Function at 0x4ad037a6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp word [eax + 2], 0
je 0x4ad03c54
push 1
push dword [ebp + 0x10]
push edi
call fcn.4ad036b1
test eax, eax
jne 0x4ad0359a
cmp dword [ebp - 0x224], eax
jne 0x4ad03591
mov eax, dword [0x4ad240e0]
cmp eax, 2
je 0x4ad03c54
test eax, eax
jne 0x4ad03b1b
jmp 0x4ad15340
cmp dword [0x4ad240e0], 5
jne 0x4ad03576
push 0x2e
push edi
call fcn.4ad01a11
mov ebx, eax
test ebx, ebx
je 0x4ad03576
mov esi, dword [sym.imp.msvcrt.dll__wcsicmp]
push str..CMD
push ebx
call esi
test eax, eax
pop ecx
pop ecx
je 0x4ad04cbb
push str..BAT
push ebx
call esi
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
jmp 0x4ad040b4
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x4ad2406c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
and dword [ebp - 0x21c], 0
push ebx
push edi
push dword [eax + 0x38]
mov dword [ebp - 0x220], ecx
call fcn.4ad0156d
mov ebx, eax
test ebx, ebx
mov edi, 0x104
je 0x4ad03802
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad037e6
sub eax, edx
sar eax, 1
cmp eax, edi
mov dword [ebp - 0x224], eax
jae 0x4ad15271
cmp byte [0x4ad24041], 0
je 0x4ad0382c
test ebx, ebx
je 0x4ad15282
push 4
push 0x4ad03cd8
push ebx
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x4ad15282
push esi
mov esi, 0x208
push esi
lea eax, [ebp - 0x214]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
push edi
lea eax, [ebp - 0x214]
push eax
call fcn.4ad01416
lea eax, [ebp - 0x214]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x4ad0385b
sub eax, ecx
movzx ecx, word [0x4ad405f0]
sar eax, 1
push ecx
inc eax
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.4ad03731
mov ax, word [0x4ad40604]
mov word [ebp - 0xc], ax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x214]
xor ebx, ebx
push eax
mov word [ebp - 0xa], 0x3a
mov word [ebp - 8], bx
call fcn.4ad023fa
cmp eax, dword [ebp - 0x224]
mov word [ebp - 0xa], bx
sbb eax, eax
neg eax
mov dword [ebp - 0x224], eax
je 0x4ad051cb
movzx eax, word [0x4ad40604]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.4ad01a11
mov edi, eax
cmp edi, ebx
je 0x4ad152a2
inc edi
inc edi
cmp word [edi], bx
mov dword [ebp - 0x218], edi
je 0x4ad118ec
push 4
mov ecx, 0x4ad01c20
mov eax, edi
pop ebx
mov dx, word [eax]
cmp dx, word [ecx]
je 0x4ad152b7
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4ad118ec
mov ecx, 0x4ad01c18
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
je 0x4ad152de
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4ad118ec
push 0x410
call fcn.4ad01e3d
mov edi, eax
test edi, edi
je 0x4ad1532e
mov ebx, dword [ebp - 0x220]
lea eax, [ebp - 0x214]
push eax
push dword [ebp + 0x10]
push ebx
call fcn.4ad01416
mov eax, dword [ebp - 0x218]
push 0x4ad01c20
push dword [ebp + 0x10]
lea ecx, [ebp - 0x214]
sub eax, ecx
sar eax, 1
and word [ebx + eax*2], 0
push ebx
call fcn.4ad014d2
push ebx
push esi
push edi
call fcn.4ad01a75
test eax, eax
jne 0x4ad15305
push edi
call fcn.4ad01a37
mov ax, word [eax]
cmp ax, word [0x4ad40604]
je 0x4ad039ac
push 0x4ad01c24
push esi
push edi
call fcn.4ad014d2
push dword [ebp - 0x218]
push esi
push edi
call fcn.4ad014d2
mov eax, edi
push 2
lea ecx, [eax + 2]
pop esi
mov dx, word [eax]
add eax, esi
test dx, dx
jne 0x4ad039c1
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push edi
call fcn.4ad020f1
mov edi, eax
test edi, edi
mov dword [ebp - 0x22c], edi
je 0x4ad1532e
movzx eax, word [0x4ad40604]
push eax
push edi
call fcn.4ad01a11
and word [eax], 0
add eax, esi
cmp dword [ebp - 0x224], 0
mov dword [ebp - 0x228], eax
je 0x4ad051d6
push ebx
call dword [sym.imp.KERNEL32.dll_NeedCurrentDirectoryForExePathW]
test eax, eax
mov dword [ebp - 0x218], eax
je 0x4ad11995
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, esi
test cx, cx
jne 0x4ad03a2b
sub eax, edx
sar eax, 1
lea edi, [eax + 2]
mov eax, dword [ebp - 0x21c]
add edi, 2
test eax, eax
jne 0x4ad05219
lea eax, [edi + edi]
push eax
call fcn.4ad01e3d
mov ebx, eax
test ebx, ebx
je 0x4ad1532e
cmp dword [ebp - 0x218], 0
je 0x4ad03a8b
mov esi, 0x4ad036a8
push esi
push edi
push ebx
call fcn.4ad014d2
push dword [ebp - 0x22c]
push edi
push ebx
call fcn.4ad014d2
push esi
push edi
push ebx
call fcn.4ad014d2
xor eax, eax
cmp dword [ebp - 0x224], eax
mov esi, 0x4ad03ce4
je 0x4ad051eb
push edi
push ebx
call fcn.4ad0375d
push 1
push esi
push ebx
call fcn.4ad01f27
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x228]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x4ad03abd
sub eax, ecx
sar eax, 1
cmp byte [0x4ad24041], dl
mov dword [ebp - 0x22c], eax
je 0x4ad1199c
push str.PATHEXT
call fcn.4ad02163
mov ebx, eax
test ebx, ebx
je 0x4ad1199c
lea eax, [ebx + 2]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad03af7
sub eax, edx
sar eax, 1
push eax
push ebx
call fcn.4ad0375d
push 1
push esi
push ebx
call fcn.4ad01f27
mov dword [ebp - 0x230], eax
mov edi, dword [ebp - 0x21c]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad03b26
sub eax, edx
sar eax, 1
mov esi, eax
push edi
lea ebx, [esi + 1]
call fcn.4ad0156d
push eax
push ebx
push edi
call fcn.4ad01416
mov eax, edi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x4ad03b4c
push dword [ebp - 0x21c]
sub eax, ecx
sar eax, 1
mov edi, eax
call fcn.4ad01a37
mov ax, word [eax]
cmp ax, word [0x4ad40604]
je 0x4ad05231
mov dword [ebp - 0x218], 1
mov esi, ebx
inc edi
mov eax, dword [ebp - 0x21c]
xor ecx, ecx
cmp word [eax], cx
je 0x4ad03ce8
mov edx, dword [ebp - 0x22c]
lea edi, [edi + edx + 1]
cmp edi, 0x104
mov dword [ebp - 0x238], edi
ja 0x4ad1196e
mov ebx, dword [ebp - 0x21c]
mov edi, dword [ebp - 0x220]
push ebx
push dword [ebp + 0x10]
push edi
call fcn.4ad01416
cmp dword [ebp - 0x218], 0
je 0x4ad0523d
cmp dword [ebp - 0x218], 0
lea eax, [ebx + esi*2]
mov dword [ebp - 0x21c], eax
je 0x4ad03bf3
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
push edi
call fcn.4ad014d2
push dword [ebp - 0x228]
push dword [ebp + 0x10]
push edi
call fcn.4ad014d2
push edi
call fcn.4ad0156d
push eax
push dword [ebp + 0x10]
push edi
call fcn.4ad01416
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad03c17
sub eax, edx
sar eax, 1
cmp word [edi + 2], 0x3a
mov esi, eax
jne 0x4ad03c3f
movzx eax, word [edi]
push eax
call fcn.4ad01d0c
test eax, eax
je 0x4ad03b1b
push 0x2e
push dword [ebp - 0x228]
call fcn.4ad01a11
test eax, eax
jne 0x4ad03554
push 0x2a
push dword [ebp - 0x228]
call fcn.4ad014ac
test eax, eax
jne 0x4ad1045c
push 0x3f
push dword [ebp - 0x228]
call fcn.4ad014ac
test eax, eax
jne 0x4ad1045c
mov ebx, dword [ebp - 0x230]
push eax
push 0x4ad03d20
push esi
push dword [ebp + 0x10]
push edi
call fcn.4ad03d2b
test eax, eax
jne 0x4ad03da0
cmp dword [0x4ad240e0], 0
je 0x4ad03cb8
cmp dword [0x4ad240e0], 2
jne 0x4ad03b1b
mov edi, dword [ebp - 0x220]
push 1
push 0x4ad04048
push esi
push dword [ebp + 0x10]
push edi
call fcn.4ad03d2b
test eax, eax
je 0x4ad03b1b
jmp 0x4ad1534b
cmp dword [ebp - 0x224], ecx
je 0x4ad1045c
mov eax, dword [0x4ad240e0]
cmp eax, ecx
je 0x4ad1045c
cmp eax, 2
je 0x4ad1045c
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.4ad013fa
leave
ret 0xc
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad03d59
mov ecx, dword [ebp - 0x238]
sub eax, edx
sar eax, 1
add ecx, eax
cmp ecx, 0x104
ja 0x4ad03d96
push 1
push ebx
push esi
push dword [ebp + 0x10]
push edi
call fcn.4ad03d2b
test eax, eax
jne 0x4ad03db1
mov eax, dword [0x4ad240e0]
cmp eax, 2
jne 0x4ad119a6
mov ax, word [ebx]
inc ebx
inc ebx
test ax, ax
jne 0x4ad03d96
cmp word [ebx], 0
je 0x4ad03c9c
mov eax, ebx
lea edx, [eax + 2]
jmp 0x4ad03d59
mov esi, dword [sym.imp.msvcrt.dll__wcsicmp]
push str..BAT
push ebx
call esi
test eax, eax
pop ecx
pop ecx
je 0x4ad04cbb
push str..CMD
push ebx
call esi
test eax, eax
pop ecx
pop ecx
je 0x4ad04cbb
xor eax, eax
jmp 0x4ad040b4
inc eax
jmp 0x4ad03d0c
push 2
pop eax
jmp 0x4ad03d0c
lea edi, [ebp - 0x214]
jmp 0x4ad038df
push str.PATH
call fcn.4ad02163
mov dword [ebp - 0x21c], eax
jmp 0x4ad03a11
cmp dword [ebp - 0x21c], eax
je 0x4ad03a9e
cmp dword [ebp - 0x218], eax
je 0x4ad05207
push esi
push edi
push ebx
call fcn.4ad014d2
push dword [ebp - 0x21c]
push edi
push ebx
call fcn.4ad014d2
jmp 0x4ad03a9e
lea edx, [eax + 2]
mov cx, word [eax]
add eax, esi
test cx, cx
jne 0x4ad0521c
sub eax, edx
sar eax, 1
add edi, eax
jmp 0x4ad03a4d
and dword [ebp - 0x218], 0
jmp 0x4ad03b84
inc esi
jmp 0x4ad03bd4
mov dword [0x4ad240e0], 0x2331
jmp 0x4ad03d0a
cmp byte [0x4ad24041], 0
je 0x4ad1045c
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4ad11988
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x15
pop ecx
cmp eax, ecx
jne 0x4ad1045c
jmp 0x4ad15378
cmp dword [ebp - 0x218], ecx
je 0x4ad1533a
lea eax, [eax + esi*2]
mov dword [ebp - 0x21c], eax
jmp 0x4ad03b1b
test al, 0x10
jne 0x4ad15327
jmp 0x4ad1045c
xor edi, edi
jmp 0x4ad03a3c
mov ebx, str..COM_.EXE_.BAT_.CMD_.VBS_.JS_.WS_.MSC
jmp 0x4ad03af1
test eax, eax
je 0x4ad03d96
jmp 0x4ad03ca5
mov dword [0x4ad240e0], 0x233f
xor eax, eax
jmp 0x4ad03d0d
push str.COMSPEC
call fcn.4ad02163
mov ebx, eax
test ebx, ebx
jne 0x4ad0382c
mov dword [0x4ad240e0], 0x400023d2
jmp 0x4ad1527b
push 0x3a
lea eax, [ebp - 0x214]
push eax
call fcn.4ad014ac
mov edi, eax
jmp 0x4ad038dd
test dx, dx
je 0x4ad152d7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4ad03904
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x4ad038f8
xor eax, eax
jmp 0x4ad03909
test dx, dx
je 0x4ad152fe
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4ad03924
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x4ad03918
xor eax, eax
jmp 0x4ad03929
cmp byte [0x4ad24041], 0
je 0x4ad1045c
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4ad11988
jmp 0x4ad1045c
push 5
jmp 0x4ad04cbd
mov dword [0x4ad240e0], 8
jmp 0x4ad1537e
inc esi
jmp 0x4ad1197a
mov edi, dword [ebp - 0x220]
jmp 0x4ad03c54
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
test eax, eax
je 0x4ad03b1b
cmp dword [ebp - 0x234], 4
je 0x4ad03ddb
jmp 0x4ad03b1b
mov dword [0x4ad240e0], ecx
push 3
jmp 0x4ad04cbd