Function at 0x41df70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44fe0c
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x463858]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov al, byte [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
push 0x29
push str.PAGE_SIZE_8192_DEFAULT_CHARACTER_SET_UTF8
lea ecx, [ebp - 0xbc]
mov dword [ebp - 0xc4], esi
mov byte [esi + 0x20], al
mov dword [ebp - 0xa8], 0xf
mov dword [ebp - 0xac], 0
mov byte [ebp - 0xbc], 0
call fcn.00401520
mov byte [ebp - 4], 1
push 4
push str.UTF8
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x60], 0xf
mov dword [ebp - 0x64], 0
mov byte [ebp - 0x74], 0
call fcn.00401520
mov byte [ebp - 4], 2
push 0
push 0x458339
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x78], 0xf
mov dword [ebp - 0x7c], 0
mov byte [ebp - 0x8c], 0
call fcn.00401520
mov byte [ebp - 4], 3
push 9
push str.masterkey
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0x90], 0xf
mov dword [ebp - 0x94], 0
mov byte [ebp - 0xa4], 0
call fcn.00401520
mov byte [ebp - 4], 4
push 6
push str.SYSDBA
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x44], 0
call fcn.00401520
mov byte [ebp - 4], 5
cmp byte [edi], 0
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
jne 0x41e0ab
xor ecx, ecx
jmp 0x41e0b9
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41e0b0
sub ecx, edx
push ecx
push edi
lea ecx, [ebp - 0x2c]
call fcn.00401520
mov byte [ebp - 4], 6
push 0
push 0x458339
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x48], 0xf
mov dword [ebp - 0x4c], 0
mov byte [ebp - 0x5c], 0
call fcn.00401520
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x2c]
push eax
lea edx, [ebp - 0x5c]
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 7
call fcn.0041cb40
add esp, 0x18
mov byte [ebp - 4], 8
mov ecx, dword [eax]
test ecx, ecx
jne 0x41e12c
xor ebx, ebx
jmp 0x41e133
mov eax, dword [ecx]
call dword [eax + 0x48]
mov ebx, eax
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x41e13f
mov eax, dword [ecx]
call dword [eax + 0x4c]
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0xc0]
mov dword [esi + 4], ebx
test ecx, ecx
je 0x41e15f
mov eax, dword [ecx]
call dword [eax + 0x4c]
mov dword [ebp - 0xc0], 0
cmp dword [ebp - 0x48], 0x10
jb 0x41e170
push dword [ebp - 0x5c]
call fcn.0042fe33
add esp, 4
cmp dword [ebp - 0x18], 0x10
mov dword [ebp - 0x48], 0xf
mov dword [ebp - 0x4c], 0
mov byte [ebp - 0x5c], 0
jb 0x41e193
push dword [ebp - 0x2c]
call fcn.0042fe33
add esp, 4
cmp dword [ebp - 0x30], 0x10
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
jb 0x41e1b6
push dword [ebp - 0x44]
call fcn.0042fe33
add esp, 4
cmp dword [ebp - 0x90], 0x10
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x44], 0
jb 0x41e1df
push dword [ebp - 0xa4]
call fcn.0042fe33
add esp, 4
cmp dword [ebp - 0x78], 0x10
mov dword [ebp - 0x90], 0xf
mov dword [ebp - 0x94], 0
mov byte [ebp - 0xa4], 0
jb 0x41e20e
push dword [ebp - 0x8c]
call fcn.0042fe33
add esp, 4
cmp dword [ebp - 0x60], 0x10
mov dword [ebp - 0x78], 0xf
mov dword [ebp - 0x7c], 0
mov byte [ebp - 0x8c], 0
jb 0x41e234
push dword [ebp - 0x74]
call fcn.0042fe33
add esp, 4
mov byte [ebp - 4], 0
cmp dword [ebp - 0xa8], 0x10
mov dword [ebp - 0x60], 0xf
mov dword [ebp - 0x64], 0
mov byte [ebp - 0x74], 0
jb 0x41e261
push dword [ebp - 0xbc]
call fcn.0042fe33
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41e277
mov ecx, dword [esi + 4]
push 3
mov eax, dword [ecx]
call dword [eax + 0x30]
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
call dword [eax + 0x34]
mov al, 1
jmp 0x41e2b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042f36b
mov esp, ebp
pop ebp
ret 8