Function at 0x4014c5
Capabilities:
Acquire debug privileges
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x29c
mov eax, dword [0x4290a0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x290], 0
push ebx
push esi
mov ebx, 0x42a450
push edi
mov ecx, ebx
call fcn.004028f3
test eax, eax
je 0x401609
mov eax, dword [0x42ae5c]
cmp eax, 6
je 0x40153d
cmp eax, 7
je 0x40153d
mov dword [0x42a440], eax
xor eax, eax
movzx ecx, word [eax + 0x42ae64]
mov word [eax + 0x44c0f8], cx
inc eax
inc eax
test cx, cx
jne 0x40150c
xor eax, eax
movzx ecx, word [eax + 0x42aee8]
mov word [eax + 0x44c178], cx
inc eax
inc eax
test cx, cx
jne 0x401523
jmp 0x4017c6
mov esi, 0x424a9c
lea edi, [ebp - 0x288]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x72
lea eax, [ebp - 0x27a]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.004100c0
mov esi, 0x424aac
lea edi, [ebp - 0x208]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0xc
movsd dword es:[edi], dword [esi]
push 0x72
lea eax, [ebp - 0x1fa]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.004100c0
mov esi, 0x424abc
lea edi, [ebp - 0x188]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0xc
movsd dword es:[edi], dword [esi]
push 0x72
lea eax, [ebp - 0x17a]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.004100c0
mov esi, 0x424acc
lea edi, [ebp - 0x108]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0xc
movsd dword es:[edi], dword [esi]
push 0x70
lea eax, [ebp - 0xf8]
push 0
push eax
movsd dword es:[edi], dword [esi]
call fcn.004100c0
mov esi, 0x424adc
lea edi, [ebp - 0x88]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0xc
movsw word es:[edi], word [esi]
push 0x6e
xor edi, edi
lea eax, [ebp - 0x76]
push edi
push eax
call fcn.004100c0
add esp, 0xc
lea esi, [ebp - 0x288]
push esi
mov ecx, ebx
call fcn.00402a02
test eax, eax
jne 0x40177e
inc edi
sub esi, 0xffffff80
cmp edi, 5
jl 0x4015f0
or dword [0x42a440], 0xffffffff
and dword [0x44c288], 0
cmp dword [0x44c0f0], 3
jne 0x4017dc
cmp dword [0x42a440], 5
ja 0x4017d5
xor ebx, ebx
cmp dword [0x44c288], ebx
jne 0x4017dc
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
mov dword [ebp - 0x294], ebx
call fcn.004100c0
add esp, 0xc
lea edi, [ebp - 0x210]
call fcn.0040251a
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
cmp ax, bx
jne 0x401670
push 6
pop ecx
lea eax, [ebp - 0x210]
mov esi, str.HGDraw.dll
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4016d4
lea eax, [ebp - 0x294]
push eax
call fcn.00402574
mov ebx, eax
pop ecx
test ebx, ebx
je 0x4017dc
mov eax, dword [ebp - 0x294]
cmp eax, 0xa
jl 0x4017dc
lea ecx, [ebp - 0x210]
push ecx
push ebx
call fcn.00403cd3
pop ecx
pop ecx
test eax, eax
jne 0x4017dc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x210]
push eax
call section..text
test eax, eax
je 0x4017dc
xor edi, edi
cmp ebx, edi
je 0x4016fc
push ebx
call fcn.0040e3ed
pop ecx
lea eax, [ebp - 0x28c]
push eax
push 0x28
mov dword [ebp - 0x28c], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x401746
mov esi, dword [ebp - 0x28c]
lea eax, [ebp - 0x298]
push eax
push str.SeDebugPrivilege
push edi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x401746
push esi
lea esi, [ebp - 0x298]
call fcn.00402d81
pop ecx
cmp dword [ebp - 0x28c], edi
je 0x40175a
push dword [ebp - 0x28c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x210]
push eax
push dword [0x42ae60]
call fcn.00402c4d
pop ecx
pop ecx
test eax, eax
jne 0x4017dc
mov eax, dword [0x42ae60]
mov dword [0x44c288], eax
jmp 0x4017dc
mov eax, edi
shl eax, 7
lea eax, [ebp + eax - 0x288]
mov edx, 0x44c178
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x401791
mov dword [0x42a440], 6
xor eax, eax
movzx ecx, word [eax + 0x42ae64]
mov word [eax + 0x44c0f8], cx
inc eax
inc eax
test cx, cx
jne 0x4017ab
mov dword [0x42a444], edi
mov dword [ebp - 0x290], 1
jmp 0x401617
and dword [0x44c288], 0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x290]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e3f8
leave
ret