Function at 0x4014c4
Capabilities:
Acquire debug privileges
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x29c
mov eax, dword [0x4290a0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x290], 0
push ebx
push esi
mov ebx, 0x42a450
push edi
mov ecx, ebx
call fcn.004028f2
test eax, eax
je 0x401608
mov eax, dword [0x42ae5c]
cmp eax, 6
je 0x40153c
cmp eax, 7
je 0x40153c
mov dword [0x42a440], eax
xor eax, eax
movzx ecx, word [eax + 0x42ae64]
mov word [eax + 0x44c0f8], cx
inc eax
inc eax
test cx, cx
jne 0x40150b
xor eax, eax
movzx ecx, word [eax + 0x42aee8]
mov word [eax + 0x44c178], cx
inc eax
inc eax
test cx, cx
jne 0x401522
jmp 0x4017c5
mov esi, 0x424acc
lea edi, [ebp - 0x288]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x72
lea eax, [ebp - 0x27a]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.004100e0
mov esi, 0x424adc
lea edi, [ebp - 0x208]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0xc
movsd dword es:[edi], dword [esi]
push 0x72
lea eax, [ebp - 0x1fa]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.004100e0
mov esi, 0x424aec
lea edi, [ebp - 0x188]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0xc
movsd dword es:[edi], dword [esi]
push 0x72
lea eax, [ebp - 0x17a]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.004100e0
mov esi, 0x424afc
lea edi, [ebp - 0x108]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0xc
movsd dword es:[edi], dword [esi]
push 0x70
lea eax, [ebp - 0xf8]
push 0
push eax
movsd dword es:[edi], dword [esi]
call fcn.004100e0
mov esi, 0x424b0c
lea edi, [ebp - 0x88]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0xc
movsw word es:[edi], word [esi]
push 0x6e
xor edi, edi
lea eax, [ebp - 0x76]
push edi
push eax
call fcn.004100e0
add esp, 0xc
lea esi, [ebp - 0x288]
push esi
mov ecx, ebx
call fcn.00402a01
test eax, eax
jne 0x40177d
inc edi
sub esi, 0xffffff80
cmp edi, 5
jl 0x4015ef
or dword [0x42a440], 0xffffffff
and dword [0x44c288], 0
cmp dword [0x44c0f0], 3
jne 0x4017db
cmp dword [0x42a440], 5
ja 0x4017d4
xor ebx, ebx
cmp dword [0x44c288], ebx
jne 0x4017db
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
mov dword [ebp - 0x294], ebx
call fcn.004100e0
add esp, 0xc
lea edi, [ebp - 0x210]
call fcn.00402519
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
cmp ax, bx
jne 0x40166f
push 6
pop ecx
lea eax, [ebp - 0x210]
mov esi, str.HGDraw.dll
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4016d3
lea eax, [ebp - 0x294]
push eax
call fcn.00402573
mov ebx, eax
pop ecx
test ebx, ebx
je 0x4017db
mov eax, dword [ebp - 0x294]
cmp eax, 0xa
jl 0x4017db
lea ecx, [ebp - 0x210]
push ecx
push ebx
call fcn.00403cd2
pop ecx
pop ecx
test eax, eax
jne 0x4017db
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x210]
push eax
call section..text
test eax, eax
je 0x4017db
xor edi, edi
cmp ebx, edi
je 0x4016fb
push ebx
call fcn.0040e3f7
pop ecx
lea eax, [ebp - 0x28c]
push eax
push 0x28
mov dword [ebp - 0x28c], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x401745
mov esi, dword [ebp - 0x28c]
lea eax, [ebp - 0x298]
push eax
push str.SeDebugPrivilege
push edi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x401745
push esi
lea esi, [ebp - 0x298]
call fcn.00402d80
pop ecx
cmp dword [ebp - 0x28c], edi
je 0x401759
push dword [ebp - 0x28c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x210]
push eax
push dword [0x42ae60]
call fcn.00402c4c
pop ecx
pop ecx
test eax, eax
jne 0x4017db
mov eax, dword [0x42ae60]
mov dword [0x44c288], eax
jmp 0x4017db
mov eax, edi
shl eax, 7
lea eax, [ebp + eax - 0x288]
mov edx, 0x44c178
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x401790
mov dword [0x42a440], 6
xor eax, eax
movzx ecx, word [eax + 0x42ae64]
mov word [eax + 0x44c0f8], cx
inc eax
inc eax
test cx, cx
jne 0x4017aa
mov dword [0x42a444], edi
mov dword [ebp - 0x290], 1
jmp 0x401616
and dword [0x44c288], 0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x290]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e402
leave
ret