Function at 0x4041e0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x238
mov eax, dword [0x4b9b20]
xor eax, esp
mov dword [esp + 0x234], eax
mov eax, dword [esp + 0x240]
push ebx
push ebp
mov ebp, dword [esp + 0x244]
push esi
push edi
mov edi, ecx
push 0
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], eax
call fcn.00401080
add esp, 4
cmp eax, 0xffffffff
jne 0x40423d
call fcn.004054c0
push 0
call fcn.00401080
add esp, 4
cmp eax, 0xffffffff
jne 0x40423d
mov eax, 0xc0000603
jmp 0x4046cf
push eax
call dword [sym.imp.ntdll.dll_NtClose]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edi
call esi
cmp eax, 0xffffffff
je 0x40425c
push edi
call esi
test eax, 0x10000
je 0x404271
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x404271
mov eax, 0xc0000202
jmp 0x4046cf
mov ecx, edi
call fcn.00404000
test eax, eax
jne 0x4046cd
mov ecx, edi
call fcn.004025b0
push edi
mov dword [esp + 0x3c], eax
call esi
test al, 1
je 0x40429e
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push 0x20000080
push 3
push 0
push 3
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x404313
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1ff
lea ecx, [esp + 0x45]
push 0
push ecx
mov byte [esp + 0x4c], 0
call fcn.004661f0
lea edx, [esp + 0x40]
add esp, 0xc
push edx
lea ebx, [esp + 0x44]
mov edx, ebp
mov ecx, edi
call fcn.00403e90
mov esi, eax
add esp, 4
test esi, esi
jne 0x4046bb
call fcn.00403fb0
mov dword [esp + 0x3c], eax
cmp eax, 0xffffffff
jne 0x40431d
mov esi, 0xc0000204
jmp 0x4046bb
mov esi, 0xc0000302
jmp 0x4046bb
push str.IsWow64Process
push 0x49ec7c
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x404350
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
cmp dword [esp + 0x10], 0
je 0x40441c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
jmp 0x404366
jmp 0x40436a
lea ebx, [ecx + 0x796f]
xor ebx, 0x501
or ebx, 0x781a
add ebx, 0x12
jmp 0x404382
lea edx, [ebx - 0xc]
and edx, 0x14
or edx, 0x199d6a
mov eax, pe_nt_image_headers32
sub eax, edx
mov dword [esp + 0x10], eax
jmp 0x40439c
mov edx, ecx
and edx, 0x3844
xor edx, eax
or edx, 0x41ab
mov edi, 0x796f
sub edi, edx
jmp 0x4043b7
jmp 0x4043ba
jmp 0x4043be
jmp 0x4043c2
lea eax, [edi + edi*8]
add eax, eax
cdq
mov ebp, 0x18
idiv ebp
lea esi, [edi + ecx - 0x123]
and esi, 0x332
lea eax, [edi + 0x422b]
and edx, 0x154
xor esi, edx
mov edx, edi
sub edx, ecx
and esi, ebx
xor esi, eax
add edx, 0x332
lea eax, [edi - 0x3f55]
and edx, eax
or esi, edx
mov edx, 0x332
shl edx, cl
add edi, 0xffffbe31
and edi, edx
and edi, dword [esp + 0x10]
or esi, edi
jmp 0x40460a
mov dword [esp + 0x1c], pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebp, eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x10], 0x8456
mov dword [esp + 0x24], 0x4287
mov dword [esp + 0x20], 0x332
mov dword [esp + 0x14], 0x3678
mov dword [esp + 0x18], 0x12
jmp 0x40445b
pushaw
mov eax, dword [esp + 0x20]
jmp 0x404465
mov ebx, dword [esp + 0x34]
jmp 0x40446c
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
jmp 0x40447c
mov edi, dword [esp + 0x30]
and eax, ebx
jmp 0x404486
or eax, esi
and ebx, dword [esp + 0x38]
jmp 0x404490
add ebx, eax
sub ecx, eax
sub esi, eax
mov dword [esp + 0x2c], ebx
jmp 0x40449d
add edi, esi
and ebx, eax
jmp 0x4044a6
xor esi, edi
add esi, ebx
jmp 0x4044ad
sub ecx, esi
add edi, ebx
jmp 0x4044b5
xor ecx, edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x34], eax
jmp 0x4044c3
mov dword [esp + 0x30], edx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], esi
jmp 0x4044d2
popaw
jmp 0x4044d7
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x10]
lea edx, [ecx + eax]
mov eax, dword [esp + 0x14]
add esi, eax
and edx, esi
lea esi, [eax + eax*8]
add esi, esi
and esi, 0x23
xor edx, esi
and ecx, eax
or edx, ecx
or edx, dword [esp + 0x24]
add eax, edx
mov dword [esp + 0x14], eax
jmp 0x40450a
mov edx, dword [esp + 0x20]
sub edx, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
add edx, dword [esp + 0x10]
lea ecx, [eax + ebp]
xor edx, ecx
mov ecx, dword [esp + 0x18]
add eax, ecx
xor eax, 0x19b
or edx, eax
add ecx, edx
mov dword [esp + 0x18], ecx
jmp 0x404535
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
sub ecx, dword [esp + 0x24]
lea edx, [ecx + eax + 5]
and edx, eax
mov eax, dword [esp + 0x14]
imul eax, eax, 0xd8
sar eax, 2
or edx, eax
sub dword [esp + 0x1c], edx
jmp 0x40455d
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
mov ecx, eax
and ecx, ebp
xor ecx, dword [esp + 0x1c]
add edx, 0x12
xor edx, dword [esp + 0x20]
or ecx, edx
sub eax, ecx
mov dword [esp + 0x14], eax
jmp 0x404580
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
add eax, dword [esp + 0x24]
mov ecx, ebp
shl edx, cl
and eax, edx
and dword [esp + 0x1c], eax
jmp 0x40459d
mov esi, dword [esp + 0x10]
mov eax, esi
cdq
idiv dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
lea eax, [ecx + ecx*8]
add eax, eax
mov edi, edx
cdq
mov ebx, 0x18
idiv ebx
mov eax, dword [esp + 0x24]
add ecx, eax
add ecx, esi
add ecx, ebp
and ecx, dword [esp + 0x20]
and edi, edx
xor edi, ecx
and dword [esp + 0x18], edi
jmp 0x4045d5
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov esi, ecx
sub esi, dword [esp + 0x24]
mov edx, ecx
add esi, eax
sub edx, ebp
add edx, eax
mov eax, dword [esp + 0x10]
and esi, edx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor eax, dword [esp + 0x18]
or esi, eax
or dword [esp + 0x1c], esi
jmp 0x404606
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x2c]
jmp 0x404612
mov ecx, 0x3d7
lea eax, [esi - 0x75643678]
lea ecx, [ecx]
jmp 0x404624
sub ecx, 1
jne 0x404620
jmp 0x40462d
imul eax, eax, 0x16c6d
mov ecx, eax
and ecx, 0xde8
xor ecx, 0xc960df20
jmp 0x404646
jmp 0x404649
jmp 0x40464d
jmp 0x404651
imul eax, eax, 0x6c62669
mov ebx, dword [esp + 0x34]
sub eax, 2
imul eax, ecx
not ecx
add eax, 0xd9b
add ecx, 0x16c6d
xor eax, ecx
mov dword [esp + 0x28], eax
lea eax, [esp + 0x28]
push eax
push ebx
lea esi, [esp + 0x48]
call fcn.00406860
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x264]
mov eax, dword [esp + 0x260]
push ecx
mov ecx, dword [esp + 0x260]
push edx
push eax
push ecx
push ebx
mov ebx, dword [esp + 0x4c]
mov edx, esi
push edx
mov ecx, edi
call fcn.00401870
add esp, 0x20
test eax, eax
jne 0x4046cd
mov esi, 0xc0000205
cmp dword [esp + 0x38], 0
je 0x4046c9
mov ecx, edi
call fcn.00402480
mov eax, esi
jmp 0x4046cf
xor eax, eax
mov ecx, dword [esp + 0x244]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00466e70
add esp, 0x238
ret