Function at 0x4ad07561
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push dword [eax + 0x38]
xor edi, edi
mov dword [ebp - 4], edi
call fcn.4ad14661
mov ebx, eax
cmp ebx, edi
je 0x4ad07590
push ebx
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
mov dword [ebp + 8], eax
jmp 0x4ad07593
mov dword [ebp + 8], edi
mov esi, 0x104
cmp dword [ebp + 8], esi
jb 0x4ad075ac
mov dword [0x4ad1d000], 0x233f
jmp 0x4ad07b52
cmp byte [0x4ad1cf7c], 0
je 0x4ad075d6
push 4
push 0x4ad01700
push ebx
call dword [sym.imp.MSVCRT.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x4ad075d6
push str.COMSPEC
call fcn.4ad06377
mov ebx, eax
push esi
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.4ad14d62
lea eax, [ebp - 0x228]
test eax, eax
je 0x4ad07602
cmp ebx, edi
je 0x4ad07602
lea eax, [ebp - 0x228]
push ebx
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
pop ecx
pop ecx
mov ax, word [0x4ad1c76c]
push eax
lea eax, [ebp - 0x228]
push eax
call fcn.4ad15724
mov ax, word [0x4ad1c744]
mov word [ebp - 0xe], 0x3a
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x228]
push eax
mov word [ebp - 0xc], di
call fcn.4ad19454
cmp eax, dword [ebp + 8]
mov word [ebp - 0xe], di
sbb eax, eax
neg eax
mov dword [ebp - 8], eax
je 0x4ad07676
mov ax, word [0x4ad1c744]
push eax
lea eax, [ebp - 0x228]
push eax
call fcn.4ad19436
mov ebx, eax
cmp ebx, edi
jne 0x4ad07672
lea eax, [ebp - 0x228]
push 0x3a
push eax
call fcn.4ad19418
mov ebx, eax
inc ebx
inc ebx
jmp 0x4ad0767c
lea ebx, [ebp - 0x228]
cmp word [ebx], di
je 0x4ad07baf
mov esi, dword [sym.imp.MSVCRT.dll_wcscmp]
mov edi, 0x4ad01438
push edi
push ebx
call esi
pop ecx
test eax, eax
pop ecx
je 0x4ad07baf
push 0x4ad01430
push ebx
call esi
pop ecx
test eax, eax
pop ecx
je 0x4ad07baf
push 0x410
call fcn.4ad0d9ca
test eax, eax
mov dword [ebp + 8], eax
je 0x4ad077db
cmp dword [ebp + 0xc], 0
je 0x4ad076e7
lea eax, [ebp - 0x228]
test eax, eax
je 0x4ad076e7
lea eax, [ebp - 0x228]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.MSVCRT.dll_wcscpy]
pop ecx
pop ecx
mov ecx, ebx
lea eax, [ebp - 0x228]
mov esi, dword [sym.imp.MSVCRT.dll_wcscat]
sub ecx, eax
mov eax, dword [ebp + 0xc]
sar ecx, 1
and word [eax + ecx*2], 0
test eax, eax
je 0x4ad07713
mov eax, edi
test eax, eax
je 0x4ad07713
push edi
push dword [ebp + 0xc]
call esi
pop ecx
pop ecx
mov edi, dword [ebp + 8]
push 0x208
push dword [ebp + 0xc]
push edi
call fcn.4ad14d91
test eax, eax
je 0x4ad0773d
cmp byte [0x4ad1cf7c], 0
je 0x4ad07b48
push dword [ebp + 0xc]
jmp 0x4ad07bbb
push edi
call fcn.4ad1948c
mov ax, word [eax]
cmp ax, word [0x4ad1c744]
je 0x4ad07760
mov eax, 0x4ad01424
mov ecx, eax
test ecx, ecx
je 0x4ad07760
push eax
push edi
call esi
pop ecx
pop ecx
test ebx, ebx
je 0x4ad0776a
push ebx
push edi
call esi
pop ecx
pop ecx
push dword [ebp + 8]
mov edi, dword [sym.imp.MSVCRT.dll_wcslen]
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 8]
call fcn.4ad0da67
mov ebx, eax
mov ax, word [0x4ad1c744]
push eax
push ebx
call fcn.4ad19436
and word [eax], 0
inc eax
inc eax
cmp dword [ebp - 8], 0
mov dword [ebp + 8], eax
jne 0x4ad077ae
push str.PATH
call fcn.4ad06377
mov dword [ebp - 4], eax
test ebx, ebx
je 0x4ad077ba
push ebx
call edi
pop ecx
mov esi, eax
jmp 0x4ad077bc
xor esi, esi
xor eax, eax
cmp dword [ebp - 4], eax
je 0x4ad077c9
push dword [ebp - 4]
call edi
pop ecx
add eax, esi
lea eax, [eax + eax + 8]
push eax
call fcn.4ad0d9ca
mov edi, eax
test edi, edi
jne 0x4ad077ec
mov dword [0x4ad1d000], 8
push 3
jmp 0x4ad07bd0
mov esi, 0x4ad016fc
mov eax, esi
test eax, eax
je 0x4ad07801
push esi
push edi
call dword [sym.imp.MSVCRT.dll_wcscat]
pop ecx
pop ecx
test ebx, ebx
je 0x4ad0780f
push ebx
push edi
call dword [sym.imp.MSVCRT.dll_wcscat]
pop ecx
pop ecx
mov eax, esi
test eax, eax
je 0x4ad0781f
push esi
push edi
call dword [sym.imp.MSVCRT.dll_wcscat]
pop ecx
pop ecx
cmp dword [ebp - 8], 0
mov esi, 0x4ad015f8
jne 0x4ad0784c
mov eax, esi
test eax, eax
je 0x4ad0783a
push esi
push edi
call dword [sym.imp.MSVCRT.dll_wcscat]
pop ecx
pop ecx
cmp dword [ebp - 4], 0
je 0x4ad0784c
push dword [ebp - 4]
push edi
call dword [sym.imp.MSVCRT.dll_wcscat]
pop ecx
pop ecx
push edi
call fcn.4ad07d33
push 1
push esi
push edi
call fcn.4ad12e5a
cmp dword [ebp + 8], 0
mov dword [ebp - 0x18], eax
je 0x4ad07873
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
mov dword [ebp - 0x14], eax
jmp 0x4ad07877
and dword [ebp - 0x14], 0
xor edi, edi
cmp byte [0x4ad1cf7c], 0
je 0x4ad0788e
push str.PATHEXT
call fcn.4ad06377
mov edi, eax
test edi, edi
jne 0x4ad07897
mov edi, str..COM_.EXE_.BAT_.CMD_.VBS_.JS_.WS
push edi
call fcn.4ad07d33
push 1
push esi
push edi
call fcn.4ad12e5a
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x4ad078bc
push ebx
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
mov edi, eax
jmp 0x4ad078be
xor edi, edi
test ebx, ebx
je 0x4ad078ed
push ebx
call fcn.4ad14661
test eax, eax
je 0x4ad078dc
push ebx
call fcn.4ad14661
push eax
push ebx
call dword [sym.imp.MSVCRT.dll_wcscpy]
pop ecx
pop ecx
test ebx, ebx
je 0x4ad078ed
push ebx
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
mov dword [ebp - 4], eax
jmp 0x4ad078f1
and dword [ebp - 4], 0
push ebx
call fcn.4ad1948c
mov ax, word [eax]
cmp ax, word [0x4ad1c744]
je 0x4ad0790c
push 1
inc edi
inc dword [ebp - 4]
pop esi
jmp 0x4ad0790e
xor esi, esi
mov ax, word [ebx]
test ax, ax
je 0x4ad07b34
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
lea ecx, [edx + ecx + 1]
cmp ecx, 0x104
jbe 0x4ad07940
test esi, esi
mov eax, edi
jne 0x4ad07935
lea eax, [edi + 1]
lea eax, [ebx + eax*2]
mov dword [ebp - 0x18], eax
jmp 0x4ad078a9
test ax, ax
je 0x4ad07b34
cmp dword [ebp + 0xc], 0
je 0x4ad0795f
test ebx, ebx
je 0x4ad0795f
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.MSVCRT.dll_wcscpy]
pop ecx
pop ecx
test esi, esi
mov eax, edi
jne 0x4ad07968
lea eax, [edi + 1]
lea eax, [ebx + eax*2]
test esi, esi
mov dword [ebp - 0x18], eax
je 0x4ad0798e
cmp dword [ebp + 0xc], 0
je 0x4ad079e2
lea eax, [ebp - 0x10]
test eax, eax
je 0x4ad0798e
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.MSVCRT.dll_wcscat]
pop ecx
pop ecx
cmp dword [ebp + 0xc], 0
je 0x4ad079e2
cmp dword [ebp + 8], 0
je 0x4ad079a8
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.MSVCRT.dll_wcscat]
pop ecx
pop ecx
cmp dword [ebp + 0xc], 0
je 0x4ad079e2
push dword [ebp + 0xc]
call fcn.4ad14661
test eax, eax
je 0x4ad079ce
push dword [ebp + 0xc]
call fcn.4ad14661
push eax
push dword [ebp + 0xc]
call dword [sym.imp.MSVCRT.dll_wcscpy]
pop ecx
pop ecx
cmp dword [ebp + 0xc], 0
je 0x4ad079e2
push dword [ebp + 0xc]
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
mov ebx, eax
jmp 0x4ad079e4
xor ebx, ebx
mov eax, dword [ebp + 0xc]
cmp word [eax + 2], 0x3a
jne 0x4ad079ff
mov ax, word [eax]
push eax
call fcn.4ad14326
test eax, eax
je 0x4ad078a9
push 0x2e
push dword [ebp + 8]
call fcn.4ad19436
test eax, eax
je 0x4ad07a56
cmp word [eax + 2], 0
je 0x4ad07a56
push 1
push dword [ebp + 0xc]
call fcn.4ad15655
test eax, eax
jne 0x4ad07a30
cmp dword [ebp - 8], eax
je 0x4ad07a44
cmp dword [0x4ad1d000], 5
jne 0x4ad07a44
push 0x2e
push dword [ebp + 0xc]
call fcn.4ad19436
mov edi, eax
test edi, edi
jne 0x4ad07b5b
mov eax, dword [0x4ad1d000]
cmp eax, 2
je 0x4ad07a56
test eax, eax
jne 0x4ad078a9
push 0x2a
push dword [ebp + 8]
call fcn.4ad19418
test eax, eax
jne 0x4ad07b48
push 0x3f
push dword [ebp + 8]
call fcn.4ad19418
test eax, eax
jne 0x4ad07b48
mov esi, dword [ebp - 0x20]
push eax
push 0x4ad016f4
push ebx
push dword [ebp + 0xc]
call fcn.4ad07bd3
test eax, eax
je 0x4ad07aea
cmp word [esi], 0
je 0x4ad07aea
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
lea edi, [eax + ecx + 1]
test esi, esi
je 0x4ad07aae
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
jmp 0x4ad07ab0
xor eax, eax
add eax, edi
cmp eax, 0x104
ja 0x4ad07adb
push 1
push esi
push ebx
push dword [ebp + 0xc]
call fcn.4ad07bd3
test eax, eax
jne 0x4ad07b81
mov eax, dword [0x4ad1d000]
cmp eax, 2
je 0x4ad07adb
test eax, eax
jne 0x4ad07aea
mov ax, word [esi]
inc esi
inc esi
test ax, ax
jne 0x4ad07adb
cmp word [esi], ax
jne 0x4ad07aa0
mov eax, dword [0x4ad1d000]
test eax, eax
je 0x4ad07afc
cmp eax, 2
jne 0x4ad078a9
push 1
push 0x4ad01698
push ebx
push dword [ebp + 0xc]
call fcn.4ad07bd3
test eax, eax
je 0x4ad078a9
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
test eax, eax
je 0x4ad078a9
cmp dword [ebp - 0x1c], 4
je 0x4ad07bab
jmp 0x4ad078a9
cmp dword [ebp - 8], 0
je 0x4ad07b48
mov eax, dword [0x4ad1d000]
test eax, eax
je 0x4ad07b48
cmp eax, 2
jne 0x4ad07b52
mov dword [0x4ad1d000], 0x2331
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
mov esi, dword [sym.imp.MSVCRT.dll__wcsicmp]
push str..CMD
push edi
call esi
pop ecx
test eax, eax
pop ecx
je 0x4ad07ba7
push str..BAT
push edi
call esi
neg eax
sbb eax, eax
pop ecx
inc eax
pop ecx
inc eax
jmp 0x4ad07b54
mov edi, dword [sym.imp.MSVCRT.dll__wcsicmp]
push str..BAT
push esi
call edi
pop ecx
test eax, eax
pop ecx
je 0x4ad07ba7
push str..CMD
push esi
call edi
pop ecx
test eax, eax
pop ecx
je 0x4ad07ba7
push 1
jmp 0x4ad07bd0
push 2
jmp 0x4ad07bd0
push 1
jmp 0x4ad07bd0
cmp byte [0x4ad1cf7c], 0
je 0x4ad07b48
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4ad07b48
test al, 0x10
je 0x4ad07b48
push 5
pop eax
jmp 0x4ad07b54