Function at 0x40c300
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40c3a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x40c32a
test bl, 0x10
je 0x40c32a
mov esi, 2
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x40c39e
push 0x438ca8
push edi
call fcn.00420687
mov esi, eax
add esp, 8
test esi, esi
je 0x40c39e
push str.time_sources
push str.REGEDIT4_r_n_r_n__r_n__This_is_a_sample_template._It_contains_only__s_information__and_r_n__therefore_is_useful_as_a_template_for_resetting__not_installing_or_upgrading_._r_n__r_n__Templates_used_for_resetting_should_only_contain_the_information_you_want_to_change._r_n__r_n_r_n
push esi
call fcn.0042069e
add esp, 0xc
cmp byte [esp + 0xc], 0
mov eax, str.Client
jne 0x40c36d
mov eax, str.Server
push eax
push str._HKEY_LOCAL_MACHINESOFTWAREGreywareDomain_Time__sTime_Sources__r_n
push esi
call fcn.0042069e
push str.__r_n__This_section_may_contain_several_values__see_the_default_.reg_file_for_more_information___but_r_n__this_sample_only_contains_the_Servers_entry._r_n__r_n__The_Servers_entry_is_a_REG_MULTI_SZ_value__a_list_of_strings_._If_you_look_at_a_REG_MULTI_SZ_r_n__entry_using_the_registry_editor__you_can_see_each_string_on_a_line_of_its_own._Unfortunately__r_n__that_display_is_something_registry_editor_provides_for_your_convenience__the_actual_.reg_format_r_n__is_far_less_friendly._r_n__r_n__A_REG_MULTI_SZ_is_a_hex_7__value__with_each_byte_of_each_string_represented_as_a_separate_hex_r_n__digit._If_your_.reg_file_is_in_Unicode_format__then_there_will_be_two_bytes_for_each_character_r_n___the_first_one_usually_zero_._If_your_.reg_file_is_in_ANSI_format__like_this_sample___then_each_r_n__character_uses_only_one_byte._r_n__r_n__There_is_no_easy_way_for_humans_to_compose_a_hex_7__value_by_typing._You_cannot_enter_the_strings_r_n__directly__only_hex_digits_are_allowed_by_the_format._The_simplest_way_to_create_the_value_is_by_r_n__using_the_registry_editor_to_make_your_changes__then_exporting_the_result_into_a_text_file_like_r_n__this_one._Alternately__you_may_use_Domain_Times_control_panel_applet_to_configure_the_servers_and_r_n__do_the_export._Using_Domain_Time_instead_of_the_registry_editor_will_provide_the_proper_hex_7__value_r_n__needed_by_Windows__and_also_a_textual_translation_as_a_comment_underneath:_r_n__r_n
push esi
call fcn.0042069e
push str._Servers_hex_7_:73_65_72_76_65_72_20_74_69_6d_65_2d_61_2e_6e_69_73_74_2e_67_6f__r_n__76_20_70_72_6f_74_6f_63_6f_6c_20_4e_54_50_00_73_65_72_76_65_72_20_74_69_6d__r_n__65_2d_62_2e_6e_69_73_74_2e_67_6f_76_20_70_72_6f_74_6f_63_6f_6c_20_4e_54_50__r_n__00_73_65_72_76_65_72_20_6e_69_73_74_31_2e_73_79_6d_6d_65_74_72_69_63_6f_6d__r_n__2e_63_6f_6d_20_70_72_6f_74_6f_63_6f_6c_20_4e_54_50_00_73_65_72_76_65_72_20__r_n__74_69_63_6b_2e_67_72_65_79_77_61_72_65_2e_63_6f_6d_20_70_72_6f_74_6f_63_6f__r_n__6c_20_44_54_32_2d_55_44_50_00_73_65_72_76_65_72_20_74_6f_63_6b_2e_67_72_65__r_n__79_77_61_72_65_2e_63_6f_6d_20_70_72_6f_74_6f_63_6f_6c_20_44_54_32_2d_48_54__r_n__54_50_00_00_r_n____Servers__REG_MULTI_SZ__text_version:_r_n____server_time_a.nist.gov_protocol_NTP_r_n____server_time_b.nist.gov_protocol_NTP_r_n____server_nist1.symmetricom.com_protocol_NTP_r_n____server_tick.greyware.com_protocol_DT2_UDP_r_n____server_tock.greyware.com_protocol_DT2_HTTP_r_n_r_n
push esi
call fcn.0042069e
push esi
call fcn.00420567
push esi
call fcn.00420901
add esp, 0x24
pop esi
pop ebx
ret
xor esi, esi
jmp 0x40c320