Function at 0x40152f
Capabilities:
Acquire debug privileges
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x29c
mov eax, dword [0x42b094]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x290], 0
push ebx
push esi
mov ebx, 0x42c460
push edi
mov ecx, ebx
call fcn.004027c3
test eax, eax
je 0x401673
mov eax, dword [0x42ce6c]
cmp eax, 6
je 0x4015a7
cmp eax, 7
je 0x4015a7
mov dword [0x42c450], eax
xor eax, eax
movzx ecx, word [eax + 0x42ce74]
mov word [eax + 0x44e118], cx
inc eax
inc eax
test cx, cx
jne 0x401576
xor eax, eax
movzx ecx, word [eax + 0x42cef8]
mov word [eax + 0x44e198], cx
inc eax
inc eax
test cx, cx
jne 0x40158d
jmp 0x401830
mov esi, 0x426ac0
lea edi, [ebp - 0x288]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x72
lea eax, [ebp - 0x27a]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.004125c0
mov esi, 0x426ad0
lea edi, [ebp - 0x208]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0xc
movsd dword es:[edi], dword [esi]
push 0x72
lea eax, [ebp - 0x1fa]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.004125c0
mov esi, 0x426ae0
lea edi, [ebp - 0x188]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0xc
movsd dword es:[edi], dword [esi]
push 0x72
lea eax, [ebp - 0x17a]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.004125c0
mov esi, 0x426af0
lea edi, [ebp - 0x108]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0xc
movsd dword es:[edi], dword [esi]
push 0x70
lea eax, [ebp - 0xf8]
push 0
push eax
movsd dword es:[edi], dword [esi]
call fcn.004125c0
mov esi, 0x426b00
lea edi, [ebp - 0x88]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0xc
movsw word es:[edi], word [esi]
push 0x6e
xor edi, edi
lea eax, [ebp - 0x76]
push edi
push eax
call fcn.004125c0
add esp, 0xc
lea esi, [ebp - 0x288]
push esi
mov ecx, ebx
call fcn.004028c4
test eax, eax
jne 0x4017e8
inc edi
sub esi, 0xffffff80
cmp edi, 5
jl 0x40165a
or dword [0x42c450], 0xffffffff
and dword [0x44e2a8], 0
cmp dword [0x44e110], 3
jne 0x401846
cmp dword [0x42c450], 5
ja 0x40183f
xor ebx, ebx
cmp dword [0x44e2a8], ebx
jne 0x401846
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
mov dword [ebp - 0x294], ebx
call fcn.004125c0
add esp, 0xc
lea edi, [ebp - 0x210]
call fcn.004023ea
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
cmp ax, bx
jne 0x4016da
push 6
pop ecx
lea eax, [ebp - 0x210]
mov esi, 0x426b14
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40173e
lea eax, [ebp - 0x294]
push eax
call fcn.00402444
mov ebx, eax
pop ecx
test ebx, ebx
je 0x401846
mov eax, dword [ebp - 0x294]
cmp eax, 0xa
jl 0x401846
lea ecx, [ebp - 0x210]
push ecx
push ebx
call fcn.00403b95
pop ecx
pop ecx
test eax, eax
jne 0x401846
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x210]
push eax
call section..text
test eax, eax
je 0x401846
xor edi, edi
cmp ebx, edi
je 0x401766
push ebx
call fcn.0041059d
pop ecx
lea eax, [ebp - 0x28c]
push eax
push 0x28
mov dword [ebp - 0x28c], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4017b0
mov esi, dword [ebp - 0x28c]
lea eax, [ebp - 0x298]
push eax
push 0x426b44
push edi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x4017b0
push esi
lea esi, [ebp - 0x298]
call fcn.00402c43
pop ecx
cmp dword [ebp - 0x28c], edi
je 0x4017c4
push dword [ebp - 0x28c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x210]
push eax
push dword [0x42ce70]
call fcn.00402b0f
pop ecx
pop ecx
test eax, eax
jne 0x401846
mov eax, dword [0x42ce70]
mov dword [0x44e2a8], eax
jmp 0x401846
mov eax, edi
shl eax, 7
lea eax, [ebp + eax - 0x288]
mov edx, 0x44e198
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x4017fb
mov dword [0x42c450], 6
xor eax, eax
movzx ecx, word [eax + 0x42ce74]
mov word [eax + 0x44e118], cx
inc eax
inc eax
test cx, cx
jne 0x401815
mov dword [0x42c454], edi
mov dword [ebp - 0x290], 1
jmp 0x401681
and dword [0x44e2a8], 0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x290]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004105a8
leave
ret