Function at 0x42fda0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push r14
push r13
push rdi
push rsi
push rbx
sub rsp, 0x2b8
mov rbp, rsp
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x80], 0
nop
xor rdi, rdi
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax + 0x18]
call fcn.00436620
mov rbx, rax
test rbx, rbx
je 0x42fe29
mov rax, rbx
mov rcx, rax
call fcn.00409fc0
mov r13d, eax
jmp 0x42fe2c
xor r13, r13
cmp r13d, 0x104
jl 0x42fe4d
mov rax, qword [0x00449798]
mov dword [rax], 0x233f
xor rax, rax
mov dword [rbp + 0x44], eax
jmp 0x430786
mov rax, qword [0x00449328]
cmp byte [rax], 0
je 0x42fe82
mov rcx, rbx
lea rdx, [0x004307d8]
mov r8d, 4
call fcn.0041ae50
test eax, eax
jne 0x42fe82
lea rcx, [0x004307e2]
call fcn.0042ae80
mov rbx, rax
lea rcx, [rbp + 0x9a]
xor rdx, rdx
mov r8d, 0x104
call fcn.00422d00
lea rcx, [rbp + 0x9a]
mov rdx, rbx
call fcn.00422b70
lea rcx, [rbp + 0x9a]
mov dx, 0x2f
call fcn.0042dfa0
mov word [rbp + 0x2aa], 0x5c
mov word [rbp + 0x2ac], 0x3a
mov word [rbp + 0x2ae], 0
lea rcx, [rbp + 0x9a]
lea rdx, [rbp + 0x2aa]
call fcn.00422bb0
cmp eax, r13d
setl al
mov byte [rbp + 0x2f], al
mov word [rbp + 0x2ac], 0
movzx rax, byte [rbp + 0x2f]
test al, al
je 0x42ff4c
lea rcx, [rbp + 0x9a]
mov dx, 0x5c
call fcn.00422ae0
mov rbx, rax
test rbx, rbx
jne 0x42ff46
xor rbx, rbx
lea rax, [rbp + 0x9a]
test rax, rax
je 0x42ff46
lea rax, [rbp + 0x9a]
jmp 0x42ff3f
cmp word [rax], 0x3a
jne 0x42ff3b
mov rbx, rax
jmp 0x42ff45
add rax, 2
cmp word [rax], 0
jne 0x42ff30
nop
add rbx, 2
jmp 0x42ff53
lea rbx, [rbp + 0x9a]
test rbx, rbx
je 0x42ff7e
mov rcx, rbx
lea rdx, [0x004307f2]
call fcn.0041ad20
test eax, eax
je 0x42ff7e
mov rcx, rbx
lea rdx, [0x004307f6]
call fcn.0041ad20
test eax, eax
jne 0x42ffc6
mov rax, qword [0x00449328]
cmp byte [rax], 0
je 0x42ffae
mov rcx, qword [rbp + 0x20]
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x42ffae
test eax, 0x10
je 0x42ffae
mov eax, 5
mov dword [rbp + 0x44], eax
jmp 0x430786
mov rax, qword [0x00449798]
mov dword [rax], 0x2331
xor rax, rax
mov dword [rbp + 0x44], eax
jmp 0x430786
mov ecx, 0x410
call fcn.004237a0
mov rsi, rax
test rsi, rsi
jne 0x42fff4
mov rax, qword [0x00449798]
mov dword [rax], 8
mov eax, 3
mov dword [rbp + 0x44], eax
jmp 0x430786
mov rcx, qword [rbp + 0x20]
lea rdx, [rbp + 0x9a]
call fcn.00422b70
lea rax, [rbp + 0x9a]
test rax, rax
je 0x430024
lea rax, [rbp + 0x9a]
mov rcx, rax
call fcn.00409fc0
mov r13d, eax
jmp 0x430027
xor r13, r13
mov rax, rbx
mov rcx, rax
call fcn.00409fc0
movsxd r13, r13d
mov eax, eax
neg rax
lea rax, [r13 + rax]
mov rcx, qword [rbp + 0x20]
mov word [rcx + rax*2], 0
lea rdx, [0x004307f2]
call fcn.00422b90
mov rcx, rsi
mov rdx, qword [rbp + 0x20]
mov r8d, 0x208
call fcn.0042d090
test eax, eax
je 0x4300b4
mov rax, qword [0x00449328]
cmp byte [rax], 0
je 0x43009c
mov rcx, qword [rbp + 0x20]
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x43009c
test eax, 0x10
je 0x43009c
mov eax, 5
mov dword [rbp + 0x44], eax
jmp 0x430786
mov rax, qword [0x00449798]
mov dword [rax], 0x2331
xor rax, rax
mov dword [rbp + 0x44], eax
jmp 0x430786
mov rcx, rsi
call fcn.00422d20
cmp word [rax], 0x5c
je 0x4300d1
mov rcx, rsi
lea rdx, [0x004307fc]
call fcn.00422b90
mov rcx, rsi
mov rdx, rbx
call fcn.00422b90
test rsi, rsi
je 0x4300ee
mov rax, rsi
mov rcx, rax
call fcn.00409fc0
jmp 0x4300f1
xor rax, rax
mov rcx, rsi
mov edx, eax
add edx, 1
add edx, edx
call fcn.004238a0
mov rsi, rax
mov rcx, rsi
mov dx, 0x5c
call fcn.00422ae0
mov qword [rbp + 0x30], rax
mov word [rax], 0
add rax, 2
mov qword [rbp + 0x30], rax
movzx rax, byte [rbp + 0x2f]
test al, al
jne 0x430138
lea rcx, [0x00430800]
call fcn.0042ae80
mov rdi, rax
test rsi, rsi
je 0x43014c
mov rax, rsi
mov rcx, rax
call fcn.00409fc0
mov ebx, eax
jmp 0x43014f
xor rbx, rbx
test rdi, rdi
je 0x430161
mov rax, rdi
mov rcx, rax
call fcn.00409fc0
jmp 0x430164
xor rax, rax
mov ecx, ebx
add ecx, eax
add ecx, 4
add ecx, ecx
call fcn.004237a0
mov qword [rbp + 0x38], rax
mov rax, qword [rbp + 0x38]
test rax, rax
jne 0x43019a
mov rax, qword [0x00449798]
mov dword [rax], 8
mov eax, 3
mov dword [rbp + 0x44], eax
jmp 0x430786
mov rcx, qword [rbp + 0x38]
lea rdx, [0x0043080a]
call fcn.00422b90
mov rcx, qword [rbp + 0x38]
mov rdx, rsi
call fcn.00422b90
mov rcx, qword [rbp + 0x38]
lea rdx, [0x0043080a]
call fcn.00422b90
movzx rax, byte [rbp + 0x2f]
test al, al
jne 0x4301eb
mov rcx, qword [rbp + 0x38]
lea rdx, [0x0043080e]
call fcn.00422b90
mov rcx, qword [rbp + 0x38]
mov rdx, rdi
call fcn.00422b90
mov rcx, qword [rbp + 0x38]
call fcn.00430e00
mov rcx, qword [rbp + 0x38]
lea rdx, [0x0043080e]
mov r8d, 1
call fcn.0042e300
mov qword [rbp + 0x38], rax
mov rax, qword [rbp + 0x30]
test rax, rax
je 0x430226
mov rax, qword [rbp + 0x30]
mov rcx, rax
call fcn.00409fc0
jmp 0x430229
xor rax, rax
mov r13d, eax
add r13d, 1
mov rax, qword [0x00449328]
cmp byte [rax], 0
je 0x43024d
lea rcx, [0x00430812]
call fcn.0042ae80
mov rbx, rax
jmp 0x430254
lea rbx, [0x00430822]
mov rcx, rbx
call fcn.00430e00
mov rcx, rbx
lea rdx, [0x0043080e]
mov r8d, 1
call fcn.0042e300
mov rbx, rax
mov rax, qword [rbp + 0x38]
test rax, rax
je 0x43028e
mov rax, qword [rbp + 0x38]
mov rcx, rax
call fcn.00409fc0
mov esi, eax
jmp 0x430291
xor rsi, rsi
mov rcx, qword [rbp + 0x38]
call fcn.00436620
mov rcx, qword [rbp + 0x38]
mov rdx, rax
call fcn.00422b70
mov rax, qword [rbp + 0x38]
test rax, rax
je 0x4302bf
mov rax, qword [rbp + 0x38]
mov rcx, rax
call fcn.00409fc0
mov edi, eax
jmp 0x4302c2
xor rdi, rdi
mov rcx, qword [rbp + 0x38]
call fcn.00422d20
cmp word [rax], 0x5c
je 0x4302dc
mov r14b, 1
add esi, 1
add edi, 1
jmp 0x4302df
xor r14, r14
mov rax, qword [rbp + 0x38]
cmp word [rax], 0
je 0x43032b
mov eax, edi
movsxd rcx, r13d
lea rax, [rax + rcx]
cmp rax, 0x104
jle 0x43032b
test r14b, r14b
je 0x430316
movsxd rsi, esi
add rsi, rsi
mov rax, qword [rbp + 0x38]
add rax, rsi
mov qword [rbp + 0x38], rax
jmp 0x430275
movsxd rsi, esi
mov rax, qword [rbp + 0x38]
lea rax, [rax + rsi*2 + 2]
mov qword [rbp + 0x38], rax
jmp 0x430275
mov rax, qword [rbp + 0x38]
cmp word [rax], 0
jne 0x43037d
movzx rax, byte [rbp + 0x2f]
test al, al
je 0x430365
mov rax, qword [0x00449798]
cmp dword [rax], 0
je 0x430356
mov rax, qword [0x00449798]
cmp dword [rax], 2
jne 0x430372
mov rax, qword [0x00449798]
mov dword [rax], 0x2331
jmp 0x430372
mov rax, qword [0x00449798]
mov dword [rax], 0x2331
xor rax, rax
mov dword [rbp + 0x44], eax
jmp 0x430786
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x38]
call fcn.00422b70
test r14b, r14b
je 0x4303a2
movsxd rsi, esi
add rsi, rsi
mov rax, qword [rbp + 0x38]
add rax, rsi
mov qword [rbp + 0x38], rax
jmp 0x4303b2
movsxd rsi, esi
mov rax, qword [rbp + 0x38]
lea rax, [rax + rsi*2 + 2]
mov qword [rbp + 0x38], rax
test r14b, r14b
je 0x4303c7
mov rcx, qword [rbp + 0x20]
lea rdx, [rbp + 0x2aa]
call fcn.00422b90
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x30]
call fcn.00422b90
mov rcx, qword [rbp + 0x20]
call fcn.00436620
mov rcx, qword [rbp + 0x20]
mov rdx, rax
call fcn.00422b70
mov rax, qword [rbp + 0x20]
test rax, rax
je 0x430403
mov rax, qword [rbp + 0x20]
mov rcx, rax
call fcn.00409fc0
mov r14d, eax
jmp 0x430406
xor r14, r14
mov rax, qword [rbp + 0x20]
cmp word [rax + 2], 0x3a
jne 0x430426
mov rax, qword [rbp + 0x20]
movzx rcx, word [rax]
call fcn.004364d0
test al, al
je 0x430275
mov rcx, qword [rbp + 0x30]
mov dx, 0x2e
call fcn.00422ae0
mov rsi, rax
test rsi, rsi
je 0x430550
cmp word [rsi + 2], 0
je 0x430550
mov rcx, qword [rbp + 0x20]
mov dl, 1
call fcn.0042de70
test al, al
jne 0x430476
movzx rax, byte [rbp + 0x2f]
test al, al
je 0x430534
mov rax, qword [0x00449798]
cmp dword [rax], 5
jne 0x430534
lea rcx, [rbp + 0x80]
mov rdx, qword [rbp + 0x20]
call fcn.0040a760
lea rcx, [rbp + 0x88]
mov rdx, qword [rbp + 0x80]
call fcn.0041aae0
mov rcx, qword [rbp + 0x88]
call fcn.0040a6e0
mov rbx, rax
lea rcx, [rbp + 0x70]
call fcn.004229b0
lea rcx, [rbp + 0x78]
mov rdx, qword [rbp + 0x70]
call fcn.0041aae0
mov rcx, qword [rbp + 0x78]
call fcn.0040a6e0
mov rcx, rbx
mov rdx, rax
call fcn.0041ad50
test eax, eax
jne 0x4304e4
mov eax, 2
mov dword [rbp + 0x44], eax
jmp 0x430786
mov rcx, rsi
lea rdx, [0x0043084a]
call fcn.0041ad50
test eax, eax
jne 0x430505
mov eax, 2
mov dword [rbp + 0x44], eax
jmp 0x430786
mov rcx, rsi
lea rdx, [0x00430854]
call fcn.0041ad50
test eax, eax
jne 0x430526
mov eax, 2
mov dword [rbp + 0x44], eax
jmp 0x430786
mov eax, 1
mov dword [rbp + 0x44], eax
jmp 0x430786
mov rax, qword [0x00449798]
cmp dword [rax], 2
je 0x430550
mov rax, qword [0x00449798]
cmp dword [rax], 0
jne 0x430275
xor rax, rax
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x430578
mov rcx, qword [rbp + 0x30]
jmp 0x430571
cmp word [rcx], 0x2a
jne 0x43056d
mov rax, rcx
jmp 0x430577
add rcx, 2
cmp word [rcx], 0
jne 0x430562
nop
test rax, rax
je 0x430581
mov al, 1
jmp 0x4305af
xor rax, rax
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x4305a9
mov rcx, qword [rbp + 0x30]
jmp 0x4305a2
cmp word [rcx], 0x3f
jne 0x43059e
mov rax, rcx
jmp 0x4305a8
add rcx, 2
cmp word [rcx], 0
jne 0x430593
nop
test rax, rax
setne al
test al, al
je 0x4305cb
mov rax, qword [0x00449798]
mov dword [rax], 0x2331
xor rax, rax
mov dword [rbp + 0x44], eax
jmp 0x430786
mov rsi, rbx
mov rcx, qword [rbp + 0x20]
mov edx, r14d
lea r8, [0x0043085e]
xor r9, r9
call fcn.00430870
test eax, eax
je 0x430714
jmp 0x430709
test rsi, rsi
je 0x430603
mov rax, rsi
mov rcx, rax
call fcn.00409fc0
jmp 0x430606
xor rax, rax
movsxd rcx, r13d
mov edx, edi
lea rcx, [rcx + rdx]
movsxd rax, eax
lea rax, [rcx + rax]
cmp rax, 0x104
jg 0x4306ff
mov rcx, qword [rbp + 0x20]
mov edx, r14d
mov r8, rsi
mov r9b, 1
call fcn.00430870
test eax, eax
je 0x4306e1
mov rcx, rsi
lea rdx, [0x00430854]
call fcn.0041ad50
test eax, eax
je 0x430663
mov rcx, rsi
lea rdx, [0x0043084a]
call fcn.0041ad50
test eax, eax
jne 0x430671
mov eax, 2
mov dword [rbp + 0x44], eax
jmp 0x430786
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x20]
call fcn.0040a760
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
call fcn.0041aae0
mov rcx, qword [rbp + 0x68]
call fcn.0040a6e0
mov rbx, rax
lea rcx, [rbp + 0x50]
call fcn.004229b0
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x50]
call fcn.0041aae0
mov rcx, qword [rbp + 0x58]
call fcn.0040a6e0
mov rcx, rbx
mov rdx, rax
call fcn.0041ad50
test eax, eax
jne 0x4306d3
mov eax, 2
mov dword [rbp + 0x44], eax
jmp 0x430786
mov eax, 1
mov dword [rbp + 0x44], eax
jmp 0x430786
mov rax, qword [0x00449798]
cmp dword [rax], 2
je 0x4306ff
mov rax, qword [0x00449798]
cmp dword [rax], 0
jne 0x430713
jmp 0x4306ff
add rsi, 2
cmp word [rsi], 0
jne 0x4306fb
add rsi, 2
cmp word [rsi], 0
jne 0x4305f1
nop
mov rax, qword [0x00449798]
cmp dword [rax], 0
je 0x430730
mov rax, qword [0x00449798]
cmp dword [rax], 2
jne 0x430275
mov rcx, qword [rbp + 0x20]
mov edx, r14d
xor r8, r8
mov r9b, 1
call fcn.00430870
test eax, eax
je 0x430275
mov rcx, qword [rbp + 0x20]
lea rdx, [rbp + 0x2a4]
call sub.kernel32.dll_GetBinaryTypeW
test eax, eax
je 0x430275
cmp dword [rbp + 0x2a4], 4
jne 0x430275
mov eax, 1
mov dword [rbp + 0x44], eax
jmp 0x430786
lea rcx, [rbp + 0x50]
mov edx, 8
call fcn.00409980
mov eax, dword [rbp + 0x44]
lea rsp, [rbp + 0x2b8]
pop rbx
pop rsi
pop rdi
pop r13
pop r14
pop rbp
ret