Function at 0x4a213370
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov esi, dword [sym.imp.msvcrt.dll__wcsicmp]
push str..BAT
push ebx
call esi
pop ecx
pop ecx
test eax, eax
je 0x4a2155e0
push str..CMD
push ebx
call esi
pop ecx
pop ecx
test eax, eax
je 0x4a2155e0
xor eax, eax
inc eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.4a2113a9
leave
ret 0xc
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x4a2340ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
and dword [ebp - 0x21c], 0
push esi
push edi
push dword [eax + 0x38]
mov dword [ebp - 0x220], ecx
call fcn.4a212598
mov edi, eax
mov esi, 0x104
test edi, edi
je 0x4a2133cc
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4a2133b0
sub eax, edx
sar eax, 1
mov dword [ebp - 0x224], eax
cmp eax, esi
jae 0x4a225971
cmp byte [0x4a234081], 0
je 0x4a2133f6
test edi, edi
je 0x4a225982
push 4
push 0x4a2138c8
push edi
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x4a225982
push ebx
mov ebx, 0x208
push ebx
lea eax, [ebp - 0x214]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push edi
push esi
lea eax, [ebp - 0x214]
push eax
call fcn.4a21185a
lea eax, [ebp - 0x214]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x4a213425
sub eax, ecx
movzx ecx, word [0x4a25065c]
sar eax, 1
push ecx
inc eax
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.4a2132fd
mov ax, word [0x4a250664]
mov word [ebp - 0xc], ax
push 0x3a
pop eax
mov word [ebp - 0xa], ax
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.4a211996
cmp eax, dword [ebp - 0x224]
push 0
sbb eax, eax
neg eax
mov dword [ebp - 0x224], eax
pop eax
mov word [ebp - 0xa], ax
jne 0x4a2138d8
lea esi, [ebp - 0x214]
cmp word [esi], 0
mov dword [ebp - 0x218], esi
je 0x4a220efa
push 4
mov ecx, 0x4a212ec4
mov eax, esi
pop edi
mov dx, word [eax]
cmp dx, word [ecx]
je 0x4a2259a2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4a220efa
mov ecx, 0x4a212ebc
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
je 0x4a2259c9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4a220efa
push 0x410
call fcn.4a211896
mov esi, eax
test esi, esi
je 0x4a225a19
mov edi, dword [ebp - 0x220]
lea eax, [ebp - 0x214]
push eax
push dword [ebp + 0x10]
push edi
call fcn.4a21185a
mov eax, dword [ebp - 0x218]
push 0x4a212ec4
push dword [ebp + 0x10]
lea ecx, [ebp - 0x214]
sub eax, ecx
sar eax, 1
xor ecx, ecx
push edi
mov word [edi + eax*2], cx
call fcn.4a2120a9
push edi
push ebx
push esi
call fcn.4a212faf
test eax, eax
jne 0x4a2259f0
push esi
call fcn.4a212ed1
mov ax, word [eax]
cmp ax, word [0x4a250664]
je 0x4a213562
push 0x4a212ec8
push ebx
push esi
call fcn.4a2120a9
push dword [ebp - 0x218]
push ebx
push esi
call fcn.4a2120a9
mov eax, esi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x4a213574
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push esi
call fcn.4a212536
mov esi, eax
mov dword [ebp - 0x22c], esi
test esi, esi
je 0x4a225a19
movzx eax, word [0x4a250664]
push eax
push esi
call fcn.4a212148
xor ecx, ecx
mov word [eax], cx
inc eax
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x224], ecx
jne 0x4a2135d0
push str.PATH
call fcn.4a212070
mov dword [ebp - 0x21c], eax
push edi
call dword [sym.imp.KERNEL32.dll_NeedCurrentDirectoryForExePathW]
mov dword [ebp - 0x218], eax
test eax, eax
je 0x4a220f3b
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4a2135ea
sub eax, edx
sar eax, 1
lea edi, [eax + 2]
mov eax, dword [ebp - 0x21c]
add edi, 2
test eax, eax
je 0x4a21361b
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4a21360b
sub eax, edx
sar eax, 1
add edi, eax
lea eax, [edi + edi]
push eax
call fcn.4a211896
mov ebx, eax
test ebx, ebx
je 0x4a225a19
cmp dword [ebp - 0x218], 0
je 0x4a213659
mov esi, 0x4a2132f4
push esi
push edi
push ebx
call fcn.4a2120a9
push dword [ebp - 0x22c]
push edi
push ebx
call fcn.4a2120a9
push esi
push edi
push ebx
call fcn.4a2120a9
xor eax, eax
mov esi, 0x4a2138d4
cmp dword [ebp - 0x224], eax
jne 0x4a21368d
cmp dword [ebp - 0x21c], eax
je 0x4a21368d
cmp dword [ebp - 0x218], eax
je 0x4a213680
push esi
push edi
push ebx
call fcn.4a2120a9
push dword [ebp - 0x21c]
push edi
push ebx
call fcn.4a2120a9
push edi
push ebx
call fcn.4a213329
push 1
push esi
push ebx
call fcn.4a2122ca
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x228]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x4a2136ac
sub eax, ecx
sar eax, 1
mov dword [ebp - 0x22c], eax
cmp byte [0x4a234081], dl
je 0x4a220f42
push str.PATHEXT
call fcn.4a212070
mov ebx, eax
test ebx, ebx
je 0x4a220f42
lea eax, [ebx + 2]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4a2136e6
sub eax, edx
sar eax, 1
push eax
push ebx
call fcn.4a213329
push 1
push esi
push ebx
call fcn.4a2122ca
mov dword [ebp - 0x230], eax
mov edi, dword [ebp - 0x21c]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4a213715
sub eax, edx
sar eax, 1
mov esi, eax
push edi
lea ebx, [esi + 1]
call fcn.4a212598
push eax
push ebx
push edi
call fcn.4a21185a
mov eax, edi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x4a21373b
push dword [ebp - 0x21c]
sub eax, ecx
sar eax, 1
mov edi, eax
call fcn.4a212ed1
mov ax, word [eax]
cmp ax, word [0x4a250664]
je 0x4a214358
mov dword [ebp - 0x218], 1
mov esi, ebx
inc edi
mov eax, dword [ebp - 0x21c]
xor ecx, ecx
cmp word [eax], cx
je 0x4a2146a7
mov edx, dword [ebp - 0x22c]
lea edi, [edi + edx + 1]
mov dword [ebp - 0x238], edi
cmp edi, 0x104
ja 0x4a225a25
mov ebx, dword [ebp - 0x21c]
mov edi, dword [ebp - 0x220]
push ebx
push dword [ebp + 0x10]
push edi
call fcn.4a21185a
cmp dword [ebp - 0x218], 0
je 0x4a214364
cmp dword [ebp - 0x218], 0
lea eax, [ebx + esi*2]
mov dword [ebp - 0x21c], eax
je 0x4a2137e2
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
push edi
call fcn.4a2120a9
push dword [ebp - 0x228]
push dword [ebp + 0x10]
push edi
call fcn.4a2120a9
push edi
call fcn.4a212598
push eax
push dword [ebp + 0x10]
push edi
call fcn.4a21185a
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4a213806
sub eax, edx
sar eax, 1
cmp word [edi + 2], 0x3a
mov esi, eax
jne 0x4a21382e
movzx eax, word [edi]
push eax
call fcn.4a212b68
test eax, eax
je 0x4a21370a
push 0x2e
push dword [ebp - 0x228]
call fcn.4a212148
test eax, eax
jne 0x4a2138fd
push 0x2a
push dword [ebp - 0x228]
call fcn.4a2118eb
test eax, eax
jne 0x4a2146bd
push 0x3f
push dword [ebp - 0x228]
call fcn.4a2118eb
test eax, eax
jne 0x4a2146bd
mov ebx, dword [ebp - 0x230]
push eax
push 0x4a21430c
push esi
push dword [ebp + 0x10]
push edi
call fcn.4a214317
test eax, eax
jne 0x4a214fba
cmp dword [0x4a234128], 0
je 0x4a2138a7
cmp dword [0x4a234128], 2
jne 0x4a21370a
mov edi, dword [ebp - 0x220]
push 1
push 0x4a211794
push esi
push dword [ebp + 0x10]
push edi
call fcn.4a214317
test eax, eax
je 0x4a21370a
jmp 0x4a225a47
movzx eax, word [0x4a250664]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.4a212148
mov esi, eax
test esi, esi
je 0x4a220210
inc esi
inc esi
jmp 0x4a213493
cmp word [eax + 2], 0
je 0x4a213843
push 1
push dword [ebp + 0x10]
push edi
call fcn.4a21315d
test eax, eax
je 0x4a214677
push 0x2e
push edi
call fcn.4a212148
mov ebx, eax
test ebx, ebx
je 0x4a21468c
mov esi, dword [sym.imp.msvcrt.dll__wcsicmp]
push str..CMD
push ebx
call esi
pop ecx
pop ecx
test eax, eax
je 0x4a2155e0
push str..BAT
push ebx
call esi
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
jmp 0x4a213204
and dword [ebp - 0x218], 0
jmp 0x4a213773
inc esi
jmp 0x4a2137c3
cmp dword [ebp - 0x224], eax
je 0x4a21468c
cmp dword [0x4a234128], 5
je 0x4a21391b
mov eax, dword [0x4a234128]
cmp eax, 2
je 0x4a213843
test eax, eax
jne 0x4a21370a
jmp 0x4a225a3c
cmp dword [ebp - 0x224], ecx
je 0x4a2146bd
mov eax, dword [0x4a234128]
cmp eax, ecx
je 0x4a2146bd
cmp eax, 2
jne 0x4a2146c7
mov dword [0x4a234128], 0x2331
xor eax, eax
jmp 0x4a213205
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4a214f6f
mov ecx, dword [ebp - 0x238]
sub eax, edx
sar eax, 1
add ecx, eax
cmp ecx, 0x104
ja 0x4a214fb0
push 1
push ebx
push esi
push dword [ebp + 0x10]
push edi
call fcn.4a214317
test eax, eax
jne 0x4a2131d8
mov eax, dword [0x4a234128]
cmp eax, 2
jne 0x4a220f4c
mov ax, word [ebx]
inc ebx
inc ebx
test ax, ax
jne 0x4a214fb0
cmp word [ebx], 0
je 0x4a21388b
mov eax, ebx
lea edx, [eax + 2]
jmp 0x4a214f6f
push 2
pop eax
jmp 0x4a213205
push 0x3a
lea eax, [ebp - 0x214]
push eax
call fcn.4a2118eb
mov esi, eax
jmp 0x4a2138f6
cmp byte [0x4a234081], 0
je 0x4a2146bd
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4a220f2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x15
pop ecx
cmp eax, ecx
jne 0x4a2146bd
jmp 0x4a225a74
test al, 0x10
jne 0x4a225a12
jmp 0x4a2146bd
xor edi, edi
jmp 0x4a2135fb
mov ebx, str..COM_.EXE_.BAT_.CMD_.VBS_.JS_.WS_.MSC
jmp 0x4a2136e0
test eax, eax
je 0x4a214fb0
jmp 0x4a213894
mov dword [0x4a234128], 0x233f
xor eax, eax
jmp 0x4a213206
push str.COMSPEC
call fcn.4a212070
mov edi, eax
test edi, edi
jne 0x4a2133f6
mov dword [0x4a234128], 0x400023d2
jmp 0x4a22597b
test dx, dx
je 0x4a2259c2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4a2134b9
add eax, edi
add ecx, edi
test dx, dx
jne 0x4a2134ad
xor eax, eax
jmp 0x4a2134be
test dx, dx
je 0x4a2259e9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4a2134d9
add eax, edi
add ecx, edi
test dx, dx
jne 0x4a2134cd
xor eax, eax
jmp 0x4a2134de
cmp byte [0x4a234081], 0
je 0x4a2146bd
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4a220f2e
jmp 0x4a2146bd
push 5
jmp 0x4a2155e2
mov dword [0x4a234128], 8
jmp 0x4a225a7a
cmp dword [ebp - 0x218], ecx
jne 0x4a225a2e
inc esi
lea eax, [eax + esi*2]
mov dword [ebp - 0x21c], eax
jmp 0x4a21370a
mov edi, dword [ebp - 0x220]
jmp 0x4a213843
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
test eax, eax
je 0x4a21370a
cmp dword [ebp - 0x234], 4
je 0x4a213202
jmp 0x4a21370a
mov dword [0x4a234128], ecx
push 3
jmp 0x4a2155e2