Function at 0xb7d143
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x294
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
mov ebx, edx
push edi
xor ecx, ecx
mov dword [ebp - 0x254], ebx
mov dword [ebp - 0x244], ecx
lea ecx, [ebp - 0x244]
push ecx
push 0xb28d98
push eax
push 0x4000
push 0xb28bb0
mov dword [ebp - 0x28c], eax
call dword [sym.imp.SHELL32.dll_SHCreateItemInKnownFolder]
mov edi, eax
test edi, edi
js 0xbf314b
push ecx
lea ecx, [ebp - 0x234]
call fcn.00b7dc7e
push 3
xor eax, eax
push 0xb28e78
inc eax
push eax
push dword [ebp - 0x244]
mov dword [ebp - 0x270], eax
call fcn.00b7d92f
mov edi, eax
test edi, edi
js 0xbf3161
lea eax, [ebx + 4]
mov esi, 0xb31a28
push eax
sub esp, 0x14
push 5
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x234]
call fcn.00b7d894
mov edi, eax
test edi, edi
js 0xbf316b
or dword [ebp - 0x284], 0xffffffff
lea eax, [ebp - 0x288]
or dword [ebp - 0x280], 0xffffffff
mov esi, 0xb31a14
push eax
sub esp, 0x14
xor ebx, ebx
mov dword [ebp - 0x288], ebx
push 5
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x234]
call fcn.00b7d9ba
mov edi, eax
test edi, edi
js 0xbf3181
mov ecx, dword [ebp - 0x288]
lea edx, [ebp - 0x260]
or esi, 0xffffffff
mov dword [ebp - 0x260], ebx
mov dword [ebp - 0x25c], esi
mov dword [ebp - 0x258], esi
call fcn.00b7dde3
test eax, eax
jns 0xb7d271
lea eax, [ebp - 0x288]
push eax
lea ecx, [ebp - 0x260]
call fcn.00b7aa48
mov ebx, dword [ebp - 0x260]
push ebx
call dword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathIsRelativeW]
test eax, eax
je 0xbf34be
lea eax, [ebp - 0x220]
xor ebx, ebx
push eax
push 0xb28e68
push 1
push ebx
push 0xb28e58
mov dword [ebp - 0x220], ebx
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
mov edi, eax
test edi, edi
js 0xbf3197
lea eax, [ebp - 0x250]
mov dword [ebp - 0x24c], esi
push eax
sub esp, 0x14
mov dword [ebp - 0x248], esi
mov esi, 0xb31a00
mov dword [ebp - 0x250], ebx
push 5
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x234]
call fcn.00b7d9ba
mov esi, 0xb3052c
test eax, eax
js 0xbf31af
lea ecx, [ebp - 0x250]
call fcn.00b7af24
test al, al
jne 0xbf31be
mov eax, dword [ebp - 0x220]
push dword [ebp - 0x250]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x14]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov edi, eax
test edi, edi
js 0xbf31fb
mov eax, dword [ebp - 0x220]
lea ecx, [ebp - 0x218]
push ecx
mov dword [ebp - 0x218], ebx
push 0xb28e48
mov esi, dword [eax]
push eax
mov ecx, dword [esi + 0x24]
call dword [0xd0cffc]
call dword [esi + 0x24]
mov edi, eax
test edi, edi
js 0xbf3213
mov eax, dword [ebp - 0x218]
mov ecx, dword [eax]
cmp dword [ebp + 0x1c], ebx
jne 0xbf3228
mov esi, dword [ecx + 0x44]
mov ecx, esi
push 0xb28e34
push eax
call dword [0xd0cffc]
call esi
mov edi, eax
test edi, edi
js 0xbf321a
mov eax, dword [ebp - 0x218]
push dword [ebp + 8]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x38]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov edi, eax
test edi, edi
js 0xbf3221
mov eax, dword [ebp - 0x218]
push dword [ebp + 0x1c]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x40]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov edi, eax
test edi, edi
js 0xbf324a
mov esi, dword [ebp - 0x218]
mov ecx, dword [ebp + 0x18]
mov edi, dword [esi]
call fcn.00b7dcbf
mov ecx, dword [edi + 0x3c]
push eax
push esi
call dword [0xd0cffc]
call dword [edi + 0x3c]
mov edi, eax
test edi, edi
js 0xbf3251
mov eax, dword [ebp - 0x220]
lea ecx, [ebp - 0x230]
push ecx
mov dword [ebp - 0x230], ebx
push 0xb28e24
mov esi, dword [eax]
push eax
mov ecx, dword [esi + 0x1c]
call dword [0xd0cffc]
call dword [esi + 0x1c]
mov edi, eax
test edi, edi
js 0xbf3269
mov eax, dword [ebp - 0x230]
lea ecx, [ebp - 0x224]
push ecx
mov dword [ebp - 0x224], ebx
push 0xb28e14
mov esi, dword [eax]
push eax
mov ecx, dword [esi]
call dword [0xd0cffc]
call dword [esi]
mov edi, eax
test edi, edi
js 0xbf3281
lea ecx, [ebp - 0x260]
mov dword [ebp - 0x27c], ebx
mov dword [ebp - 0x278], ebx
mov dword [ebp - 0x274], ebx
call fcn.00b7abdc
mov esi, dword [ebp - 0x25c]
lea ecx, [ebp - 0x27c]
lea eax, [esi + 7]
push eax
push 0xb28e04
call fcn.00b7ace0
mov edi, eax
test edi, edi
js 0xbf3299
mov ebx, dword [ebp - 0x260]
cmp esi, 0xffffffff
je 0xb7d78f
push esi
push ebx
lea ecx, [ebp - 0x27c]
call fcn.00b7aed7
mov edi, eax
test edi, edi
js 0xbf32a7
mov eax, dword [ebp - 0x224]
lea ecx, [ebp - 0x22c]
push ecx
push dword [ebp - 0x27c]
xor edi, edi
push dword [ebp - 0x218]
mov dword [ebp - 0x22c], edi
mov esi, dword [eax]
push eax
mov ecx, dword [esi + 0x18]
call dword [0xd0cffc]
call dword [esi + 0x18]
test eax, eax
js 0xbf33ac
mov eax, dword [ebp - 0x22c]
lea ecx, [ebp - 0x21c]
push ecx
mov dword [ebp - 0x21c], edi
push 0xb28df4
mov esi, dword [eax]
push eax
mov ecx, dword [esi]
call dword [0xd0cffc]
call dword [esi]
mov edi, eax
test edi, edi
js 0xbf32bf
mov eax, dword [ebp - 0x21c]
lea ecx, [ebp - 0x240]
or dword [ebp - 0x23c], 0xffffffff
xor edx, edx
or dword [ebp - 0x238], 0xffffffff
mov dword [ebp - 0x240], edx
mov esi, dword [eax]
push ecx
push 0xb28dd8
push eax
mov ecx, dword [esi + 0x20]
call dword [0xd0cffc]
call dword [esi + 0x20]
test eax, eax
js 0xb7d7b2
mov byte [ebp - 0x211], 1
cmp dword [ebp + 0x1c], 0
jne 0xbf331c
xor eax, eax
mov byte [ebp - 0x270], al
or dword [ebp - 0x268], 0xffffffff
lea edx, [ebp - 0x26c]
or dword [ebp - 0x264], 0xffffffff
mov dword [ebp - 0x26c], eax
mov eax, dword [ebp - 0x21c]
push edx
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x10]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov edi, eax
test edi, edi
js 0xbf3365
mov esi, dword [ebp - 0x254]
mov edx, 0x104
lea ecx, [esi + 8]
push ecx
push dword [ebp - 0x26c]
push ecx
call fcn.00b7dbd0
mov edi, eax
test edi, edi
js 0xbf336c
cmp dword [ebp - 0x26c], 0
mov al, byte [ebp - 0x211]
mov byte [esi], al
mov eax, dword [ebp - 0x270]
mov byte [esi + 1], al
je 0xbf33a5
push dword [ebp - 0x26c]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
xor eax, eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x240], 0
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x264], eax
je 0xb7d639
push dword [ebp - 0x240]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
xor eax, eax
mov dword [ebp - 0x240], eax
mov ecx, dword [ebp - 0x21c]
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x238], eax
test ecx, ecx
je 0xb7d667
mov dword [ebp - 0x21c], eax
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xd0cffc]
call esi
xor eax, eax
mov ecx, dword [ebp - 0x22c]
test ecx, ecx
je 0xb7d687
mov dword [ebp - 0x22c], eax
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x27c]
test eax, eax
je 0xb7d698
push eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov ecx, dword [ebp - 0x224]
test ecx, ecx
je 0xb7d6ba
xor eax, eax
mov dword [ebp - 0x224], eax
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ecx, dword [ebp - 0x230]
test ecx, ecx
je 0xb7d6dc
xor eax, eax
mov dword [ebp - 0x230], eax
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ecx, dword [ebp - 0x218]
test ecx, ecx
je 0xb7d6fe
xor eax, eax
mov dword [ebp - 0x218], eax
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x250]
test eax, eax
je 0xb7d70f
push eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov ecx, dword [ebp - 0x220]
xor eax, eax
test ecx, ecx
je 0xb7d733
mov dword [ebp - 0x220], eax
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xd0cffc]
call esi
xor eax, eax
mov edi, eax
test ebx, ebx
je 0xb7d740
push ebx
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
cmp dword [ebp - 0x288], 0
jne 0xbf3500
lea ecx, [ebp - 0x234]
call fcn.00b7dc86
mov edx, dword [ebp - 0x244]
test edx, edx
je 0xb7d77a
xor eax, eax
mov dword [ebp - 0x244], eax
mov ecx, dword [edx]
push edx
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret 0x18
xor edx, edx
test ebx, ebx
je 0xbf32a0
mov esi, ebx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0xb7d79e
sub esi, ecx
sar esi, 1
jmp 0xb7d4a8
xor eax, eax
mov byte [ebp - 0x211], al
cmp dword [ebp + 0x1c], eax
jne 0xbf331c
push dword [ebp + 0x10]
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x218]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x38]
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
js 0xbf32d7
mov edi, dword [ebp - 0x224]
lea ecx, [ebp - 0x228]
call fcn.00b8ba6f
mov esi, dword [edi]
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x27c]
push dword [ebp - 0x218]
mov ecx, dword [esi + 0x18]
push edi
call dword [0xd0cffc]
call dword [esi + 0x18]
test eax, eax
js 0xbf32de
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x228]
call fcn.00b50626
mov edi, eax
test edi, edi
js 0xbf32fc
mov edi, dword [ebp - 0x21c]
lea ecx, [ebp - 0x240]
call fcn.00b7a9bd
or dword [ebp - 0x23c], 0xffffffff
lea eax, [ebp - 0x240]
or dword [ebp - 0x238], 0xffffffff
mov esi, dword [edi]
push eax
push 0xb28dd8
push edi
mov ecx, dword [esi + 0x20]
call dword [0xd0cffc]
call dword [esi + 0x20]
test eax, eax
setns byte [ebp - 0x211]
lea ecx, [ebp - 0x228]
call fcn.00b8ba6f
jmp 0xb7d56c
mov ecx, dword [ebp + 4]
push edi
push 0xb3052c
push 0x69
pop edx
call fcn.00bc2921
jmp 0xb7d758
push edi
push 0xb3052c
push 0x77
jmp 0xbf3173
push edi
push 0xb3052c
push 0x79
mov ecx, dword [ebp + 4]
pop edx
call fcn.00bc2921
jmp 0xb7d74d
mov ecx, dword [ebp + 4]
push edi
push 0xb3052c
push 0x7c
pop edx
call fcn.00bc2921
jmp 0xb7d740
mov ecx, dword [ebp + 4]
mov edx, 0x8b
push edi
push 0xb3052c
call fcn.00bc2921
jmp 0xbf34a7
mov ecx, dword [ebp + 4]
mov edx, 0x8f
push eax
push esi
call fcn.00b913f8
lea ecx, [ebp - 0x250]
call fcn.00b7a9bd
mov ecx, dword [ebp - 0x28c]
lea edx, [ebp - 0x250]
or dword [ebp - 0x24c], 0xffffffff
or dword [ebp - 0x248], 0xffffffff
call fcn.00cab9e2
mov edi, eax
test edi, edi
jns 0xb7d305
push edi
push esi
mov edx, 0x93
jmp 0xbf3206
push edi
push 0xb3052c
mov edx, 0x96
mov ecx, dword [ebp + 4]
call fcn.00bc2921
jmp 0xbf349c
mov edx, 0x99
jmp 0xbf3256
mov edx, 0x9f
jmp 0xbf3256
mov edx, 0xa0
jmp 0xbf3256
push dword [ebp + 0x10]
mov esi, dword [ecx + 0x38]
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov edi, eax
test edi, edi
jns 0xb7d3ad
mov edx, 0xa4
jmp 0xbf3256
mov edx, 0xa7
jmp 0xbf3256
mov edx, 0xa8
mov ecx, dword [ebp + 4]
push edi
push 0xb3052c
call fcn.00bc2921
jmp 0xbf3491
mov ecx, dword [ebp + 4]
mov edx, 0xab
push edi
push 0xb3052c
call fcn.00bc2921
jmp 0xbf3486
mov ecx, dword [ebp + 4]
mov edx, 0xae
push edi
push 0xb3052c
call fcn.00bc2921
jmp 0xbf347b
mov edx, 0xb1
jmp 0xbf32ac
mov esi, edx
jmp 0xb7d4a8
mov edx, 0xb2
mov ecx, dword [ebp + 4]
push edi
push 0xb3052c
call fcn.00bc2921
jmp 0xbf3470
mov ecx, dword [ebp + 4]
mov edx, 0xb8
push edi
push 0xb3052c
call fcn.00bc2921
jmp 0xbf3395
mov edx, 0xc2
jmp 0xbf32e3
mov edx, 0xc3
mov ecx, dword [ebp + 4]
push eax
push 0xb3052c
call fcn.00b913f8
mov ebx, dword [ebp - 0x260]
jmp 0xb7d884
mov ecx, dword [ebp + 4]
mov edx, 0xc5
push edi
push 0xb3052c
call fcn.00bc2921
lea ecx, [ebp - 0x228]
call fcn.00b8ba6f
jmp 0xbf338a
mov edi, dword [ebp - 0x21c]
lea ecx, [ebp - 0x240]
call fcn.00b7a9bd
or dword [ebp - 0x23c], 0xffffffff
lea eax, [ebp - 0x240]
or dword [ebp - 0x238], 0xffffffff
mov esi, dword [edi]
push eax
push 0xb470f4
push edi
mov ecx, dword [esi + 0x20]
call dword [0xd0cffc]
call dword [esi + 0x20]
test eax, eax
js 0xb7d576
xor eax, eax
jmp 0xb7d57e
mov edx, 0xcd
jmp 0xbf3371
mov edx, 0xce
mov ecx, dword [ebp + 4]
push edi
push 0xb3052c
call fcn.00bc2921
lea ecx, [ebp - 0x26c]
call fcn.00b7a9bd
lea ecx, [ebp - 0x240]
call fcn.00b7a9bd
lea ecx, [ebp - 0x21c]
call fcn.00b8ba6f
jmp 0xbf3465
xor eax, eax
jmp 0xb7d610
lea eax, [ebp - 0x210]
mov esi, 0x104
push eax
lea eax, [ebp - 0x290]
mov dword [ebp - 0x290], esi
push eax
push dword [ebp - 0x250]
call dword [sym.imp.api_ms_win_appmodel_runtime_l1_1_1.dll_GetStagedPackagePathByFullName]
test eax, eax
je 0xbf33ea
mov ecx, dword [ebp + 4]
lea edx, [esi - 0x2b]
push eax
push 0xb3052c
call fcn.00ca90dc
mov edi, eax
jmp 0xbf3465
push ebx
lea eax, [ebp - 0x210]
push eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchCombine]
mov edi, eax
test edi, edi
jns 0xbf3407
mov edx, 0xda
jmp 0xbf3457
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathFileExistsW]
test eax, eax
jne 0xbf3432
mov ecx, dword [ebp + 4]
mov edi, 0x80070003
push edi
push 0xb3052c
mov edx, 0xdb
call fcn.00bc28ed
jmp 0xbf3465
mov esi, dword [ebp - 0x254]
lea eax, [ebp - 0x210]
push eax
mov edx, 0x104
lea ecx, [esi + 8]
call fcn.00b7db60
mov edi, eax
test edi, edi
jns 0xbf34b4
mov edx, 0xdd
mov ecx, dword [ebp + 4]
push edi
push 0xb3052c
call fcn.00bc2921
lea ecx, [ebp - 0x22c]
call fcn.00b8ba6f
lea ecx, [ebp - 0x27c]
call fcn.00b7a9bd
lea ecx, [ebp - 0x224]
call fcn.00b8ba6f
lea ecx, [ebp - 0x230]
call fcn.00b82546
lea ecx, [ebp - 0x218]
call fcn.00b8ba6f
lea ecx, [ebp - 0x250]
call fcn.00b7a9bd
lea ecx, [ebp - 0x220]
call fcn.00b8ba6f
jmp 0xbf34eb
xor eax, eax
mov word [esi], ax
jmp 0xb7d667
mov esi, dword [ebp - 0x254]
mov edx, 0x104
push ebx
lea ecx, [esi + 8]
call fcn.00b7db60
mov edi, eax
test edi, edi
jns 0xbf34f6
mov ecx, dword [ebp + 4]
mov edx, pe_nt_image_headers32
push edi
push 0xb3052c
call fcn.00bc2921
mov ebx, dword [ebp - 0x260]
jmp 0xb7d735
xor eax, eax
mov word [esi], ax
jmp 0xb7d733
push dword [ebp - 0x288]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
jmp 0xb7d74d