Function at 0x470f80
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x510425
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x569080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.004047f0
mov edi, eax
test edi, edi
je 0x471771
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x525578]
mov ecx, edi
call esi
add eax, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x1c], eax
call fcn.004047f0
mov dword [ebp - 0x20], eax
test eax, eax
je 0x47177b
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x525578]
mov ecx, dword [ebp - 0x20]
call esi
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
mov eax, str.FilePath
lea ecx, [ebp - 0x18]
test eax, 0xffff0000
jne 0x471028
movzx eax, ax
push eax
call fcn.004043d0
jmp 0x471034
push 8
push str.FilePath
call fcn.00403870
mov byte [ebp - 4], 3
lea eax, [ebp - 0x14]
mov esi, dword [ebp - 0x1c]
mov ecx, esi
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call dword [0x525578]
mov ecx, edi
call esi
mov byte [ebp - 4], 1
or eax, 0xffffffff
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x471080
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x525578]
mov ecx, edi
call esi
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
je 0x47118c
mov ecx, dword [ebp + 0xc]
lea esi, [ebx + 0xf4]
push esi
lea eax, [ebp - 0x14]
push eax
call fcn.004639d0
mov dword [ebx + 0x10c], eax
test eax, eax
je 0x4710b5
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.00409df0
mov eax, dword [edi]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x1c], eax
call fcn.004047f0
mov dword [ebp - 0x20], eax
test eax, eax
je 0x471785
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x525578]
mov ecx, dword [ebp - 0x20]
call esi
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 5
mov eax, str.FileSize
lea ecx, [ebp - 0x18]
test eax, 0xffff0000
jne 0x471103
movzx eax, ax
push eax
call fcn.004043d0
jmp 0x47110f
push 8
push str.FileSize
call fcn.00403870
mov byte [ebp - 4], 6
lea eax, [ebp - 0x14]
mov esi, dword [ebp - 0x1c]
mov ecx, esi
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [0x525578]
mov ecx, edi
call esi
mov byte [ebp - 4], 1
or eax, 0xffffffff
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x47115c
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x525578]
mov ecx, edi
call esi
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
cmp dword [ecx - 0xc], 0
je 0x471177
or dword [ebx + 0xf0], 2
call fcn.0040e3d0
mov dword [ebx + 0x128], eax
mov dword [ebx + 0xec], 1
lea ecx, [ebx + 0xf4]
jmp 0x471708
mov eax, dword [edi]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x1c], eax
call fcn.004047f0
mov dword [ebp - 0x20], eax
test eax, eax
je 0x47178f
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x525578]
mov ecx, dword [ebp - 0x20]
call esi
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 8
mov eax, str.RegistryKey
lea ecx, [ebp - 0x18]
test eax, 0xffff0000
jne 0x4711da
movzx eax, ax
push eax
call fcn.004043d0
jmp 0x4711e6
push 0xb
push str.RegistryKey
call fcn.00403870
mov byte [ebp - 4], 9
lea esi, [ebx + 0xf4]
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
push esi
push eax
mov eax, dword [ebp + 8]
push eax
mov dword [ebp - 0x20], esi
call dword [0x525578]
mov ecx, edi
call dword [ebp - 0x1c]
mov byte [ebp - 4], 1
or eax, 0xffffffff
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x47123e
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x525578]
mov ecx, edi
call esi
mov edi, dword [ebp + 0x10]
lea esi, [ebx + 0xf4]
mov eax, dword [esi]
mov ecx, esi
mov dword [ebx + 0xec], 0
cmp dword [eax - 0xc], 0
jne 0x471708
mov eax, dword [edi]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x24], eax
call fcn.004047f0
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x471799
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x525578]
mov ecx, dword [ebp - 0x1c]
call esi
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xb
mov eax, str.CustomDetection
lea ecx, [ebp - 0x18]
test eax, 0xffff0000
jne 0x4712a4
movzx eax, ax
push eax
call fcn.004043d0
jmp 0x4712b0
push 0xf
push str.CustomDetection
call fcn.00403870
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x14]
mov esi, dword [ebp - 0x24]
mov ecx, esi
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call dword [0x525578]
mov ecx, edi
call esi
mov byte [ebp - 4], 1
or eax, 0xffffffff
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4712fc
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x525578]
mov ecx, edi
call esi
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
je 0x471444
mov ecx, dword [ebp + 0xc]
lea esi, [ebx + 0xf4]
push esi
lea eax, [ebp - 0x14]
push eax
call fcn.004639d0
mov dword [ebx + 0x10c], eax
test eax, eax
je 0x471331
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.00409df0
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x471347
mov ebx, 0xe0000034
jmp 0x47172d
mov dword [ebx + 0xec], 3
mov eax, dword [edi]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x20], eax
call fcn.004047f0
mov dword [ebp - 0x24], eax
test eax, eax
je 0x4717a3
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x525578]
mov ecx, dword [ebp - 0x24]
call esi
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xe
mov eax, str.CustomDetectionParams
lea ecx, [ebp - 0x18]
test eax, 0xffff0000
jne 0x47139f
movzx eax, ax
push eax
call fcn.004043d0
jmp 0x4713ab
push 0x15
push str.CustomDetectionParams
call fcn.00403870
mov byte [ebp - 4], 0xf
lea eax, [ebx + 0xf8]
mov esi, dword [ebp - 0x20]
mov ecx, esi
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call dword [0x525578]
mov ecx, edi
call esi
mov byte [ebp - 4], 1
or eax, 0xffffffff
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4713fa
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x525578]
mov ecx, edi
call esi
mov edi, dword [ebp + 0x10]
mov eax, dword [ebx + 0xf4]
cmp dword [eax - 0xc], 0
je 0x471181
lea edx, [ebp - 0xd]
mov byte [ebp - 0xd], 0
lea ecx, [ebx + 0xf4]
call fcn.00486650
test eax, eax
jne 0x471429
cmp byte [ebp - 0xd], al
je 0x471181
mov eax, dword [ebx + 0x94]
shr eax, 0xd
test al, 1
jne 0x471181
mov ebx, 0xe0000026
jmp 0x47172d
mov eax, dword [edi]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x1c], eax
call fcn.004047f0
mov dword [ebp - 0x24], eax
test eax, eax
je 0x4717ad
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x525578]
mov ecx, dword [ebp - 0x24]
call esi
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x11
mov eax, str.AppIdName
lea ecx, [ebp - 0x18]
test eax, 0xffff0000
jne 0x471492
movzx eax, ax
push eax
call fcn.004043d0
jmp 0x47149e
push 9
push str.AppIdName
call fcn.00403870
mov byte [ebp - 4], 0x12
lea eax, [ebx + 0xfc]
mov esi, dword [ebp - 0x1c]
mov ecx, esi
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call dword [0x525578]
mov ecx, edi
call esi
mov byte [ebp - 4], 1
or eax, 0xffffffff
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4714ed
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x525578]
mov ecx, edi
call esi
mov edi, dword [ebp + 0x10]
mov eax, dword [ebx + 0xfc]
mov ecx, dword [ebp - 0x20]
cmp dword [eax - 0xc], 0
je 0x471708
mov eax, dword [edi]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x1c], eax
call fcn.004047f0
mov dword [ebp - 0x24], eax
test eax, eax
je 0x4717b7
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x525578]
mov ecx, dword [ebp - 0x24]
call esi
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x14
mov eax, str.AppIdArch
lea ecx, [ebp - 0x18]
test eax, 0xffff0000
jne 0x47154e
movzx eax, ax
push eax
call fcn.004043d0
jmp 0x47155a
push 9
push str.AppIdArch
call fcn.00403870
mov byte [ebp - 4], 0x15
lea eax, [ebx + 0x100]
mov esi, dword [ebp - 0x1c]
mov ecx, esi
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call dword [0x525578]
mov ecx, edi
call esi
mov byte [ebp - 4], 1
or eax, 0xffffffff
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4715a9
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x525578]
mov ecx, edi
call esi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x1c], eax
call fcn.004047f0
mov dword [ebp - 0x24], eax
test eax, eax
je 0x4717c1
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x525578]
mov ecx, dword [ebp - 0x24]
call esi
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x17
mov eax, str.AppIdResourceId
lea ecx, [ebp - 0x18]
test eax, 0xffff0000
jne 0x4715f7
movzx eax, ax
push eax
call fcn.004043d0
jmp 0x471603
push 0xf
push str.AppIdResourceId
call fcn.00403870
mov byte [ebp - 4], 0x18
lea eax, [ebx + 0x104]
mov esi, dword [ebp - 0x1c]
mov ecx, esi
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call dword [0x525578]
mov ecx, edi
call esi
mov byte [ebp - 4], 1
or eax, 0xffffffff
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x471652
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x525578]
mov ecx, edi
call esi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x1c], eax
call fcn.004047f0
mov dword [ebp - 0x24], eax
test eax, eax
je 0x4717cb
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x525578]
mov ecx, dword [ebp - 0x24]
call esi
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x1a
mov eax, str.AppIdPublisherId
lea ecx, [ebp - 0x18]
test eax, 0xffff0000
jne 0x4716a0
movzx eax, ax
push eax
call fcn.004043d0
jmp 0x4716ac
push 0x10
push str.AppIdPublisherId
call fcn.00403870
mov byte [ebp - 4], 0x1b
lea eax, [ebx + 0x108]
mov esi, dword [ebp - 0x1c]
mov ecx, esi
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call dword [0x525578]
mov ecx, edi
call esi
mov byte [ebp - 4], 1
or eax, 0xffffffff
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4716fb
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x525578]
mov ecx, edi
call esi
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x20]
mov dword [ebx + 0xec], 4
mov eax, dword [ecx]
cmp dword [eax - 0xc], 0
jne 0x471723
mov eax, dword [ebx + 0xfc]
cmp dword [eax - 0xc], 0
jne 0x471723
mov ebx, 0xe0000014
jmp 0x47172d
push edi
mov ecx, ebx
call fcn.0046e6f0
xor ebx, ebx
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x47175b
mov edi, dword [eax]
push eax
mov edx, dword [edi]
mov esi, dword [edx + 4]
mov ecx, esi
call dword [0x525578]
mov ecx, edi
call esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.004027d0
push 0x80004005
call fcn.004027d0
push 0x80004005
call fcn.004027d0
push 0x80004005
call fcn.004027d0
push 0x80004005
call fcn.004027d0
push 0x80004005
call fcn.004027d0
push 0x80004005
call fcn.004027d0
push 0x80004005
call fcn.004027d0
push 0x80004005
call fcn.004027d0
push 0x80004005
call fcn.004027d0
int3