Function at 0x4ad03370
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov esi, dword [sym.imp.msvcrt.dll__wcsicmp]
push str..BAT
push ebx
call esi
pop ecx
pop ecx
test eax, eax
je 0x4ad055e0
push str..CMD
push ebx
call esi
pop ecx
pop ecx
test eax, eax
je 0x4ad055e0
xor eax, eax
inc eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.4ad013a9
leave
ret 0xc
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x4ad240ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
and dword [ebp - 0x21c], 0
push esi
push edi
push dword [eax + 0x38]
mov dword [ebp - 0x220], ecx
call fcn.4ad02598
mov edi, eax
mov esi, 0x104
test edi, edi
je 0x4ad033cc
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad033b0
sub eax, edx
sar eax, 1
mov dword [ebp - 0x224], eax
cmp eax, esi
jae 0x4ad15971
cmp byte [0x4ad24081], 0
je 0x4ad033f6
test edi, edi
je 0x4ad15982
push 4
push 0x4ad038c8
push edi
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x4ad15982
push ebx
mov ebx, 0x208
push ebx
lea eax, [ebp - 0x214]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push edi
push esi
lea eax, [ebp - 0x214]
push eax
call fcn.4ad0185a
lea eax, [ebp - 0x214]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x4ad03425
sub eax, ecx
movzx ecx, word [0x4ad4065c]
sar eax, 1
push ecx
inc eax
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.4ad032fd
mov ax, word [0x4ad40664]
mov word [ebp - 0xc], ax
push 0x3a
pop eax
mov word [ebp - 0xa], ax
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.4ad01996
cmp eax, dword [ebp - 0x224]
push 0
sbb eax, eax
neg eax
mov dword [ebp - 0x224], eax
pop eax
mov word [ebp - 0xa], ax
jne 0x4ad038d8
lea esi, [ebp - 0x214]
cmp word [esi], 0
mov dword [ebp - 0x218], esi
je 0x4ad10efa
push 4
mov ecx, 0x4ad02ec4
mov eax, esi
pop edi
mov dx, word [eax]
cmp dx, word [ecx]
je 0x4ad159a2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4ad10efa
mov ecx, 0x4ad02ebc
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
je 0x4ad159c9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4ad10efa
push 0x410
call fcn.4ad01896
mov esi, eax
test esi, esi
je 0x4ad15a19
mov edi, dword [ebp - 0x220]
lea eax, [ebp - 0x214]
push eax
push dword [ebp + 0x10]
push edi
call fcn.4ad0185a
mov eax, dword [ebp - 0x218]
push 0x4ad02ec4
push dword [ebp + 0x10]
lea ecx, [ebp - 0x214]
sub eax, ecx
sar eax, 1
xor ecx, ecx
push edi
mov word [edi + eax*2], cx
call fcn.4ad020a9
push edi
push ebx
push esi
call fcn.4ad02faf
test eax, eax
jne 0x4ad159f0
push esi
call fcn.4ad02ed1
mov ax, word [eax]
cmp ax, word [0x4ad40664]
je 0x4ad03562
push 0x4ad02ec8
push ebx
push esi
call fcn.4ad020a9
push dword [ebp - 0x218]
push ebx
push esi
call fcn.4ad020a9
mov eax, esi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x4ad03574
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push esi
call fcn.4ad02536
mov esi, eax
mov dword [ebp - 0x22c], esi
test esi, esi
je 0x4ad15a19
movzx eax, word [0x4ad40664]
push eax
push esi
call fcn.4ad02148
xor ecx, ecx
mov word [eax], cx
inc eax
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x224], ecx
jne 0x4ad035d0
push str.PATH
call fcn.4ad02070
mov dword [ebp - 0x21c], eax
push edi
call dword [sym.imp.KERNEL32.dll_NeedCurrentDirectoryForExePathW]
mov dword [ebp - 0x218], eax
test eax, eax
je 0x4ad10f3b
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad035ea
sub eax, edx
sar eax, 1
lea edi, [eax + 2]
mov eax, dword [ebp - 0x21c]
add edi, 2
test eax, eax
je 0x4ad0361b
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad0360b
sub eax, edx
sar eax, 1
add edi, eax
lea eax, [edi + edi]
push eax
call fcn.4ad01896
mov ebx, eax
test ebx, ebx
je 0x4ad15a19
cmp dword [ebp - 0x218], 0
je 0x4ad03659
mov esi, 0x4ad032f4
push esi
push edi
push ebx
call fcn.4ad020a9
push dword [ebp - 0x22c]
push edi
push ebx
call fcn.4ad020a9
push esi
push edi
push ebx
call fcn.4ad020a9
xor eax, eax
mov esi, 0x4ad038d4
cmp dword [ebp - 0x224], eax
jne 0x4ad0368d
cmp dword [ebp - 0x21c], eax
je 0x4ad0368d
cmp dword [ebp - 0x218], eax
je 0x4ad03680
push esi
push edi
push ebx
call fcn.4ad020a9
push dword [ebp - 0x21c]
push edi
push ebx
call fcn.4ad020a9
push edi
push ebx
call fcn.4ad03329
push 1
push esi
push ebx
call fcn.4ad022ca
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x228]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x4ad036ac
sub eax, ecx
sar eax, 1
mov dword [ebp - 0x22c], eax
cmp byte [0x4ad24081], dl
je 0x4ad10f42
push str.PATHEXT
call fcn.4ad02070
mov ebx, eax
test ebx, ebx
je 0x4ad10f42
lea eax, [ebx + 2]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad036e6
sub eax, edx
sar eax, 1
push eax
push ebx
call fcn.4ad03329
push 1
push esi
push ebx
call fcn.4ad022ca
mov dword [ebp - 0x230], eax
mov edi, dword [ebp - 0x21c]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad03715
sub eax, edx
sar eax, 1
mov esi, eax
push edi
lea ebx, [esi + 1]
call fcn.4ad02598
push eax
push ebx
push edi
call fcn.4ad0185a
mov eax, edi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x4ad0373b
push dword [ebp - 0x21c]
sub eax, ecx
sar eax, 1
mov edi, eax
call fcn.4ad02ed1
mov ax, word [eax]
cmp ax, word [0x4ad40664]
je 0x4ad04358
mov dword [ebp - 0x218], 1
mov esi, ebx
inc edi
mov eax, dword [ebp - 0x21c]
xor ecx, ecx
cmp word [eax], cx
je 0x4ad046a7
mov edx, dword [ebp - 0x22c]
lea edi, [edi + edx + 1]
mov dword [ebp - 0x238], edi
cmp edi, 0x104
ja 0x4ad15a25
mov ebx, dword [ebp - 0x21c]
mov edi, dword [ebp - 0x220]
push ebx
push dword [ebp + 0x10]
push edi
call fcn.4ad0185a
cmp dword [ebp - 0x218], 0
je 0x4ad04364
cmp dword [ebp - 0x218], 0
lea eax, [ebx + esi*2]
mov dword [ebp - 0x21c], eax
je 0x4ad037e2
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
push edi
call fcn.4ad020a9
push dword [ebp - 0x228]
push dword [ebp + 0x10]
push edi
call fcn.4ad020a9
push edi
call fcn.4ad02598
push eax
push dword [ebp + 0x10]
push edi
call fcn.4ad0185a
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad03806
sub eax, edx
sar eax, 1
cmp word [edi + 2], 0x3a
mov esi, eax
jne 0x4ad0382e
movzx eax, word [edi]
push eax
call fcn.4ad02b68
test eax, eax
je 0x4ad0370a
push 0x2e
push dword [ebp - 0x228]
call fcn.4ad02148
test eax, eax
jne 0x4ad038fd
push 0x2a
push dword [ebp - 0x228]
call fcn.4ad018eb
test eax, eax
jne 0x4ad046bd
push 0x3f
push dword [ebp - 0x228]
call fcn.4ad018eb
test eax, eax
jne 0x4ad046bd
mov ebx, dword [ebp - 0x230]
push eax
push 0x4ad0430c
push esi
push dword [ebp + 0x10]
push edi
call fcn.4ad04317
test eax, eax
jne 0x4ad04fba
cmp dword [0x4ad24128], 0
je 0x4ad038a7
cmp dword [0x4ad24128], 2
jne 0x4ad0370a
mov edi, dword [ebp - 0x220]
push 1
push 0x4ad01794
push esi
push dword [ebp + 0x10]
push edi
call fcn.4ad04317
test eax, eax
je 0x4ad0370a
jmp 0x4ad15a47
movzx eax, word [0x4ad40664]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.4ad02148
mov esi, eax
test esi, esi
je 0x4ad10210
inc esi
inc esi
jmp 0x4ad03493
cmp word [eax + 2], 0
je 0x4ad03843
push 1
push dword [ebp + 0x10]
push edi
call fcn.4ad0315d
test eax, eax
je 0x4ad04677
push 0x2e
push edi
call fcn.4ad02148
mov ebx, eax
test ebx, ebx
je 0x4ad0468c
mov esi, dword [sym.imp.msvcrt.dll__wcsicmp]
push str..CMD
push ebx
call esi
pop ecx
pop ecx
test eax, eax
je 0x4ad055e0
push str..BAT
push ebx
call esi
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
jmp 0x4ad03204
and dword [ebp - 0x218], 0
jmp 0x4ad03773
inc esi
jmp 0x4ad037c3
cmp dword [ebp - 0x224], eax
je 0x4ad0468c
cmp dword [0x4ad24128], 5
je 0x4ad0391b
mov eax, dword [0x4ad24128]
cmp eax, 2
je 0x4ad03843
test eax, eax
jne 0x4ad0370a
jmp 0x4ad15a3c
cmp dword [ebp - 0x224], ecx
je 0x4ad046bd
mov eax, dword [0x4ad24128]
cmp eax, ecx
je 0x4ad046bd
cmp eax, 2
jne 0x4ad046c7
mov dword [0x4ad24128], 0x2331
xor eax, eax
jmp 0x4ad03205
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad04f6f
mov ecx, dword [ebp - 0x238]
sub eax, edx
sar eax, 1
add ecx, eax
cmp ecx, 0x104
ja 0x4ad04fb0
push 1
push ebx
push esi
push dword [ebp + 0x10]
push edi
call fcn.4ad04317
test eax, eax
jne 0x4ad031d8
mov eax, dword [0x4ad24128]
cmp eax, 2
jne 0x4ad10f4c
mov ax, word [ebx]
inc ebx
inc ebx
test ax, ax
jne 0x4ad04fb0
cmp word [ebx], 0
je 0x4ad0388b
mov eax, ebx
lea edx, [eax + 2]
jmp 0x4ad04f6f
push 2
pop eax
jmp 0x4ad03205
push 0x3a
lea eax, [ebp - 0x214]
push eax
call fcn.4ad018eb
mov esi, eax
jmp 0x4ad038f6
cmp byte [0x4ad24081], 0
je 0x4ad046bd
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4ad10f2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x15
pop ecx
cmp eax, ecx
jne 0x4ad046bd
jmp 0x4ad15a74
test al, 0x10
jne 0x4ad15a12
jmp 0x4ad046bd
xor edi, edi
jmp 0x4ad035fb
mov ebx, str..COM_.EXE_.BAT_.CMD_.VBS_.JS_.WS_.MSC
jmp 0x4ad036e0
test eax, eax
je 0x4ad04fb0
jmp 0x4ad03894
mov dword [0x4ad24128], 0x233f
xor eax, eax
jmp 0x4ad03206
push str.COMSPEC
call fcn.4ad02070
mov edi, eax
test edi, edi
jne 0x4ad033f6
mov dword [0x4ad24128], 0x400023d2
jmp 0x4ad1597b
test dx, dx
je 0x4ad159c2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4ad034b9
add eax, edi
add ecx, edi
test dx, dx
jne 0x4ad034ad
xor eax, eax
jmp 0x4ad034be
test dx, dx
je 0x4ad159e9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4ad034d9
add eax, edi
add ecx, edi
test dx, dx
jne 0x4ad034cd
xor eax, eax
jmp 0x4ad034de
cmp byte [0x4ad24081], 0
je 0x4ad046bd
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4ad10f2e
jmp 0x4ad046bd
push 5
jmp 0x4ad055e2
mov dword [0x4ad24128], 8
jmp 0x4ad15a7a
cmp dword [ebp - 0x218], ecx
jne 0x4ad15a2e
inc esi
lea eax, [eax + esi*2]
mov dword [ebp - 0x21c], eax
jmp 0x4ad0370a
mov edi, dword [ebp - 0x220]
jmp 0x4ad03843
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
test eax, eax
je 0x4ad0370a
cmp dword [ebp - 0x234], 4
je 0x4ad03202
jmp 0x4ad0370a
mov dword [0x4ad24128], ecx
push 3
jmp 0x4ad055e2