Function at 0x40dee0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x31c
mov eax, dword [0x446050]
xor eax, esp
mov dword [esp + 0x318], eax
push ebx
push ebp
push esi
push edi
push str.GetSystemWow64DirectoryA
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40e2d6
push 0x104
lea ecx, [esp + 0x224]
push ecx
call eax
test eax, eax
je 0x40e2d6
cmp byte [esp + 0x220], 0
mov bl, 0x5c
je 0x40df56
lea eax, [esp + 0x220]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40df44
sub eax, edx
cmp byte [esp + eax + 0x21f], bl
je 0x40df72
lea edi, [esp + 0x220]
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40df60
mov dx, word [0x43b288]
mov word [edi], dx
push 0x104
push str.Manager_File_Path
push str.SoftwareWow6432NodeGreywareDomain_Time_II_ManagerParameters
mov eax, 0x4364e7
lea edi, [esp + 0x1c]
call fcn.00411bd0
add esp, 0xc
cmp byte [esp + 0x10], 0
je 0x40dfce
mov eax, edi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40dfa0
sub eax, edx
cmp byte [esp + eax + 0xf], bl
je 0x40e08f
lea edi, [esp + 0x10]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40dfb8
mov ax, word [0x43b288]
mov word [edi], ax
jmp 0x40e08f
push 0x104
push str.ProgramFilesDir
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersion
mov eax, str.c:program_files__x86_
lea edi, [esp + 0x1c]
call fcn.00411bd0
mov si, word [0x43b288]
add esp, 0xc
cmp byte [esp + 0x10], 0
je 0x40e010
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e001
sub eax, edx
cmp byte [esp + eax + 0xf], bl
je 0x40e020
lea edi, [esp + 0x10]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40e015
mov word [edi], si
lea eax, [esp + 0x10]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40e025
mov ecx, dword [str.Domain_Time_II]
mov edx, dword [0x43b0b8]
mov dword [eax], ecx
mov ecx, dword [0x43b0bc]
mov dword [eax + 4], edx
mov dx, word [0x43b0c0]
mov dword [eax + 8], ecx
mov cl, byte [0x43b0c2]
mov word [eax + 0xc], dx
mov byte [eax + 0xe], cl
cmp byte [esp + 0x10], 0
je 0x40e07f
lea eax, [esp + 0x10]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e070
sub eax, edx
cmp byte [esp + eax + 0xf], bl
je 0x40e08f
lea edi, [esp + 0x10]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40e084
mov word [edi], si
push str.dtman.exe
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x120]
push 0x436a34
push eax
call fcn.0041fa79
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
add esp, 0x10
lea ecx, [esp + 0x118]
push ecx
call edi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40e0f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x40e0db
test bl, 0x10
je 0x40e0db
mov esi, 2
mov ebp, dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call ebp
test esi, esi
jne 0x40e0f6
mov eax, 1
jmp 0x40e2d8
xor esi, esi
jmp 0x40e0d1
push str.dtset.exe
lea edx, [esp + 0x224]
push edx
lea eax, [esp + 0x120]
push 0x436a34
push eax
call fcn.0041fa79
add esp, 0x10
lea ecx, [esp + 0x118]
push ecx
call edi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40e2f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x40e143
test bl, 0x10
je 0x40e143
mov esi, 2
push esi
call ebp
test esi, esi
je 0x40e0e8
push str.domtimes.exe
lea edx, [esp + 0x224]
push edx
lea eax, [esp + 0x120]
push 0x436a34
push eax
call fcn.0041fa79
add esp, 0x10
lea eax, [esp + 0x118]
call fcn.00419180
test al, al
jne 0x40e0e8
push str.domtimem.exe
lea ecx, [esp + 0x224]
push ecx
lea edx, [esp + 0x120]
push 0x436a34
push edx
call fcn.0041fa79
add esp, 0x10
lea eax, [esp + 0x118]
call fcn.00419180
test al, al
jne 0x40e0e8
push str.dtaudit.exe
lea eax, [esp + 0x224]
push eax
lea ecx, [esp + 0x120]
push 0x436a34
push ecx
call fcn.0041fa79
add esp, 0x10
lea eax, [esp + 0x118]
call fcn.00419180
test al, al
jne 0x40e0e8
push str.dtupdate.exe
lea edx, [esp + 0x224]
push edx
lea eax, [esp + 0x120]
push 0x436a34
push eax
call fcn.0041fa79
add esp, 0x10
lea eax, [esp + 0x118]
call fcn.00419180
test al, al
jne 0x40e0e8
push str.domtimec.exe
lea ecx, [esp + 0x224]
push ecx
lea edx, [esp + 0x120]
push 0x436a34
push edx
call fcn.0041fa79
add esp, 0x10
lea eax, [esp + 0x118]
call fcn.00419180
test al, al
jne 0x40e0e8
mov eax, str.SoftwareWow6432NodeGreywareDomain_Time_ServerParameters
call fcn.00411e10
test eax, eax
jne 0x40e0e8
mov eax, str.SoftwareWow6432NodeGreywareDomain_Time_ClientParameters
call fcn.00411e10
test eax, eax
jne 0x40e0e8
mov eax, str.SoftwareWow6432NodeGreywareDomain_Time_II_MonitorParameters
call fcn.00411e10
test eax, eax
jne 0x40e0e8
mov eax, str.SoftwareWow6432NodeGreywareDomain_Time_II_ManagerParameters
call fcn.00411e10
test eax, eax
jne 0x40e0e8
mov eax, str.SoftwareWow6432NodeGreywareDomain_Time_II_Update_ServerParameters
call fcn.00411e10
test eax, eax
jne 0x40e0e8
mov eax, str.SoftwareWow6432NodeGreywareDomain_Time_II_Audit_ServerParameters
call fcn.00411e10
test eax, eax
jne 0x40e0e8
mov eax, str.SoftwareWow6432NodeGreywareDomain_Time_SetParameters
call fcn.00411e10
test eax, eax
jne 0x40e0e8
xor eax, eax
mov ecx, dword [esp + 0x328]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041f826
add esp, 0x31c
ret
xor esi, esi
jmp 0x40e139