Function at 0x41e690
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x574d68
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x5e5044]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41e989
test al, 0x10
jne 0x41e989
push 0
push dword [esi]
lea ecx, [ebp - 0x30]
call fcn.0042f562
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0
call fcn.0042fac3
mov ebx, eax
lea ecx, [ebx - 0x1000]
cmp ecx, 0x3ffff000
ja 0x41e969
cdq
xor ecx, ecx
and edx, 3
add eax, edx
mov edx, 4
sar eax, 2
add eax, 3
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00421aa6
add esp, 4
lea ecx, [ebp - 0x30]
mov esi, eax
push ebx
push esi
call fcn.0042fd7d
mov al, byte [esi]
xor edi, edi
cmp al, 0x4c
jne 0x41e82a
cmp byte [esi + 1], 0x65
jne 0x41e82a
cmp byte [esi + 2], 0x65
jne 0x41e82a
movzx ecx, byte [esi + ebx - 1]
movzx eax, byte [esi + ebx - 2]
movzx edx, byte [esi + 6]
shl ecx, 8
add ecx, eax
mov dword [ebp - 0x18], edx
movzx eax, byte [esi + ebx - 3]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + ebx - 4]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 4]
mov dword [ebp + 8], eax
movzx eax, byte [esi + 7]
shl eax, 8
add eax, edx
mov dword [ebp - 0x10], ecx
movzx ecx, byte [esi + 5]
shl eax, 8
add eax, ecx
mov dword [ebp - 0x1c], ecx
shl eax, 8
lea ecx, [ebx - 0xc]
add eax, dword [ebp + 8]
cmp eax, ecx
jne 0x41e936
lea ecx, [edi + 8]
lea eax, [ebx - 4]
cmp eax, ecx
jle 0x41e7ce
lea edx, [ebx - 4]
nop
movzx eax, byte [ecx + esi]
inc ecx
add edi, eax
cmp ecx, edx
jl 0x41e7c0
mov edx, dword [ebp - 0x18]
cmp edi, dword [ebp - 0x10]
je 0x41e932
shl edx, 8
lea eax, [ebx - 0xc]
add edx, dword [ebp - 0x1c]
xor edi, edi
shl edx, 8
add edx, dword [ebp + 8]
cmp edx, eax
jne 0x41e936
lea eax, [ebx - 0xc]
cdq
and edx, 3
add eax, edx
sar eax, 2
test eax, eax
jle 0x41e80d
lea ecx, [esi + 8]
add edi, dword [ecx]
lea ecx, [ecx + 4]
sub eax, 1
jne 0x41e803
cmp edi, dword [ebp - 0x10]
jne 0x41e936
mov eax, dword [ebp - 0x14]
mov bl, 1
mov dword [eax + 0x1d0], 0
jmp 0x41e938
test al, al
je 0x41e936
cmp byte [esi + 1], 0
je 0x41e936
cmp byte [esi + 2], 0
je 0x41e936
mov al, byte [esi + 3]
test al, al
je 0x41e936
cmp al, 0x30
je 0x41e8c8
cmp al, 0x31
je 0x41e8c8
cmp al, 0x41
je 0x41e8c8
movzx ecx, byte [esi + 0x6f]
movzx eax, byte [esi + 0x6e]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 0x6d]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 0x6c]
shl ecx, 8
add ecx, eax
lea eax, [ebx - 0x74]
cmp ecx, eax
jne 0x41e936
xor edx, edx
mov ecx, 0x74
mov dword [ebp + 8], edx
cmp ebx, ecx
jle 0x41e902
lea eax, [ebx - 0x74]
cmp eax, 2
jl 0x41e8b7
lea edi, [ebx - 1]
movzx eax, byte [esi + ecx]
add edx, eax
movzx eax, byte [esi + ecx + 1]
add dword [ebp + 8], eax
add ecx, 2
cmp ecx, edi
jl 0x41e8a0
xor edi, edi
cmp ecx, ebx
jge 0x41e8bf
movzx edi, byte [ecx + esi]
mov eax, dword [ebp + 8]
add eax, edx
add edi, eax
jmp 0x41e902
movzx ecx, byte [esi + 6]
movzx eax, byte [esi + 5]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 4]
shl ecx, 8
add ecx, eax
lea eax, [ebx - 0xc]
cmp ecx, eax
jne 0x41e936
lea eax, [ebx - 0xc]
cdq
and edx, 3
add eax, edx
sar eax, 2
test eax, eax
jle 0x41e902
lea ecx, [esi + 8]
add edi, dword [ecx]
lea ecx, [ecx + 4]
sub eax, 1
jne 0x41e8f8
movzx ecx, byte [esi + 0x73]
movzx eax, byte [esi + 0x72]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 0x71]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 0x70]
shl ecx, 8
add ecx, eax
cmp edi, ecx
jne 0x41e936
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x1d0], 1
mov bl, 1
jmp 0x41e938
xor bl, bl
push 4
push esi
call fcn.0054cce7
add esp, 8
lea ecx, [ebp - 0x30]
call fcn.0042f8ea
lea ecx, [ebp - 0x30]
call fcn.0042f624
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x30]
xor bl, bl
call fcn.0042f624
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4