Function at 0x1001f185
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x10086084]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
push edi
xor eax, eax
mov dword [esp + 0x20], ecx
lea edi, [esp + 0x24]
xor ecx, ecx
stosd dword es:[edi], eax
mov ebx, edx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], ecx
stosd dword es:[edi], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [esp + 0x20]
test edi, edi
je 0x1001f41d
test ebx, ebx
je 0x1001f41d
mov eax, dword [edi + 0x10]
mov dword [ebx + 0x410], eax
mov eax, dword [edi]
sub eax, 1
je 0x1001f26c
sub eax, 1
je 0x1001f239
sub eax, 1
je 0x1001f212
mov eax, 0x80070057
push eax
mov esi, eax
push 0x87d
mov ecx, 0x10004d8c
call fcn.1003a254
jmp 0x1001f443
or dword [ebx + 0x414], 8
mov edx, dword [edi + 8]
lea eax, [esp + 0x18]
push eax
lea ecx, [edi + 0x38]
call fcn.10048762
test eax, eax
jns 0x1001f2d4
mov eax, dword [edi + 8]
jmp 0x1001f2d8
lea ecx, [edi + 0x14]
lea edx, [esp + 0xc]
call fcn.1004c906
mov esi, eax
test esi, esi
jns 0x1001f253
push esi
push 0x86e
jmp 0x1001f203
cmp dword [esp + 0xc], 1
jne 0x1001f263
or dword [ebx + 0x414], 1
jmp 0x1001f219
or dword [ebx + 0x414], 4
jmp 0x1001f219
or dword [ebx + 0x414], 2
lea eax, [esp + 0x10]
push eax
lea eax, [edi + 0x14]
push eax
call dword [sym.imp.RPCRT4.dll_UuidToStringW]
mov esi, eax
test esi, esi
je 0x1001f29e
jle 0x1001f293
movzx esi, si
or esi, 0x80070000
push esi
push 0x852
jmp 0x1001f203
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
xor edx, edx
call fcn.1003a198
mov esi, eax
cmp esi, 0x80070002
jne 0x1001f2c1
or dword [ebx + 0x414], 8
xor esi, esi
test esi, esi
jns 0x1001f219
push esi
push 0x862
jmp 0x1001f42a
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], eax
test eax, eax
je 0x1001f302
push eax
lea ecx, [ebx + 0x208]
mov edx, 0x208
call fcn.1001fe64
mov esi, eax
test esi, esi
jns 0x1001f302
push esi
push 0x892
jmp 0x1001f42a
cmp dword [edi + 0xc], 0
je 0x1001f328
push dword [edi + 0xc]
mov edx, 0x208
mov ecx, ebx
call fcn.1001fe64
mov esi, eax
test esi, esi
jns 0x1001f328
push esi
push 0x89d
jmp 0x1001f42a
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
push 1
push 0
xor edx, edx
call fcn.1001d410
test eax, eax
js 0x1001f3d8
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x24]
call fcn.10049bc1
mov esi, eax
test esi, esi
jns 0x1001f362
push esi
push 0x8b0
jmp 0x1001f42a
lea edx, [esp + 0x24]
xor ecx, ecx
mov eax, dword [edx + ecx*4]
cmp eax, dword [edi + ecx*4 + 0x14]
jne 0x1001f379
inc ecx
cmp ecx, 4
jne 0x1001f368
jmp 0x1001f38b
mov eax, dword [ebx + 0x414]
and eax, 0xfffffffa
or eax, 0x48
mov dword [ebx + 0x414], eax
mov edi, dword [esp + 0x14]
mov ecx, dword [edi + 0x28]
test ecx, ecx
je 0x1001f3b6
call fcn.10030b0c
push eax
mov edx, 0x208
mov ecx, ebx
call fcn.1001fe64
mov esi, eax
test esi, esi
jns 0x1001f3bd
push esi
push 0x8c0
jmp 0x1001f42a
or dword [ebx + 0x414], 0x10
mov eax, dword [edi + 0x10]
mov dword [ebx + 0x410], eax
cmp dword [edi + 0x3c], 0
jne 0x1001f434
or dword [ebx + 0x414], 0x100
jmp 0x1001f434
cmp eax, 0xc142011c
je 0x1001f3f4
cmp eax, 0x80070002
je 0x1001f3f4
cmp eax, 0x80070003
je 0x1001f3f4
cmp eax, 0xc1420132
jne 0x1001f406
mov eax, dword [ebx + 0x414]
and eax, 0xfffffffa
or eax, 0x28
mov dword [ebx + 0x414], eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1001f419
or dword [ebx + 0x414], 0x10
xor esi, esi
jmp 0x1001f434
mov eax, 0x80070057
push eax
mov esi, eax
push 0x83a
mov ecx, 0x10004d8c
call fcn.1003a254
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x1001f443
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], 0
je 0x1001f455
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.RPCRT4.dll_RpcStringFreeW]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x1001f46d
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x14]
call fcn.100497c0
mov ecx, dword [esp + 0x34]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10083b20
mov esp, ebp
pop ebp
ret