Function at 0x4ad04b40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, r12d
jmp 0x4ad04f98
cmp dword [rsp + 0x24], r12d
jne 0x4ad10437
mov dword [0x4ad2e13c], 0x2331
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call entry0
mov rbx, qword [rsp + 0x2b8]
add rsp, 0x260
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x260
mov rax, qword [0x4ad2e1c8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rcx, qword [rcx + 0x70]
movsxd r13, r8d
xor r15d, r15d
mov dword [rsp + 0x20], r13d
mov rbp, rdx
mov r14, r15
call fcn.4ad02e40
mov ebx, 0x104
mov rsi, rax
cmp rax, r15
je 0x4ad185d5
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
cmp rcx, rbx
jae 0x4ad185c6
cmp byte [0x4ad2e0ca], r15b
je 0x4ad04be3
cmp rsi, r15
je 0x4ad185df
lea rdx, [0x4ad29798]
mov r8d, 4
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsnicmp]
cmp eax, r15d
je 0x4ad185df
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x208
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x40]
mov rdx, rbx
sub rsi, rax
lea rcx, [rsp + 0x40]
lea rax, [rdx + 0x7ffffefa]
cmp rax, r15
je 0x4ad04c28
movzx eax, word [rsi + rcx]
cmp ax, r15w
je 0x4ad04c28
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x4ad04c05
cmp rdx, r15
je 0x4ad18606
mov word [rcx], r15w
mov esi, 0x5c
lea rcx, [rsp + 0x40]
cmp rcx, r15
je 0x4ad04c58
mov edx, 0x2f
call qword [sym.imp.msvcrt.dll_wcschr]
cmp rax, r15
jne 0x4ad10471
mov eax, 0x3a
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x40]
mov word [rsp + 0x38], si
mov word [rsp + 0x3c], r15w
mov word [rsp + 0x3a], ax
call fcn.4ad03130
mov r12d, r15d
mov word [rsp + 0x3a], r15w
cmp rax, rdi
setb r12b
mov dword [rsp + 0x24], r12d
cmp r12d, r15d
jne 0x4ad051e3
lea rbx, [rsp + 0x40]
cmp word [rbx], r15w
je 0x4ad1563d
lea rdi, [0x4ad29788]
mov rsi, rbx
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x4ad1563d
lea rdi, [0x4ad2978c]
mov rsi, rbx
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x4ad1563d
mov ecx, 0x410
call fcn.4ad016dc
mov rsi, rax
cmp rax, r15
je 0x4ad1860f
lea r8, [rsp + 0x40]
mov rdx, r13
mov rcx, rbp
call fcn.4ad01744
lea r11, [rsp + 0x40]
mov rax, rbx
sub rax, r11
lea r8, [0x4ad29788]
mov rdx, r13
sar rax, 1
mov rcx, rbp
mov word [rbp + rax*2], r15w
call fcn.4ad01ac0
mov edi, 0x208
mov edx, edi
mov r8, rbp
mov rcx, rsi
call fcn.4ad045b0
cmp eax, r15d
jne 0x4ad1861e
mov rax, rsi
mov rcx, rsi
cmp word [rsi], r15w
je 0x4ad04d59
mov rcx, rax
add rax, 2
cmp word [rax], r15w
jne 0x4ad04d4c
mov eax, 0x5c
cmp word [rcx], ax
je 0x4ad04d75
lea r8, [0x4ad29784]
mov rdx, rdi
mov rcx, rsi
call fcn.4ad01ac0
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call fcn.4ad01ac0
xor eax, eax
or rbx, 0xffffffffffffffff
mov rcx, rbx
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea edx, [rcx + rcx]
mov rcx, rsi
call fcn.4ad02db8
mov r13, rax
cmp rax, r15
je 0x4ad1860f
lea edx, [rbx + 0x5d]
mov rcx, rax
call qword [sym.imp.msvcrt.dll_wcsrchr]
xor edi, edi
mov word [rax], di
lea r15, [rax + 2]
cmp r12d, edi
jne 0x4ad04dd5
lea rcx, str.PATH
call fcn.4ad01a60
mov r14, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_NeedCurrentDirectoryForExePathW]
mov r12d, eax
cmp eax, edi
je 0x4ad1863f
xor eax, eax
mov rcx, rbx
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
inc rcx
xor edi, edi
jmp 0x4ad04dfe
lea esi, [rcx + 2]
cmp r14, rdi
je 0x4ad04e1b
xor eax, eax
mov rcx, rbx
mov rdi, r14
repne scasw ax, word [rdi]
not rcx
dec rcx
add esi, ecx
xor edi, edi
lea ecx, [rsi + rsi]
call fcn.4ad016dc
mov rbx, rax
cmp rax, rdi
je 0x4ad1860f
cmp r12d, edi
je 0x4ad04e6b
movsxd rdi, esi
lea r8, [0x4ad297a4]
mov rcx, rax
mov rdx, rdi
call fcn.4ad01ac0
mov r8, r13
mov rdx, rdi
mov rcx, rbx
call fcn.4ad01ac0
lea r8, [0x4ad297a4]
mov rdx, rdi
mov rcx, rbx
call fcn.4ad01ac0
xor edi, edi
cmp dword [rsp + 0x24], edi
jne 0x4ad04e9b
cmp r14, rdi
je 0x4ad04e9b
cmp r12d, edi
je 0x4ad04e8d
lea r8, [0x4ad29794]
movsxd rdx, esi
mov rcx, rbx
call fcn.4ad01ac0
movsxd rdx, esi
mov r8, r14
mov rcx, rbx
call fcn.4ad01ac0
mov edx, esi
mov rcx, rbx
call fcn.4ad05140
lea rdx, [0x4ad29794]
mov r8d, 1
call fcn.4ad02a74
or rcx, 0xffffffffffffffff
mov rdi, r15
mov r13, rax
xor eax, eax
xor r12d, r12d
repne scasw ax, word [rdi]
not rcx
mov r14, rcx
cmp byte [0x4ad2e0ca], r12b
je 0x4ad18647
lea rcx, str.PATHEXT
call fcn.4ad01a60
mov rsi, rax
cmp rax, r12
je 0x4ad18647
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsi + 2]
repne scasw ax, word [rdi]
not rcx
lea rdx, [rcx - 1]
mov rcx, rsi
call fcn.4ad05140
lea rdx, [0x4ad29794]
mov r8d, 1
call fcn.4ad02a74
mov qword [rsp + 0x30], rax
jmp 0x4ad04f29
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
movsxd rbx, ecx
lea rsi, [rcx - 1]
mov rcx, r13
call fcn.4ad02e40
mov rdx, rbx
mov rcx, r13
mov r8, rax
call fcn.4ad01744
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r13
mov rdx, r13
repne scasw ax, word [rdi]
mov rax, r13
not rcx
dec rcx
cmp word [r13], r12w
je 0x4ad04f81
mov rdx, rax
add rax, 2
cmp word [rax], r12w
jne 0x4ad04f74
mov eax, 0x5c
cmp word [rdx], ax
je 0x4ad016c0
lea edi, [rax - 0x5b]
mov esi, ebx
inc ecx
jmp 0x4ad04f98
cmp word [r13], r12w
je 0x4ad04970
mov r12d, ecx
lea rax, [r12 + r14]
cmp rax, 0x104
ja 0x4ad18653
movsxd rax, dword [rsp + 0x20]
mov r8, r13
mov rcx, rbp
mov rdx, rax
mov rbx, rax
call fcn.4ad01744
lea eax, [rsi + 1]
xor ecx, ecx
cmp edi, ecx
cmovne eax, esi
xor esi, esi
cdqe
lea r13, [r13 + rax*2]
cmp edi, esi
je 0x4ad04ff3
lea r8, [rsp + 0x38]
mov rdx, rbx
mov rcx, rbp
call fcn.4ad01ac0
mov r8, r15
mov rdx, rbx
mov rcx, rbp
call fcn.4ad01ac0
mov rcx, rbp
call fcn.4ad02e40
mov rdx, rbx
mov rcx, rbp
mov r8, rax
call fcn.4ad01744
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasw ax, word [rdi]
mov eax, 0x3a
not rcx
lea rbx, [rcx - 1]
cmp word [rbp + 2], ax
jne 0x4ad05046
movzx ecx, word [rbp]
call fcn.4ad05188
cmp eax, esi
je 0x4ad0550c
cmp r15, rsi
je 0x4ad05092
mov edi, 0x2e
mov rcx, r15
mov edx, edi
call qword [sym.imp.msvcrt.dll_wcsrchr]
cmp rax, rsi
jne 0x4ad05205
mov edx, 0x2a
mov rcx, r15
call qword [sym.imp.msvcrt.dll_wcschr]
cmp rax, rsi
jne 0x4ad0497b
mov edx, 0x3f
mov rcx, r15
call qword [sym.imp.msvcrt.dll_wcschr]
cmp rax, rsi
jne 0x4ad0497b
mov rdi, qword [rsp + 0x30]
movsxd rdx, dword [rsp + 0x20]
xor ecx, ecx
movsxd rbx, ebx
lea r8, [0x4ad29800]
mov rsi, rdi
mov word [rbp + rbx*2], cx
mov rcx, rbp
call fcn.4ad01ac0
mov edx, dword [rsp + 0x20]
xor r8d, r8d
mov rcx, rbp
call fcn.4ad0488c
xor r8d, r8d
cmp eax, r8d
jne 0x4ad05272
mov edx, dword [0x4ad2e13c]
xor r12d, r12d
cmp edx, r12d
je 0x4ad050ec
jmp 0x4ad050e3
cmp edx, 2
jne 0x4ad04f29
movsxd rdi, dword [rsp + 0x20]
lea r8, [0x4ad297a8]
mov rcx, rbp
mov rdx, rdi
mov word [rbp + rbx*2], r12w
call fcn.4ad01ac0
mov r8d, 1
mov edx, edi
mov rcx, rbp
call fcn.4ad0488c
cmp eax, r12d
je 0x4ad04f29
jmp 0x4ad1867b
lea rcx, [rsp + 0x40]
mov edx, esi
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov rbx, rax
cmp rax, r15
je 0x4ad15625
add rbx, 2
jmp 0x4ad04c9f
cmp word [rax + 2], si
je 0x4ad05064
mov edx, dword [rsp + 0x20]
lea r8d, [rdi - 0x2d]
mov rcx, rbp
call fcn.4ad0488c
cmp eax, esi
je 0x4ad054e7
mov edx, edi
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov rdi, rax
cmp rax, rsi
je 0x4ad054f5
lea rdx, str..CMD
mov rcx, rax
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, esi
je 0x4ad05536
lea rdx, str..BAT
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsicmp]
neg eax
sbb eax, eax
add eax, 2
jmp 0x4ad04987
cmp word [rdi], r8w
je 0x4ad050d3
mov edx, dword [0x4ad2e13c]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
add rcx, r12
add rcx, r14
cmp rcx, 0x104
ja 0x4ad186a2
movsxd rdi, dword [rsp + 0x20]
mov word [rbp + rbx*2], r8w
mov rcx, rbp
mov rdx, rdi
mov r8, rsi
call fcn.4ad01ac0
mov r8d, 1
mov edx, edi
mov rcx, rbp
call fcn.4ad0488c
xor edi, edi
cmp eax, edi
jne 0x4ad05301
mov edx, dword [0x4ad2e13c]
cmp edx, 2
jne 0x4ad1866b
movzx eax, word [rsi]
add rsi, 2
cmp ax, di
jne 0x4ad052e5
mov r8d, 0
cmp word [rsi], di
jne 0x4ad05282
jmp 0x4ad186a9
lea rdx, str..BAT
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, edi
je 0x4ad05536
lea rdx, str..CMD
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, edi
je 0x4ad05536
mov eax, 1
jmp 0x4ad04987
movsxd rax, dword [rsp + 0x24]
cmp rax, rsi
jne 0x4ad10454
mov eax, dword [0x4ad2e13c]
cmp eax, 2
je 0x4ad05064
cmp eax, esi
je 0x4ad05064
xor r12d, r12d
jmp 0x4ad04f29
mov eax, 2
jmp 0x4ad04987
mov eax, dword [0x4ad2e13c]
cmp eax, r12d
je 0x4ad0497b
cmp eax, 2
jne 0x4ad04985
jmp 0x4ad0497b
mov eax, dword [0x4ad2e13c]
cmp eax, 5
jne 0x4ad054fb
jmp 0x4ad05227
mov word [rax], si
lea rcx, [rax + 2]
jmp 0x4ad04c3f
lea rcx, [rsp + 0x40]
mov edx, 0x3a
call qword [sym.imp.msvcrt.dll_wcschr]
mov rbx, rax
jmp 0x4ad051fc
cmp byte [0x4ad2e0ca], r15b
je 0x4ad0497b
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4ad186ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x15
jne 0x4ad0497b
jmp 0x4ad186c0
mov dword [0x4ad2e13c], 0x233f
jmp 0x4ad04987
mov rdi, qword [rsp + 0x30]
jmp 0x4ad04bb2
lea rcx, str.COMSPEC
call fcn.4ad01a60
mov rsi, rax
cmp rax, r15
jne 0x4ad04be3
mov dword [0x4ad2e13c], 0x400023d2
jmp 0x4ad04985
sub rcx, 2
jmp 0x4ad04c31
mov dword [0x4ad2e13c], 8
jmp 0x4ad186c6
cmp byte [0x4ad2e0ca], r15b
je 0x4ad0497b
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4ad0497b
jmp 0x4ad186ae
mov rcx, rdi
jmp 0x4ad04dfe
lea rsi, str..COM_.EXE_.BAT_.CMD_.VBS_.JS_.WS_.MSC
jmp 0x4ad04ef4
lea eax, [rsi + 1]
xor r12d, r12d
cmp edi, r12d
cmovne eax, esi
cdqe
lea r13, [r13 + rax*2]
jmp 0x4ad04f29
cmp edx, edi
je 0x4ad052e5
xor r12d, r12d
jmp 0x4ad050e3
lea rdx, [rsp + 0x28]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
cmp eax, r12d
je 0x4ad04f29
cmp dword [rsp + 0x28], 4
je 0x4ad05331
jmp 0x4ad04f29
xor edi, edi
jmp 0x4ad052e5
jmp 0x4ad050d9
test al, 0x10
je 0x4ad0497b
mov eax, 5
jmp 0x4ad04987
mov dword [0x4ad2e13c], eax
mov eax, 3
jmp 0x4ad04987