Function at 0x1003ea30
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10048272
mov eax, dword fs:[0]
push eax
sub esp, 0x7e8
mov eax, dword [0x10056024]
xor eax, esp
mov dword [esp + 0x7e0], eax
push ebx
push esi
push edi
mov eax, dword [0x10056024]
xor eax, esp
push eax
lea eax, [esp + 0x7f8]
mov dword fs:[0], eax
push 0x103
xor edi, edi
lea eax, [esp + 0x3d9]
push edi
push eax
mov esi, ecx
mov byte [esp + 0x3e0], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x48
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x2c], eax
cmp eax, edi
mov dword [esp + 0x800], edi
je 0x1003eab7
push eax
call fcn.10039a50
mov dword [esp + 0x18], eax
jmp 0x1003eabb
mov dword [esp + 0x18], edi
mov dword [esp + 0x800], 0xffffffff
call sub.Encrypt.dll_CreateEncryptObject
mov edx, dword [eax]
mov dword [esp + 0x28], eax
mov ecx, eax
mov eax, dword [edx + 8]
push 2
mov dword [esp + 0x14], edi
call eax
lea ecx, [esp + 0x3d4]
push ecx
push edi
push edi
push 0x23
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jl 0x1003eb4e
lea eax, [esp + 0x3d4]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x1003eb05
mov edx, dword [str.AomeiBRNAS.XML]
mov ecx, dword [0x1004f13c]
mov dword [eax], edx
mov edx, dword [0x1004f140]
mov dword [eax + 4], ecx
mov ecx, dword [0x1004f144]
mov dword [eax + 8], edx
mov dl, byte [0x1004f148]
mov dword [eax + 0xc], ecx
mov byte [eax + 0x10], dl
lea eax, [esp + 0x3d4]
push eax
call ebx
cmp eax, 0xffffffff
jne 0x1003ec20
push 0x104
lea ecx, [esp + 0x3d8]
push edi
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea edx, [esp + 0x3d8]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x3d4]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1003eb82
sub eax, edx
cmp eax, edi
jle 0x1003ebad
mov cl, 0x5c
cmp byte [esp + eax + 0x3d4], cl
je 0x1003eba5
sub eax, 1
cmp eax, edi
jg 0x1003eb93
jmp 0x1003ebad
mov byte [esp + eax + 0x3d4], 0
lea eax, [esp + 0x3d4]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x1003ebb7
mov ecx, dword [str.NAS.XML]
mov edx, dword [0x1004f150]
mov dword [eax], ecx
mov cl, byte [0x1004f154]
mov dword [eax + 4], edx
lea edx, [esp + 0x3d4]
push edx
mov byte [eax + 8], cl
call ebx
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
cmp eax, edi
jne 0x1003ec20
push 0xf9
call fcn.1003dfc0
add esp, 4
mov esi, eax
call sub.Comn.dll_GetObjectLog
mov edx, dword [eax]
push esi
push edi
push str.::GetFileAttributesA_sCurPath____INVALID_FILE_ATTRIBUTES
push str._s_return_code:_0x_08X___s.
push eax
mov eax, dword [edx + 0xc]
call eax
jmp 0x1003f249
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x3d4]
push ecx
push edx
call fcn.10039b00
movzx eax, al
cmp eax, edi
jne 0x1003ec59
push 0xfc
call fcn.1003dfc0
add esp, 4
mov esi, eax
call sub.Comn.dll_GetObjectLog
push esi
push edi
push str.xmlAllTasks__LoadFile_sCurPath__TIXML_ENCODING_UTF8_
jmp 0x1003f23c
mov edi, dword [esi + 0xc]
add esi, 4
cmp dword [esi + 4], edi
mov dword [esp + 0x2c], esi
jbe 0x1003ec6e
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov ebx, dword [esi + 4]
cmp ebx, dword [esi + 8]
jbe 0x1003ec7c
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp ebx, edi
je 0x1003ec91
push ebx
mov ebx, dword [esi + 8]
mov eax, edi
call fcn.10041420
add esp, 4
mov dword [esi + 8], eax
mov eax, dword [esp + 0x18]
mov esi, dword [eax + 0x18]
test esi, esi
je 0x1003ecb4
xor edi, edi
mov edi, edi
mov edx, dword [esi]
mov eax, dword [edx + 0x18]
mov ecx, esi
call eax
test eax, eax
jne 0x1003ecf2
mov esi, dword [esi + 0x28]
cmp esi, edi
jne 0x1003eca0
xor eax, eax
xor edi, edi
xor ecx, ecx
cmp eax, edi
setne cl
mov esi, ecx
cmp esi, edi
jne 0x1003ecfd
push 0x101
call fcn.1003dfc0
add esp, 4
mov edi, eax
call sub.Comn.dll_GetObjectLog
mov edx, dword [eax]
push edi
push esi
push str.__pRoot__NULL_
push str._s_return_code:_0x_08X___s.
push eax
mov eax, dword [edx + 0xc]
call eax
jmp 0x1003f249
mov edx, dword [esi]
mov eax, dword [edx + 0x18]
mov ecx, esi
call eax
jmp 0x1003ecb8
mov esi, dword [eax + 0x18]
cmp esi, edi
je 0x1003ed1c
mov edx, dword [esi]
mov eax, dword [edx + 0x18]
mov ecx, esi
call eax
test eax, eax
jne 0x1003f1e7
mov esi, dword [esi + 0x28]
cmp esi, edi
jne 0x1003ed04
xor eax, eax
mov ebx, eax
mov dword [esp + 0x24], ebx
mov esi, dword [esp + 0x10]
push 0x206
lea ecx, [esp + 0x8a]
push edi
push ecx
mov word [esp + 0x90], di
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea edx, [esp + 0x290]
push edi
push edx
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x103
lea eax, [esp + 0x4e1]
push edi
push eax
mov byte [esp + 0x4e8], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x3f
lea ecx, [esp + 0x399]
push edi
push ecx
mov byte [esp + 0x3a0], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
cmp esi, edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], edi
je 0x1003edae
push esi
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [esp + 0x10], edi
xor eax, eax
cmp ebx, edi
setne al
cmp eax, edi
je 0x1003f221
mov eax, dword [ebx + 0x4c]
add ebx, 0x2c
cmp eax, ebx
je 0x1003edf1
jmp 0x1003edd0
mov esi, dword [eax + 0x14]
add esi, 8
mov edi, str.password
mov ecx, 9
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1003f1f5
mov eax, dword [eax + 0x20]
cmp eax, ebx
jne 0x1003edd0
xor eax, eax
push eax
lea ecx, [esp + 0x34]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
mov dword [esp + 0x800], 1
mov eax, dword [ebx + 0x20]
cmp eax, ebx
je 0x1003ee31
mov esi, dword [eax + 0x14]
add esi, 8
mov edi, str.username
mov ecx, 9
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1003f200
mov eax, dword [eax + 0x20]
cmp eax, ebx
jne 0x1003ee10
xor eax, eax
push eax
lea ecx, [esp + 0x50]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
mov byte [esp + 0x800], 2
mov eax, dword [ebx + 0x20]
cmp eax, ebx
je 0x1003ee71
lea ecx, [ecx]
mov esi, dword [eax + 0x14]
add esi, 8
mov edi, str.nasipname
mov ecx, 0xa
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1003f20b
mov eax, dword [eax + 0x20]
cmp eax, ebx
jne 0x1003ee50
xor eax, eax
push eax
lea ecx, [esp + 0x6c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
mov byte [esp + 0x800], 3
cmp dword [esp + 0x48], 0x10
mov eax, dword [esp + 0x34]
mov dword [esp + 0x1c], 0x104
mov dword [esp + 0x14], 0x40
jae 0x1003eea5
lea eax, [esp + 0x34]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x48]
lea edx, [esp + 0x398]
push edx
push ecx
push eax
call sub.Encrypt.dll_StrToHex
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
push 0
push 0
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x4e8]
push eax
mov eax, dword [esp + 0x24]
push eax
lea eax, [esp + 0x3a8]
push eax
call edx
push 0
push 0
push 0xffffffffffffffff
lea eax, [esp + 0x4e8]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
test esi, esi
mov dword [esp + 0x20], esi
jbe 0x1003f178
xor ecx, ecx
lea eax, [esi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.MSVCR80.dll_void____cdecl_operator_new___unsigned_int_
mov edi, eax
add esp, 4
lea eax, [esi + esi + 2]
push eax
push 0
push edi
mov dword [esp + 0x1c], edi
call sub.MSVCR80.dll_memset
add esp, 0xc
push edi
lea ecx, [esp + 0x4e0]
push ecx
lea ebx, [esp + 0x28]
call fcn.10040120
test eax, eax
je 0x1003f178
push 0x40
lea edx, [esp + 0x310]
push edi
push edx
call dword [sym.imp.MSVCR80.dll_wcsncpy]
add esp, 0xc
test edi, edi
je 0x1003ef84
push edi
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [esp + 0x10], 0
push 0x104
lea eax, [esp + 0x4e0]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x40
lea ecx, [esp + 0x398]
push 0
push ecx
call sub.MSVCR80.dll_memset
mov eax, dword [esp + 0x5c]
add esp, 0xc
cmp dword [esp + 0x64], 0x10
mov dword [esp + 0x1c], 0x104
mov dword [esp + 0x14], 0x40
jae 0x1003efce
lea eax, [esp + 0x50]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x64]
lea ecx, [esp + 0x398]
push ecx
push edx
push eax
call sub.Encrypt.dll_StrToHex
mov ecx, dword [esp + 0x28]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
push 0
push 0
lea edx, [esp + 0x24]
push edx
lea edx, [esp + 0x4e8]
push edx
mov edx, dword [esp + 0x24]
push edx
lea edx, [esp + 0x3a8]
push edx
call eax
push 0
push 0
push 0xffffffffffffffff
lea ecx, [esp + 0x4e8]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
test esi, esi
mov dword [esp + 0x20], esi
jbe 0x1003f178
xor ecx, ecx
lea eax, [esi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.MSVCR80.dll_void____cdecl_operator_new___unsigned_int_
mov edi, eax
add esp, 4
lea eax, [esi + esi + 2]
push eax
push 0
push edi
mov dword [esp + 0x1c], edi
call sub.MSVCR80.dll_memset
add esp, 0xc
push edi
lea ecx, [esp + 0x4e0]
push ecx
lea ebx, [esp + 0x28]
call fcn.10040120
test eax, eax
je 0x1003f178
push 0x40
lea edx, [esp + 0x290]
push edi
push edx
call dword [sym.imp.MSVCR80.dll_wcsncpy]
xor ebx, ebx
add esp, 0xc
cmp edi, ebx
je 0x1003f0ab
push edi
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [esp + 0x10], ebx
push 0x104
lea eax, [esp + 0x4e0]
push ebx
push eax
call sub.MSVCR80.dll_memset
mov ecx, dword [esp + 0x78]
add esp, 0xc
cmp dword [esp + 0x80], 0x10
jae 0x1003f0d3
lea ecx, [esp + 0x6c]
lea edx, [esp + 0x4dc]
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
cmp al, bl
jne 0x1003f0e0
push 0x206
lea ecx, [esp + 0x5ea]
push ebx
push ecx
mov word [esp + 0x5f0], bx
call sub.MSVCR80.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add esp, 0xc
push ebx
push ebx
push 0xffffffffffffffff
lea edx, [esp + 0x4e8]
push edx
push ebx
push 0xfde9
call esi
push eax
lea eax, [esp + 0x5e8]
push eax
push 0xffffffffffffffff
lea ecx, [esp + 0x4e8]
push ecx
push ebx
push 0xfde9
call esi
xor eax, eax
jmp 0x1003f150
movzx ecx, word [esp + eax + 0x5e4]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1003f150
mov esi, dword [esp + 0x2c]
lea eax, [esp + 0x84]
call fcn.10040d60
lea ecx, [esp + 0x68]
mov byte [esp + 0x800], 2
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esp + 0x4c]
mov byte [esp + 0x800], 1
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esp + 0x30]
mov dword [esp + 0x800], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov edx, dword [esp + 0x24]
mov esi, dword [edx + 0x28]
test esi, esi
je 0x1003f1d4
lea esp, [esp]
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
mov ecx, esi
call edx
test eax, eax
jne 0x1003f216
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x1003f1c0
xor eax, eax
test eax, eax
mov dword [esp + 0x24], eax
je 0x1003f24c
xor edi, edi
mov ebx, eax
jmp 0x1003ed24
mov edx, dword [esi]
mov eax, dword [edx + 0x18]
mov ecx, esi
call eax
jmp 0x1003ed1e
mov eax, dword [eax + 0x18]
add eax, 8
jmp 0x1003edf3
mov eax, dword [eax + 0x18]
add eax, 8
jmp 0x1003ee33
mov eax, dword [eax + 0x18]
add eax, 8
jmp 0x1003ee73
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
mov ecx, esi
call edx
jmp 0x1003f1d6
push 0x10e
call fcn.1003dfc0
add esp, 4
mov esi, eax
call sub.Comn.dll_GetObjectLog
push esi
push edi
push str.__pItem__NULL_
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push str._s_return_code:_0x_08X___s.
push eax
call edx
add esp, 0x14
mov edi, dword [esp + 0x18]
xor ebx, ebx
cmp edi, ebx
je 0x1003f281
mov esi, dword [edi + 0x18]
cmp esi, ebx
je 0x1003f271
lea ecx, [ecx]
mov ecx, esi
mov eax, dword [ecx]
mov edx, dword [eax]
mov esi, dword [esi + 0x28]
push 1
call edx
cmp esi, ebx
jne 0x1003f260
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
mov eax, dword [edi]
mov edx, dword [eax]
push 1
mov ecx, edi
call edx
mov eax, dword [esp + 0x28]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x7f8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x7e0]
xor ecx, esp
call fcn.10045f6c
mov esp, ebp
pop ebp
ret