Function at 0x41bc4f
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
push ebx
sub esp, 0x12c
cmp byte [0x510776], 0
mov dword [ebp - 0xec], edi
jne 0x41bc79
cmp dword [0x50ff40], 0
je 0x41c2f5
mov eax, dword [ebp + 0xc]
lea ebx, [ebp - 0xd8]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0x49a9db
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x40
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll__snprintf_s]
lea eax, [ebp - 0xec]
mov byte [ebp - 0x99], 0
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.0043dbc7
mov dword [ebp - 0xfc], eax
test eax, eax
je 0x41c2f5
mov dword [ebp - 0x100], 1
xor edi, edi
cmp edi, dword [0x4dff04]
jae 0x41be48
lea esi, [edi*4]
xor edx, edx
mov eax, dword [0x4dff00]
mov dword [ebp - 0x104], edx
mov ebx, dword [eax + esi]
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x104]
cmp edx, eax
jae 0x41bd23
add ebx, edx
cmp byte [ebx], 0x5c
jne 0x41bd20
mov byte [ebx], 0x2f
inc edx
jmp 0x41bcf6
add ebx, 2
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0xec]
mov dword [esp], eax
call sub.msvcrt.dll_strstr
mov ebx, eax
test eax, eax
je 0x41be42
cmp dword [ebp - 0x100], 0
je 0x41bd61
lea eax, [ebp - 0xd8]
mov dword [esp], str.Updating__s:
mov dword [esp + 4], eax
call fcn.0043d9e0
mov eax, dword [0x4dff00]
mov eax, dword [eax + esi]
mov dword [esp], 0x49a9ee
add eax, 2
mov dword [esp + 4], eax
call fcn.0043d9e0
lea eax, [ebp - 0xe8]
sub ebx, dword [ebp - 0xec]
mov dword [esp + 8], eax
mov eax, dword [0x4dff00]
mov eax, dword [eax + esi]
xor esi, esi
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.0041acc9
mov eax, dword [ebp - 0xec]
test ebx, ebx
jle 0x41bdb6
cmp byte [eax + ebx - 1], 0xa
je 0x41bdb6
dec ebx
jmp 0x41bda8
mov al, byte [eax + ebx]
mov edx, eax
and edx, 0xffffffdf
sub edx, 0x41
cmp dl, 5
jbe 0x41bde9
sub eax, 0x30
cmp al, 9
jbe 0x41bde9
mov dword [esp + 8], 0x880
mov dword [esp + 4], str.hash.c
mov dword [esp], str.IS_HEXASCII_md5_data_pos__
jmp 0x41be8a
inc ebx
xor edx, edx
mov al, byte [ebp + edx - 0xe8]
mov ecx, eax
mov byte [ebp - 0x100], al
shr cl, 4
lea esi, [ecx + 0x57]
cmp cl, 9
ja 0x41be09
lea esi, [ecx + 0x30]
mov ecx, dword [ebp - 0xec]
mov eax, esi
mov byte [ecx + ebx - 1], al
mov al, byte [ebp - 0x100]
and eax, 0xf
lea ecx, [eax + 0x57]
cmp al, 9
ja 0x41be28
lea ecx, [eax + 0x30]
mov eax, dword [ebp - 0xec]
inc edx
mov byte [eax + ebx], cl
add ebx, 2
cmp edx, 0x10
jne 0x41bdec
xor ebx, ebx
mov dword [ebp - 0x100], ebx
inc edi
jmp 0x41bce1
cmp dword [0x50ff40], 0
je 0x41c2c5
mov eax, dword [ebp - 0xfc]
lea ebx, [eax + 0x400]
mov dword [esp], ebx
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x100], eax
test eax, eax
jne 0x41be90
mov dword [esp + 8], 0x88b
mov dword [esp + 4], str.hash.c
mov dword [esp], str.new_data___NULL
call dword [0x491228]
mov eax, dword [0x4dff14]
mov edx, dword [0x4dff10]
test eax, eax
jne 0x41bea3
test edx, edx
je 0x41bef1
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov dword [esp + 8], str._md5sum_totalbytes__0x_llx_n
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x100]
mov dword [esp], eax
call fcn.0041a69d
mov eax, dword [ebp - 0x100]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edi, dword [ebp - 0xfc]
mov esi, dword [ebp - 0x100]
add edi, eax
add eax, esi
mov dword [ebp - 0x110], edi
mov dword [ebp - 0x10c], eax
jmp 0x41bf09
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x104], 0x259
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x104]
lea ebx, [ebp - 0x98]
mov eax, dword [eax*4 + 0x48e200]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], str._sefi_boot_s
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x40
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll__snprintf_s]
mov byte [ebp - 0x59], 0
mov dword [esp], ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
push ecx
test eax, eax
je 0x41c155
xor edx, edx
lea eax, [ebp - 0xf0]
lea edi, [ebp - 0x58]
mov esi, ebx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x104]
mov eax, dword [eax*4 + 0x48e200]
mov dword [esp + 8], 0xa
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x104]
mov dword [esp + 4], eax
mov eax, dword [0x5241b8]
mov dword [esp], eax
call fcn.0043c5a4
mov dword [ebp - 0x114], eax
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov edx, eax
lea eax, [eax + 1]
cmp eax, 0x40
mov ecx, eax
mov eax, 0x3f
rep movsb byte es:[edi], byte [esi]
cmove edx, eax
lea eax, [ebp - 0x58]
mov byte [ebp + edx - 0x58], 0
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov byte [ebp + eax - 0x5c], 0
lea eax, [ebp - 0x58]
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], str._original.efi
mov dword [esp + 4], 0x40
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_strncat_s]
cmp dword [ebp - 0x114], 0
jne 0x41c03a
lea eax, [ebp - 0x58]
mov dword [esp], str.Could_not_rename:__s___s
mov dword [esp + 8], eax
lea eax, [ebp - 0x98]
mov dword [esp + 4], eax
jmp 0x41c150
lea edx, [ebp - 0x58]
mov eax, ebx
call fcn.0041a64f
test eax, eax
je 0x41c01d
lea eax, [ebp - 0x58]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp], str.Renamed:__s___s
call fcn.0043d9e0
xor eax, eax
mov dword [esp], ebx
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0xc0000000
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
lea eax, [eax - 1]
sub esp, 0x1c
cmp eax, 0xfffffffd
jbe 0x41c0bc
call fcn.0043df77
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp], str.Could_not_create__s:__s.
call fcn.0043d9e0
jmp 0x41c10d
xor eax, eax
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xf0]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x114]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.0043ebc0
test eax, eax
jne 0x41c119
call fcn.0043df77
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp], str.Could_not_write__s:__s.
call fcn.0043d9e0
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push eax
mov edx, ebx
lea eax, [ebp - 0x58]
call fcn.0041a64f
jmp 0x41c155
mov dword [esp], esi
xor edi, edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push esi
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov eax, dword [ebp - 0xf0]
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
call fcn.0043e475
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp], str.Created:__s___s_
call fcn.0043d9e0
inc dword [ebp - 0x104]
cmp dword [ebp - 0x104], 0x262
jne 0x41bf1f
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x114], eax
mov dword [esp + 4], str._._efi_boot_boot
mov eax, dword [ebp - 0x114]
mov dword [esp], eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
push edx
push edx
mov dword [ebp - 0x104], eax
test eax, eax
je 0x41c281
mov ebx, 1
mov eax, dword [ebx*4 + 0x48eb60]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edi, dword [ebp - 0x104]
lea eax, [edi + eax + 0xc]
lea esi, [edi + 0xc]
cmp byte [eax], 0xa
mov dword [ebp - 0x114], esi
jne 0x41c272
mov byte [eax], 0
mov eax, dword [ebx*4 + 0x48eb60]
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
push ecx
push ecx
test eax, eax
jne 0x41c258
mov edx, dword [ebx*4 + 0x48eb60]
mov dword [esp], edx
mov dword [ebp - 0x118], edx
call sub.msvcrt.dll_strlen
mov esi, dword [ebp - 0x108]
mov ecx, dword [ebp - 0x104]
mov edi, dword [ebp - 0x10c]
sub ecx, esi
lea ecx, [ecx + eax + 8]
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 4], str._original.efi_n
mov dword [esp], edi
call sub.msvcrt.dll_strcpy
mov edx, dword [ebp - 0x118]
lea eax, [edi + 0xe]
add dword [ebp - 0x110], 9
mov dword [ebp - 0x10c], eax
mov dword [esp], edx
call sub.msvcrt.dll_strlen
mov edi, dword [ebp - 0x104]
lea eax, [edi + eax + 0xd]
mov dword [ebp - 0x108], eax
mov eax, dword [ebx*4 + 0x48eb60]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov esi, dword [ebp - 0x104]
mov byte [esi + eax + 0xc], 0xa
inc ebx
cmp ebx, 0xa
jne 0x41c1a3
jmp 0x41c177
mov eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0xfc]
mov edi, dword [ebp - 0x108]
mov esi, dword [ebp - 0x108]
add ecx, eax
sub ecx, edi
mov edi, dword [ebp - 0x10c]
rep movsb byte es:[edi], byte [esi]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0xfc]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xec]
mov dword [esp + 4], eax
lea eax, [ebp - 0xd8]
mov dword [esp], eax
call fcn.0043dcb9
mov eax, dword [ebp - 0xec]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp], 0x4dff00
call fcn.0043c17c
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret