Function at 0xf008fc9
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x660
mov eax, dword [0xf062038]
mov edx, dword [ebp + 0xc]
and dword [ebp - 0x650], 0
and dword [0xf09bf5c], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, 0xf0025f4
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0x64c], edx
movsw word es:[edi], word [esi]
mov dword [ebp - 0x658], 0xffff
call fcn.0f011257
cmp byte [edx], 0
jne 0xf009081
mov esi, 0x1fa
push esi
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0xf009086
cmp eax, esi
ja 0xf009086
lea eax, [ebp - 0x14]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xf00903b
lea edi, [ebp - 0x21c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0xf00904b
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x21c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0xf009081
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x64c], eax
mov esi, 0x1fa
mov eax, dword [ebp - 0x64c]
cmp byte [eax], 0
jne 0xf0090e0
push esi
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
test eax, eax
je 0xf0090fb
cmp eax, esi
ja 0xf0090fb
lea eax, [ebp - 0x14]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xf0090ac
lea edi, [ebp - 0x21c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0xf0090bc
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x21c]
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x64c], eax
push 0
push dword [ebp - 0x64c]
call dword [sym.imp.KERNEL32.dll__lopen]
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp - 0x64c], edi
jne 0xf009102
xor eax, eax
jmp 0xf0095c5
xor esi, esi
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll__llseek]
cmp eax, 0xffffffff
je 0xf0095b7
mov esi, dword [sym.imp.KERNEL32.dll__lread]
push 0x171
lea eax, [ebp - 0x49c]
push eax
push edi
call esi
cmp eax, 0xffffffff
jne 0xf009137
xor esi, esi
jmp 0xf0095b7
push 0x16
lea eax, [ebp - 0x234]
push eax
push edi
call esi
cmp eax, 0xffffffff
je 0xf009130
push 0x10
mov edi, 0xf0025e4
lea esi, [ebp - 0x234]
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0xf0095b4
and dword [ebp - 0x654], eax
jmp 0xf009494
movzx eax, word [ebp - 0x224]
xor esi, esi
push esi
push eax
push dword [ebp - 0x64c]
call dword [sym.imp.KERNEL32.dll__llseek]
cmp eax, 0xffffffff
je 0xf0095b7
push 0x16
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0x64c]
call dword [sym.imp.KERNEL32.dll__lread]
cmp eax, 0xffffffff
je 0xf0095b7
push 0x10
pop eax
mov edi, 0xf0025d4
lea esi, [ebp - 0x234]
mov ecx, eax
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0xf009235
cmp dword [ebp - 0x654], edx
jne 0xf009235
movzx eax, word [ebp - 0x222]
xor esi, esi
push esi
push eax
push dword [ebp - 0x64c]
call dword [sym.imp.KERNEL32.dll__llseek]
cmp eax, 0xffffffff
je 0xf0095b7
push 6
lea eax, [ebp - 0x660]
push eax
push dword [ebp - 0x64c]
call dword [sym.imp.KERNEL32.dll__lread]
cmp eax, 0xffffffff
je 0xf0095b7
mov ax, word [ebp - 0x660]
mov word [ebx + 0x1e], ax
mov ax, word [ebp - 0x65e]
mov word [ebx + 0x1c], ax
mov al, byte [ebp - 0x65c]
mov cl, al
and cl, 0x1c
shl cl, 2
and al, 3
or cl, al
mov byte [ebx + 0x21], cl
jmp 0xf009494
mov edi, 0xf0025c4
lea esi, [ebp - 0x234]
mov ecx, eax
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0xf00934f
movzx eax, word [ebp - 0x222]
xor esi, esi
push esi
push eax
push dword [ebp - 0x64c]
call dword [sym.imp.KERNEL32.dll__llseek]
cmp eax, 0xffffffff
je 0xf0095b7
push 0x68
lea eax, [ebp - 0x29c]
push eax
push dword [ebp - 0x64c]
call dword [sym.imp.KERNEL32.dll__lread]
cmp eax, 0xffffffff
je 0xf0095b7
mov ax, word [ebp - 0x294]
mov word [ebx + 0x1a], ax
mov ax, word [ebp - 0x292]
mov word [ebx + 0x18], ax
mov ax, word [ebp - 0x290]
mov word [ebx + 0x1e], ax
mov ax, word [ebp - 0x28e]
inc esi
cmp word [ebp - 0x658], 0x64
mov word [ebx + 0x1c], ax
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x654], esi
jbe 0xf009300
mov cx, word [ebp - 0x298]
cmp cx, 0x64
jae 0xf0092e0
mov byte [0xf065228], cl
mov cx, word [ebp - 0x296]
cmp cx, 0x32
jae 0xf0092f5
shl cl, 1
mov byte [0xf065229], cl
mov ecx, eax
shr ecx, 0xc
and cl, 1
mov byte [ebx + 0x26], cl
mov ecx, eax
shr ecx, 5
and cl, 0x7f
mov byte [ebx + 0x21], cl
mov cl, al
and cl, 1
mov byte [ebx + 0x20], cl
mov cx, word [ebp - 0x284]
mov word [ebx + 0x24], cx
mov cx, word [ebp - 0x282]
mov word [ebx + 0x22], cx
mov ecx, eax
shr ecx, 3
shr eax, 0x11
and ecx, esi
and eax, esi
mov word [ebx + 0x10], cx
mov dword [0xf064378], eax
lea eax, [ebp - 0x274]
mov dword [ebp - 0x650], eax
jmp 0xf009494
mov edi, 0xf0025b4
lea esi, [ebp - 0x234]
mov ecx, eax
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0xf009415
movzx eax, word [ebp - 0x222]
xor esi, esi
push esi
push eax
push dword [ebp - 0x64c]
call dword [sym.imp.KERNEL32.dll__llseek]
cmp eax, 0xffffffff
je 0xf0095b7
push 0x8c
lea eax, [ebp - 0x328]
push eax
push dword [ebp - 0x64c]
call dword [sym.imp.KERNEL32.dll__lread]
cmp eax, 0xffffffff
je 0xf0095b7
mov eax, dword [ebp - 0x328]
mov dword [0xf09bf5c], eax
and al, 0xf
cmp byte [ebx + 0x2d], 0
mov byte [ebx + 0x2e], al
jne 0xf009494
push 0x40
call fcn.0f00e79f
test eax, eax
mov dword [0xf071990], eax
mov byte [ebp - 0x2dd], 0
je 0xf0093e8
lea edx, [ebp - 0x31c]
mov cl, byte [edx]
inc edx
mov byte [eax], cl
inc eax
test cl, cl
jne 0xf0093de
push 0x40
call fcn.0f00e79f
test eax, eax
mov dword [0xf071994], eax
mov byte [ebp - 0x29d], 0
je 0xf009494
lea edx, [ebp - 0x2dc]
mov cl, byte [edx]
inc edx
mov byte [eax], cl
inc eax
test cl, cl
jne 0xf009409
jmp 0xf009494
mov ecx, eax
mov edi, 0xf0025a4
lea esi, [ebp - 0x234]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0xf009494
movzx eax, word [ebp - 0x222]
xor esi, esi
push esi
push eax
push dword [ebp - 0x64c]
call dword [sym.imp.KERNEL32.dll__llseek]
cmp eax, 0xffffffff
je 0xf0095b7
push 0x1ac
lea eax, [ebp - 0x648]
push eax
push dword [ebp - 0x64c]
call dword [sym.imp.KERNEL32.dll__lread]
cmp eax, 0xffffffff
je 0xf0095b7
mov ecx, dword [ebp - 0x592]
cmp cx, 0x64
ja 0xf009494
mov al, 0x64
sub al, cl
shl al, 1
cmp cx, si
mov dword [ebp - 0x658], ecx
mov byte [0xf065228], al
mov byte [0xf065229], al
jbe 0xf009494
mov byte [ebx + 0x26], 1
cmp word [ebp - 0x224], 0xffff
jne 0xf00916b
cmp dword [0xf06cb30], 0
jne 0xf0094c3
cmp byte [0xf09c688], 0
je 0xf0095b4
cmp byte [ebx + 0x2e], 1
jne 0xf0095b4
cmp byte [ebp - 0x49a], 0
mov edi, 0x105
je 0xf009512
cmp byte [ebx + 0x29], 0
jne 0xf009512
push 0x1d
pop esi
cmp byte [ebp + esi - 0x49a], 0x20
jne 0xf0094e7
dec esi
jns 0xf0094da
test esi, esi
jl 0xf009512
push edi
call fcn.0f00e79f
test eax, eax
mov dword [ebx], eax
je 0xf009512
lea ecx, [esi + 1]
push ecx
lea ecx, [ebp - 0x49a]
push ecx
push eax
call fcn.0f01cfc0
mov eax, dword [ebx]
add esp, 0xc
mov byte [eax + esi + 1], 0
cmp byte [ebp - 0x437], 0
je 0xf009540
cmp byte [ebx + 0x2a], 0
jne 0xf009540
push edi
call fcn.0f00e79f
test eax, eax
mov dword [ebx + 8], eax
je 0xf009540
lea ecx, [ebp - 0x437]
mov edx, eax
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0xf009536
cmp byte [ebx + 0x2c], 0
jne 0xf009576
mov esi, dword [ebp - 0x650]
test esi, esi
jne 0xf009556
lea esi, [ebp - 0x3f7]
cmp byte [esi], 0
je 0xf009576
push edi
call fcn.0f00e79f
test eax, eax
mov dword [ebx + 4], eax
je 0xf009576
mov ecx, esi
mov edx, eax
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0xf00956c
cmp dword [0xf06cb30], 0
je 0xf00958f
xor eax, eax
mov al, byte [ebp - 0x439]
shr eax, 4
and al, 1
mov byte [ebx + 0x27], al
cmp byte [ebx + 0x28], 0
je 0xf0095b4
push edi
call fcn.0f00e79f
test eax, eax
mov dword [ebx + 0xc], eax
je 0xf0095b4
lea ecx, [ebp - 0x478]
mov edx, eax
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0xf0095aa
xor esi, esi
inc esi
push dword [ebp - 0x64c]
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0f01b9b9
leave
ret 8