Function at 0x440250
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60a6f8
mov eax, dword fs:[0]
push eax
sub esp, 0x310
mov eax, dword [0x69f000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2e8], ecx
mov dword [ebp - 0x2ec], 0
call fcn.00408570
mov edx, dword [eax + 0xf4]
add eax, 0xf4
push str.Validating_parent_process
push eax
call dword [edx + 4]
xorps xmm0, xmm0
mov dword [ebp - 0x258], 0
xor eax, eax
mov dword [ebp - 0x254], 0
movups xmmword [ebp - 0x268], xmm0
add esp, 8
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x254], 7
mov word [ebp - 0x268], ax
mov dword [ebp - 4], eax
movups xmmword [ebp - 0x250], xmm0
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], 7
mov word [ebp - 0x250], ax
mov byte [ebp - 4], 1
movups xmmword [ebp - 0x238], xmm0
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], 7
mov word [ebp - 0x238], ax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
test eax, eax
je 0x440386
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x440364
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x268]
call fcn.0040be20
lea ecx, [ebp - 0x268]
call fcn.00419680
cmp dword [ebp - 0x254], 8
lea eax, [ebp - 0x268]
mov edx, dword [ebp - 0x268]
lea ecx, [ebp - 0x268]
cmovae eax, edx
lea edi, [ebp - 0x268]
mov dword [ebp - 0x21c], eax
cmovae ecx, edx
mov eax, dword [ebp - 0x258]
cmovae edi, edx
lea esi, [ecx + eax*2]
cmp edi, esi
je 0x4403ef
sub dword [ebp - 0x21c], edi
movzx eax, word [edi]
push eax
call fcn.005df541
mov ecx, dword [ebp - 0x21c]
add esp, 4
mov word [ecx + edi], ax
add edi, 2
cmp edi, esi
jne 0x4403d2
push ecx
call fcn.00418f80
add esp, 4
test al, al
je 0x4404e8
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
push eax
push 0
push 0x410
mov dword [ebp - 0x21c], 0
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
test esi, esi
je 0x44043c
push str.NTDLL.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov edi, eax
test edi, edi
jne 0x44044b
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 0x2e8]
mov dword [ecx + 0x28], 0
jmp 0x4404bb
push str.NtQueryInformationProcess
push edi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
jne 0x440478
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov ecx, dword [ebp - 0x2e8]
mov dword [ecx + 0x28], 0
jmp 0x4404bb
lea ecx, [ebp - 0x21c]
push ecx
push 0x18
lea ecx, [ebp - 0x2e0]
push ecx
push 0
push esi
call eax
test eax, eax
jne 0x44045b
cmp dword [ebp - 0x21c], 0x18
jne 0x44045b
push edi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 0x2e8]
mov eax, dword [ebp - 0x2cc]
mov dword [ecx + 0x28], eax
test eax, eax
jne 0x4404ee
call fcn.00408570
mov ecx, dword [eax + 0xf4]
add eax, 0xf4
push str.Unable_to_obtain_the_parent_process_id.
push str.ElevationManagerError
push eax
call dword [ecx + 0x24]
add esp, 0xc
mov byte [ebp - 0x2e1], 0
jmp 0x440af8
mov ecx, dword [ebp - 0x2e8]
mov ecx, dword [ecx + 0x28]
lea eax, [ebp - 0x238]
push eax
lea edx, [ebp - 0x250]
call fcn.00419970
add esp, 4
test al, al
jne 0x440537
call fcn.00408570
mov ecx, dword [eax + 0xf4]
add eax, 0xf4
push str.Unable_to_obtain_the_parent_process_info.
push str.ElevationManagerError
push eax
call dword [ecx + 0x24]
add esp, 0xc
mov byte [ebp - 0x2e1], 0
jmp 0x440af8
lea ecx, [ebp - 0x250]
call fcn.00419680
mov edx, dword [ebp - 0x23c]
lea eax, [ebp - 0x250]
mov esi, dword [ebp - 0x240]
lea edi, [ebp - 0x250]
cmp edx, 8
lea ecx, [ebp - 0x250]
cmovae eax, dword [ebp - 0x250]
cmovae ecx, dword [ebp - 0x250]
lea esi, [eax + esi*2]
mov eax, dword [ebp - 0x250]
cmovae edi, eax
cmp edi, esi
je 0x4405b9
sub ecx, edi
mov dword [ebp - 0x21c], ecx
nop dword [eax]
movzx eax, word [edi]
push eax
call fcn.005df541
mov ecx, dword [ebp - 0x21c]
add esp, 4
mov word [edi + ecx], ax
add edi, 2
cmp edi, esi
jne 0x440590
mov edx, dword [ebp - 0x23c]
mov eax, dword [ebp - 0x250]
cmp edx, 8
lea ecx, [ebp - 0x250]
mov edx, dword [ebp - 0x258]
lea esi, [ebp - 0x268]
cmovae ecx, eax
cmp dword [ebp - 0x254], 8
cmovae esi, dword [ebp - 0x268]
cmp edx, dword [ebp - 0x240]
jne 0x44085f
test edx, edx
je 0x440606
sub esi, ecx
mov ax, word [ecx + esi]
cmp ax, word [ecx]
jne 0x44085f
add ecx, 2
sub edx, 1
jne 0x4405f1
xorps xmm0, xmm0
mov dword [ebp - 0x288], 0
xor eax, eax
mov dword [ebp - 0x284], 0
movups xmmword [ebp - 0x298], xmm0
mov dword [ebp - 0x288], 0
mov dword [ebp - 0x284], 7
mov word [ebp - 0x298], ax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x298]
call fcn.0046a420
push 0xd
xorps xmm0, xmm0
mov dword [ebp - 0x270], 0
push str.pathValid.txt
lea ecx, [ebp - 0x280]
mov dword [ebp - 0x26c], 0
movups xmmword [ebp - 0x280], xmm0
call fcn.0040c3f0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x288]
test ecx, ecx
je 0x440725
mov eax, dword [ebp - 0x270]
test eax, eax
je 0x440725
lea edi, [eax + ecx]
lea eax, [edi*2 + 0x16]
push eax
call fcn.005d89b1
mov esi, eax
add esp, 4
test esi, esi
je 0x440725
cmp dword [ebp - 0x284], 8
lea ecx, [ebp - 0x298]
lea eax, [edi + 0xb]
cmovae ecx, dword [ebp - 0x298]
push ecx
push eax
push esi
call fcn.005d894d
add esp, 0xc
lea eax, [ebp - 0x280]
cmp dword [ebp - 0x26c], 8
cmovae eax, dword [ebp - 0x280]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x440700
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x298]
call fcn.0040be20
push esi
call fcn.005d8486
add esp, 4
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x280]
call fcn.0040bd90
cmp dword [ebp - 0x284], 8
lea eax, [ebp - 0x298]
cmovae eax, dword [ebp - 0x298]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44077f
cmp dword [ebp - 0x284], 8
lea eax, [ebp - 0x298]
cmovae eax, dword [ebp - 0x298]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
push ecx
mov dl, 1
lea ecx, [ebp - 0x298]
call fcn.0046ad20
add esp, 4
xorps xmm0, xmm0
mov dword [ebp - 0x2b8], 0
xor eax, eax
mov dword [ebp - 0x2b4], 0
movups xmmword [ebp - 0x2c8], xmm0
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 0x2b4], 7
mov word [ebp - 0x2c8], ax
mov byte [ebp - 4], 6
movups xmmword [ebp - 0x2b0], xmm0
mov dword [ebp - 0x2a0], eax
mov dword [ebp - 0x29c], eax
mov dword [ebp - 0x2a0], eax
mov dword [ebp - 0x29c], 7
mov word [ebp - 0x2b0], ax
mov byte [ebp - 4], 7
movups xmmword [ebp - 0x280], xmm0
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x26c], 7
mov word [ebp - 0x280], ax
mov byte [ebp - 4], 8
push 0x118
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.005d5480
add esp, 0xc
mov dword [ebp - 0x12c], 0x11c
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
test eax, eax
je 0x4408e2
mov eax, dword [ebp - 0x128]
mov esi, dword [ebp - 0x124]
jmp 0x4408ee
sub esp, 0x18
lea eax, [ebp - 0x268]
mov ecx, esp
mov dword [ebp - 0x21c], esp
push eax
call fcn.0040bb80
mov byte [ebp - 4], 3
mov byte [ebp - 4], 2
call fcn.004264b0
add esp, 0x18
test al, al
jne 0x440606
call fcn.00408570
cmp dword [ebp - 0x23c], 8
lea edx, [ebp - 0x250]
lea ecx, [ebp - 0x268]
cmovae edx, dword [ebp - 0x250]
cmp dword [ebp - 0x254], 8
lea esi, [eax + 0xf4]
mov eax, dword [esi]
cmovae ecx, dword [ebp - 0x268]
push edx
push ecx
push str.Parent_process_path_is_different._Current_path:__s._Parent_path:__s.
push str.ElevationManagerError
push esi
call dword [eax + 0x24]
add esp, 0x14
mov byte [ebp - 0x2e1], 0
jmp 0x440af8
mov esi, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x21c]
cdq
lea ecx, [ebp - 0x2b0]
push edx
push eax
call fcn.00463940
mov eax, esi
lea ecx, [ebp - 0x280]
cdq
push edx
push eax
call fcn.00463940
add esp, 0x10
mov byte [ebp - 4], 9
mov eax, SysReAllocString
mov ecx, dword [ebp - 0x2a0]
sub eax, ecx
cmp eax, 1
jb 0x440d78
cmp dword [ebp - 0x29c], 8
lea eax, [ebp - 0x2b0]
push 1
cmovae eax, dword [ebp - 0x2b0]
push 0x662818
push ecx
push eax
lea eax, [ebp - 0x2b0]
push eax
push dword [ebp - 0x21c]
lea ecx, [ebp - 0x2e0]
call fcn.004101e0
mov dword [ebp - 0x2ec], 1
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x280]
cmp dword [ebp - 0x26c], 8
lea ecx, [ebp - 0x2e0]
push dword [ebp - 0x270]
cmovae eax, dword [ebp - 0x280]
push eax
call fcn.0040ff20
xor ecx, ecx
mov dword [ebp - 0x2f4], 0
mov dword [ebp - 0x2f0], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x304], xmm0
movups xmmword [ebp - 0x314], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x2f4], xmm0
mov word [eax], cx
lea ecx, [ebp - 0x2c8]
movq qword [ebp - 0x220], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov dword [ebp - 0x2ec], 3
call fcn.0040bd90
movups xmm0, xmmword [ebp - 0x314]
mov esi, 3
xor eax, eax
movups xmmword [ebp - 0x2c8], xmm0
mov dword [ebp - 0x2f4], 0
movq xmm0, qword [ebp - 0x220]
mov dword [ebp - 0x2ec], esi
and esi, 0xfffffffd
movq qword [ebp - 0x2b8], xmm0
mov dword [ebp - 0x2f0], 7
mov word [ebp - 0x304], ax
mov dword [ebp - 0x2ec], esi
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x304]
call fcn.0040bd90
and esi, 0xfffffffe
mov dword [ebp - 0x2ec], esi
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x2e0]
call fcn.0040bd90
cmp dword [ebp - 0x2b4], 8
lea esi, [ebp - 0x2c8]
mov edx, dword [ebp - 0x2b8]
cmovae esi, dword [ebp - 0x314]
cmp edx, 3
jne 0x440b49
mov ecx, 0x66554c
test edx, edx
je 0x440ab5
sub esi, ecx
nop dword [eax + eax]
mov ax, word [ecx + esi]
cmp ax, word [ecx]
jne 0x440b49
add ecx, 2
sub edx, 1
jne 0x440aa0
mov byte [ebp - 0x2e1], 1
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x280]
call fcn.0040bd90
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x2b0]
call fcn.0040bd90
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c8]
call fcn.0040bd90
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x298]
call fcn.0040bd90
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x238]
call fcn.0040bd90
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x250]
call fcn.0040bd90
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x268]
call fcn.0040bd90
mov al, byte [ebp - 0x2e1]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005d077b
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x224], 8
lea eax, [ebp - 0x238]
mov edx, dword [ebp - 0x238]
lea ecx, [ebp - 0x238]
cmovae eax, edx
lea edi, [ebp - 0x238]
mov dword [ebp - 0x21c], eax
cmovae ecx, edx
mov eax, dword [ebp - 0x228]
cmovae edi, edx
lea esi, [ecx + eax*2]
cmp edi, esi
je 0x440bad
sub dword [ebp - 0x21c], edi
nop word [eax + eax]
movzx eax, word [edi]
push eax
call fcn.005df541
mov ecx, dword [ebp - 0x21c]
add esp, 4
mov word [ecx + edi], ax
add edi, 2
cmp edi, esi
jne 0x440b90
push 1
xorps xmm0, xmm0
mov dword [ebp - 0x2f4], 0
push 0x661064
lea ecx, [ebp - 0x304]
mov dword [ebp - 0x2f0], 0
movups xmmword [ebp - 0x304], xmm0
call fcn.0040c3f0
mov byte [ebp - 4], 0xb
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x21c], esp
xorps xmm0, xmm0
lea esi, [ebp - 0x238]
push 0
movups xmmword [ecx], xmm0
push 0x65fe6c
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0040c3f0
mov byte [ebp - 4], 0xc
mov byte [ebp - 4], 0xb
mov edx, esi
lea ecx, [ebp - 0x304]
call fcn.00423670
add esp, 0x18
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x304]
call fcn.0040bd90
push 1
xorps xmm0, xmm0
mov dword [ebp - 0x30c], 0
push 0x662818
lea ecx, [ebp - 0x31c]
mov dword [ebp - 0x308], 0
movups xmmword [ebp - 0x31c], xmm0
call fcn.0040c3f0
mov byte [ebp - 4], 0xd
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2e8], esp
xorps xmm0, xmm0
push 0
movups xmmword [ecx], xmm0
push 0x65fe6c
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0040c3f0
mov byte [ebp - 4], 0xe
mov byte [ebp - 4], 0xd
mov edx, esi
lea ecx, [ebp - 0x31c]
call fcn.00423670
add esp, 0x18
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x31c]
call fcn.0040bd90
mov edi, dword [ebp - 0x238]
mov ecx, esi
mov esi, dword [ebp - 0x224]
cmp esi, 8
mov edx, dword [ebp - 0x228]
push 0x1a
push str.adobe_systems_incorporated
cmovae ecx, edi
push 0
call fcn.0040c360
add esp, 0xc
cmp eax, 0xffffffff
jne 0x440ab5
mov edx, dword [ebp - 0x228]
lea ecx, [ebp - 0x238]
push 0x11
cmp esi, 8
push str.adobe_systems_inc
cmovae ecx, edi
push 0
call fcn.0040c360
add esp, 0xc
cmp eax, 0xffffffff
jne 0x440ab5
mov edx, dword [ebp - 0x228]
lea ecx, [ebp - 0x238]
push 9
cmp esi, 8
push str.adobe_inc
cmovae ecx, edi
push 0
call fcn.0040c360
add esp, 0xc
cmp eax, 0xffffffff
jne 0x440ab5
call fcn.00408570
mov ecx, dword [eax + 0xf4]
add eax, 0xf4
push str.Parent_process_signature_validation_failed.
push str.ElevationManagerError
push eax
call dword [ecx + 0x24]
add esp, 0xc
mov byte [ebp - 0x2e1], 0
jmp 0x440abc
call fcn.004084d0
int3