Function at 0x70e1cc36
Capabilities:
Check if file exists
Get file attributes
Get system information on windows
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x70e6ef18
mov eax, dword fs:[0]
push eax
sub esp, 0x478
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x440], eax
mov dword [ebp - 0x450], ecx
mov dword [ebp - 0x44c], esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edi, eax
mov dword [ebp - 0x444], edi
cmp word [edi], si
je 0x70e1d066
mov edi, edi
push 4
mov dword [ebp - 0x43c], esi
call fcn.70df39ac
add esp, 4
cmp eax, esi
je 0x70e1ccb8
mov dword [eax], 1
mov dword [ebp - 0x438], eax
jmp 0x70e1ccbe
mov dword [ebp - 0x438], esi
lea edx, [ebp - 0x43c]
push edx
mov dword [ebp - 4], 1
call fcn.70df3e38
mov dword [ebp - 4], 2
mov ecx, SysReAllocString
mov eax, 0x70e1d1bc
lea esp, [esp]
cmp word [eax], si
je 0x70e1cd15
add eax, 2
dec ecx
jne 0x70e1cce5
push 0x70e77804
lea ecx, [ebp - 0x21c]
push ecx
mov dword [ebp - 0x218], 0x80070057
mov dword [ebp - 0x21c], 0x70e07854
call fcn.70e610ef
cmp ecx, esi
je 0x70e1ccf0
mov edi, dword [ebp - 0x43c]
mov eax, SysReAllocString
sub eax, ecx
cmp dword [edi], eax
jl 0x70e1cfbe
mov ebx, dword [sym.imp.KERNEL32.dll_CompareStringW]
push eax
push 0x70e1d1bc
push eax
lea esi, [edi + 4]
push esi
push 1
push 0x400
call ebx
cmp eax, 2
sete al
test al, al
je 0x70e1cfbe
mov ecx, SysReAllocString
mov eax, 0x70e1d1e4
cmp word [eax], 0
je 0x70e1cd91
add eax, 2
dec ecx
jne 0x70e1cd60
push 0x70e77804
lea edx, [ebp - 0x424]
push edx
mov dword [ebp - 0x420], 0x80070057
mov dword [ebp - 0x424], 0x70e07854
call fcn.70e610ef
test ecx, ecx
je 0x70e1cd6c
mov eax, SysReAllocString
sub eax, ecx
mov ecx, dword [edi]
cmp ecx, eax
jl 0x70e1cfbe
push eax
push 0x70e1d1e4
push eax
sub ecx, eax
lea eax, [esi + ecx*2]
push eax
push 1
push 0x400
call ebx
cmp eax, 2
sete al
test al, al
je 0x70e1cfbe
mov eax, dword [edi]
add eax, 0xffffffda
push eax
push 0x12
lea esi, [ebp - 0x434]
lea ecx, [ebp - 0x43c]
call fcn.70e176ae
mov byte [ebp - 4], 3
sub esp, 8
mov esi, esp
mov dword [ebp - 0x480], esp
push 4
mov dword [ebp - 0x448], esi
mov dword [esi], 0
call fcn.70df39ac
add esp, 4
test eax, eax
je 0x70e1ce14
mov dword [eax], 1
jmp 0x70e1ce16
xor eax, eax
mov dword [esi + 4], eax
mov edi, dword [ebp - 0x450]
mov byte [ebp - 4], 4
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
cmp esi, edi
je 0x70e1ce5c
push eax
call ebx
test eax, eax
jne 0x70e1ce4b
mov eax, dword [esi + 4]
push eax
call fcn.70df3455
mov eax, dword [esi]
add esp, 4
push eax
call fcn.70df3455
add esp, 4
mov ecx, dword [edi]
mov dword [esi], ecx
mov eax, dword [edi + 4]
push eax
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
sub esp, 8
mov byte [ebp - 4], 5
mov esi, esp
mov dword [ebp - 0x448], esp
push 4
mov dword [ebp - 0x448], esi
mov dword [esi], 0
call fcn.70df39ac
add esp, 4
test eax, eax
je 0x70e1ce8d
mov dword [eax], 1
jmp 0x70e1ce8f
xor eax, eax
mov dword [esi + 4], eax
lea edx, [ebp - 0x434]
mov byte [ebp - 4], 6
cmp esi, edx
je 0x70e1cedc
push eax
call ebx
test eax, eax
jne 0x70e1cebe
mov eax, dword [esi + 4]
push eax
call fcn.70df3455
mov eax, dword [esi]
add esp, 4
push eax
call fcn.70df3455
add esp, 4
mov eax, dword [ebp - 0x434]
mov dword [esi], eax
mov ecx, dword [ebp - 0x430]
mov dword [esi + 4], ecx
mov edx, dword [ebp - 0x430]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea eax, [ebp - 0x42c]
mov byte [ebp - 4], 5
push eax
mov byte [ebp - 4], 3
call fcn.70e1ec54
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x42c]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x70e1cfc6
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x428]
push ecx
call ebx
test eax, eax
jne 0x70e1cf3c
mov edx, dword [ebp - 0x428]
push edx
call fcn.70df3455
mov eax, dword [ebp - 0x42c]
add esp, 4
push eax
call fcn.70df3455
add esp, 4
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x430]
push ecx
call ebx
test eax, eax
jne 0x70e1cf6b
mov edx, dword [ebp - 0x430]
push edx
call fcn.70df3455
mov eax, dword [ebp - 0x434]
add esp, 4
push eax
call fcn.70df3455
add esp, 4
mov edi, dword [ebp - 0x43c]
mov eax, dword [edi]
mov ecx, dword [ebp - 0x444]
mov byte [ebp - 4], 0
mov esi, dword [ebp - 0x438]
lea edx, [ecx + eax*2 + 2]
push esi
mov dword [ebp - 0x444], edx
call ebx
test eax, eax
jne 0x70e1cfa6
push esi
call fcn.70df3455
add esp, 4
push edi
call fcn.70df3455
add esp, 4
mov eax, dword [ebp - 0x444]
xor esi, esi
cmp word [eax], si
je 0x70e1d066
mov edi, eax
jmp 0x70e1cc96
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
jmp 0x70e1cf71
mov eax, dword [ebp - 0x440]
push eax
lea edi, [ebp - 0x42c]
call fcn.70df4c1b
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x428]
push ecx
mov dword [ebp - 0x44c], 1
call ebx
test eax, eax
jne 0x70e1d011
mov edx, dword [ebp - 0x428]
push edx
call fcn.70df3455
mov eax, dword [ebp - 0x42c]
add esp, 4
push eax
call fcn.70df3455
add esp, 4
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x430]
push ecx
call ebx
test eax, eax
jne 0x70e1d040
mov edx, dword [ebp - 0x430]
push edx
call fcn.70df3455
mov eax, dword [ebp - 0x434]
add esp, 4
push eax
call fcn.70df3455
add esp, 4
mov byte [ebp - 4], 0
mov esi, dword [ebp - 0x438]
push esi
call ebx
test eax, eax
jne 0x70e1d197
push esi
call fcn.70df3455
mov ecx, dword [ebp - 0x43c]
jmp 0x70e1d18b
xor eax, eax
lea edx, [ebp - 0x47c]
push edx
mov dword [ebp - 0x47c], eax
mov dword [ebp - 0x478], eax
mov dword [ebp - 0x474], eax
mov dword [ebp - 0x470], eax
mov dword [ebp - 0x46c], eax
mov dword [ebp - 0x468], eax
mov dword [ebp - 0x464], eax
mov dword [ebp - 0x460], eax
mov dword [ebp - 0x45c], eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ebx, 9
mov edi, 0x70e1d210
cmp word [ebp - 0x47c], bx
je 0x70e1d0c3
mov edi, 0x70e08c00
push 4
mov dword [ebp - 0x42c], esi
call fcn.70df39ac
add esp, 4
cmp eax, esi
je 0x70e1d0e5
mov dword [eax], 1
mov dword [ebp - 0x428], eax
jmp 0x70e1d0eb
mov dword [ebp - 0x428], esi
lea eax, [ebp - 0x42c]
push eax
mov dword [ebp - 4], 8
call fcn.70df3e38
mov ecx, dword [ebp - 0x450]
push ecx
lea edx, [ebp - 0x458]
push edx
lea ecx, [ebp - 0x42c]
mov dword [ebp - 4], ebx
call fcn.70e1c753
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x440]
push eax
lea edi, [ebp - 0x458]
call fcn.70df4c1b
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x454]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push ecx
mov dword [ebp - 0x44c], 1
call edi
test eax, eax
jne 0x70e1d16e
mov edx, dword [ebp - 0x454]
push edx
call fcn.70df3455
mov eax, dword [ebp - 0x458]
add esp, 4
push eax
call fcn.70df3455
add esp, 4
mov byte [ebp - 4], 0
mov esi, dword [ebp - 0x428]
push esi
call edi
test eax, eax
jne 0x70e1d197
push esi
call fcn.70df3455
mov ecx, dword [ebp - 0x42c]
add esp, 4
push ecx
call fcn.70df3455
add esp, 4
mov eax, dword [ebp - 0x440]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.70df25ed
mov esp, ebp
pop ebp
ret 4