Function at 0x4352f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push r14
push r13
push rdi
push rsi
push rbx
sub rsp, 0x2b8
mov rbp, rsp
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x80], 0
nop
xor rdi, rdi
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax + 0x18]
call fcn.00440d60
mov rbx, rax
mov rcx, rbx
call fcn.00426d10
mov dword [rbp + 0x40], eax
mov eax, dword [rbp + 0x40]
cmp eax, 0x104
jl 0x435392
mov rax, qword [0x0044d4a8]
mov dword [rax], 0x233f
xor rax, rax
mov dword [rbp + 0x44], eax
jmp 0x435bac
mov rax, qword [0x0044d168]
cmp byte [rax], 0
je 0x4353c7
mov rcx, rbx
lea rdx, [0x00435bf8]
mov r8d, 4
call fcn.0041cf40
test eax, eax
jne 0x4353c7
lea rcx, [0x00435c02]
call fcn.004291e0
mov rbx, rax
lea rcx, [rbp + 0x9a]
xor rdx, rdx
mov r8d, 0x104
call fcn.00426ef0
lea rcx, [rbp + 0x9a]
mov rdx, rbx
call fcn.00426d30
lea rcx, [rbp + 0x9a]
mov dx, 0x2f
call fcn.0042c070
mov word [rbp + 0x2aa], 0x5c
mov word [rbp + 0x2ac], 0x3a
mov word [rbp + 0x2ae], 0
lea rcx, [rbp + 0x9a]
lea rdx, [rbp + 0x2aa]
call fcn.00426d70
mov ecx, dword [rbp + 0x40]
cmp eax, ecx
setl al
mov byte [rbp + 0x37], al
mov word [rbp + 0x2ac], 0
movzx rax, byte [rbp + 0x37]
test al, al
je 0x435478
lea rcx, [rbp + 0x9a]
mov dx, 0x5c
call fcn.00426ca0
mov rbx, rax
test rbx, rbx
jne 0x435472
lea rcx, [rbp + 0x9a]
mov dx, 0x3a
call fcn.00426c70
mov rbx, rax
add rbx, 2
jmp 0x43547f
lea rbx, [rbp + 0x9a]
test rbx, rbx
je 0x4354aa
mov rcx, rbx
lea rdx, [0x00435c12]
call fcn.0041ce20
test eax, eax
je 0x4354aa
mov rcx, rbx
lea rdx, [0x00435c16]
call fcn.0041ce20
test eax, eax
jne 0x4354f2
mov rax, qword [0x0044d168]
cmp byte [rax], 0
je 0x4354da
mov rcx, qword [rbp + 0x28]
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4354da
test eax, 0x10
je 0x4354da
mov eax, 5
mov dword [rbp + 0x44], eax
jmp 0x435bac
mov rax, qword [0x0044d4a8]
mov dword [rax], 0x2331
xor rax, rax
mov dword [rbp + 0x44], eax
jmp 0x435bac
mov ecx, 0x410
call fcn.0043ea20
mov rsi, rax
test rsi, rsi
jne 0x435520
mov rax, qword [0x0044d4a8]
mov dword [rax], 8
mov eax, 3
mov dword [rbp + 0x44], eax
jmp 0x435bac
mov rcx, qword [rbp + 0x28]
lea rdx, [rbp + 0x9a]
call fcn.00426d30
lea rcx, [rbp + 0x9a]
call fcn.00426d10
mov r13d, eax
mov rcx, rbx
call fcn.0040a4f0
movsxd r13, r13d
mov eax, eax
neg rax
lea rax, [r13 + rax]
mov rcx, qword [rbp + 0x28]
mov word [rcx + rax*2], 0
lea rdx, [0x00435c12]
call fcn.00426d50
mov rcx, rsi
mov rdx, qword [rbp + 0x28]
mov r8d, 0x208
call fcn.0042b5c0
test eax, eax
je 0x4355c9
mov rax, qword [0x0044d168]
cmp byte [rax], 0
je 0x4355b1
mov rcx, qword [rbp + 0x28]
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4355b1
test eax, 0x10
je 0x4355b1
mov eax, 5
mov dword [rbp + 0x44], eax
jmp 0x435bac
mov rax, qword [0x0044d4a8]
mov dword [rax], 0x2331
xor rax, rax
mov dword [rbp + 0x44], eax
jmp 0x435bac
mov rcx, rsi
call fcn.00426f10
cmp word [rax], 0x5c
je 0x4355e6
mov rcx, rsi
lea rdx, [0x00435c1c]
call fcn.00426d50
mov rcx, rsi
mov rdx, rbx
call fcn.00426d50
mov rcx, rsi
call fcn.00426d10
mov rcx, rsi
mov edx, eax
add edx, 1
add edx, edx
call fcn.0043ec40
mov rsi, rax
mov rcx, rsi
mov dx, 0x5c
call fcn.00426ca0
mov qword [rbp + 0x38], rax
mov word [rax], 0
add rax, 2
mov qword [rbp + 0x38], rax
movzx rax, byte [rbp + 0x37]
test al, al
jne 0x435640
lea rcx, [0x00435c20]
call fcn.004291e0
mov rdi, rax
mov rcx, rsi
call fcn.00426d10
mov ebx, eax
mov rcx, rdi
call fcn.00426d10
mov ecx, ebx
add ecx, eax
add ecx, 4
add ecx, ecx
call fcn.0043ea20
mov rbx, rax
test rbx, rbx
jne 0x435683
mov rax, qword [0x0044d4a8]
mov dword [rax], 8
mov eax, 3
mov dword [rbp + 0x44], eax
jmp 0x435bac
mov rcx, rbx
lea rdx, [0x00435c2a]
call fcn.00426d50
mov rcx, rbx
mov rdx, rsi
call fcn.00426d50
mov rcx, rbx
lea rdx, [0x00435c2a]
call fcn.00426d50
movzx rax, byte [rbp + 0x37]
test al, al
jne 0x4356cf
mov rcx, rbx
lea rdx, [0x00435c2e]
call fcn.00426d50
mov rcx, rbx
mov rdx, rdi
call fcn.00426d50
mov rcx, rbx
call fcn.00436b30
mov rcx, rbx
lea rdx, [0x00435c2e]
mov r8d, 1
call fcn.0043edb0
mov rbx, rax
mov rcx, qword [rbp + 0x38]
call fcn.00426d10
add eax, 1
mov dword [rbp + 0x40], eax
mov rax, qword [0x0044d168]
cmp byte [rax], 0
je 0x43571c
lea rcx, [0x00435c32]
call fcn.004291e0
mov rsi, rax
jmp 0x435723
lea rsi, [0x00435c42]
mov rcx, rsi
call fcn.00436b30
mov rcx, rsi
lea rdx, [0x00435c2e]
mov r8d, 1
call fcn.0043edb0
mov rsi, rax
mov rcx, rbx
call fcn.00426d10
mov edi, eax
mov rcx, rbx
call fcn.00440d60
mov rcx, rbx
mov rdx, rax
call fcn.00426d30
mov rcx, rbx
call fcn.00426d10
mov r13d, eax
mov rcx, rbx
call fcn.00426f10
cmp word [rax], 0x5c
je 0x435786
mov r14b, 1
add edi, 1
add r13d, 1
jmp 0x435789
xor r14, r14
cmp word [rbx], 0
je 0x4357bf
mov eax, r13d
mov ecx, dword [rbp + 0x40]
movsxd rcx, ecx
lea rax, [rax + rcx]
cmp rax, 0x104
jle 0x4357bf
test r14b, r14b
je 0x4357b5
movsxd rdi, edi
add rdi, rdi
add rbx, rdi
jmp 0x435744
movsxd rdi, edi
lea rbx, [rbx + rdi*2 + 2]
jmp 0x435744
cmp word [rbx], 0
jne 0x43580d
movzx rax, byte [rbp + 0x37]
test al, al
je 0x4357f5
mov rax, qword [0x0044d4a8]
cmp dword [rax], 0
je 0x4357e6
mov rax, qword [0x0044d4a8]
cmp dword [rax], 2
jne 0x435802
mov rax, qword [0x0044d4a8]
mov dword [rax], 0x2331
jmp 0x435802
mov rax, qword [0x0044d4a8]
mov dword [rax], 0x2331
xor rax, rax
mov dword [rbp + 0x44], eax
jmp 0x435bac
mov rcx, qword [rbp + 0x28]
mov rdx, rbx
call fcn.00426d30
test r14b, r14b
je 0x435829
movsxd rdi, edi
add rdi, rdi
add rbx, rdi
jmp 0x435831
movsxd rdi, edi
lea rbx, [rbx + rdi*2 + 2]
test r14b, r14b
je 0x435846
mov rcx, qword [rbp + 0x28]
lea rdx, [rbp + 0x2aa]
call fcn.00426d50
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x38]
call fcn.00426d50
mov rcx, qword [rbp + 0x28]
call fcn.00440d60
mov rcx, qword [rbp + 0x28]
mov rdx, rax
call fcn.00426d30
mov rcx, qword [rbp + 0x28]
call fcn.00426d10
mov r14d, eax
mov rax, qword [rbp + 0x28]
cmp word [rax + 2], 0x3a
jne 0x435894
mov rax, qword [rbp + 0x28]
movzx rcx, word [rax]
call fcn.00440c10
test al, al
je 0x435744
mov rcx, qword [rbp + 0x38]
mov dx, 0x2e
call fcn.00426ca0
mov rdi, rax
test rdi, rdi
je 0x4359be
cmp word [rdi + 2], 0
je 0x4359be
mov rcx, qword [rbp + 0x28]
mov dl, 1
call fcn.0042bf80
test al, al
jne 0x4358e4
movzx rax, byte [rbp + 0x37]
test al, al
je 0x4359a2
mov rax, qword [0x0044d4a8]
cmp dword [rax], 5
jne 0x4359a2
lea rcx, [rbp + 0x80]
mov rdx, qword [rbp + 0x28]
call fcn.0040ab70
lea rcx, [rbp + 0x88]
mov rdx, qword [rbp + 0x80]
call fcn.0041cbf0
mov rcx, qword [rbp + 0x88]
call fcn.0040aaf0
mov rbx, rax
lea rcx, [rbp + 0x70]
call fcn.00426b70
lea rcx, [rbp + 0x78]
mov rdx, qword [rbp + 0x70]
call fcn.0041cbf0
mov rcx, qword [rbp + 0x78]
call fcn.0040aaf0
mov rcx, rbx
mov rdx, rax
call fcn.0041ce50
test eax, eax
jne 0x435952
mov eax, 2
mov dword [rbp + 0x44], eax
jmp 0x435bac
mov rcx, rdi
lea rdx, [0x00435c6a]
call fcn.0041ce50
test eax, eax
jne 0x435973
mov eax, 2
mov dword [rbp + 0x44], eax
jmp 0x435bac
mov rcx, rdi
lea rdx, [0x00435c74]
call fcn.0041ce50
test eax, eax
jne 0x435994
mov eax, 2
mov dword [rbp + 0x44], eax
jmp 0x435bac
mov eax, 1
mov dword [rbp + 0x44], eax
jmp 0x435bac
mov rax, qword [0x0044d4a8]
cmp dword [rax], 2
je 0x4359be
mov rax, qword [0x0044d4a8]
cmp dword [rax], 0
jne 0x435744
mov rcx, qword [rbp + 0x38]
mov dx, 0x2a
call fcn.00426c70
test rax, rax
jne 0x4359e2
mov rcx, qword [rbp + 0x38]
mov dx, 0x3f
call fcn.00426c70
test rax, rax
je 0x4359fa
mov rax, qword [0x0044d4a8]
mov dword [rax], 0x2331
xor rax, rax
mov dword [rbp + 0x44], eax
jmp 0x435bac
mov rdi, rsi
mov rcx, qword [rbp + 0x28]
mov edx, r14d
lea r8, [0x00435c7e]
xor r9, r9
call fcn.00435c90
test eax, eax
je 0x435b3a
jmp 0x435b2f
mov rcx, rdi
call fcn.00426d10
mov ecx, dword [rbp + 0x40]
movsxd rcx, ecx
mov edx, r13d
lea rcx, [rcx + rdx]
movsxd rax, eax
lea rax, [rcx + rax]
cmp rax, 0x104
jg 0x435b25
mov rcx, qword [rbp + 0x28]
mov edx, r14d
mov r8, rdi
mov r9b, 1
call fcn.00435c90
test eax, eax
je 0x435b07
mov rcx, rdi
lea rdx, [0x00435c74]
call fcn.0041ce50
test eax, eax
je 0x435a89
mov rcx, rdi
lea rdx, [0x00435c6a]
call fcn.0041ce50
test eax, eax
jne 0x435a97
mov eax, 2
mov dword [rbp + 0x44], eax
jmp 0x435bac
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x28]
call fcn.0040ab70
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
call fcn.0041cbf0
mov rcx, qword [rbp + 0x68]
call fcn.0040aaf0
mov rbx, rax
lea rcx, [rbp + 0x50]
call fcn.00426b70
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x50]
call fcn.0041cbf0
mov rcx, qword [rbp + 0x58]
call fcn.0040aaf0
mov rcx, rbx
mov rdx, rax
call fcn.0041ce50
test eax, eax
jne 0x435af9
mov eax, 2
mov dword [rbp + 0x44], eax
jmp 0x435bac
mov eax, 1
mov dword [rbp + 0x44], eax
jmp 0x435bac
mov rax, qword [0x0044d4a8]
cmp dword [rax], 2
je 0x435b25
mov rax, qword [0x0044d4a8]
cmp dword [rax], 0
jne 0x435b39
jmp 0x435b25
add rdi, 2
cmp word [rdi], 0
jne 0x435b21
add rdi, 2
cmp word [rdi], 0
jne 0x435a20
nop
mov rax, qword [0x0044d4a8]
cmp dword [rax], 0
je 0x435b56
mov rax, qword [0x0044d4a8]
cmp dword [rax], 2
jne 0x435744
mov rcx, qword [rbp + 0x28]
mov edx, r14d
xor r8, r8
mov r9b, 1
call fcn.00435c90
test eax, eax
je 0x435744
mov rcx, qword [rbp + 0x28]
lea rdx, [rbp + 0x2a4]
call sub.kernel32.dll_GetBinaryTypeW
test eax, eax
je 0x435744
cmp dword [rbp + 0x2a4], 4
jne 0x435744
mov eax, 1
mov dword [rbp + 0x44], eax
jmp 0x435bac
lea rcx, [rbp + 0x50]
mov edx, 8
call fcn.00409f10
mov eax, dword [rbp + 0x44]
lea rsp, [rbp + 0x2b8]
pop rbx
pop rsi
pop rdi
pop r13
pop r14
pop rbp
ret