Function at 0x4ad032a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov esi, dword [sym.imp.msvcrt.dll__wcsicmp]
push str..BAT
push ebx
call esi
pop ecx
pop ecx
test eax, eax
je 0x4ad0706d
push str..CMD
push ebx
call esi
pop ecx
pop ecx
test eax, eax
je 0x4ad0706d
xor eax, eax
inc eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.4ad0139d
leave
ret 0xc
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x4ad240ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
and dword [ebp - 0x21c], 0
push esi
push edi
push dword [eax + 0x38]
mov dword [ebp - 0x220], ecx
call fcn.4ad01b0c
mov edi, eax
mov esi, 0x104
test edi, edi
je 0x4ad032fc
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad032e0
sub eax, edx
sar eax, 1
mov dword [ebp - 0x224], eax
cmp eax, esi
jae 0x4ad15995
cmp byte [0x4ad24081], 0
je 0x4ad03326
test edi, edi
je 0x4ad159a6
push 4
push 0x4ad037d4
push edi
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x4ad159a6
push ebx
mov ebx, 0x208
push ebx
lea eax, [ebp - 0x214]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push edi
push esi
lea eax, [ebp - 0x214]
push eax
call fcn.4ad017fb
lea eax, [ebp - 0x214]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x4ad03355
sub eax, ecx
movzx ecx, word [0x4ad4061c]
sar eax, 1
push ecx
inc eax
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.4ad0322d
mov ax, word [0x4ad40620]
mov word [ebp - 0xc], ax
push 0x3a
pop eax
mov word [ebp - 0xa], ax
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.4ad0196a
cmp eax, dword [ebp - 0x224]
push 0
sbb eax, eax
neg eax
mov dword [ebp - 0x224], eax
pop eax
mov word [ebp - 0xa], ax
je 0x4ad06ec5
movzx eax, word [0x4ad40620]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.4ad01b5c
mov esi, eax
test esi, esi
je 0x4ad104c8
inc esi
inc esi
cmp word [esi], 0
mov dword [ebp - 0x218], esi
je 0x4ad10927
push 4
mov ecx, 0x4ad02dc0
mov eax, esi
pop edi
mov dx, word [eax]
cmp dx, word [ecx]
je 0x4ad159c6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4ad10927
mov ecx, 0x4ad02db8
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
je 0x4ad159ed
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4ad10927
push 0x410
call fcn.4ad018b8
mov esi, eax
test esi, esi
je 0x4ad15a3d
mov edi, dword [ebp - 0x220]
lea eax, [ebp - 0x214]
push eax
push dword [ebp + 0x10]
push edi
call fcn.4ad017fb
mov eax, dword [ebp - 0x218]
push 0x4ad02dc0
push dword [ebp + 0x10]
lea ecx, [ebp - 0x214]
sub eax, ecx
sar eax, 1
xor ecx, ecx
push edi
mov word [edi + eax*2], cx
call fcn.4ad01a89
push edi
push ebx
push esi
call fcn.4ad02ece
test eax, eax
jne 0x4ad15a14
push esi
call fcn.4ad02d9a
mov ax, word [eax]
cmp ax, word [0x4ad40620]
je 0x4ad034ac
push 0x4ad02db4
push ebx
push esi
call fcn.4ad01a89
push dword [ebp - 0x218]
push ebx
push esi
call fcn.4ad01a89
mov eax, esi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x4ad034be
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push esi
call fcn.4ad02a13
mov esi, eax
mov dword [ebp - 0x22c], esi
test esi, esi
je 0x4ad15a3d
movzx eax, word [0x4ad40620]
push eax
push esi
call fcn.4ad01b5c
xor ecx, ecx
mov word [eax], cx
inc eax
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x224], ecx
je 0x4ad06ed0
push edi
call dword [sym.imp.KERNEL32.dll_NeedCurrentDirectoryForExePathW]
mov dword [ebp - 0x218], eax
test eax, eax
je 0x4ad10968
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad03528
sub eax, edx
sar eax, 1
lea edi, [eax + 2]
mov eax, dword [ebp - 0x21c]
add edi, 2
test eax, eax
jne 0x4ad06f13
lea eax, [edi + edi]
push eax
call fcn.4ad018b8
mov ebx, eax
test ebx, ebx
je 0x4ad15a3d
cmp dword [ebp - 0x218], 0
je 0x4ad03588
mov esi, 0x4ad03224
push esi
push edi
push ebx
call fcn.4ad01a89
push dword [ebp - 0x22c]
push edi
push ebx
call fcn.4ad01a89
push esi
push edi
push ebx
call fcn.4ad01a89
xor eax, eax
mov esi, 0x4ad037e0
cmp dword [ebp - 0x224], eax
je 0x4ad06ee5
push edi
push ebx
call fcn.4ad03259
push 1
push esi
push ebx
call fcn.4ad027a7
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x228]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x4ad035ba
sub eax, ecx
sar eax, 1
mov dword [ebp - 0x22c], eax
cmp byte [0x4ad24081], dl
je 0x4ad1096f
push str.PATHEXT
call fcn.4ad01931
mov ebx, eax
test ebx, ebx
je 0x4ad1096f
lea eax, [ebx + 2]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad035f4
sub eax, edx
sar eax, 1
push eax
push ebx
call fcn.4ad03259
push 1
push esi
push ebx
call fcn.4ad027a7
mov dword [ebp - 0x230], eax
mov edi, dword [ebp - 0x21c]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad03623
sub eax, edx
sar eax, 1
mov esi, eax
push edi
lea ebx, [esi + 1]
call fcn.4ad01b0c
push eax
push ebx
push edi
call fcn.4ad017fb
mov eax, edi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x4ad03649
push dword [ebp - 0x21c]
sub eax, ecx
sar eax, 1
mov edi, eax
call fcn.4ad02d9a
mov ax, word [eax]
cmp ax, word [0x4ad40620]
je 0x4ad06f2b
mov dword [ebp - 0x218], 1
mov esi, ebx
inc edi
mov eax, dword [ebp - 0x21c]
xor ecx, ecx
cmp word [eax], cx
je 0x4ad04c7e
mov edx, dword [ebp - 0x22c]
lea edi, [edi + edx + 1]
mov dword [ebp - 0x238], edi
cmp edi, 0x104
ja 0x4ad15a49
mov ebx, dword [ebp - 0x21c]
mov edi, dword [ebp - 0x220]
push ebx
push dword [ebp + 0x10]
push edi
call fcn.4ad017fb
cmp dword [ebp - 0x218], 0
je 0x4ad06f37
cmp dword [ebp - 0x218], 0
lea eax, [ebx + esi*2]
mov dword [ebp - 0x21c], eax
je 0x4ad036f0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
push edi
call fcn.4ad01a89
push dword [ebp - 0x228]
push dword [ebp + 0x10]
push edi
call fcn.4ad01a89
push edi
call fcn.4ad01b0c
push eax
push dword [ebp + 0x10]
push edi
call fcn.4ad017fb
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad03714
sub eax, edx
sar eax, 1
cmp word [edi + 2], 0x3a
mov esi, eax
jne 0x4ad0373c
movzx eax, word [edi]
push eax
call fcn.4ad03036
test eax, eax
je 0x4ad03618
push 0x2e
push dword [ebp - 0x228]
call fcn.4ad01b5c
test eax, eax
jne 0x4ad037e4
push 0x2a
push dword [ebp - 0x228]
call fcn.4ad01892
test eax, eax
jne 0x4ad04c94
push 0x3f
push dword [ebp - 0x228]
call fcn.4ad01892
test eax, eax
jne 0x4ad04c94
mov ebx, dword [ebp - 0x230]
push eax
push 0x4ad04b78
push esi
push dword [ebp + 0x10]
push edi
call fcn.4ad04b83
test eax, eax
jne 0x4ad04bfd
cmp dword [0x4ad24120], 0
je 0x4ad037b5
cmp dword [0x4ad24120], 2
jne 0x4ad03618
mov edi, dword [ebp - 0x220]
push 1
push 0x4ad03c18
push esi
push dword [ebp + 0x10]
push edi
call fcn.4ad04b83
test eax, eax
je 0x4ad03618
jmp 0x4ad15a6b
cmp word [eax + 2], 0
je 0x4ad03751
push 1
push dword [ebp + 0x10]
push edi
call fcn.4ad03169
test eax, eax
je 0x4ad04c4e
push 0x2e
push edi
call fcn.4ad01b5c
mov ebx, eax
test ebx, ebx
je 0x4ad04c63
mov esi, dword [sym.imp.msvcrt.dll__wcsicmp]
push str..CMD
push ebx
call esi
pop ecx
pop ecx
test eax, eax
je 0x4ad0706d
push str..BAT
push ebx
call esi
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
jmp 0x4ad03210
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad04bb2
mov ecx, dword [ebp - 0x238]
sub eax, edx
sar eax, 1
add ecx, eax
cmp ecx, 0x104
ja 0x4ad04bf3
push 1
push ebx
push esi
push dword [ebp + 0x10]
push edi
call fcn.4ad04b83
test eax, eax
jne 0x4ad031e4
mov eax, dword [0x4ad24120]
cmp eax, 2
jne 0x4ad10979
mov ax, word [ebx]
inc ebx
inc ebx
test ax, ax
jne 0x4ad04bf3
cmp word [ebx], 0
je 0x4ad03799
mov eax, ebx
lea edx, [eax + 2]
jmp 0x4ad04bb2
cmp dword [ebp - 0x224], eax
je 0x4ad04c63
cmp dword [0x4ad24120], 5
je 0x4ad03802
mov eax, dword [0x4ad24120]
cmp eax, 2
je 0x4ad03751
test eax, eax
jne 0x4ad03618
jmp 0x4ad15a60
cmp dword [ebp - 0x224], ecx
je 0x4ad04c94
mov eax, dword [0x4ad24120]
cmp eax, ecx
je 0x4ad04c94
cmp eax, 2
jne 0x4ad04c9e
mov dword [0x4ad24120], 0x2331
xor eax, eax
jmp 0x4ad03211
lea esi, [ebp - 0x214]
jmp 0x4ad033dd
push str.PATH
call fcn.4ad01931
mov dword [ebp - 0x21c], eax
jmp 0x4ad0350e
cmp dword [ebp - 0x21c], eax
je 0x4ad0359b
cmp dword [ebp - 0x218], eax
je 0x4ad06f01
push esi
push edi
push ebx
call fcn.4ad01a89
push dword [ebp - 0x21c]
push edi
push ebx
call fcn.4ad01a89
jmp 0x4ad0359b
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad06f16
sub eax, edx
sar eax, 1
add edi, eax
jmp 0x4ad0354a
and dword [ebp - 0x218], 0
jmp 0x4ad03681
inc esi
jmp 0x4ad036d1
push 2
pop eax
jmp 0x4ad03211
push 0x3a
lea eax, [ebp - 0x214]
push eax
call fcn.4ad01892
mov esi, eax
jmp 0x4ad033db
cmp byte [0x4ad24081], 0
je 0x4ad04c94
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4ad1095b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x15
pop ecx
cmp eax, ecx
jne 0x4ad04c94
jmp 0x4ad15a98
test al, 0x10
jne 0x4ad15a36
jmp 0x4ad04c94
xor edi, edi
jmp 0x4ad03539
mov ebx, str..COM_.EXE_.BAT_.CMD_.VBS_.JS_.WS_.MSC
jmp 0x4ad035ee
test eax, eax
je 0x4ad04bf3
jmp 0x4ad037a2
mov dword [0x4ad24120], 0x233f
xor eax, eax
jmp 0x4ad03212
push str.COMSPEC
call fcn.4ad01931
mov edi, eax
test edi, edi
jne 0x4ad03326
mov dword [0x4ad24120], 0x400023d2
jmp 0x4ad1599f
test dx, dx
je 0x4ad159e6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4ad03403
add eax, edi
add ecx, edi
test dx, dx
jne 0x4ad033f7
xor eax, eax
jmp 0x4ad03408
test dx, dx
je 0x4ad15a0d
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4ad03423
add eax, edi
add ecx, edi
test dx, dx
jne 0x4ad03417
xor eax, eax
jmp 0x4ad03428
cmp byte [0x4ad24081], 0
je 0x4ad04c94
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4ad1095b
jmp 0x4ad04c94
push 5
jmp 0x4ad0706f
mov dword [0x4ad24120], 8
jmp 0x4ad15a9e
cmp dword [ebp - 0x218], ecx
jne 0x4ad15a52
inc esi
lea eax, [eax + esi*2]
mov dword [ebp - 0x21c], eax
jmp 0x4ad03618
mov edi, dword [ebp - 0x220]
jmp 0x4ad03751
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
test eax, eax
je 0x4ad03618
cmp dword [ebp - 0x234], 4
je 0x4ad0320e
jmp 0x4ad03618
mov dword [0x4ad24120], ecx
push 3
jmp 0x4ad0706f