Function at 0x404900
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x238
mov eax, dword [0x4beb20]
xor eax, esp
mov dword [esp + 0x234], eax
mov eax, dword [esp + 0x240]
push ebx
push ebp
mov ebp, dword [esp + 0x244]
push esi
push edi
mov edi, ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], eax
call fcn.00401ca0
test eax, eax
jne 0x404951
call fcn.00405bd0
call fcn.00401ca0
test eax, eax
jne 0x404951
mov eax, 0xc0000603
jmp 0x404ddf
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edi
call esi
cmp eax, 0xffffffff
je 0x404969
push edi
call esi
test eax, 0x10000
je 0x40497e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x40497e
mov eax, 0xc0000202
jmp 0x404ddf
mov ecx, edi
call fcn.00404720
test eax, eax
jne 0x404ddd
mov ecx, edi
call fcn.00402cd0
push edi
mov dword [esp + 0x3c], eax
call esi
test al, 1
je 0x4049ab
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push 0x20000080
push 3
push 0
push 3
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x404a20
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1ff
lea ecx, [esp + 0x45]
push 0
push ecx
mov byte [esp + 0x4c], 0
call fcn.00468830
lea edx, [esp + 0x40]
add esp, 0xc
push edx
lea ebx, [esp + 0x44]
mov edx, ebp
mov ecx, edi
call fcn.004045b0
mov esi, eax
add esp, 4
test esi, esi
jne 0x404dcb
call fcn.004046d0
mov dword [esp + 0x3c], eax
cmp eax, 0xffffffff
jne 0x404a2a
mov esi, 0xc0000204
jmp 0x404dcb
mov esi, 0xc0000302
jmp 0x404dcb
push str.IsWow64Process
push 0x4a3b04
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x404a5d
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
cmp dword [esp + 0x10], 0
je 0x404b29
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
jmp 0x404a73
jmp 0x404a77
lea ebx, [ecx + 0x796f]
xor ebx, 0x501
or ebx, 0x781a
add ebx, 0x12
jmp 0x404a8f
lea edx, [ebx - 0xc]
and edx, 0x14
or edx, 0x199d6a
mov eax, 0x110
sub eax, edx
mov dword [esp + 0x10], eax
jmp 0x404aa9
mov edx, ecx
and edx, 0x3844
xor edx, eax
or edx, 0x41ab
mov edi, 0x796f
sub edi, edx
jmp 0x404ac4
jmp 0x404ac7
jmp 0x404acb
jmp 0x404acf
lea eax, [edi + edi*8]
add eax, eax
cdq
mov ebp, 0x18
idiv ebp
lea esi, [edi + ecx - 0x123]
and esi, 0x332
lea eax, [edi + 0x422b]
and edx, 0x154
xor esi, edx
mov edx, edi
sub edx, ecx
and esi, ebx
xor esi, eax
add edx, 0x332
lea eax, [edi - 0x3f55]
and edx, eax
or esi, edx
mov edx, 0x332
shl edx, cl
add edi, 0xffffbe31
and edi, edx
and edi, dword [esp + 0x10]
or esi, edi
jmp 0x404d17
mov dword [esp + 0x1c], 0x110
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebp, eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x10], 0x8456
mov dword [esp + 0x24], 0x4287
mov dword [esp + 0x20], 0x332
mov dword [esp + 0x14], 0x3678
mov dword [esp + 0x18], 0x12
jmp 0x404b68
pushaw
mov eax, dword [esp + 0x20]
jmp 0x404b72
mov ebx, dword [esp + 0x34]
jmp 0x404b79
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
jmp 0x404b89
mov edi, dword [esp + 0x30]
and eax, ebx
jmp 0x404b93
or eax, esi
and ebx, dword [esp + 0x38]
jmp 0x404b9d
add ebx, eax
sub ecx, eax
sub esi, eax
mov dword [esp + 0x2c], ebx
jmp 0x404baa
add edi, esi
and ebx, eax
jmp 0x404bb3
xor esi, edi
add esi, ebx
jmp 0x404bba
sub ecx, esi
add edi, ebx
jmp 0x404bc2
xor ecx, edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x34], eax
jmp 0x404bd0
mov dword [esp + 0x30], edx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], esi
jmp 0x404bdf
popaw
jmp 0x404be4
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x10]
lea edx, [ecx + eax]
mov eax, dword [esp + 0x14]
add esi, eax
and edx, esi
lea esi, [eax + eax*8]
add esi, esi
and esi, 0x23
xor edx, esi
and ecx, eax
or edx, ecx
or edx, dword [esp + 0x24]
add eax, edx
mov dword [esp + 0x14], eax
jmp 0x404c17
mov edx, dword [esp + 0x20]
sub edx, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
add edx, dword [esp + 0x10]
lea ecx, [eax + ebp]
xor edx, ecx
mov ecx, dword [esp + 0x18]
add eax, ecx
xor eax, 0x19b
or edx, eax
add ecx, edx
mov dword [esp + 0x18], ecx
jmp 0x404c42
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
sub ecx, dword [esp + 0x24]
lea edx, [ecx + eax + 5]
and edx, eax
mov eax, dword [esp + 0x14]
imul eax, eax, 0xd8
sar eax, 2
or edx, eax
sub dword [esp + 0x1c], edx
jmp 0x404c6a
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
mov ecx, eax
and ecx, ebp
xor ecx, dword [esp + 0x1c]
add edx, 0x12
xor edx, dword [esp + 0x20]
or ecx, edx
sub eax, ecx
mov dword [esp + 0x14], eax
jmp 0x404c8d
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
add eax, dword [esp + 0x24]
mov ecx, ebp
shl edx, cl
and eax, edx
and dword [esp + 0x1c], eax
jmp 0x404caa
mov esi, dword [esp + 0x10]
mov eax, esi
cdq
idiv dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
lea eax, [ecx + ecx*8]
add eax, eax
mov edi, edx
cdq
mov ebx, 0x18
idiv ebx
mov eax, dword [esp + 0x24]
add ecx, eax
add ecx, esi
add ecx, ebp
and ecx, dword [esp + 0x20]
and edi, edx
xor edi, ecx
and dword [esp + 0x18], edi
jmp 0x404ce2
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov esi, ecx
sub esi, dword [esp + 0x24]
mov edx, ecx
add esi, eax
sub edx, ebp
add edx, eax
mov eax, dword [esp + 0x10]
and esi, edx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor eax, dword [esp + 0x18]
or esi, eax
or dword [esp + 0x1c], esi
jmp 0x404d13
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x2c]
jmp 0x404d1f
mov ecx, 0x3d7
lea eax, [esi - 0x75643678]
lea ebx, [ebx]
jmp 0x404d34
sub ecx, 1
jne 0x404d30
jmp 0x404d3d
imul eax, eax, 0x16c6d
mov ecx, eax
and ecx, 0xde8
xor ecx, 0xc960df20
jmp 0x404d56
jmp 0x404d59
jmp 0x404d5d
jmp 0x404d61
imul eax, eax, 0x6c62669
mov ebx, dword [esp + 0x34]
sub eax, 2
imul eax, ecx
not ecx
add eax, 0xd9b
add ecx, 0x16c6d
xor eax, ecx
mov dword [esp + 0x28], eax
lea eax, [esp + 0x28]
push eax
push ebx
lea esi, [esp + 0x48]
call fcn.00406f70
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x264]
mov eax, dword [esp + 0x260]
push ecx
mov ecx, dword [esp + 0x260]
push edx
push eax
push ecx
push ebx
mov ebx, dword [esp + 0x4c]
mov edx, esi
push edx
mov ecx, edi
call fcn.00401db0
add esp, 0x20
test eax, eax
jne 0x404ddd
mov esi, 0xc0000205
cmp dword [esp + 0x38], 0
je 0x404dd9
mov ecx, edi
call fcn.00402ba0
mov eax, esi
jmp 0x404ddf
xor eax, eax
mov ecx, dword [esp + 0x244]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004694b0
add esp, 0x238
ret