Function at 0x402b60
Capabilities:
Check if file exists
Delete file
Get file attributes
Read file via mapping
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x410330
push 0x409a10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x23c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x1c], ebx
mov esi, dword [ebp + 8]
cmp esi, ebx
je 0x402cd7
mov eax, dword [esi + 0x134]
add eax, 0x42
push eax
lea eax, [ebp - 0x120]
push eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call edi
lea eax, [ebp - 0x120]
push eax
call fcn.0040878e
pop ecx
lea eax, [esi + 0x2c]
push eax
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp byte [esi + 0x14], 0x63
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x228]
push eax
jne 0x402c4b
call edi
lea eax, [ebp - 0x228]
push eax
call fcn.0040878e
pop ecx
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x402c2a
test al, 0x10
jne 0x402c43
mov dword [0x415b48], 9
jmp 0x402cd7
lea eax, [ebp - 0x228]
push eax
push esi
call fcn.004036a0
pop ecx
pop ecx
test eax, eax
je 0x402c1b
mov eax, dword [esi + 0x18]
add dword [esi + 0xc], eax
push 1
pop eax
jmp 0x402f72
call edi
lea eax, [ebp - 0x228]
push eax
call fcn.0040873c
lea eax, [ebp - 0x228]
push eax
push esi
call fcn.004036a0
add esp, 0xc
test eax, eax
je 0x402c1b
lea eax, [esi + 0x2c]
push eax
push esi
call fcn.00403e15
pop ecx
pop ecx
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x402ca4
test al, 0x10
jne 0x402ca4
test al, 7
je 0x402ca4
and eax, 0xfffffff8
push eax
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
push 0x80
push 2
pop edi
push edi
push ebx
push ebx
push 0xc0000000
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x22c], eax
cmp eax, 0xffffffff
jne 0x402cde
mov dword [0x415b48], 7
xor eax, eax
jmp 0x402f72
cmp dword [esi + 0x18], ebx
je 0x402ecb
cmp dword [esi + 0x1c], ebx
je 0x402ecb
push 0x30d40
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x238], eax
cmp eax, ebx
jne 0x402d12
mov dword [0x415b48], edi
jmp 0x402ed2
push 1
push ebx
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x244], eax
push ebx
push ebx
push ebx
push edi
push ebx
push dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
call edi
mov dword [ebp - 0x248], eax
cmp eax, ebx
je 0x402d61
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x240], eax
cmp eax, ebx
jne 0x402d70
push dword [ebp - 0x248]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x415b48], 2
jmp 0x402ed2
mov ecx, dword [ebp - 0x244]
add eax, ecx
mov dword [ebp - 0x23c], eax
push ebx
push dword [esi + 0x1c]
push ebx
push 4
push ebx
push dword [ebp - 0x22c]
call edi
mov dword [ebp - 0x24c], eax
cmp eax, ebx
je 0x402dd4
push dword [esi + 0x1c]
push ebx
push ebx
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov dword [ebp - 0x230], ecx
cmp ecx, ebx
jne 0x402de3
push dword [ebp - 0x23c]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x248]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x24c]
call edi
mov dword [0x415b48], 8
jmp 0x402ed2
mov dword [esi + 8], 1
mov al, byte [esi + 0x14]
cmp al, bl
jne 0x402e0a
mov eax, dword [esi + 0x1c]
cmp eax, ebx
jbe 0x402e56
push eax
push dword [ebp - 0x23c]
push ecx
call fcn.004096d0
add esp, 0xc
jmp 0x402e56
mov dword [ebp - 4], ebx
push dword [ebp - 0x238]
push dword [esi + 0x1c]
movzx eax, al
push eax
push dword [ebp - 0x23c]
push ecx
call fcn.004019c2
add esp, 0x14
mov dword [ebp - 0x234], eax
or dword [ebp - 4], 0xffffffff
jmp 0x402e48
cmp eax, ebx
je 0x402e56
mov dword [0x415b48], 6
push dword [esi + 0x1c]
push dword [ebp - 0x230]
call fcn.004020af
pop ecx
pop ecx
cmp ax, word [esi + 0x130]
je 0x402e7b
mov dword [0x415b48], 6
jmp 0x402ed2
push dword [ebp - 0x230]
mov edi, dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
call edi
push dword [ebp - 0x24c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x240]
call edi
push dword [ebp - 0x248]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x23c], ebx
push 1
pop edi
push edi
push ebx
push dword [esi + 0x18]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x1c], edi
jmp 0x402ed2
mov dword [ebp - 0x1c], 1
cmp dword [ebp - 0x23c], ebx
je 0x402ee6
push dword [ebp - 0x23c]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp - 0x230], ebx
je 0x402efa
push dword [ebp - 0x230]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp - 0x238], ebx
je 0x402f0e
push dword [ebp - 0x238]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp - 0x22c], 0xffffffff
je 0x402f57
lea eax, [esi + 0x20]
push eax
push eax
push eax
push dword [ebp - 0x22c]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push dword [ebp - 0x22c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test byte [0x4193f2], 1
je 0x402f57
xor eax, eax
mov al, byte [esi + 0x2a]
and eax, 7
or eax, 0x20
push eax
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp dword [ebp - 0x1c], ebx
jne 0x402f69
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esi + 0x18]
add dword [esi + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret