Function at 0x430e00
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x884
mov eax, dword [0x5ad6f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x61c]
push esi
push edi
push 0x208
push 0
push eax
mov dword [ebp - 0x830], ebx
call fcn.00513d10
add esp, 0xc
lea eax, [ebp - 0x61c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.00513d10
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 0xc
cmp dword [0x5ad014], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
je 0x430f52
push str.GetNativeSystemInfo
push 0x564590
call esi
push eax
call edi
test eax, eax
je 0x430f48
xorps xmm0, xmm0
mov dword [ebp - 0x844], 0
lea ecx, [ebp - 0x864]
push ecx
movups xmmword [ebp - 0x864], xmm0
movups xmmword [ebp - 0x854], xmm0
call eax
mov ax, word [ebp - 0x864]
cmp ax, 9
je 0x430f3e
cmp ax, 6
je 0x430f3e
cmp ax, 0xc
je 0x430f3e
push str.IsWow64Process2
push 0x5645f4
mov dword [ebp - 0x82c], 0
mov dword [ebp - 0x828], 0
call esi
push eax
call edi
mov esi, eax
test esi, esi
je 0x430f35
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x82c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x430f35
xor eax, eax
mov ecx, 0xaa64
cmp word [ebp - 0x828], cx
sete al
mov dword [0x5b3d20], eax
jmp 0x430f48
xor eax, eax
mov dword [0x5b3d20], eax
jmp 0x430f48
mov dword [0x5b3d20], 1
mov dword [0x5ad014], 0
cmp dword [0x5b3d20], 0
lea eax, [ebp - 0x61c]
je 0x430f68
push str.HaloDesktop64.exe
jmp 0x430f6d
push 0x565ea0
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x431278
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
push 8
lea eax, [ebp - 0x61c]
push eax
push ebx
lea eax, [ebp - 0x414]
push eax
push 0x564f20
call fcn.004173a0
add esp, 0x14
test eax, eax
jne 0x431278
push 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00513d10
lea ecx, [ebp - 0x20c]
add esp, 0xc
lea esi, [ebp - 0x414]
mov eax, ecx
mov edx, 0x104
sub esi, eax
nop dword [eax]
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x43100e
movzx eax, word [esi + ecx]
test ax, ax
je 0x43100e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x430ff0
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
test ebx, ebx
je 0x4310fe
mov ecx, 0x104
lea eax, [ebp - 0x20c]
nop
cmp word [eax], 0
je 0x43103e
add eax, 2
sub ecx, 1
jne 0x431030
mov edx, 0x104
mov edi, ecx
mov eax, edx
sub eax, ecx
neg edi
sbb edi, edi
and edi, eax
test ecx, ecx
je 0x43109c
mov esi, edx
lea ecx, [ebp - 0x20c]
lea ecx, [ecx + edi*2]
sub esi, edi
je 0x43108f
mov ebx, 0x56824c
mov eax, SysReAllocString
sub ebx, ecx
nop
test eax, eax
je 0x431089
movzx edi, word [ebx + ecx]
test di, di
je 0x431089
mov word [ecx], di
dec eax
add ecx, 2
sub esi, 1
jne 0x431070
mov ebx, dword [ebp - 0x830]
test esi, esi
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
mov ecx, edx
lea eax, [ebp - 0x20c]
cmp word [eax], 0
je 0x4310b2
add eax, 2
sub ecx, 1
jne 0x4310a4
mov eax, edx
mov esi, ecx
sub eax, ecx
neg esi
sbb esi, esi
and esi, eax
test ecx, ecx
je 0x4310fe
lea ecx, [ebp - 0x20c]
lea ecx, [ecx + esi*2]
sub edx, esi
je 0x4310f1
mov edi, ebx
mov eax, SysReAllocString
sub edi, ecx
test eax, eax
je 0x4310f1
movzx esi, word [edi + ecx]
test si, si
je 0x4310f1
mov word [ecx], si
dec eax
add ecx, 2
sub edx, 1
jne 0x4310d8
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
xorps xmm0, xmm0
mov dword [ebp - 0x828], 0
xor eax, eax
movlpd qword [ebp - 0x880], xmm0
mov word [ebp - 0x842], ax
mov eax, 8
movlpd qword [ebp - 0x878], xmm0
movlpd qword [ebp - 0x870], xmm0
movlpd qword [ebp - 0x868], xmm0
movlpd qword [ebp - 0x860], xmm0
movlpd qword [ebp - 0x852], xmm0
movlpd qword [ebp - 0x84a], xmm0
movups xmmword [ebp - 0x840], xmm0
mov dword [ebp - 0x884], 0x44
mov dword [ebp - 0x858], 0x81
mov word [ebp - 0x854], ax
call fcn.0042a460
mov edi, eax
test edi, edi
je 0x431202
push 0x5645ac
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x4311a6
push 0x5645ac
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x4311f6
push str.CreateProcessWithTokenW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4311f6
lea ecx, [ebp - 0x840]
push ecx
lea ecx, [ebp - 0x884]
push ecx
push 0
push 0
push 0
lea ecx, [ebp - 0x20c]
push ecx
push 0
push 0
push edi
call eax
test eax, eax
je 0x4311f6
push dword [ebp - 0x83c]
call esi
push dword [ebp - 0x840]
call esi
mov dword [ebp - 0x828], 1
push edi
call esi
cmp dword [ebp - 0x828], 0
jne 0x431278
push 0x208
lea eax, [ebp - 0x824]
push 0
push eax
call fcn.00513d10
add esp, 0xc
test ebx, ebx
je 0x43125b
lea ecx, [ebp - 0x824]
mov edx, 0x104
mov eax, ecx
sub ebx, eax
nop dword [eax + eax]
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x43124e
movzx eax, word [ecx + ebx]
test ax, ax
je 0x43124e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x431230
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.004454c0
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d684f
mov esp, ebp
pop ebp
ret 4