Function at 0x4089c7
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push 0x134
mov eax, 0x438b7c
call fcn.0041a581
mov byte [ebp - 0x25], dl
mov edi, ecx
mov dword [ebp - 0x44], edi
xor ebx, ebx
mov dword [ebp - 0xd0], ebx
mov dword [ebp - 4], 2
call fcn.00413c5e
push eax
lea ecx, [ebp - 0x1c]
call fcn.00413a4e
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 3
call fcn.00401a65
mov esi, eax
push 0x449ab4
lea edx, [ebp + 0xc]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x90]
call fcn.0040fd4a
pop ecx
push esi
mov edx, eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x8c]
call fcn.00413659
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x18]
mov edx, eax
mov dword [esp], str..report.txt
call fcn.0040fd4a
pop ecx
mov ecx, dword [ebp - 0x8c]
lea ecx, [ecx - 0x10]
call fcn.004142bb
mov ecx, dword [ebp - 0x90]
lea ecx, [ecx - 0x10]
call fcn.004142bb
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x94]
lea ecx, [ecx - 0x10]
call fcn.004142bb
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.0041423d
add eax, 0x10
mov dword [ebp - 0x98], eax
lea esi, [eax - 0x10]
mov byte [ebp - 4], 0xb
mov ecx, esi
call fcn.0041423d
add eax, 0x10
mov ecx, esi
mov dword [ebp - 0x20], eax
call fcn.004142bb
mov byte [ebp - 4], 0xc
mov esi, 0x445374
cmp byte [0x453008], bl
je 0x408b22
mov eax, dword [0x45300c]
cmp dword [eax - 0xc], ebx
jne 0x408ad3
push str.__silent
lea ecx, [ebp - 0x1c]
call fcn.004140fd
jmp 0x408b22
lea eax, [ebp - 0x18]
mov edx, str.__silent__
push eax
lea ecx, [ebp - 0x64]
call fcn.0040fcda
pop ecx
push esi
mov edx, eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x9c]
call fcn.0040fd4a
pop ecx
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xe
call fcn.004136ae
mov ecx, dword [ebp - 0x9c]
lea ecx, [ecx - 0x10]
call fcn.004142bb
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x64]
lea ecx, [ecx - 0x10]
call fcn.004142bb
lea ecx, [ebp - 0x14]
call fcn.00401ea6
mov byte [ebp - 4], 0xf
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x408bbb
call fcn.00413c5e
push eax
lea ecx, [ebp - 0x48]
call fcn.00413a4e
push ecx
mov byte [ebp - 4], 0x10
lea ebx, [ebp - 0x48]
mov esi, esp
mov dword [ebp - 0x24], esi
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.0041423d
add eax, 0x10
lea ecx, [ebp - 0xe8]
mov edx, ebx
mov dword [esi], eax
call fcn.004087c6
pop ecx
mov ecx, dword [ebp - 0xe0]
mov ebx, dword [eax]
shr ebx, 0x1f
lea ecx, [ecx - 0x10]
call fcn.004142bb
xor bl, 1
mov esi, dword [ebp - 0x48]
je 0x408ba8
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x408ba8
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x14]
call fcn.004136ae
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 0xf
call fcn.004142bb
xor ebx, ebx
mov esi, 0x445374
lea eax, [ebp + 8]
mov edx, str.Ninite.exe__
push eax
lea ecx, [ebp - 0x78]
call fcn.0040fcda
pop ecx
push esi
mov edx, eax
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x74]
call fcn.0040fd4a
pop ecx
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x12
push ecx
mov edx, eax
lea ecx, [ebp - 0x70]
call fcn.00413659
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x6c]
mov edx, eax
mov dword [esp], str.__fullpath__
call fcn.0040fd4a
pop ecx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x14
push ecx
mov edx, eax
lea ecx, [ebp - 0x68]
call fcn.00413659
pop ecx
push esi
mov edx, eax
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x10]
call fcn.0040fd4a
pop ecx
mov ecx, dword [ebp - 0x68]
lea ecx, [ecx - 0x10]
call fcn.004142bb
mov ecx, dword [ebp - 0x6c]
lea ecx, [ecx - 0x10]
call fcn.004142bb
mov ecx, dword [ebp - 0x70]
lea ecx, [ecx - 0x10]
call fcn.004142bb
mov ecx, dword [ebp - 0x74]
lea ecx, [ecx - 0x10]
call fcn.004142bb
mov byte [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x78]
lea ecx, [ecx - 0x10]
call fcn.004142bb
mov eax, dword [0x45303c]
test eax, eax
mov ecx, dword [0x453040]
cmovne ecx, eax
test ecx, ecx
je 0x408cae
push dword [ecx + 4]
lea eax, [ebp - 0x7c]
push dword [ecx]
push str.__proxyauth___ws____ws_
push eax
call fcn.00401b1f
add esp, 0x10
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x10]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.0041305b
mov byte [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x7c]
lea ecx, [ecx - 0x10]
call fcn.004142bb
mov eax, dword [0x453030]
mov ecx, dword [0x45302c]
sub eax, ecx
sar eax, 2
mov dword [ebp - 0x2c], ebx
test eax, eax
je 0x408dd0
mov edi, ebx
mov ecx, dword [ecx + edi*4]
sub ecx, 0x10
call fcn.0041423d
lea esi, [eax + 0x10]
mov dword [ebp - 0x2c], esi
push ecx
lea eax, [ebp - 0x80]
mov byte [ebp - 4], 0x1d
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040fdf6
push 0x449ab4
mov ecx, eax
mov byte [ebp - 4], 0x1e
call fcn.004135ba
mov ebx, eax
mov byte [ebp - 4], 0x1d
mov ecx, dword [ebp - 0x80]
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
call fcn.004142bb
add bl, 1
je 0x408d33
push 0x449ab4
call fcn.0041f66d
pop ecx
push eax
push 0x449ab4
lea ecx, [ebp - 0x2c]
call fcn.0041305b
mov esi, dword [ebp - 0x2c]
push 0x4458ec
lea edx, [ebp - 0x10]
lea ecx, [ebp - 0x50]
call fcn.0040fd4a
pop ecx
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x1f
push ecx
mov edx, eax
lea ecx, [ebp - 0x88]
call fcn.00413659
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x84]
mov edx, eax
mov dword [esp], 0x445374
call fcn.0040fd4a
pop ecx
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x21
call fcn.004136ae
mov ecx, dword [ebp - 0x84]
lea ecx, [ecx - 0x10]
call fcn.004142bb
mov ecx, dword [ebp - 0x88]
lea ecx, [ecx - 0x10]
call fcn.004142bb
mov ecx, dword [ebp - 0x50]
lea ecx, [ecx - 0x10]
call fcn.004142bb
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 0x1b
call fcn.004142bb
mov eax, dword [0x453030]
inc edi
mov ecx, dword [0x45302c]
sub eax, ecx
sar eax, 2
cmp edi, eax
jb 0x408ccb
mov edi, dword [ebp - 0x44]
xor ebx, ebx
cmp byte [ebp - 0x25], 0
mov byte [0x453000], 1
mov dword [ebp - 0x4c], 1
je 0x408f8a
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
mov dword [ebp - 0x40], esi
test esi, esi
mov byte [ebp - 4], 0x22
setne al
test al, al
jne 0x408e79
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x18a
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov edi, esp
call fcn.00413c5e
push eax
mov ecx, edi
call fcn.00413a4e
lea ecx, [ebp - 0xdc]
call fcn.004142d3
mov edi, dword [ebp - 0x44]
lea eax, [ebp - 0xdc]
push eax
mov ecx, edi
mov byte [ebp - 4], 0x23
call fcn.0040153c
mov ecx, dword [ebp - 0xd4]
lea ecx, [ecx - 0x10]
call fcn.004142bb
test esi, esi
je 0x40925f
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x40925f
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RunDll
push esi
call ebx
test eax, eax
mov dword [ebp - 0x50], eax
setne cl
test cl, cl
jne 0x408ed5
push 0x18c
push 0x80004005
push ecx
mov edi, esp
call fcn.00413c5e
push eax
mov ecx, edi
call fcn.00413a4e
lea ecx, [ebp - 0xa8]
call fcn.004142d3
mov edi, dword [ebp - 0x44]
lea eax, [ebp - 0xa8]
push eax
mov ecx, edi
mov byte [ebp - 4], 0x24
call fcn.0040153c
mov ecx, dword [ebp - 0xa0]
jmp 0x408e5d
cmp byte [0x453010], 0
je 0x408f39
push str.HandlerEx
push esi
call ebx
test eax, eax
mov dword [0x453028], eax
setne al
test al, al
jne 0x408f39
push 0x190
push 0x80004005
push ecx
mov edi, esp
call fcn.00413c5e
push eax
mov ecx, edi
call fcn.00413a4e
lea ecx, [ebp - 0xb4]
call fcn.004142d3
mov edi, dword [ebp - 0x44]
lea eax, [ebp - 0xb4]
push eax
mov ecx, edi
mov byte [ebp - 4], 0x25
call fcn.0040153c
mov ecx, dword [ebp - 0xac]
jmp 0x408e5d
xor ebx, ebx
cmp dword [ebp + 0x14], ebx
je 0x408f4a
push ebx
push dword [ebp + 0x14]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 0x18], 0
je 0x408f61
push ebx
push 6
push 0x111
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push dword [ebp - 0x10]
push esi
call dword [ebp - 0x50]
mov dword [ebp - 0x4c], eax
mov dword [0x453028], ebx
mov byte [ebp - 4], 0x1b
test esi, esi
je 0x409164
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x409164
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
push 0x44
pop esi
push esi
lea eax, [ebp - 0x140]
mov byte [ebp - 4], 0x26
push ebx
push eax
call fcn.0041b4e0
mov eax, dword [ebp - 0x10]
add esp, 0xc
mov dword [ebp - 0x140], esi
cmp dword [eax - 4], 1
jle 0x408fcb
push dword [eax - 0xc]
lea ecx, [ebp - 0x10]
call fcn.00413eb9
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x140]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne al
test al, al
jne 0x40907d
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x1b5
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov esi, esp
call fcn.00413c5e
push eax
mov ecx, esi
call fcn.00413a4e
lea ecx, [ebp - 0xc0]
call fcn.004142d3
lea eax, [ebp - 0xc0]
mov byte [ebp - 4], 0x27
push eax
mov ecx, edi
call fcn.0040153c
mov ecx, dword [ebp - 0xb8]
lea ecx, [ecx - 0x10]
call fcn.004142bb
cmp dword [ebp - 0x38], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x409066
push dword [ebp - 0x38]
call esi
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x3c], 0
je 0x40925f
push dword [ebp - 0x3c]
call esi
mov dword [ebp - 0x3c], ebx
jmp 0x40925f
cmp byte [0x453008], 0
jne 0x4090c4
push 0x12c
push dword [ebp - 0x3c]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
cmp byte [0x453008], 0
jne 0x4090c4
cmp dword [ebp + 0x14], 0
je 0x4090ad
push ebx
push dword [ebp + 0x14]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 0x18], 0
je 0x4090c4
push ebx
push 6
push 0x111
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
setne al
test al, al
jne 0x409141
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x1ca
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov esi, esp
call fcn.00413c5e
push eax
mov ecx, esi
call fcn.00413a4e
lea ecx, [ebp - 0xcc]
call fcn.004142d3
lea eax, [ebp - 0xcc]
mov byte [ebp - 4], 0x28
push eax
mov ecx, edi
call fcn.0040153c
mov ecx, dword [ebp - 0xc4]
jmp 0x40904a
mov byte [ebp - 4], 0x1b
cmp dword [ebp - 0x38], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x409159
push dword [ebp - 0x38]
call esi
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x3c], 0
je 0x409164
push dword [ebp - 0x3c]
call esi
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], 0
je 0x409206
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
push ebx
push ecx
mov byte [ebp - 4], 0x29
lea ecx, [eax - 0x10]
mov esi, esp
lea ebx, [ebp - 0x60]
mov dword [ebp - 0x40], esi
call fcn.0041423d
add eax, 0x10
lea ecx, [ebp - 0xf4]
mov edx, ebx
mov dword [esi], eax
call fcn.00402d74
pop ecx
pop ecx
mov ecx, dword [ebp - 0xec]
add ecx, 0xfffffff0
call fcn.004142bb
cmp dword [ebp - 0x5c], 0
je 0x4091f3
push dword [ebp - 0x5c]
push ecx
mov ecx, ebx
call fcn.00410c02
push eax
lea ecx, [ebp - 0x24]
call fcn.0040fc0d
mov ecx, dword [ebp + 0x1c]
mov byte [ebp - 4], 0x2a
push dword [eax]
call fcn.0041354b
mov ecx, dword [ebp - 0x24]
lea ecx, [ecx - 0x10]
call fcn.004142bb
mov byte [ebp - 4], 0x1b
cmp dword [ebp - 0x60], 0
je 0x409206
push dword [ebp - 0x60]
call fcn.00420f91
pop ecx
cmp byte [0x453008], 0
je 0x40924a
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x40924a
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x1d9
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
push str.The_process_returned_an_error
call fcn.00414128
mov ecx, edi
call fcn.004142d3
jmp 0x40925f
and dword [edi], 0
and dword [edi + 4], 0
call fcn.00413c5e
push eax
lea ecx, [edi + 8]
call fcn.00413a4e
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.004142bb
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.004142bb
lea ecx, [ebp - 0x20]
call fcn.0040396d
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.004142bb
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.004142bb
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.004142bb
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.004142bb
mov ecx, dword [ebp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.004142bb
mov eax, edi
call fcn.0041a54a
ret