Function at 0x10032571
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xd8
mov eax, dword [0x10086084]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xbc], eax
xor eax, eax
push 0x34
push eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x88], edx
push eax
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0xc8], edi
mov dword [ebp - 0x94], esi
call sub.msvcrt.dll_memset
xor ecx, ecx
lea eax, [ebp - 0x7c]
add esp, 0xc
mov dword [ebp - 0x9c], ecx
mov ebx, ecx
mov dword [ebp - 0xd4], ecx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0xd0], ecx
push 0x40
push ecx
push eax
mov dword [ebp - 0xb8], ecx
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0xc0], ecx
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0xcc], ecx
mov dword [ebp - 0xa0], ecx
call sub.msvcrt.dll_memset
xor ecx, ecx
add esp, 0xc
mov dword [ebp - 0xc4], ecx
test esi, esi
je 0x10032e5a
cmp word [esi], cx
je 0x10032e5a
mov dword [ebp - 0xa8], ecx
mov esi, ecx
test edi, edi
je 0x10032642
mov ecx, edi
mov edi, dword [ebp - 0x94]
jmp 0x1003264a
mov edi, dword [ebp - 0x94]
mov ecx, edi
call fcn.10036a6b
mov dword [ebp - 0xb8], eax
test eax, eax
jne 0x1003265b
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0xb0], eax
cmp eax, 0xffffffff
je 0x10032685
mov ecx, eax
mov esi, eax
and ecx, 0x400
and esi, 0x4000
mov dword [ebp - 0xa8], ecx
jmp 0x10032687
mov ecx, ebx
neg esi
lea edx, [ebp - 0xa4]
sbb esi, esi
and esi, 0x80120080
add esi, 0x80000000
neg ecx
sbb eax, eax
mov ecx, dword [ebp - 0x98]
and eax, 0x200000
xor edi, edi
add eax, 0x2000000
push edi
mov dword [ebp - 0xac], eax
call fcn.10030a2b
mov ecx, dword [ebp - 0xb0]
mov eax, ecx
mov edx, dword [ebp - 0xa4]
and eax, edx
test al, 0x10
jne 0x100326e2
test cl, 0x10
jne 0x100326dd
test dl, 0x20
jne 0x100326e2
mov eax, dword [ebp + 0x18]
jmp 0x100326e7
mov eax, edi
mov dword [ebp + 0x18], eax
mov edi, esi
test eax, eax
je 0x100326fb
test edx, 0x10000
je 0x100326fb
or edi, 0x1000000
push 0x34
xor esi, esi
lea eax, [ebp - 0x3c]
push esi
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0x88]
add esp, 0xc
test eax, eax
je 0x1003271b
cmp eax, 0xffffffff
jne 0x1003275c
mov eax, dword [ebp - 0xb8]
test eax, eax
jne 0x1003272b
mov eax, dword [ebp - 0x94]
push esi
push dword [ebp - 0xac]
push 3
push esi
push 7
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x88], edi
cmp edi, 0xffffffff
je 0x10032b82
mov dword [ebp - 0xc4], 1
jmp 0x1003275e
mov edi, eax
lea eax, [ebp - 0x3c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x10032b6b
mov eax, dword [ebp - 0x3c]
and eax, 0xfffffdff
mov edi, eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0xa8], ebx
je 0x100329be
push 0x4000
push 8
mov dword [ebp - 0xb4], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xa0], esi
test esi, esi
je 0x100329b1
mov edx, dword [ebp - 0x88]
lea eax, [ebp - 0xb4]
xor ecx, ecx
push ecx
push eax
push 0x4000
push esi
push ecx
push ecx
push 0x900a8
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1003295a
cmp dword [esi], 0x80000008
jne 0x100329bc
push 0x24
pop eax
cmp ax, word [esi + 4]
jne 0x100329bc
mov eax, dword [ebp - 0x98]
xor ecx, ecx
and edi, 0xfffffbff
mov esi, ecx
test eax, eax
je 0x10032816
mov esi, dword [eax + 0x30]
mov eax, dword [ebp - 0x8c]
test al, 0x10
je 0x100329bc
test esi, esi
je 0x100329bc
mov edx, dword [ebp - 0xa0]
lea eax, [ebp - 0x8c]
push eax
push ecx
push dword [ebp - 0xb4]
mov dword [ebp - 0x8c], ecx
mov ecx, esi
call fcn.1003fa91
test eax, eax
js 0x100329bc
mov eax, dword [ebp - 0x8c]
test eax, eax
je 0x100329bc
lea ecx, [ebp - 0x90]
mov edx, esi
push ecx
mov ecx, dword [ebp - 0x98]
push eax
call fcn.100320b5
mov esi, eax
test esi, esi
jns 0x10032919
push esi
push 0x2c9
mov ecx, 0x100068b4
call fcn.1003a254
xor edx, edx
inc edx
mov dword [ebp - 0x80], edx
test esi, 0x10000000
je 0x100328ee
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
cmp eax, 0x13d
jne 0x100328df
mov dword [ebp - 0x84], esi
mov ebx, dword [ebp - 0x90]
mov edi, dword [ebp - 0x88]
mov esi, dword [ebp - 0x80]
cmp dword [ebp - 0xc4], 0
je 0x100328d3
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 0x88], 0xffffffff
jmp 0x10032b94
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [ebp - 0x84], eax
jmp 0x100328b4
mov ebx, dword [ebp - 0x90]
mov eax, esi
mov edi, dword [ebp - 0x88]
and eax, 0x1fff0000
cmp eax, 0x70000
jne 0x10032915
movzx eax, si
mov dword [ebp - 0x84], eax
mov esi, edx
jmp 0x100328c3
mov eax, esi
jmp 0x1003290b
mov ebx, dword [ebp - 0x90]
xor esi, esi
mov eax, dword [ebp - 0x8c]
push dword [ebp - 0xa0]
mov dword [ebp - 0xa8], esi
mov dword [ebx + 0x7c], eax
mov eax, 0xfffffbff
and dword [ebp - 0x3c], eax
and edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x100329be
mov dword [ebp - 0xa0], esi
jmp 0x100329be
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0x84], edi
cmp edi, 0x1126
jne 0x100329b1
mov edi, dword [ebp - 0x8c]
xor ecx, ecx
mov edx, 0xfffffbff
mov dword [ebp - 0xa8], ecx
and dword [ebp - 0x3c], edx
and edi, edx
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
neg eax
sbb eax, eax
not eax
and eax, esi
xor esi, esi
mov dword [ebp - 0xa0], eax
mov eax, esi
mov dword [ebp - 0x84], eax
jmp 0x100329be
xor esi, esi
inc esi
mov dword [ebp - 0x80], esi
jmp 0x10032b11
xor esi, esi
push dword [ebp - 0xc8]
push edi
mov edi, dword [ebp - 0x88]
mov edx, edi
call fcn.10033117
mov ecx, dword [ebp - 0x98]
mov edx, edi
mov dword [ebp - 0xd4], eax
call fcn.1003303a
cmp dword [ebp + 0x18], 0
mov dword [ebp - 0xd0], eax
je 0x10032b22
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x8c], esi
push eax
lea eax, [ebp - 0xc8]
mov dword [ebp - 0xac], esi
push eax
lea eax, [ebp - 0xb0]
mov dword [ebp - 0xb0], esi
push eax
lea eax, [ebp - 0xac]
mov dword [ebp - 0xc8], esi
push eax
lea eax, [ebp - 0x8c]
push eax
mov eax, dword [ebp - 0xa4]
and eax, 0x10000
or eax, 0x2e000
shr eax, 0xd
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
mov edi, eax
mov dword [ebp - 0x84], edi
test edi, edi
je 0x10032a8e
mov eax, dword [ebp - 0xb8]
xor esi, esi
inc esi
mov dword [ebp - 0x80], esi
test eax, eax
jne 0x10032a6f
mov eax, dword [ebp - 0x94]
test edi, edi
jle 0x10032a7c
movzx edi, di
or edi, 0x80070000
push 0x341
push 0x100068b4
push edi
push 0x100068c8
jmp 0x10032ae5
push dword [ebp - 0x9c]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorLength]
mov dword [ebp - 0xcc], eax
test eax, eax
jne 0x10032b1c
xor esi, esi
inc esi
mov dword [ebp - 0x80], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x84], edi
test eax, eax
jne 0x10032ac8
mov eax, dword [ebp - 0x94]
test edi, edi
jle 0x10032ad5
movzx edi, di
or edi, 0x80070000
push 0x34f
push 0x100068b4
push edi
push 0x100068ec
mov edx, dword [ebp - 0x98]
xor ecx, ecx
push eax
inc ecx
call fcn.1002fae3
cmp dword [ebp - 0x9c], 0
je 0x10032b11
push dword [ebp - 0x9c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov dword [ebp - 0x9c], eax
mov edi, dword [ebp - 0x88]
jmp 0x100328c3
mov edi, dword [ebp - 0x88]
push esi
lea eax, [ebp - 0xb4]
mov dword [ebp - 0xb4], esi
push eax
push 0x40
lea eax, [ebp - 0x7c]
push eax
push esi
push esi
push 0x9009c
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x100328c0
cmp dword [ebp - 0xb4], 0x40
mov esi, dword [ebp - 0x80]
jne 0x100328c3
mov dword [ebp - 0xc0], 1
jmp 0x100328c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
mov dword [ebp - 0x84], eax
inc esi
mov dword [ebp - 0x80], esi
jmp 0x100328c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
mov dword [ebp - 0x84], eax
inc esi
mov dword [ebp - 0x80], esi
test esi, esi
jne 0x10032e5f
mov dword [ebp - 0xa4], esi
mov edi, esi
mov dword [ebp - 0x90], edi
test ebx, ebx
jne 0x10032bc4
push 0xa0
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov ecx, dword [ebp - 0x94]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x10032bcd
sub ecx, edx
sar ecx, 1
movzx eax, cx
mov dword [ebp - 0xb0], eax
movzx eax, ax
lea eax, [eax*2 + 2]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xbc]
test eax, eax
je 0x10032c4f
cmp word [eax], si
je 0x10032c4f
mov ecx, eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x10032c19
sub ecx, edx
sar ecx, 1
movzx eax, cx
mov dword [ebp - 0xa4], eax
movzx eax, ax
lea eax, [eax*2 + 2]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
jmp 0x10032c57
xor eax, eax
mov dword [ebp - 0xbc], eax
mov ecx, dword [ebp - 0xc0]
mov dword [ebp - 0x8c], esi
test ecx, ecx
je 0x10032c86
push 0x40
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp - 0xc0]
mov edi, eax
mov dword [ebp - 0x90], eax
test ebx, ebx
je 0x10032e5f
mov eax, dword [ebp - 0xac]
test eax, eax
je 0x10032e5f
cmp dword [ebp - 0xbc], 0
je 0x10032cad
test esi, esi
je 0x10032e5f
test ecx, ecx
je 0x10032cb9
test edi, edi
je 0x10032e5f
mov ecx, dword [ebp - 0xb0]
push dword [ebp - 0x94]
movzx edx, cx
mov ecx, eax
inc edx
call fcn.10015ac7
test esi, esi
je 0x10032ceb
mov eax, dword [ebp - 0xa4]
mov ecx, esi
push dword [ebp - 0xbc]
movzx edx, ax
inc edx
call fcn.10015ac7
test edi, edi
je 0x10032d03
push 0x10
pop ecx
lea esi, [ebp - 0x7c]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x8c]
mov edi, dword [ebp - 0x90]
xor eax, eax
cmp dword [ebx], eax
je 0x10032d25
push dword [ebx]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x10032d23
xor eax, eax
mov dword [ebx], eax
jmp 0x10032d25
xor eax, eax
cmp dword [ebx + 8], 0
je 0x10032d45
push dword [ebx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x10032d45
xor eax, eax
mov dword [ebx + 8], eax
cmp dword [ebp + 0x14], 0
mov eax, dword [ebp - 0xac]
mov dword [ebx], eax
mov eax, dword [ebp - 0xb0]
mov word [ebx + 4], ax
mov eax, dword [ebp - 0xa4]
mov dword [ebx + 8], esi
mov word [ebx + 0xc], ax
mov eax, dword [ebp - 0x3c]
mov dword [ebx + 0x10], eax
je 0x10032d7b
mov eax, dword [ebp - 0x3c]
and eax, 0xfffffbff
mov dword [ebx + 0x10], eax
cmp dword [ebp + 0x18], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0x2c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebx + 0x28], eax
mov eax, dword [ebp - 0x38]
mov dword [ebx + 0x30], eax
mov eax, dword [ebp - 0x34]
mov dword [ebx + 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebx + 0x38], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebx + 0x3c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebx + 0x40], eax
mov eax, dword [ebp - 0x24]
mov dword [ebx + 0x44], eax
je 0x10032deb
mov edx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x98]
push 0xffffffffffffffff
push dword [ebp - 0xcc]
call fcn.100334d3
test eax, eax
je 0x10032dd6
mov eax, dword [eax + 8]
mov dword [ebx + 0x48], eax
jmp 0x10032ddd
mov dword [ebp - 0x80], 1
push dword [ebp - 0x9c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x10032def
or dword [ebx + 0x48], 0xffffffff
mov edx, dword [ebp - 0x80]
test edx, edx
jne 0x10032e39
mov eax, dword [ebp - 0xd0]
mov dword [ebx + 0x50], eax
mov eax, dword [ebp - 0xd4]
mov dword [ebx + 0x4c], eax
mov dword [ebx + 0x54], edi
cmp dword [ebp - 0xa8], edx
je 0x10032e27
mov ecx, dword [ebp - 0xa0]
mov eax, dword [ecx]
mov dword [ebx + 0x58], eax
movzx eax, word [ecx + 6]
mov dword [ebx + 0x5c], eax
jmp 0x10032e39
cmp dword [ebp - 0x14], 1
jbe 0x10032e39
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x5c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x58], eax
xor ecx, ecx
mov dword [ebx + 0x98], ecx
test edx, edx
je 0x10032e61
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, ebx
mov esi, eax
call fcn.10031fd4
xor ecx, ecx
mov ebx, ecx
jmp 0x10032e67
push 0x57
pop esi
jmp 0x10032e67
xor ecx, ecx
mov esi, dword [ebp - 0x84]
mov eax, dword [ebp - 0xa0]
test eax, eax
je 0x10032e80
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xb8]
test eax, eax
je 0x10032e9b
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0xc4], 0
je 0x10032eb6
mov eax, dword [ebp - 0x88]
cmp eax, 0xffffffff
je 0x10032eb6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x10032ec1
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 8]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10083b20
mov esp, ebp
pop ebp
ret 0x14