Function at 0x402e60
Capabilities:
Check if file exists
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe8
mov eax, dword [0x425008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberA]
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0
jge 0x402e93
xor eax, eax
jmp 0x4030c4
mov ecx, dword [ebp - 0xdc]
push ecx
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_PathBuildRootA]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
je 0x402eba
xor eax, eax
jmp 0x4030c4
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x402ecf
xor eax, eax
jmp 0x4030c4
mov dword [ebp - 0xc4], 0x94
lea edx, [ebp - 0xc4]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0xb4], 2
je 0x402ef9
mov eax, 1
jmp 0x4030c4
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0xe0], 7
lea eax, [ebp - 0xcc]
push eax
push 0
push 0
mov ecx, dword [ebp - 0xe0]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_GetFileSecurityA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x402f3b
xor eax, eax
jmp 0x4030c4
mov eax, dword [ebp - 0xcc]
push eax
call fcn.0040cd3b
add esp, 4
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
jne 0x402f60
xor eax, eax
jmp 0x4030c4
mov ecx, dword [ebp - 0xcc]
push ecx
push 0
mov edx, dword [ebp - 0xc8]
push edx
call fcn.0040ae60
add esp, 0xc
lea eax, [ebp - 0xcc]
push eax
mov ecx, dword [ebp - 0xcc]
push ecx
mov edx, dword [ebp - 0xc8]
push edx
mov eax, dword [ebp - 0xe0]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetFileSecurityA]
test eax, eax
jne 0x402fb8
mov edx, dword [ebp - 0xc8]
push edx
call fcn.0040cdcd
add esp, 4
xor eax, eax
jmp 0x4030c4
mov dword [ebp - 0xd4], 0
push 2
call dword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
test eax, eax
je 0x402fea
lea eax, [ebp - 0xd4]
push eax
push 0
push 0xa
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x403006
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov ecx, dword [ebp - 0xc8]
push ecx
call fcn.0040cdcd
add esp, 4
xor eax, eax
jmp 0x4030c4
mov dword [ebp - 0xd8], 6
push 0x10
push 0
lea edx, [ebp - 0x1c]
push edx
call fcn.0040ae60
add esp, 0xc
mov dword [ebp - 0x18], 0x120116
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0xd8]
push ecx
call dword [sym.imp.ADVAPI32.dll_MapGenericMask]
mov dword [ebp - 0xd0], 1
mov dword [ebp - 0xe8], 0x14
mov dword [ebp - 0xe4], 0
lea edx, [ebp - 0xd0]
push edx
lea eax, [ebp - 0xe4]
push eax
lea ecx, [ebp - 0xe8]
push ecx
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0xd8]
push ecx
mov edx, dword [ebp - 0xd4]
push edx
mov eax, dword [ebp - 0xc8]
push eax
call dword [sym.imp.ADVAPI32.dll_AccessCheck]
test eax, eax
jne 0x40309c
mov dword [ebp - 0xd0], 0
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov ecx, dword [ebp - 0xc8]
push ecx
call fcn.0040cdcd
add esp, 4
mov edx, dword [ebp - 0xd4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xd0]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409e94
mov esp, ebp
pop ebp
ret