Function at 0x401c50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x3000
call fcn.0040ce80
mov ecx, dword [esp + 0x3008]
push ebx
push ebp
mov ebp, dword [esp + 0x300c]
push esi
mov edx, ecx
mov ebx, dword [esp + 0x3018]
push edi
xor eax, eax
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
test ebx, ebx
rep stosb byte es:[edi], al
je 0x401d44
mov al, byte [ebx]
test al, al
je 0x401d44
cmp al, 0x5c
jne 0x401cb4
mov eax, dword [esp + 0x3020]
push 2
push eax
push ebp
call fcn.0040d861
add esp, 0xc
mov byte [ebp + 2], 0
jmp 0x401d20
cmp byte [ebx + 1], 0x3a
jne 0x401cc1
mov edi, ebx
jmp 0x401d4b
mov edi, dword [esp + 0x3024]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ecx + ebp - 1], 0x5c
je 0x401d20
mov edi, 0x41c0cc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
jmp 0x401d63
mov edi, dword [esp + 0x3024]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ecx + ebp - 1], 0x5c
je 0x401da5
mov edi, 0x41c0cc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x401db9
test al, 0x10
jne 0x401f4c
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x1010]
push 0x41c0cc
rep stosd dword es:[edi], eax
push ebp
call fcn.0040d7eb
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ebp
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x1018]
sub ecx, edx
push ecx
push ebp
push eax
call fcn.0040d861
push 0x41c0cc
push ebp
call fcn.0040d7eb
mov esi, eax
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x2c]
push ecx
lea ecx, [esi + 1]
push ecx
push edx
call fcn.0040d861
add esp, 0x28
test esi, esi
je 0x401f4c
lea eax, [esp + 0x10]
push 0x41c0cc
push eax
call fcn.0040d7eb
mov esi, eax
add esp, 8
test esi, esi
je 0x401f4c
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x2010]
rep stosd dword es:[edi], eax
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x10]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x10]
sub ecx, edx
push ecx
lea ecx, [esp + 0x2014]
push eax
push ecx
call fcn.0040d861
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
dec ecx
inc esi
push ecx
push esi
push edx
call fcn.0040d861
mov edi, 0x41c0cc
or ecx, 0xffffffff
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x1010]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x1010]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x2010]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x1010]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call sym.Sure_XLite.exe__xCreateDirectory_4
cmp eax, 0xffffffff
jne 0x401e30
push 0x1f4
call sym.Sure_XLite.exe__xSleep_4
lea ecx, [esp + 0x1010]
push ecx
call sym.Sure_XLite.exe__xCreateDirectory_4
cmp eax, 0xffffffff
jne 0x401e30
pop edi
pop esi
pop ebp
or eax, eax
pop ebx
add esp, 0x3000
ret 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x3000
ret 0x14