Function at 0x409970
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x238
mov eax, dword [0x56c3c0]
xor eax, esp
mov dword [esp + 0x234], eax
mov eax, dword [esp + 0x240]
push ebx
push ebp
mov ebp, dword [esp + 0x244]
push esi
push edi
mov edi, ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], eax
call fcn.00402360
test eax, eax
jne 0x4099c1
call fcn.0040e710
call fcn.00402360
test eax, eax
jne 0x4099c1
mov eax, 0xc0000603
jmp 0x409e4f
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edi
call esi
cmp eax, 0xffffffff
je 0x4099d9
push edi
call esi
test eax, 0x10000
je 0x4099ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x4099ee
mov eax, 0xc0000202
jmp 0x409e4f
mov ecx, edi
call fcn.00409790
test eax, eax
jne 0x409e4d
mov ecx, edi
call fcn.00404ff0
push edi
mov dword [esp + 0x3c], eax
call esi
test al, 1
je 0x409a1b
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push 0x20000080
push 3
push 0
push 3
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x409a90
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1ff
lea ecx, [esp + 0x45]
push 0
push ecx
mov byte [esp + 0x4c], 0
call fcn.004d5720
lea edx, [esp + 0x40]
add esp, 0xc
push edx
lea ebx, [esp + 0x44]
mov edx, ebp
mov ecx, edi
call fcn.00408170
mov esi, eax
add esp, 4
test esi, esi
jne 0x409e3b
call fcn.00409740
mov dword [esp + 0x3c], eax
cmp eax, 0xffffffff
jne 0x409a9a
mov esi, 0xc0000204
jmp 0x409e3b
mov esi, 0xc0000302
jmp 0x409e3b
push str.IsWow64Process
push 0x53f174
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x409acd
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
cmp dword [esp + 0x10], 0
je 0x409b99
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
jmp 0x409ae3
jmp 0x409ae7
lea ebx, [ecx + 0x796f]
xor ebx, 0x501
or ebx, 0x781a
add ebx, 0x12
jmp 0x409aff
lea edx, [ebx - 0xc]
and edx, 0x14
or edx, 0x199d6a
mov eax, 0x110
sub eax, edx
mov dword [esp + 0x10], eax
jmp 0x409b19
mov edx, ecx
and edx, 0x3844
xor edx, eax
or edx, 0x41ab
mov edi, 0x796f
sub edi, edx
jmp 0x409b34
jmp 0x409b37
jmp 0x409b3b
jmp 0x409b3f
lea eax, [edi + edi*8]
add eax, eax
cdq
mov ebp, 0x18
idiv ebp
lea esi, [edi + ecx - 0x123]
and esi, 0x332
lea eax, [edi + 0x422b]
and edx, 0x154
xor esi, edx
mov edx, edi
sub edx, ecx
and esi, ebx
xor esi, eax
add edx, 0x332
lea eax, [edi - 0x3f55]
and edx, eax
or esi, edx
mov edx, 0x332
shl edx, cl
add edi, 0xffffbe31
and edi, edx
and edi, dword [esp + 0x10]
or esi, edi
jmp 0x409d87
mov dword [esp + 0x1c], 0x110
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebp, eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x10], 0x8456
mov dword [esp + 0x24], 0x4287
mov dword [esp + 0x20], 0x332
mov dword [esp + 0x14], 0x3678
mov dword [esp + 0x18], 0x12
jmp 0x409bd8
pushaw
mov eax, dword [esp + 0x20]
jmp 0x409be2
mov ebx, dword [esp + 0x34]
jmp 0x409be9
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
jmp 0x409bf9
mov edi, dword [esp + 0x30]
and eax, ebx
jmp 0x409c03
or eax, esi
and ebx, dword [esp + 0x38]
jmp 0x409c0d
add ebx, eax
sub ecx, eax
sub esi, eax
mov dword [esp + 0x2c], ebx
jmp 0x409c1a
add edi, esi
and ebx, eax
jmp 0x409c23
xor esi, edi
add esi, ebx
jmp 0x409c2a
sub ecx, esi
add edi, ebx
jmp 0x409c32
xor ecx, edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x34], eax
jmp 0x409c40
mov dword [esp + 0x30], edx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], esi
jmp 0x409c4f
popaw
jmp 0x409c54
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x10]
lea edx, [ecx + eax]
mov eax, dword [esp + 0x14]
add esi, eax
and edx, esi
lea esi, [eax + eax*8]
add esi, esi
and esi, 0x23
xor edx, esi
and ecx, eax
or edx, ecx
or edx, dword [esp + 0x24]
add eax, edx
mov dword [esp + 0x14], eax
jmp 0x409c87
mov edx, dword [esp + 0x20]
sub edx, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
add edx, dword [esp + 0x10]
lea ecx, [eax + ebp]
xor edx, ecx
mov ecx, dword [esp + 0x18]
add eax, ecx
xor eax, 0x19b
or edx, eax
add ecx, edx
mov dword [esp + 0x18], ecx
jmp 0x409cb2
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
sub ecx, dword [esp + 0x24]
lea edx, [ecx + eax + 5]
and edx, eax
mov eax, dword [esp + 0x14]
imul eax, eax, 0xd8
sar eax, 2
or edx, eax
sub dword [esp + 0x1c], edx
jmp 0x409cda
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
mov ecx, eax
and ecx, ebp
xor ecx, dword [esp + 0x1c]
add edx, 0x12
xor edx, dword [esp + 0x20]
or ecx, edx
sub eax, ecx
mov dword [esp + 0x14], eax
jmp 0x409cfd
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
add eax, dword [esp + 0x24]
mov ecx, ebp
shl edx, cl
and eax, edx
and dword [esp + 0x1c], eax
jmp 0x409d1a
mov esi, dword [esp + 0x10]
mov eax, esi
cdq
idiv dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
lea eax, [ecx + ecx*8]
add eax, eax
mov edi, edx
cdq
mov ebx, 0x18
idiv ebx
mov eax, dword [esp + 0x24]
add ecx, eax
add ecx, esi
add ecx, ebp
and ecx, dword [esp + 0x20]
and edi, edx
xor edi, ecx
and dword [esp + 0x18], edi
jmp 0x409d52
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov esi, ecx
sub esi, dword [esp + 0x24]
mov edx, ecx
add esi, eax
sub edx, ebp
add edx, eax
mov eax, dword [esp + 0x10]
and esi, edx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor eax, dword [esp + 0x18]
or esi, eax
or dword [esp + 0x1c], esi
jmp 0x409d83
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x2c]
jmp 0x409d8f
mov ecx, 0x3d7
lea eax, [esi - 0x75643678]
lea ebx, [ebx]
jmp 0x409da4
sub ecx, 1
jne 0x409da0
jmp 0x409dad
imul eax, eax, 0x16c6d
mov ecx, eax
and ecx, 0xde8
xor ecx, 0xc960df20
jmp 0x409dc6
jmp 0x409dc9
jmp 0x409dcd
jmp 0x409dd1
imul eax, eax, 0x6c62669
mov ebx, dword [esp + 0x34]
sub eax, 2
imul eax, ecx
not ecx
add eax, 0xd9b
add ecx, 0x16c6d
xor eax, ecx
mov dword [esp + 0x28], eax
lea eax, [esp + 0x28]
push eax
push ebx
lea esi, [esp + 0x48]
call fcn.00415e40
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x264]
mov eax, dword [esp + 0x260]
push ecx
mov ecx, dword [esp + 0x260]
push edx
push eax
push ecx
push ebx
mov ebx, dword [esp + 0x4c]
mov edx, esi
push edx
mov ecx, edi
call fcn.00402560
add esp, 0x20
test eax, eax
jne 0x409e4d
mov esi, 0xc0000205
cmp dword [esp + 0x38], 0
je 0x409e49
mov ecx, edi
call fcn.00404eb0
mov eax, esi
jmp 0x409e4f
xor eax, eax
mov ecx, dword [esp + 0x244]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004d6555
add esp, 0x238
ret