Function at 0x100211fd
Capabilities:
Check if file exists

Disassembly:
push ebp
sub esp, 0x588
lea ebp, [esp - 4]
mov eax, dword [0x100598e8]
xor eax, ebp
mov dword [ebp + 0x588], eax
push 0x50
mov eax, 0x100483c5
call fcn.1003177f
mov edx, dword [ebp + 0x5a0]
mov esi, dword [ebp + 0x598]
mov eax, ecx
mov ecx, dword [ebp + 0x594]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp + 0x59c]
xor edi, edi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x48], edx
cmp dword [eax + 4], edi
je 0x100217ce
cmp esi, edi
je 0x100217ce
cmp ecx, edi
je 0x100217ce
mov dword [ebp - 0x28], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], edi
mov ebx, dword [0x1005cb6c]
push 0x19b8
mov byte [ebp - 4], 2
mov dword [ebp - 0x3c], ebx
call fcn.10032132
pop ecx
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 3
cmp eax, edi
je 0x1002129d
mov ecx, eax
call fcn.1001562a
mov dword [ebp - 0x18], eax
jmp 0x100212a0
mov dword [ebp - 0x18], edi
mov byte [ebp - 4], 2
cmp dword [ebp - 0x18], edi
je 0x1002179b
cmp ebx, edi
je 0x10021793
mov eax, dword [ebx]
lea ecx, [ebp - 0x34]
push ecx
push 0x1004bf80
mov ecx, ebx
call dword [eax + 0x30]
test eax, eax
je 0x10021793
mov eax, dword [ebx]
lea ecx, [ebp - 0x28]
push ecx
push 0x1004b040
mov ecx, ebx
call dword [eax + 0x30]
test eax, eax
jne 0x100212f9
mov eax, dword [ebx]
lea ecx, [ebp - 0x28]
push ecx
push 0x1004b014
mov ecx, ebx
call dword [eax + 0x30]
test eax, eax
je 0x10021793
mov eax, dword [ebx]
lea ecx, [ebp - 0x38]
push ecx
push 0x1004bf80
mov ecx, ebx
call dword [eax + 0x30]
test eax, eax
je 0x10021793
push 0x9d84
lea ecx, [ebp - 0x30]
call fcn.100107c9
mov eax, dword [eax]
mov ebx, dword [ebp - 0x18]
push eax
push 0x3c
add ebx, 0x8a4
push ebx
call fcn.10012a0b
lea ecx, [ebp - 0x30]
call fcn.1000e380
lea ecx, [ebp]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
call fcn.1000e521
mov eax, dword [0x100591c4]
mov dword [ebp - 0x40], eax
xor eax, eax
push 0x206
mov word [ebp + 0x380], ax
lea eax, [ebp + 0x382]
push edi
push eax
mov byte [ebp - 4], 5
call fcn.10031310
mov eax, dword [esi]
add esp, 0xc
mov edi, 0x104
push edi
lea ecx, [ebp + 0x380]
push ecx
mov ecx, dword [ebp - 0x24]
push dword [ecx + 4]
push esi
call dword [eax + 0x10]
test eax, eax
jne 0x100213ae
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x100213a5
mov dword [ebp - 0x14], 7
jmp 0x100216df
and dword [ebp - 0x10], 0
jmp 0x100216e6
push edi
lea eax, [ebp + 0x178]
push eax
lea eax, [ebp + 0x380]
push eax
call fcn.1000ed1b
add esp, 0xc
test eax, eax
je 0x100213dd
lea eax, [ebp + 0x178]
push eax
push edi
lea eax, [ebp + 0x380]
push eax
call fcn.10009101
mov edi, dword [ebp - 0x18]
push esi
lea ecx, [edi + 0x858]
call fcn.10020a8b
push 0x848
push dword [ebp - 0x24]
lea eax, [edi + 8]
push eax
call fcn.100318a0
mov eax, dword [ebp - 0x34]
add edi, 0x850
add esp, 0xc
cmp dword [edi], eax
je 0x10021414
push eax
push edi
call fcn.100125bd
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x38]
add eax, 0x854
cmp dword [eax], ecx
je 0x1002142a
push ecx
push eax
call fcn.100125bd
mov ecx, dword [ebp - 0x18]
lea eax, [ebp + 0x380]
push eax
add ecx, 0x87c
call fcn.1001015c
lea eax, [ebp + 0x380]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100216d8
lea eax, [ebp + 0x380]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
cmp eax, 1
je 0x100216d8
mov ecx, dword [ebp - 0x20]
and dword [ebp - 0x30], 0
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call fcn.10020d72
test eax, eax
je 0x10021490
mov dword [ebp - 0x14], 2
jmp 0x100216df
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x100214e3
mov ecx, dword [ebp - 0x20]
cmp dword [ecx + 0x18], eax
jne 0x100214b3
call fcn.10020914
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], 1
xor eax, eax
cmp dword [ecx + 0x14], eax
je 0x100214e3
push 0x9d83
lea ecx, [ebp - 0x3c]
call fcn.100107c9
push dword [eax]
push 0x3c
push ebx
call fcn.10012a0b
lea ecx, [ebp - 0x3c]
call fcn.1000e380
mov dword [ebp - 0x14], 5
jmp 0x100216df
or dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x4c], eax
mov eax, dword [esi]
push esi
call dword [eax + 0xc]
cmp eax, 6
jb 0x10021539
mov eax, dword [edi]
mov ecx, dword [esi]
push eax
mov eax, dword [ebp - 0x24]
push dword [eax + 4]
push esi
call dword [ecx + 0x98]
push dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
call fcn.1001772a
test eax, eax
je 0x1002155a
mov edi, dword [edi]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
lea edx, [ebp - 0x4c]
push edx
lea edx, [ebp - 0x44]
push edx
push edi
push eax
call dword [ecx + 0x28]
test eax, eax
jl 0x1002155a
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], eax
jmp 0x1002155a
mov eax, dword [esi]
push esi
call dword [eax + 0xc]
cmp eax, 5
jb 0x1002155a
mov edi, dword [edi]
mov eax, dword [esi]
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp - 0x24]
push edi
push dword [ecx + 4]
push esi
call dword [eax + 0x88]
xor eax, eax
mov word [ebp + 4], ax
mov word [ebp - 0x5c], ax
lea eax, [ebp + 0x380]
push eax
lea ecx, [ebp - 0x5c]
mov dword [ebp], 0x178
call fcn.1000de77
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 6
call fcn.1000de5f
lea eax, [ebp - 0x5c]
push eax
mov byte [ebp - 4], 5
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
xor esi, esi
inc esi
push esi
lea eax, [ebp - 0x40]
push 0x1004c0bc
push eax
call fcn.10010895
mov ecx, dword [ebp - 0x1c]
add esp, 0xc
push dword [ebp - 0x40]
lea eax, [ebp]
push 0x200
push esi
push eax
call fcn.10017a2d
test eax, eax
je 0x10021660
cmp byte [ebp + 0x3e], 1
je 0x10021660
mov al, byte [ebp + 0x34]
cmp al, 0xff
je 0x10021660
mov edi, dword [ebp - 0x20]
push 4
pop ebx
cmp dword [edi + 0xc], esi
jne 0x100215fc
cmp word [ebp + 0x36], bx
jne 0x100215fc
mov dword [ebp - 0x14], 9
jmp 0x100216d3
cmp dword [edi + 8], esi
jne 0x10021648
sub al, 0x1e
cmp al, 0x31
jbe 0x10021685
cmp dword [ebp - 0x2c], 0xffffffff
je 0x10021613
cmp dword [ebp - 0x2c], 0x1e
jae 0x10021685
lea eax, [ebp + 0x380]
push eax
mov ecx, edi
call fcn.10020f54
test eax, eax
je 0x1002162d
mov dword [ebp - 0x14], ebx
jmp 0x100216d3
lea eax, [ebp + 0x380]
push eax
push dword [ebp - 0x24]
mov ecx, edi
push dword [ebp - 0x3c]
call fcn.10020cfe
test eax, eax
jne 0x100216c3
mov al, byte [ebp + 0x34]
sub al, 0x46
cmp al, 9
ja 0x100216e6
xor eax, eax
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
jmp 0x100216e6
lea eax, [ebp + 0x380]
push eax
call fcn.1000cb73
pop ecx
cmp eax, 0xffffffff
je 0x100216cc
cmp eax, 0x3200000
ja 0x100216cc
cmp dword [ebp - 0x2c], 0xffffffff
je 0x1002168a
cmp dword [ebp - 0x2c], 0x1e
jb 0x1002168a
mov dword [ebp - 0x14], esi
jmp 0x100216d3
mov ecx, dword [ebp - 0x20]
lea eax, [ebp + 0x380]
push eax
call fcn.10020f54
test eax, eax
je 0x100216a6
mov dword [ebp - 0x14], 4
jmp 0x100216d3
mov ecx, dword [ebp - 0x20]
lea eax, [ebp + 0x380]
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x3c]
call fcn.10020cfe
test eax, eax
je 0x100213a5
mov dword [ebp - 0x14], 3
jmp 0x100216d3
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x10], esi
jmp 0x100216e6
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0x48], 0
je 0x10021743
cmp dword [ebp - 0x10], 1
jne 0x10021743
mov eax, dword [0x100591c4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
push dword [eax + 0x18]
lea eax, [ebp - 0x1c]
push dword [ebp - 0x14]
mov byte [ebp - 4], 7
push 0x1004eb64
push eax
call fcn.10010895
mov esi, dword [ebp - 0x18]
add esp, 0x10
lea eax, [ebp - 0x1c]
push eax
lea ecx, [esi + 0x884]
call fcn.1001bcfd
mov ecx, dword [ebp - 0x48]
push 1
push 2
push esi
call fcn.1001aa88
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 5
call fcn.1000e380
mov ecx, dword [ebp - 0x18]
call fcn.10015385
lea ecx, [ebp - 0x40]
call fcn.1000e380
lea ecx, [ebp]
call fcn.1000e673
mov eax, dword [ebp - 0x38]
mov byte [ebp - 4], 1
test eax, eax
je 0x1002176c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x34]
mov byte [ebp - 4], 0
test eax, eax
je 0x1002177d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x28]
or dword [ebp - 4], 0xffffffff
test eax, eax
je 0x1002178e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
jmp 0x100217d0
mov ecx, dword [ebp - 0x18]
call fcn.10015385
mov eax, dword [ebp - 0x38]
mov byte [ebp - 4], 1
cmp eax, edi
je 0x100217ac
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x34]
mov byte [ebp - 4], 0
cmp eax, edi
je 0x100217bd
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x28]
or dword [ebp - 4], 0xffffffff
cmp eax, edi
je 0x100217ce
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x588]
xor ecx, ebp
call fcn.10031770
add ebp, 0x58c
leave
ret 0x10