Function at 0x433bc0
Capabilities:
Access peb ldr_data
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4f9031
mov eax, dword fs:[0]
push eax
sub esp, 0x94
push ebx
push ebp
push esi
push edi
mov eax, dword [0x52e028]
xor eax, esp
push eax
lea eax, [esp + 0xa8]
mov dword fs:[0], eax
mov eax, dword [esp + 0xbc]
xor esi, esi
push eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x30], esi
call dword [0x4fff2c]
mov dword [esp + 0xb0], esi
lea ecx, [esp + 0x44]
push ecx
call fcn.004072d0
mov byte [esp + 0xb0], 1
lea ecx, [esp + 0x18]
call dword [0x4fff58]
mov byte [esp + 0xb0], 2
lea ecx, [esp + 0x28]
call dword [0x4fff58]
mov byte [esp + 0xb0], 3
mov esi, dword [esp + 0xb8]
mov ebx, dword [esi + 0xc]
cmp ebx, dword [esi + 0x10]
jbe 0x433c57
call dword [0x4ff3d0]
mov ebp, dword [esi]
mov dword [esp + 0x24], ebx
lea ecx, [ecx]
mov edi, dword [esi + 0x10]
cmp dword [esi + 0xc], edi
jbe 0x433c6e
call dword [0x4ff3d0]
mov eax, dword [esi]
test ebp, ebp
je 0x433c78
cmp ebp, eax
je 0x433c7e
call dword [0x4ff3d0]
cmp ebx, edi
je 0x433ef4
test ebp, ebp
jne 0x433d39
call dword [0x4ff3d0]
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x433ca1
call dword [0x4ff3d0]
push ebx
lea ecx, [esp + 0x1c]
call dword [0x4ffefc]
mov edx, dword [esp + 0x18]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push edx
call edi
push eax
lea ecx, [esp + 0x2c]
call dword [0x4fff04]
push 0x500ea8
lea ecx, [esp + 0x2c]
call dword [0x4ffb78]
test eax, eax
jne 0x433d41
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x3c]
push ecx
call fcn.00433f70
add esp, 8
mov byte [esp + 0xb0], 4
push eax
lea ecx, [esp + 0x1c]
call dword [0x4ffefc]
mov byte [esp + 0xb0], 3
lea ecx, [esp + 0x38]
call dword [0x4fff34]
mov edx, dword [esp + 0x18]
cmp dword [edx - 0xc], 0
jne 0x433d41
lea eax, [esp + 0x84]
push ebx
push ebp
push eax
mov ebx, esi
call fcn.00402cd0
mov ecx, dword [eax + 4]
mov ebp, dword [eax]
mov dword [esp + 0x24], ecx
mov ebx, ecx
jmp 0x433c60
mov eax, dword [ebp]
jmp 0x433c96
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.SHLWAPI.dll_PathIsNetworkPathW]
test eax, eax
je 0x433d59
lea eax, [esp + 0x8c]
jmp 0x433d1f
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x433d6e
lea eax, [esp + 0x74]
jmp 0x433d1f
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x433d86
lea eax, [esp + 0x94]
jmp 0x433d1f
lea ecx, [esp + 0x18]
call dword [0x4ffae0]
mov edx, dword [esp + 0x18]
push edx
call edi
push eax
lea ecx, [esp + 0x2c]
call dword [0x4fff04]
mov eax, dword [esp + 0x28]
cmp dword [eax - 0xc], 0
je 0x433df5
mov ecx, dword [esp + 0x30]
cmp dword [ecx - 0xc], 0
je 0x433dee
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x38]
push eax
mov edi, 0x501d9c
call fcn.00407070
add esp, 8
mov byte [esp + 0xb0], 5
mov eax, dword [eax]
or dword [esp + 0x2c], 1
push 0
push eax
lea ecx, [esp + 0x38]
call dword [0x4ffadc]
cmp eax, 0xffffffff
je 0x433df5
mov byte [esp + 0x1f], 0
jmp 0x433dfa
mov byte [esp + 0x1f], 1
mov dword [esp + 0xb0], 3
test byte [esp + 0x2c], 1
je 0x433e1b
and dword [esp + 0x2c], 0xfffffffe
lea ecx, [esp + 0x34]
call dword [0x4fff34]
cmp byte [esp + 0x1f], 0
je 0x433e40
push ebx
push ebp
lea ecx, [esp + 0x6c]
push ecx
mov ebx, esi
call fcn.00402cd0
mov edx, dword [eax + 4]
mov ebp, dword [eax]
mov dword [esp + 0x24], edx
mov ebx, edx
jmp 0x433c60
mov eax, dword [esp + 0x5c]
mov edi, dword [esp + 0x44]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x70]
push edx
lea esi, [esp + 0x4c]
mov dword [esp + 0x48], eax
call fcn.00407470
mov esi, eax
mov eax, dword [esi]
test eax, eax
je 0x433e6b
cmp eax, edi
je 0x433e75
mov edi, dword [0x4ff3d0]
call edi
jmp 0x433e7b
mov edi, dword [0x4ff3d0]
mov eax, dword [esp + 0x40]
cmp dword [esi + 4], eax
je 0x433eb1
push ebx
mov ebx, dword [esp + 0xbc]
push ebp
lea ecx, [esp + 0x84]
push ecx
call fcn.00402cd0
mov edx, dword [eax + 4]
mov ebp, dword [eax]
mov esi, dword [esp + 0xb8]
mov dword [esp + 0x24], edx
mov ebx, edx
jmp 0x433c60
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0xa0]
push ecx
lea ebx, [esp + 0x4c]
call fcn.00407380
test ebp, ebp
jne 0x433eef
call edi
xor eax, eax
mov edx, dword [esp + 0x24]
cmp edx, dword [eax + 0x10]
jb 0x433eda
call edi
add dword [esp + 0x24], 4
mov ebx, dword [esp + 0x24]
mov esi, dword [esp + 0xb8]
jmp 0x433c60
mov eax, dword [ebp]
jmp 0x433ecf
mov edi, dword [esi + 0x10]
sub edi, dword [esi + 0xc]
sar edi, 2
mov byte [esp + 0xb0], 2
lea ecx, [esp + 0x28]
call dword [0x4fff34]
mov byte [esp + 0xb0], 1
lea ecx, [esp + 0x18]
call dword [0x4fff34]
mov byte [esp + 0xb0], 0
lea eax, [esp + 0x44]
push eax
call fcn.00407320
mov dword [esp + 0xb0], 0xffffffff
lea ecx, [esp + 0x30]
call dword [0x4fff34]
mov eax, edi
mov ecx, dword [esp + 0xa8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret