Function at 0x407fa1
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push 0x13c
mov eax, 0x430e26
call fcn.0041be63
mov byte [ebp - 0x21], dl
mov edi, ecx
mov dword [ebp - 0x44], edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], 3
call fcn.00412f7e
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040f3c2
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 4
call fcn.00401a7a
mov esi, eax
push 0x43acc8
lea edx, [ebp + 0xc]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x6c]
call fcn.0040e5b7
pop ecx
push esi
mov edx, eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x90]
call fcn.0041280d
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x18]
mov edx, eax
mov dword [esp], str..report.txt
call fcn.0040e5b7
pop ecx
mov ecx, dword [ebp - 0x90]
lea ecx, [ecx - 0x10]
call fcn.004130bf
mov ecx, dword [ebp - 0x6c]
lea ecx, [ecx - 0x10]
call fcn.004130bf
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x74]
lea ecx, [ecx - 0x10]
call fcn.004130bf
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00413040
add eax, 0x10
mov dword [ebp - 0x54], eax
lea esi, [eax - 0x10]
mov byte [ebp - 4], 0xc
mov ecx, esi
call fcn.00413040
add eax, 0x10
mov ecx, esi
mov dword [ebp - 0x28], eax
call fcn.004130bf
mov byte [ebp - 4], 0xd
mov esi, 0x439ac4
cmp byte [0x446fcc], bl
je 0x4080e4
mov eax, dword [0x446fd0]
cmp dword [eax - 0xc], ebx
jne 0x40809b
push str.__silent
lea ecx, [ebp - 0x1c]
call fcn.00412bd1
jmp 0x4080e4
lea eax, [ebp - 0x18]
mov edx, str.__silent__
push eax
lea ecx, [ebp - 0x60]
call fcn.0040e61c
pop ecx
push esi
mov edx, eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x7c]
call fcn.0040e5b7
pop ecx
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xf
call fcn.00412862
mov ecx, dword [ebp - 0x7c]
lea ecx, [ecx - 0x10]
call fcn.004130bf
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x60]
lea ecx, [ecx - 0x10]
call fcn.004130bf
lea ecx, [ebp - 0x14]
call fcn.00401e4e
mov byte [ebp - 4], 0x10
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40817a
call fcn.00412f7e
push eax
lea ecx, [ebp - 0x4c]
call fcn.0040f3c2
push ecx
mov byte [ebp - 4], 0x11
lea ebx, [ebp - 0x4c]
mov ecx, dword [ebp - 0x14]
mov esi, esp
lea ecx, [ecx - 0x10]
call fcn.00413040
add eax, 0x10
lea ecx, [ebp - 0x100]
mov edx, ebx
mov dword [esi], eax
call fcn.00407daa
pop ecx
mov ecx, dword [ebp - 0xf8]
cmp dword [eax], 0
lea ecx, [ecx - 0x10]
setge bl
call fcn.004130bf
mov esi, dword [ebp - 0x4c]
test bl, bl
je 0x408167
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x408167
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x14]
call fcn.00412862
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 0x10
call fcn.004130bf
xor ebx, ebx
mov esi, 0x439ac4
lea eax, [ebp + 8]
mov edx, str.Ninite.exe__
push eax
lea ecx, [ebp - 0x70]
call fcn.0040e61c
pop ecx
push esi
mov edx, eax
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x5c]
call fcn.0040e5b7
pop ecx
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x13
push ecx
mov edx, eax
lea ecx, [ebp - 0x88]
call fcn.0041280d
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x64]
mov edx, eax
mov dword [esp], str.__fullpath__
call fcn.0040e5b7
pop ecx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x15
push ecx
mov edx, eax
lea ecx, [ebp - 0x84]
call fcn.0041280d
pop ecx
push esi
mov edx, eax
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x10]
call fcn.0040e5b7
pop ecx
mov ecx, dword [ebp - 0x84]
lea ecx, [ecx - 0x10]
call fcn.004130bf
mov ecx, dword [ebp - 0x64]
lea ecx, [ecx - 0x10]
call fcn.004130bf
mov ecx, dword [ebp - 0x88]
lea ecx, [ecx - 0x10]
call fcn.004130bf
mov ecx, dword [ebp - 0x5c]
lea ecx, [ecx - 0x10]
call fcn.004130bf
mov byte [ebp - 4], 0x1c
mov ecx, dword [ebp - 0x70]
lea ecx, [ecx - 0x10]
call fcn.004130bf
mov eax, dword [0x447000]
test eax, eax
mov ecx, dword [0x447004]
cmovne ecx, eax
test ecx, ecx
je 0x408279
push dword [ecx + 4]
lea eax, [ebp - 0x80]
push dword [ecx]
push str.__proxyauth___ws____ws_
push eax
call fcn.00401b35
add esp, 0x10
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x10]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.00412268
mov byte [ebp - 4], 0x1c
mov ecx, dword [ebp - 0x80]
lea ecx, [ecx - 0x10]
call fcn.004130bf
mov eax, dword [0x446ff4]
mov ecx, dword [0x446ff0]
sub eax, ecx
sar eax, 2
mov dword [ebp - 0x2c], ebx
test eax, eax
je 0x408394
mov edi, ebx
mov ecx, dword [ecx + edi*4]
sub ecx, 0x10
call fcn.00413040
lea esi, [eax + 0x10]
mov dword [ebp - 0x2c], esi
push ecx
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x1e
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040e527
push 0x43acc8
mov ecx, eax
mov byte [ebp - 4], 0x1f
call fcn.00412773
mov ebx, eax
mov byte [ebp - 4], 0x1e
mov ecx, dword [ebp - 0x78]
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
call fcn.004130bf
inc bl
je 0x4082fd
push 0x43acc8
call fcn.00418604
pop ecx
push eax
push 0x43acc8
lea ecx, [ebp - 0x2c]
call fcn.00412268
mov esi, dword [ebp - 0x2c]
push 0x439ffc
lea edx, [ebp - 0x10]
lea ecx, [ebp - 0x48]
call fcn.0040e5b7
pop ecx
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x20
push ecx
mov edx, eax
lea ecx, [ebp - 0x68]
call fcn.0041280d
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x8c]
mov edx, eax
mov dword [esp], 0x439ac4
call fcn.0040e5b7
pop ecx
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x22
call fcn.00412862
mov ecx, dword [ebp - 0x8c]
lea ecx, [ecx - 0x10]
call fcn.004130bf
mov ecx, dword [ebp - 0x68]
lea ecx, [ecx - 0x10]
call fcn.004130bf
mov ecx, dword [ebp - 0x48]
lea ecx, [ecx - 0x10]
call fcn.004130bf
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 0x1c
call fcn.004130bf
mov eax, dword [0x446ff4]
inc edi
mov ecx, dword [0x446ff0]
sub eax, ecx
sar eax, 2
cmp edi, eax
jb 0x408296
mov edi, dword [ebp - 0x44]
xor ebx, ebx
cmp byte [ebp - 0x21], 0
mov byte [0x446fc4], 1
mov dword [ebp - 0x50], 1
je 0x408555
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
mov dword [ebp - 0x40], esi
test esi, esi
mov byte [ebp - 4], 0x23
setne al
test al, al
jne 0x408444
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x18a
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov edi, esp
call fcn.00412f7e
push eax
mov ecx, edi
call fcn.0040f3c2
lea ecx, [ebp - 0xac]
call fcn.004130db
mov byte [ebp - 4], 0x24
lea eax, [ebp - 0xac]
mov edi, dword [ebp - 0x44]
mov ecx, edi
push eax
call fcn.00402691
mov ecx, dword [ebp - 0xa4]
lea ecx, [ecx - 0x10]
mov dword [ebp - 0x20], 1
call fcn.004130bf
test esi, esi
je 0x408865
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x408865
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RunDll
push esi
call ebx
test eax, eax
mov dword [ebp - 0x48], eax
setne cl
test cl, cl
jne 0x4084a0
push 0x18c
push 0x80004005
push ecx
mov edi, esp
call fcn.00412f7e
push eax
mov ecx, edi
call fcn.0040f3c2
lea ecx, [ebp - 0xdc]
call fcn.004130db
mov byte [ebp - 4], 0x25
lea eax, [ebp - 0xdc]
mov edi, dword [ebp - 0x44]
mov ecx, edi
push eax
call fcn.00402691
mov ecx, dword [ebp - 0xd4]
jmp 0x408421
cmp byte [0x446fd4], 0
je 0x408504
push str.HandlerEx
push esi
call ebx
test eax, eax
mov dword [0x446fec], eax
setne al
test al, al
jne 0x408504
push 0x190
push 0x80004005
push ecx
mov edi, esp
call fcn.00412f7e
push eax
mov ecx, edi
call fcn.0040f3c2
lea ecx, [ebp - 0xd0]
call fcn.004130db
mov byte [ebp - 4], 0x26
lea eax, [ebp - 0xd0]
mov edi, dword [ebp - 0x44]
mov ecx, edi
push eax
call fcn.00402691
mov ecx, dword [ebp - 0xc8]
jmp 0x408421
xor ebx, ebx
cmp dword [ebp + 0x14], ebx
je 0x408515
push ebx
push dword [ebp + 0x14]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 0x18], 0
je 0x40852c
push ebx
push 6
push 0x111
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push dword [ebp - 0x10]
push esi
call dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov dword [0x446fec], ebx
mov byte [ebp - 4], 0x1c
test esi, esi
je 0x408736
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x408736
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
push 0x44
pop esi
push esi
lea eax, [ebp - 0x148]
mov byte [ebp - 4], 0x27
push ebx
push eax
call fcn.004188f0
mov eax, dword [ebp - 0x10]
add esp, 0xc
mov dword [ebp - 0x148], esi
cmp dword [eax - 4], 1
jle 0x408596
push dword [eax - 0xc]
lea ecx, [ebp - 0x10]
call fcn.00412c6b
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x148]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne al
test al, al
jne 0x40864f
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x1b5
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov esi, esp
call fcn.00412f7e
push eax
mov ecx, esi
call fcn.0040f3c2
lea ecx, [ebp - 0xc4]
call fcn.004130db
lea eax, [ebp - 0xc4]
mov byte [ebp - 4], 0x28
push eax
mov ecx, edi
call fcn.00402691
mov ecx, dword [ebp - 0xbc]
lea ecx, [ecx - 0x10]
mov dword [ebp - 0x20], 1
call fcn.004130bf
cmp dword [ebp - 0x38], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x408638
push dword [ebp - 0x38]
call esi
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x3c], 0
je 0x408865
push dword [ebp - 0x3c]
call esi
mov dword [ebp - 0x3c], ebx
jmp 0x408865
cmp byte [0x446fcc], 0
jne 0x408696
push 0x12c
push dword [ebp - 0x3c]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
cmp byte [0x446fcc], 0
jne 0x408696
cmp dword [ebp + 0x14], 0
je 0x40867f
push ebx
push dword [ebp + 0x14]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 0x18], 0
je 0x408696
push ebx
push 6
push 0x111
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
setne al
test al, al
jne 0x408713
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x1ca
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov esi, esp
call fcn.00412f7e
push eax
mov ecx, esi
call fcn.0040f3c2
lea ecx, [ebp - 0xb8]
call fcn.004130db
lea eax, [ebp - 0xb8]
mov byte [ebp - 4], 0x29
push eax
mov ecx, edi
call fcn.00402691
mov ecx, dword [ebp - 0xb0]
jmp 0x408615
mov byte [ebp - 4], 0x1c
cmp dword [ebp - 0x38], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x40872b
push dword [ebp - 0x38]
call esi
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x3c], 0
je 0x408736
push dword [ebp - 0x3c]
call esi
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], 0
je 0x4087e0
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x94], ebx
push ebx
push ecx
lea ecx, [eax - 0x10]
mov byte [ebp - 4], 0x2a
lea ebx, [ebp - 0xa0]
mov esi, esp
call fcn.00413040
add eax, 0x10
lea ecx, [ebp - 0xe8]
mov edx, ebx
mov dword [esi], eax
call fcn.00402cc3
pop ecx
pop ecx
mov ecx, dword [ebp - 0xe0]
lea ecx, [ecx - 0x10]
call fcn.004130bf
mov eax, dword [ebp - 0x9c]
mov esi, dword [ebp - 0xa0]
test eax, eax
je 0x4087d1
push eax
push esi
lea ecx, [ebp - 0x58]
call fcn.0040e405
mov ecx, dword [ebp + 0x1c]
mov byte [ebp - 4], 0x2b
push dword [eax]
call fcn.00412704
mov ecx, dword [ebp - 0x58]
lea ecx, [ecx - 0x10]
call fcn.004130bf
mov byte [ebp - 4], 0x1c
test esi, esi
je 0x4087e0
push esi
call fcn.00418a45
pop ecx
cmp byte [0x446fcc], 0
je 0x408849
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x408849
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x1d9
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
push str.The_process_returned_an_error
call fcn.00412bfc
lea ecx, [ebp - 0xf4]
call fcn.004130db
push eax
mov ecx, edi
mov byte [ebp - 4], 0x2c
call fcn.00402691
mov ecx, dword [ebp - 0xec]
mov dword [ebp - 0x20], 1
lea ecx, [ecx - 0x10]
call fcn.004130bf
jmp 0x408865
and dword [edi], 0
and dword [edi + 4], 0
call fcn.00412f7e
push eax
lea ecx, [edi + 8]
call fcn.0040f3c2
mov dword [ebp - 0x20], 1
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.004130bf
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.004130bf
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xb
call fcn.0040392a
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.004130bf
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.004130bf
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.004130bf
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.004130bf
mov ecx, dword [ebp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.004130bf
mov eax, edi
call fcn.0041be31
ret