Function at 0x413350
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x443c22
mov eax, dword fs:[0]
push eax
sub esp, 0x274
mov eax, dword [0x451050]
xor eax, esp
mov dword [esp + 0x270], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x451050]
xor eax, esp
push eax
lea eax, [esp + 0x288]
mov dword fs:[0], eax
xor ebx, ebx
cmp dword [0x458810], ebx
je 0x413525
mov edx, 0x4587fc
lea ecx, [esp + 0x14]
call fcn.00412c30
mov dword [esp + 0x290], ebx
mov eax, 7
xor ecx, ecx
mov dword [esp + 0x64], eax
mov dword [esp + 0x60], ebx
mov word [esp + 0x50], cx
xor edx, edx
mov dword [esp + 0x48], eax
mov dword [esp + 0x44], ebx
mov word [esp + 0x34], dx
mov byte [esp + 0x290], 2
xor esi, esi
lea ebp, [ebx + 8]
mov edi, edi
cmp esi, dword [esp + 0x28]
jbe 0x4133eb
call fcn.004344ed
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x18]
cmp ecx, ebp
jae 0x4133fb
lea eax, [esp + 0x18]
cmp word [eax + esi*2], bx
je 0x413446
cmp esi, dword [esp + 0x28]
jbe 0x41340c
call fcn.004344ed
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x2c], ebp
jae 0x41341a
lea eax, [esp + 0x18]
cmp word [eax + esi*2], 0x20
je 0x413443
cmp esi, dword [esp + 0x28]
jbe 0x41342c
call fcn.004344ed
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x18]
cmp ecx, ebp
jae 0x41343c
lea eax, [esp + 0x18]
cmp word [eax + esi*2], 9
jne 0x413446
inc esi
jmp 0x4133e0
mov eax, dword [esp + 0x18]
mov edi, esi
cmp ecx, ebp
jae 0x413454
lea eax, [esp + 0x18]
cmp word [eax], 0x22
jne 0x4134a2
inc esi
mov edi, esi
lea ecx, [ecx]
cmp edi, dword [esp + 0x28]
jbe 0x41346b
call fcn.004344ed
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x2c], ebp
jae 0x413479
lea eax, [esp + 0x18]
cmp word [eax + edi*2], bx
je 0x4134be
cmp edi, dword [esp + 0x28]
jbe 0x41348a
call fcn.004344ed
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x2c], ebp
jae 0x413498
lea eax, [esp + 0x18]
cmp word [eax + edi*2], 0x22
je 0x4134be
inc edi
jmp 0x413460
mov eax, dword [esp + 0x18]
cmp ecx, ebp
jae 0x4134ae
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x413530
mov edi, dword [esp + 0x28]
cmp edi, esi
ja 0x41359e
cmp dword [esp + 0x48], ebp
jb 0x4134d9
mov eax, dword [esp + 0x34]
push eax
call fcn.00434772
add esp, 4
xor ecx, ecx
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], ebx
mov word [esp + 0x34], cx
cmp dword [esp + 0x64], ebp
jb 0x4134ff
mov edx, dword [esp + 0x50]
push edx
call fcn.00434772
add esp, 4
xor eax, eax
mov dword [esp + 0x64], 7
mov dword [esp + 0x60], ebx
mov word [esp + 0x50], ax
cmp dword [esp + 0x2c], ebp
jb 0x413525
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00434772
add esp, 4
xor eax, eax
jmp 0x41385a
cmp edi, dword [esp + 0x28]
jbe 0x41353b
call fcn.004344ed
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x2c], ebp
jae 0x413549
lea eax, [esp + 0x18]
cmp word [eax + edi*2], bx
je 0x4134be
cmp edi, dword [esp + 0x28]
jbe 0x41355e
call fcn.004344ed
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x2c], ebp
jae 0x41356c
lea eax, [esp + 0x18]
cmp word [eax + edi*2], 0x20
je 0x4134be
cmp edi, dword [esp + 0x28]
jbe 0x413582
call fcn.004344ed
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x2c], ebp
jae 0x413590
lea eax, [esp + 0x18]
cmp word [eax + edi*2], 9
je 0x4134be
inc edi
jmp 0x413530
lea edx, [esp + 0x14]
mov ecx, edi
push edx
sub ecx, esi
mov edx, esi
lea esi, [esp + 0x6c]
call fcn.004173d0
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x54]
mov byte [esp + 0x298], 3
call fcn.004038b0
mov byte [esp + 0x290], 2
cmp dword [esp + 0x80], ebp
jb 0x4135e4
mov eax, dword [esp + 0x6c]
push eax
call fcn.00434772
add esp, 4
mov ecx, dword [esp + 0x28]
lea esi, [edi + 1]
mov edi, ecx
cmp esi, ecx
jae 0x413698
cmp esi, ecx
jbe 0x413602
call fcn.004344ed
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x2c], ebp
jae 0x413610
lea eax, [esp + 0x18]
cmp word [eax + esi*2], bx
je 0x41365d
cmp esi, ecx
jbe 0x413623
call fcn.004344ed
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x2c], ebp
jae 0x413631
lea eax, [esp + 0x18]
cmp word [eax + esi*2], 0x20
je 0x41365a
cmp esi, ecx
jbe 0x413645
call fcn.004344ed
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x2c], ebp
jae 0x413653
lea eax, [esp + 0x18]
cmp word [eax + esi*2], 9
jne 0x41365d
inc esi
jmp 0x4135f5
cmp esi, edi
jae 0x413698
lea edx, [esp + 0x14]
mov ecx, edi
push edx
sub ecx, esi
mov edx, esi
lea esi, [esp + 0x6c]
call fcn.004173d0
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x38]
mov byte [esp + 0x298], 4
call fcn.004038b0
mov byte [esp + 0x290], 2
call fcn.004034a0
jmp 0x4136a7
push ebx
mov eax, 0x447354
lea esi, [esp + 0x34]
call fcn.00403960
mov ecx, dword [esp + 0x34]
cmp dword [esp + 0x48], ebp
jae 0x4136b5
lea ecx, [esp + 0x34]
mov eax, dword [esp + 0x50]
cmp dword [esp + 0x64], ebp
jae 0x4136c3
lea eax, [esp + 0x50]
push 1
push ebx
push ecx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x4137f9
lea eax, [esp + 0x84]
push eax
push 0x7d2d
mov ebx, 0x100
call fcn.0040af30
add esp, 8
lea eax, [esp + 0x84]
lea ecx, [esp + 0x68]
call fcn.00403460
push 4
mov eax, str._r_n_r_n
lea ecx, [esp + 0x6c]
mov byte [esp + 0x294], 5
call fcn.004037d0
push 0
lea ecx, [esp + 0x50]
push ecx
or eax, 0xffffffff
lea esi, [esp + 0x70]
call fcn.00403710
push 1
mov eax, 0x4478f8
mov ecx, esi
call fcn.004037d0
push 0
lea edx, [esp + 0x34]
push edx
or eax, 0xffffffff
call fcn.00403710
mov edi, dword [esp + 0x6c]
cmp dword [esp + 0x80], ebp
jae 0x413760
lea edi, [esp + 0x6c]
mov esi, dword [0x459f80]
call fcn.004088d0
cmp dword [esp + 0x80], ebp
jb 0x413781
mov eax, dword [esp + 0x6c]
push eax
call fcn.00434772
add esp, 4
xor edi, edi
xor ecx, ecx
mov esi, 7
mov dword [esp + 0x80], esi
mov dword [esp + 0x7c], edi
mov word [esp + 0x6c], cx
cmp dword [esp + 0x48], ebp
jb 0x4137ad
mov edx, dword [esp + 0x34]
push edx
call fcn.00434772
add esp, 4
xor eax, eax
mov dword [esp + 0x48], esi
mov dword [esp + 0x44], edi
mov word [esp + 0x34], ax
cmp dword [esp + 0x64], ebp
jb 0x4137cf
mov ecx, dword [esp + 0x50]
push ecx
call fcn.00434772
add esp, 4
xor edx, edx
mov dword [esp + 0x64], esi
mov dword [esp + 0x60], edi
mov word [esp + 0x50], dx
cmp dword [esp + 0x2c], ebp
jb 0x413525
mov eax, dword [esp + 0x18]
push eax
call fcn.00434772
add esp, 4
xor eax, eax
jmp 0x41385a
cmp dword [esp + 0x48], ebp
jb 0x41380c
mov ecx, dword [esp + 0x34]
push ecx
call fcn.00434772
add esp, 4
xor edx, edx
mov esi, 7
mov dword [esp + 0x48], esi
mov dword [esp + 0x44], ebx
mov word [esp + 0x34], dx
cmp dword [esp + 0x64], ebp
jb 0x413833
mov eax, dword [esp + 0x50]
push eax
call fcn.00434772
add esp, 4
xor ecx, ecx
mov dword [esp + 0x64], esi
mov dword [esp + 0x60], ebx
mov word [esp + 0x50], cx
cmp dword [esp + 0x2c], ebp
jb 0x413855
mov edx, dword [esp + 0x18]
push edx
call fcn.00434772
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x288]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x270]
xor ecx, esp
call fcn.00433c32
add esp, 0x280
ret