, 0x5c
call fcn.00422b00
mov rbx, rax
test rbx, rbx
jne 0x431192
lea rcx, [rbp + 0x9a]
mov dx, 0x3a
call fcn.00422ad0
mov rbx, rax
add rbx, 2
jmp 0x43119f
lea rbx, [rbp + 0x9a]
test rbx, rbx
je 0x4311ca
mov rcx, rbx
lea rdx, [0x00431942]
call fcn.0041ad40
test eax, eax
je 0x4311ca
mov rcx, rbx
lea rdx, [0x00431946]
call fcn.0041ad40
test eax, eax
jne 0x431212
mov rax, qword [0x00448428]
cmp byte [rax], 0
je 0x4311fa
mov rcx, qword [rbp + 0x28]
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4311fa
test eax, 0x10
je 0x4311fa
mov eax, 5
mov dword [rbp + 0x44], eax
jmp 0x4318cf
mov rax, qword [0x00448898]
mov dword [rax], 0x2331
xor rax, rax
mov dword [rbp + 0x44], eax
jmp 0x4318cf
mov ecx, 0x410
call fcn.004398c0
mov rsi, rax
test rsi, rsi
jne 0x431240
mov rax, qword [0x00448898]
mov dword [rax], 8
mov eax, 3
mov dword [rbp + 0x44], eax
jmp 0x4318cf
mov rcx, qword [rbp + 0x28]
lea rdx, [rbp + 0x9a]
call fcn.00422b90
mov rax, rbx
mov rcx, rax
call fcn.00409fc0
mov r13d, eax
lea rcx, [rbp + 0x9a]
call fcn.00422b70
movsxd rax, eax
mov r13d, r13d
neg r13
lea rax, [rax + r13]
mov rcx, qword [rbp + 0x28]
mov word [rcx + rax*2], 0
lea rdx, [0x00431942]
call fcn.00422bb0
mov rcx, rsi
mov rdx, qword [rbp + 0x28]
mov r8d, 0x208
call fcn.004278b0
test eax, eax
je 0x4312ec
mov rax, qword [0x00448428]
cmp byte [rax], 0
je 0x4312d4
mov rcx, qword [rbp + 0x28]
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4312d4
test eax, 0x10
je 0x4312d4
mov eax, 5
mov dword [rbp + 0x44], eax
jmp 0x4318cf
mov rax, qword [0x00448898]
mov dword [rax], 0x2331
xor rax, rax
mov dword [rbp + 0x44], eax
jmp 0x4318cf
mov rcx, rsi
call fcn.00422d20
cmp word [rax], 0x5c
je 0x431309
mov rcx, rsi
lea rdx, [0x0043194c]
call fcn.00422bb0
mov rcx, rsi
mov rdx, rbx
call fcn.00422bb0
mov rcx, rsi
call fcn.00422b70
mov rcx, rsi
mov edx, eax
add edx, 1
add edx, edx
call fcn.004399c0
mov rsi, rax
mov rcx, rsi
mov dx, 0x5c
call fcn.00422b00
mov qword [rbp + 0x38], rax
mov word [rax], 0
add rax, 2
mov qword [rbp + 0x38], rax
movzx rax, byte [rbp + 0x37]
test al, al
jne 0x431363
lea rcx, [0x00431950]
call fcn.00425460
mov rdi, rax
mov rcx, rsi
call fcn.00422b70
mov ebx, eax
mov rcx, rdi
call fcn.00422b70
mov ecx, ebx
add ecx, eax
add ecx, 4
add ecx, ecx
call fcn.004398c0
mov rbx, rax
test rbx, rbx
jne 0x4313a6
mov rax, qword [0x00448898]
mov dword [rax], 8
mov eax, 3
mov dword [rbp + 0x44], eax
jmp 0x4318cf
mov rcx, rbx
lea rdx, [0x0043195a]
call fcn.00422bb0
mov rcx, rbx
mov rdx, rsi
call fcn.00422bb0
mov rcx, rbx
lea rdx, [0x0043195a]
call fcn.00422bb0
movzx rax, byte [rbp + 0x37]
test al, al
jne 0x4313f2
mov rcx, rbx
lea rdx, [0x0043195e]
call fcn.00422bb0
mov rcx, rbx
mov rdx, rdi
call fcn.00422bb0
mov rcx, rbx
call fcn.00431f50
mov rcx, rbx
lea rdx, [0x0043195e]
mov r8d, 1
call fcn.00439b20
mov rbx, rax
mov rcx, qword [rbp + 0x38]
call fcn.00422b70
add eax, 1
mov dword [rbp + 0x40], eax
mov rax, qword [0x00448428]
cmp byte [rax], 0
je 0x43143f
lea rcx, [0x00431962]
call fcn.00425460
mov rsi, rax
jmp 0x431446
lea rsi, [0x00431972]
mov rcx, rsi
call fcn.00431f50
mov rcx, rsi
lea rdx, [0x0043195e]
mov r8d, 1
call fcn.00439b20
mov rsi, rax
mov rcx, rbx
call fcn.00422b70
mov edi, eax
mov rcx, rbx
call fcn.0043b960
mov rcx, rbx
mov rdx, rax
call fcn.00422b90
mov rcx, rbx
call fcn.00422b70
mov r13d, eax
mov rcx, rbx
call fcn.00422d20
cmp word [rax], 0x5c
je 0x4314a9
mov r14b, 1
add edi, 1
add r13d, 1
jmp 0x4314ac
xor r14, r14
cmp word [rbx], 0
je 0x4314e2
mov eax, r13d
mov ecx, dword [rbp + 0x40]
movsxd rcx, ecx
lea rax, [rax + rcx]
cmp rax, 0x104
jle 0x4314e2
test r14b, r14b
je 0x4314d8
movsxd rdi, edi
add rdi, rdi
add rbx, rdi
jmp 0x431467
movsxd rdi, edi
lea rbx, [rbx + rdi*2 + 2]
jmp 0x431467
cmp word [rbx], 0
jne 0x431530
movzx rax, byte [rbp + 0x37]
test al, al
je 0x431518
mov rax, qword [0x00448898]
cmp dword [rax], 0
je 0x431509
mov rax, qword [0x00448898]
cmp dword [rax], 2
jne 0x431525
mov rax, qword [0x00448898]
mov dword [rax], 0x2331
jmp 0x431525
mov rax, qword [0x00448898]
mov dword [rax], 0x2331
xor rax, rax
mov dword [rbp + 0x44], eax
jmp 0x4318cf
mov rcx, qword [rbp + 0x28]
mov rdx, rbx
call fcn.00422b90
test r14b, r14b
je 0x43154c
movsxd rdi, edi
add rdi, rdi
add rbx, rdi
jmp 0x431554
movsxd rdi, edi
lea rbx, [rbx + rdi*2 + 2]
test r14b, r14b
je 0x431569
mov rcx, qword [rbp + 0x28]
lea rdx, [rbp + 0x2aa]
call fcn.00422bb0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x38]
call fcn.00422bb0
mov rcx, qword [rbp + 0x28]
call fcn.0043b960
mov rcx, qword [rbp + 0x28]
mov rdx, rax
call fcn.00422b90
mov rcx, qword [rbp + 0x28]
call fcn.00422b70
mov r14d, eax
mov rax, qword [rbp + 0x28]
cmp word [rax + 2], 0x3a
jne 0x4315b7
mov rax, qword [rbp + 0x28]
movzx rcx, word [rax]
call fcn.0043b810
test al, al
je 0x431467
mov rcx, qword [rbp + 0x38]
mov dx, 0x2e
call fcn.00422b00
mov rdi, rax
test rdi, rdi
je 0x4316e1
cmp word [rdi + 2], 0
je 0x4316e1
mov rcx, qword [rbp + 0x28]
mov dl, 1
call fcn.00428280
test al, al
jne 0x431607
movzx rax, byte [rbp + 0x37]
test al, al
je 0x4316c5
mov rax, qword [0x00448898]
cmp dword [rax], 5
jne 0x4316c5
lea rcx, [rbp + 0x80]
mov rdx, qword [rbp + 0x28]
call fcn.0040a760
lea rcx, [rbp + 0x88]
mov rdx, qword [rbp + 0x80]
call fcn.0041ab00
mov rcx, qword [rbp + 0x88]
call fcn.0040a6e0
mov rbx, rax
lea rcx, [rbp + 0x70]
call fcn.004229d0
lea rcx, [rbp + 0x78]
mov rdx, qword [rbp + 0x70]
call fcn.0041ab00
mov rcx, qword [rbp + 0x78]
call fcn.0040a6e0
mov rcx, rbx
mov rdx, rax
call fcn.0041ad70
test eax, eax
jne 0x431675
mov eax, 2
mov dword [rbp + 0x44], eax
jmp 0x4318cf
mov rcx, rdi
lea rdx, [0x0043199a]
call fcn.0041ad70
test eax, eax
jne 0x431696
mov eax, 2
mov dword [rbp + 0x44], eax
jmp 0x4318cf
mov rcx, rdi
lea rdx, [0x004319a4]
call fcn.0041ad70
test eax, eax
jne 0x4316b7
mov eax, 2
mov dword [rbp + 0x44], eax
jmp 0x4318cf
mov eax, 1
mov dword [rbp + 0x44], eax
jmp 0x4318cf
mov rax, qword [0x00448898]
cmp dword [rax], 2
je 0x4316e1
mov rax, qword [0x00448898]
cmp dword [rax], 0
jne 0x431467
mov rcx, qword [rbp + 0x38]
mov dx, 0x2a
call fcn.00422ad0
test rax, rax
jne 0x431705
mov rcx, qword [rbp + 0x38]
mov dx, 0x3f
call fcn.00422ad0
test rax, rax
je 0x43171d
mov rax, qword [0x00448898]
mov dword [rax], 0x2331
xor rax, rax
mov dword [rbp + 0x44], eax
jmp 0x4318cf
mov rdi, rsi
mov rcx, qword [rbp + 0x28]
mov edx, r14d
lea r8, [0x004319ae]
xor r9, r9
call fcn.004319c0
test eax, eax
je 0x43185d
jmp 0x431852
mov rcx, rdi
call fcn.00422b70
mov ecx, dword [rbp + 0x40]
movsxd rcx, ecx
mov edx, r13d
lea rcx, [rcx + rdx]
movsxd rax, eax
lea rax, [rcx + rax]
cmp rax, 0x104
jg 0x431848
mov rcx, qword [rbp + 0x28]
mov edx, r14d
mov r8, rdi
mov r9b, 1
call fcn.004319c0
test eax, eax
je 0x43182a
mov rcx, rdi
lea rdx, [0x004319a4]
call fcn.0041ad70
test eax, eax
je 0x4317ac
mov rcx, rdi
lea rdx, [0x0043199a]
call fcn.0041ad70
test eax, eax
jne 0x4317ba
mov eax, 2
mov dword [rbp + 0x44], eax
jmp 0x4318cf
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x28]
call fcn.0040a760
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
call fcn.0041ab00
mov rcx, qword [rbp + 0x68]
call fcn.0040a6e0
mov rbx, rax
lea rcx, [rbp + 0x50]
call fcn.004229d0
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x50]
call fcn.0041ab00
mov rcx, qword [rbp + 0x58]
call fcn.0040a6e0
mov rcx, rbx
mov rdx, rax
call fcn.0041ad70
test eax, eax
jne 0x43181c
mov eax, 2
mov dword [rbp + 0x44], eax
jmp 0x4318cf
mov eax, 1
mov dword [rbp + 0x44], eax
jmp 0x4318cf
mov rax, qword [0x00448898]
cmp dword [rax], 2
je 0x431848
mov rax, qword [0x00448898]
cmp dword [rax], 0
jne 0x43185c
jmp 0x431848
add rdi, 2
cmp word [rdi], 0
jne 0x431844
add rdi, 2
cmp word [rdi], 0
jne 0x431743
nop
mov rax, qword [0x00448898]
cmp dword [rax], 0
je 0x431879
mov rax, qword [0x00448898]
cmp dword [rax], 2
jne 0x431467
mov rcx, qword [rbp + 0x28]
mov edx, r14d
xor r8, r8
mov r9b, 1
call fcn.004319c0
test eax, eax
je 0x431467
mov rcx, qword [rbp + 0x28]
lea rdx, [rbp + 0x2a4]
call sub.kernel32.dll_GetBinaryTypeW
test eax, eax
je 0x431467
cmp dword [rbp + 0x2a4], 4
jne 0x431467
mov eax, 1
mov dword [rbp + 0x44], eax
jmp 0x4318cf
lea rcx, [rbp + 0x50]
mov edx, 8
call fcn.00409980
mov eax, dword [rbp + 0x44]
lea rsp, [rbp + 0x2b8]
pop rbx
pop rsi
pop rdi
pop r13
pop r14
pop rbp
ret