Function at 0x1008ebc8
Capabilities:
Check if file exists

Disassembly:
push 0x2c
mov eax, 0x10117a78
call fcn.100604ea
mov edi, ecx
xor esi, esi
cmp dword [edi], esi
je 0x1008edfc
lea ebx, [edi + 0xc]
mov eax, dword [ebx]
cmp dword [eax - 0xc], esi
je 0x1008edfc
cmp dword [edi + 0x14], esi
je 0x1008edfc
cmp dword [edi + 0x18], esi
je 0x1008edfc
cmp dword [edi + 0x1c], esi
je 0x1008edfc
cmp dword [edi + 0x10], 1
jne 0x1008ec1e
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1008edfc
mov dword [ebp - 0x28], esi
lea eax, [ebp - 0x28]
mov dword [ebp - 4], esi
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1008ede9
mov ecx, dword [ebp - 0x28]
mov edx, str.SeSecurityPrivilege
push 1
call fcn.1008f50c
pop ecx
mov ecx, dword [ebp - 0x28]
mov edx, str.SeTakeOwnershipPrivilege
push 1
mov dword [ebp - 0x18], eax
call fcn.1008f50c
pop ecx
mov ecx, dword [ebp - 0x28]
mov edx, str.SeRestorePrivilege
push 1
mov dword [ebp - 0x1c], eax
call fcn.1008f50c
pop ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], esi
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], esi
call fcn.100029f0
push eax
lea ecx, [ebp - 0x10]
call fcn.1000281b
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
mov byte [ebp - 4], 3
cmp dword [edi + 4], esi
je 0x1008ed3a
call fcn.10090275
cmp dword [eax + 4], esi
je 0x1008ed3a
cmp dword [edi + 0x10], 4
jne 0x1008ed2c
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
lea edx, [ebp - 0x14]
call fcn.1008f3d2
pop ecx
test eax, eax
je 0x1008ece4
lea eax, [ebp - 0x30]
push eax
push 0x80100
push esi
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1008ed3a
cmp dword [ebp - 0x18], 0
je 0x1008ecf9
mov ecx, dword [ebp - 0x28]
mov edx, str.SeSecurityPrivilege
push esi
call fcn.1008f50c
pop ecx
cmp dword [ebp - 0x1c], 0
je 0x1008ed0e
mov ecx, dword [ebp - 0x28]
mov edx, str.SeTakeOwnershipPrivilege
push esi
call fcn.1008f50c
pop ecx
cmp dword [ebp - 0x20], 0
je 0x1008edc7
mov ecx, dword [ebp - 0x28]
mov edx, str.SeRestorePrivilege
push esi
call fcn.1008f50c
pop ecx
jmp 0x1008edc7
cmp dword [edi + 0x10], 1
jne 0x1008ed3a
lea ecx, [ebp - 0x38]
call fcn.1001132e
cmp dword [edi + 0x10], 4
jne 0x1008ed65
call fcn.10090275
cmp dword [eax + 4], esi
je 0x1008ed65
push esi
push dword [edi + 0x18]
push esi
push dword [edi + 0x14]
push VariantClear
push dword [edi + 0x10]
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
jmp 0x1008ed7d
push esi
push dword [edi + 0x18]
push esi
push dword [edi + 0x14]
push VariantClear
push dword [edi + 0x10]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
cmp dword [ebp - 0x18], 0
mov ebx, eax
je 0x1008ed94
mov ecx, dword [ebp - 0x28]
mov edx, str.SeSecurityPrivilege
push esi
call fcn.1008f50c
pop ecx
cmp dword [ebp - 0x1c], 0
je 0x1008eda9
mov ecx, dword [ebp - 0x28]
mov edx, str.SeTakeOwnershipPrivilege
push esi
call fcn.1008f50c
pop ecx
cmp dword [ebp - 0x20], 0
je 0x1008edbe
mov ecx, dword [ebp - 0x28]
mov edx, str.SeRestorePrivilege
push esi
call fcn.1008f50c
pop ecx
test ebx, ebx
jne 0x1008edc7
mov dword [edi], esi
xor esi, esi
inc esi
lea ecx, [ebp - 0x38]
call fcn.100112cb
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.10002a86
cmp dword [ebp - 0x30], 0
je 0x1008ede9
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x28], 0
je 0x1008edf8
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x1008edfe
xor eax, eax
call fcn.100604b3
ret