Function at 0x430490
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push r14
push r13
push rdi
push rsi
push rbx
sub rsp, 0x2b8
mov rbp, rsp
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x80], 0
nop
xor rdi, rdi
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax + 0x18]
call fcn.00436d10
mov rbx, rax
test rbx, rbx
je 0x430519
mov rax, rbx
mov rcx, rax
call fcn.0040a830
mov r13d, eax
jmp 0x43051c
xor r13, r13
cmp r13d, 0x104
jl 0x43053d
mov rax, qword [0x004498a8]
mov dword [rax], 0x233f
xor rax, rax
mov dword [rbp + 0x44], eax
jmp 0x430e76
mov rax, qword [0x00449430]
cmp byte [rax], 0
je 0x430572
mov rcx, rbx
lea rdx, [0x00430ec8]
mov r8d, 4
call fcn.0041b8b0
test eax, eax
jne 0x430572
lea rcx, [0x00430ed2]
call fcn.0042b900
mov rbx, rax
lea rcx, [rbp + 0x9a]
xor rdx, rdx
mov r8d, 0x104
call fcn.00423760
lea rcx, [rbp + 0x9a]
mov rdx, rbx
call fcn.004235d0
lea rcx, [rbp + 0x9a]
mov dx, 0x2f
call fcn.0042e690
mov word [rbp + 0x2aa], 0x5c
mov word [rbp + 0x2ac], 0x3a
mov word [rbp + 0x2ae], 0
lea rcx, [rbp + 0x9a]
lea rdx, [rbp + 0x2aa]
call fcn.00423610
cmp eax, r13d
setl al
mov byte [rbp + 0x2f], al
mov word [rbp + 0x2ac], 0
movzx rax, byte [rbp + 0x2f]
test al, al
je 0x43063c
lea rcx, [rbp + 0x9a]
mov dx, 0x5c
call fcn.00423540
mov rbx, rax
test rbx, rbx
jne 0x430636
xor rbx, rbx
lea rax, [rbp + 0x9a]
test rax, rax
je 0x430636
lea rax, [rbp + 0x9a]
jmp 0x43062f
cmp word [rax], 0x3a
jne 0x43062b
mov rbx, rax
jmp 0x430635
add rax, 2
cmp word [rax], 0
jne 0x430620
nop
add rbx, 2
jmp 0x430643
lea rbx, [rbp + 0x9a]
test rbx, rbx
je 0x43066e
mov rcx, rbx
lea rdx, [0x00430ee2]
call fcn.0041b780
test eax, eax
je 0x43066e
mov rcx, rbx
lea rdx, [0x00430ee6]
call fcn.0041b780
test eax, eax
jne 0x4306b6
mov rax, qword [0x00449430]
cmp byte [rax], 0
je 0x43069e
mov rcx, qword [rbp + 0x20]
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x43069e
test eax, 0x10
je 0x43069e
mov eax, 5
mov dword [rbp + 0x44], eax
jmp 0x430e76
mov rax, qword [0x004498a8]
mov dword [rax], 0x2331
xor rax, rax
mov dword [rbp + 0x44], eax
jmp 0x430e76
mov ecx, 0x410
call fcn.00424200
mov rsi, rax
test rsi, rsi
jne 0x4306e4
mov rax, qword [0x004498a8]
mov dword [rax], 8
mov eax, 3
mov dword [rbp + 0x44], eax
jmp 0x430e76
mov rcx, qword [rbp + 0x20]
lea rdx, [rbp + 0x9a]
call fcn.004235d0
lea rax, [rbp + 0x9a]
test rax, rax
je 0x430714
lea rax, [rbp + 0x9a]
mov rcx, rax
call fcn.0040a830
mov r13d, eax
jmp 0x430717
xor r13, r13
mov rax, rbx
mov rcx, rax
call fcn.0040a830
movsxd r13, r13d
mov eax, eax
neg rax
lea rax, [r13 + rax]
mov rcx, qword [rbp + 0x20]
mov word [rcx + rax*2], 0
lea rdx, [0x00430ee2]
call fcn.004235f0
mov rcx, rsi
mov rdx, qword [rbp + 0x20]
mov r8d, 0x208
call fcn.0042db10
test eax, eax
je 0x4307a4
mov rax, qword [0x00449430]
cmp byte [rax], 0
je 0x43078c
mov rcx, qword [rbp + 0x20]
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x43078c
test eax, 0x10
je 0x43078c
mov eax, 5
mov dword [rbp + 0x44], eax
jmp 0x430e76
mov rax, qword [0x004498a8]
mov dword [rax], 0x2331
xor rax, rax
mov dword [rbp + 0x44], eax
jmp 0x430e76
mov rcx, rsi
call fcn.00423780
cmp word [rax], 0x5c
je 0x4307c1
mov rcx, rsi
lea rdx, [0x00430eec]
call fcn.004235f0
mov rcx, rsi
mov rdx, rbx
call fcn.004235f0
test rsi, rsi
je 0x4307de
mov rax, rsi
mov rcx, rax
call fcn.0040a830
jmp 0x4307e1
xor rax, rax
mov rcx, rsi
mov edx, eax
add edx, 1
add edx, edx
call fcn.00424300
mov rsi, rax
mov rcx, rsi
mov dx, 0x5c
call fcn.00423540
mov qword [rbp + 0x30], rax
mov word [rax], 0
add rax, 2
mov qword [rbp + 0x30], rax
movzx rax, byte [rbp + 0x2f]
test al, al
jne 0x430828
lea rcx, [0x00430ef0]
call fcn.0042b900
mov rdi, rax
test rsi, rsi
je 0x43083c
mov rax, rsi
mov rcx, rax
call fcn.0040a830
mov ebx, eax
jmp 0x43083f
xor rbx, rbx
test rdi, rdi
je 0x430851
mov rax, rdi
mov rcx, rax
call fcn.0040a830
jmp 0x430854
xor rax, rax
mov ecx, ebx
add ecx, eax
add ecx, 4
add ecx, ecx
call fcn.00424200
mov qword [rbp + 0x38], rax
mov rax, qword [rbp + 0x38]
test rax, rax
jne 0x43088a
mov rax, qword [0x004498a8]
mov dword [rax], 8
mov eax, 3
mov dword [rbp + 0x44], eax
jmp 0x430e76
mov rcx, qword [rbp + 0x38]
lea rdx, [0x00430efa]
call fcn.004235f0
mov rcx, qword [rbp + 0x38]
mov rdx, rsi
call fcn.004235f0
mov rcx, qword [rbp + 0x38]
lea rdx, [0x00430efa]
call fcn.004235f0
movzx rax, byte [rbp + 0x2f]
test al, al
jne 0x4308db
mov rcx, qword [rbp + 0x38]
lea rdx, [0x00430efe]
call fcn.004235f0
mov rcx, qword [rbp + 0x38]
mov rdx, rdi
call fcn.004235f0
mov rcx, qword [rbp + 0x38]
call fcn.004314f0
mov rcx, qword [rbp + 0x38]
lea rdx, [0x00430efe]
mov r8d, 1
call fcn.0042e9f0
mov qword [rbp + 0x38], rax
mov rax, qword [rbp + 0x30]
test rax, rax
je 0x430916
mov rax, qword [rbp + 0x30]
mov rcx, rax
call fcn.0040a830
jmp 0x430919
xor rax, rax
mov r13d, eax
add r13d, 1
mov rax, qword [0x00449430]
cmp byte [rax], 0
je 0x43093d
lea rcx, [0x00430f02]
call fcn.0042b900
mov rbx, rax
jmp 0x430944
lea rbx, [0x00430f12]
mov rcx, rbx
call fcn.004314f0
mov rcx, rbx
lea rdx, [0x00430efe]
mov r8d, 1
call fcn.0042e9f0
mov rbx, rax
mov rax, qword [rbp + 0x38]
test rax, rax
je 0x43097e
mov rax, qword [rbp + 0x38]
mov rcx, rax
call fcn.0040a830
mov esi, eax
jmp 0x430981
xor rsi, rsi
mov rcx, qword [rbp + 0x38]
call fcn.00436d10
mov rcx, qword [rbp + 0x38]
mov rdx, rax
call fcn.004235d0
mov rax, qword [rbp + 0x38]
test rax, rax
je 0x4309af
mov rax, qword [rbp + 0x38]
mov rcx, rax
call fcn.0040a830
mov edi, eax
jmp 0x4309b2
xor rdi, rdi
mov rcx, qword [rbp + 0x38]
call fcn.00423780
cmp word [rax], 0x5c
je 0x4309cc
mov r14b, 1
add esi, 1
add edi, 1
jmp 0x4309cf
xor r14, r14
mov rax, qword [rbp + 0x38]
cmp word [rax], 0
je 0x430a1b
mov eax, edi
movsxd rcx, r13d
lea rax, [rax + rcx]
cmp rax, 0x104
jle 0x430a1b
test r14b, r14b
je 0x430a06
movsxd rsi, esi
add rsi, rsi
mov rax, qword [rbp + 0x38]
add rax, rsi
mov qword [rbp + 0x38], rax
jmp 0x430965
movsxd rsi, esi
mov rax, qword [rbp + 0x38]
lea rax, [rax + rsi*2 + 2]
mov qword [rbp + 0x38], rax
jmp 0x430965
mov rax, qword [rbp + 0x38]
cmp word [rax], 0
jne 0x430a6d
movzx rax, byte [rbp + 0x2f]
test al, al
je 0x430a55
mov rax, qword [0x004498a8]
cmp dword [rax], 0
je 0x430a46
mov rax, qword [0x004498a8]
cmp dword [rax], 2
jne 0x430a62
mov rax, qword [0x004498a8]
mov dword [rax], 0x2331
jmp 0x430a62
mov rax, qword [0x004498a8]
mov dword [rax], 0x2331
xor rax, rax
mov dword [rbp + 0x44], eax
jmp 0x430e76
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x38]
call fcn.004235d0
test r14b, r14b
je 0x430a92
movsxd rsi, esi
add rsi, rsi
mov rax, qword [rbp + 0x38]
add rax, rsi
mov qword [rbp + 0x38], rax
jmp 0x430aa2
movsxd rsi, esi
mov rax, qword [rbp + 0x38]
lea rax, [rax + rsi*2 + 2]
mov qword [rbp + 0x38], rax
test r14b, r14b
je 0x430ab7
mov rcx, qword [rbp + 0x20]
lea rdx, [rbp + 0x2aa]
call fcn.004235f0
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x30]
call fcn.004235f0
mov rcx, qword [rbp + 0x20]
call fcn.00436d10
mov rcx, qword [rbp + 0x20]
mov rdx, rax
call fcn.004235d0
mov rax, qword [rbp + 0x20]
test rax, rax
je 0x430af3
mov rax, qword [rbp + 0x20]
mov rcx, rax
call fcn.0040a830
mov r14d, eax
jmp 0x430af6
xor r14, r14
mov rax, qword [rbp + 0x20]
cmp word [rax + 2], 0x3a
jne 0x430b16
mov rax, qword [rbp + 0x20]
movzx rcx, word [rax]
call fcn.00436bc0
test al, al
je 0x430965
mov rcx, qword [rbp + 0x30]
mov dx, 0x2e
call fcn.00423540
mov rsi, rax
test rsi, rsi
je 0x430c40
cmp word [rsi + 2], 0
je 0x430c40
mov rcx, qword [rbp + 0x20]
mov dl, 1
call fcn.0042e560
test al, al
jne 0x430b66
movzx rax, byte [rbp + 0x2f]
test al, al
je 0x430c24
mov rax, qword [0x004498a8]
cmp dword [rax], 5
jne 0x430c24
lea rcx, [rbp + 0x80]
mov rdx, qword [rbp + 0x20]
call fcn.0040afd0
lea rcx, [rbp + 0x88]
mov rdx, qword [rbp + 0x80]
call fcn.0041b540
mov rcx, qword [rbp + 0x88]
call fcn.0040af50
mov rbx, rax
lea rcx, [rbp + 0x70]
call fcn.00423410
lea rcx, [rbp + 0x78]
mov rdx, qword [rbp + 0x70]
call fcn.0041b540
mov rcx, qword [rbp + 0x78]
call fcn.0040af50
mov rcx, rbx
mov rdx, rax
call fcn.0041b7b0
test eax, eax
jne 0x430bd4
mov eax, 2
mov dword [rbp + 0x44], eax
jmp 0x430e76
mov rcx, rsi
lea rdx, [0x00430f3a]
call fcn.0041b7b0
test eax, eax
jne 0x430bf5
mov eax, 2
mov dword [rbp + 0x44], eax
jmp 0x430e76
mov rcx, rsi
lea rdx, [0x00430f44]
call fcn.0041b7b0
test eax, eax
jne 0x430c16
mov eax, 2
mov dword [rbp + 0x44], eax
jmp 0x430e76
mov eax, 1
mov dword [rbp + 0x44], eax
jmp 0x430e76
mov rax, qword [0x004498a8]
cmp dword [rax], 2
je 0x430c40
mov rax, qword [0x004498a8]
cmp dword [rax], 0
jne 0x430965
xor rax, rax
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x430c68
mov rcx, qword [rbp + 0x30]
jmp 0x430c61
cmp word [rcx], 0x2a
jne 0x430c5d
mov rax, rcx
jmp 0x430c67
add rcx, 2
cmp word [rcx], 0
jne 0x430c52
nop
test rax, rax
je 0x430c71
mov al, 1
jmp 0x430c9f
xor rax, rax
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x430c99
mov rcx, qword [rbp + 0x30]
jmp 0x430c92
cmp word [rcx], 0x3f
jne 0x430c8e
mov rax, rcx
jmp 0x430c98
add rcx, 2
cmp word [rcx], 0
jne 0x430c83
nop
test rax, rax
setne al
test al, al
je 0x430cbb
mov rax, qword [0x004498a8]
mov dword [rax], 0x2331
xor rax, rax
mov dword [rbp + 0x44], eax
jmp 0x430e76
mov rsi, rbx
mov rcx, qword [rbp + 0x20]
mov edx, r14d
lea r8, [0x00430f4e]
xor r9, r9
call fcn.00430f60
test eax, eax
je 0x430e04
jmp 0x430df9
test rsi, rsi
je 0x430cf3
mov rax, rsi
mov rcx, rax
call fcn.0040a830
jmp 0x430cf6
xor rax, rax
movsxd rcx, r13d
mov edx, edi
lea rcx, [rcx + rdx]
movsxd rax, eax
lea rax, [rcx + rax]
cmp rax, 0x104
jg 0x430def
mov rcx, qword [rbp + 0x20]
mov edx, r14d
mov r8, rsi
mov r9b, 1
call fcn.00430f60
test eax, eax
je 0x430dd1
mov rcx, rsi
lea rdx, [0x00430f44]
call fcn.0041b7b0
test eax, eax
je 0x430d53
mov rcx, rsi
lea rdx, [0x00430f3a]
call fcn.0041b7b0
test eax, eax
jne 0x430d61
mov eax, 2
mov dword [rbp + 0x44], eax
jmp 0x430e76
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x20]
call fcn.0040afd0
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
call fcn.0041b540
mov rcx, qword [rbp + 0x68]
call fcn.0040af50
mov rbx, rax
lea rcx, [rbp + 0x50]
call fcn.00423410
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x50]
call fcn.0041b540
mov rcx, qword [rbp + 0x58]
call fcn.0040af50
mov rcx, rbx
mov rdx, rax
call fcn.0041b7b0
test eax, eax
jne 0x430dc3
mov eax, 2
mov dword [rbp + 0x44], eax
jmp 0x430e76
mov eax, 1
mov dword [rbp + 0x44], eax
jmp 0x430e76
mov rax, qword [0x004498a8]
cmp dword [rax], 2
je 0x430def
mov rax, qword [0x004498a8]
cmp dword [rax], 0
jne 0x430e03
jmp 0x430def
add rsi, 2
cmp word [rsi], 0
jne 0x430deb
add rsi, 2
cmp word [rsi], 0
jne 0x430ce1
nop
mov rax, qword [0x004498a8]
cmp dword [rax], 0
je 0x430e20
mov rax, qword [0x004498a8]
cmp dword [rax], 2
jne 0x430965
mov rcx, qword [rbp + 0x20]
mov edx, r14d
xor r8, r8
mov r9b, 1
call fcn.00430f60
test eax, eax
je 0x430965
mov rcx, qword [rbp + 0x20]
lea rdx, [rbp + 0x2a4]
call sub.kernel32.dll_GetBinaryTypeW
test eax, eax
je 0x430965
cmp dword [rbp + 0x2a4], 4
jne 0x430965
mov eax, 1
mov dword [rbp + 0x44], eax
jmp 0x430e76
lea rcx, [rbp + 0x50]
mov edx, 8
call fcn.0040a1f0
mov eax, dword [rbp + 0x44]
lea rsp, [rbp + 0x2b8]
pop rbx
pop rsi
pop rdi
pop r13
pop r14
pop rbp
ret