Function at 0x435d60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push r14
push r13
push rdi
push rsi
push rbx
sub rsp, 0x2b8
mov rbp, rsp
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x80], 0
nop
xor rdi, rdi
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax + 0x18]
call fcn.004417d0
mov rbx, rax
mov rcx, rbx
call fcn.00427780
mov dword [rbp + 0x40], eax
mov eax, dword [rbp + 0x40]
cmp eax, 0x104
jl 0x435e02
mov rax, qword [0x0044e5f0]
mov dword [rax], 0x233f
xor rax, rax
mov dword [rbp + 0x44], eax
jmp 0x43661c
mov rax, qword [0x0044e2a8]
cmp byte [rax], 0
je 0x435e37
mov rcx, rbx
lea rdx, [0x00436668]
mov r8d, 4
call fcn.0041d9b0
test eax, eax
jne 0x435e37
lea rcx, [0x00436672]
call fcn.00429c50
mov rbx, rax
lea rcx, [rbp + 0x9a]
xor rdx, rdx
mov r8d, 0x104
call fcn.00427960
lea rcx, [rbp + 0x9a]
mov rdx, rbx
call fcn.004277a0
lea rcx, [rbp + 0x9a]
mov dx, 0x2f
call fcn.0042cae0
mov word [rbp + 0x2aa], 0x5c
mov word [rbp + 0x2ac], 0x3a
mov word [rbp + 0x2ae], 0
lea rcx, [rbp + 0x9a]
lea rdx, [rbp + 0x2aa]
call fcn.004277e0
mov ecx, dword [rbp + 0x40]
cmp eax, ecx
setl al
mov byte [rbp + 0x37], al
mov word [rbp + 0x2ac], 0
movzx rax, byte [rbp + 0x37]
test al, al
je 0x435ee8
lea rcx, [rbp + 0x9a]
mov dx, 0x5c
call fcn.00427710
mov rbx, rax
test rbx, rbx
jne 0x435ee2
lea rcx, [rbp + 0x9a]
mov dx, 0x3a
call fcn.004276e0
mov rbx, rax
add rbx, 2
jmp 0x435eef
lea rbx, [rbp + 0x9a]
test rbx, rbx
je 0x435f1a
mov rcx, rbx
lea rdx, [0x00436682]
call fcn.0041d890
test eax, eax
je 0x435f1a
mov rcx, rbx
lea rdx, [0x00436686]
call fcn.0041d890
test eax, eax
jne 0x435f62
mov rax, qword [0x0044e2a8]
cmp byte [rax], 0
je 0x435f4a
mov rcx, qword [rbp + 0x28]
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x435f4a
test eax, 0x10
je 0x435f4a
mov eax, 5
mov dword [rbp + 0x44], eax
jmp 0x43661c
mov rax, qword [0x0044e5f0]
mov dword [rax], 0x2331
xor rax, rax
mov dword [rbp + 0x44], eax
jmp 0x43661c
mov ecx, 0x410
call fcn.0043f490
mov rsi, rax
test rsi, rsi
jne 0x435f90
mov rax, qword [0x0044e5f0]
mov dword [rax], 8
mov eax, 3
mov dword [rbp + 0x44], eax
jmp 0x43661c
mov rcx, qword [rbp + 0x28]
lea rdx, [rbp + 0x9a]
call fcn.004277a0
lea rcx, [rbp + 0x9a]
call fcn.00427780
mov r13d, eax
mov rcx, rbx
call fcn.0040ad60
movsxd r13, r13d
mov eax, eax
neg rax
lea rax, [r13 + rax]
mov rcx, qword [rbp + 0x28]
mov word [rcx + rax*2], 0
lea rdx, [0x00436682]
call fcn.004277c0
mov rcx, rsi
mov rdx, qword [rbp + 0x28]
mov r8d, 0x208
call fcn.0042c030
test eax, eax
je 0x436039
mov rax, qword [0x0044e2a8]
cmp byte [rax], 0
je 0x436021
mov rcx, qword [rbp + 0x28]
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x436021
test eax, 0x10
je 0x436021
mov eax, 5
mov dword [rbp + 0x44], eax
jmp 0x43661c
mov rax, qword [0x0044e5f0]
mov dword [rax], 0x2331
xor rax, rax
mov dword [rbp + 0x44], eax
jmp 0x43661c
mov rcx, rsi
call fcn.00427980
cmp word [rax], 0x5c
je 0x436056
mov rcx, rsi
lea rdx, [0x0043668c]
call fcn.004277c0
mov rcx, rsi
mov rdx, rbx
call fcn.004277c0
mov rcx, rsi
call fcn.00427780
mov rcx, rsi
mov edx, eax
add edx, 1
add edx, edx
call fcn.0043f6b0
mov rsi, rax
mov rcx, rsi
mov dx, 0x5c
call fcn.00427710
mov qword [rbp + 0x38], rax
mov word [rax], 0
add rax, 2
mov qword [rbp + 0x38], rax
movzx rax, byte [rbp + 0x37]
test al, al
jne 0x4360b0
lea rcx, [0x00436690]
call fcn.00429c50
mov rdi, rax
mov rcx, rsi
call fcn.00427780
mov ebx, eax
mov rcx, rdi
call fcn.00427780
mov ecx, ebx
add ecx, eax
add ecx, 4
add ecx, ecx
call fcn.0043f490
mov rbx, rax
test rbx, rbx
jne 0x4360f3
mov rax, qword [0x0044e5f0]
mov dword [rax], 8
mov eax, 3
mov dword [rbp + 0x44], eax
jmp 0x43661c
mov rcx, rbx
lea rdx, [0x0043669a]
call fcn.004277c0
mov rcx, rbx
mov rdx, rsi
call fcn.004277c0
mov rcx, rbx
lea rdx, [0x0043669a]
call fcn.004277c0
movzx rax, byte [rbp + 0x37]
test al, al
jne 0x43613f
mov rcx, rbx
lea rdx, [0x0043669e]
call fcn.004277c0
mov rcx, rbx
mov rdx, rdi
call fcn.004277c0
mov rcx, rbx
call fcn.004375a0
mov rcx, rbx
lea rdx, [0x0043669e]
mov r8d, 1
call fcn.0043f820
mov rbx, rax
mov rcx, qword [rbp + 0x38]
call fcn.00427780
add eax, 1
mov dword [rbp + 0x40], eax
mov rax, qword [0x0044e2a8]
cmp byte [rax], 0
je 0x43618c
lea rcx, [0x004366a2]
call fcn.00429c50
mov rsi, rax
jmp 0x436193
lea rsi, [0x004366b2]
mov rcx, rsi
call fcn.004375a0
mov rcx, rsi
lea rdx, [0x0043669e]
mov r8d, 1
call fcn.0043f820
mov rsi, rax
mov rcx, rbx
call fcn.00427780
mov edi, eax
mov rcx, rbx
call fcn.004417d0
mov rcx, rbx
mov rdx, rax
call fcn.004277a0
mov rcx, rbx
call fcn.00427780
mov r13d, eax
mov rcx, rbx
call fcn.00427980
cmp word [rax], 0x5c
je 0x4361f6
mov r14b, 1
add edi, 1
add r13d, 1
jmp 0x4361f9
xor r14, r14
cmp word [rbx], 0
je 0x43622f
mov eax, r13d
mov ecx, dword [rbp + 0x40]
movsxd rcx, ecx
lea rax, [rax + rcx]
cmp rax, 0x104
jle 0x43622f
test r14b, r14b
je 0x436225
movsxd rdi, edi
add rdi, rdi
add rbx, rdi
jmp 0x4361b4
movsxd rdi, edi
lea rbx, [rbx + rdi*2 + 2]
jmp 0x4361b4
cmp word [rbx], 0
jne 0x43627d
movzx rax, byte [rbp + 0x37]
test al, al
je 0x436265
mov rax, qword [0x0044e5f0]
cmp dword [rax], 0
je 0x436256
mov rax, qword [0x0044e5f0]
cmp dword [rax], 2
jne 0x436272
mov rax, qword [0x0044e5f0]
mov dword [rax], 0x2331
jmp 0x436272
mov rax, qword [0x0044e5f0]
mov dword [rax], 0x2331
xor rax, rax
mov dword [rbp + 0x44], eax
jmp 0x43661c
mov rcx, qword [rbp + 0x28]
mov rdx, rbx
call fcn.004277a0
test r14b, r14b
je 0x436299
movsxd rdi, edi
add rdi, rdi
add rbx, rdi
jmp 0x4362a1
movsxd rdi, edi
lea rbx, [rbx + rdi*2 + 2]
test r14b, r14b
je 0x4362b6
mov rcx, qword [rbp + 0x28]
lea rdx, [rbp + 0x2aa]
call fcn.004277c0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x38]
call fcn.004277c0
mov rcx, qword [rbp + 0x28]
call fcn.004417d0
mov rcx, qword [rbp + 0x28]
mov rdx, rax
call fcn.004277a0
mov rcx, qword [rbp + 0x28]
call fcn.00427780
mov r14d, eax
mov rax, qword [rbp + 0x28]
cmp word [rax + 2], 0x3a
jne 0x436304
mov rax, qword [rbp + 0x28]
movzx rcx, word [rax]
call fcn.00441680
test al, al
je 0x4361b4
mov rcx, qword [rbp + 0x38]
mov dx, 0x2e
call fcn.00427710
mov rdi, rax
test rdi, rdi
je 0x43642e
cmp word [rdi + 2], 0
je 0x43642e
mov rcx, qword [rbp + 0x28]
mov dl, 1
call fcn.0042c9f0
test al, al
jne 0x436354
movzx rax, byte [rbp + 0x37]
test al, al
je 0x436412
mov rax, qword [0x0044e5f0]
cmp dword [rax], 5
jne 0x436412
lea rcx, [rbp + 0x80]
mov rdx, qword [rbp + 0x28]
call fcn.0040b3e0
lea rcx, [rbp + 0x88]
mov rdx, qword [rbp + 0x80]
call fcn.0041d660
mov rcx, qword [rbp + 0x88]
call fcn.0040b360
mov rbx, rax
lea rcx, [rbp + 0x70]
call fcn.004275e0
lea rcx, [rbp + 0x78]
mov rdx, qword [rbp + 0x70]
call fcn.0041d660
mov rcx, qword [rbp + 0x78]
call fcn.0040b360
mov rcx, rbx
mov rdx, rax
call fcn.0041d8c0
test eax, eax
jne 0x4363c2
mov eax, 2
mov dword [rbp + 0x44], eax
jmp 0x43661c
mov rcx, rdi
lea rdx, [0x004366da]
call fcn.0041d8c0
test eax, eax
jne 0x4363e3
mov eax, 2
mov dword [rbp + 0x44], eax
jmp 0x43661c
mov rcx, rdi
lea rdx, [0x004366e4]
call fcn.0041d8c0
test eax, eax
jne 0x436404
mov eax, 2
mov dword [rbp + 0x44], eax
jmp 0x43661c
mov eax, 1
mov dword [rbp + 0x44], eax
jmp 0x43661c
mov rax, qword [0x0044e5f0]
cmp dword [rax], 2
je 0x43642e
mov rax, qword [0x0044e5f0]
cmp dword [rax], 0
jne 0x4361b4
mov rcx, qword [rbp + 0x38]
mov dx, 0x2a
call fcn.004276e0
test rax, rax
jne 0x436452
mov rcx, qword [rbp + 0x38]
mov dx, 0x3f
call fcn.004276e0
test rax, rax
je 0x43646a
mov rax, qword [0x0044e5f0]
mov dword [rax], 0x2331
xor rax, rax
mov dword [rbp + 0x44], eax
jmp 0x43661c
mov rdi, rsi
mov rcx, qword [rbp + 0x28]
mov edx, r14d
lea r8, [0x004366ee]
xor r9, r9
call fcn.00436700
test eax, eax
je 0x4365aa
jmp 0x43659f
mov rcx, rdi
call fcn.00427780
mov ecx, dword [rbp + 0x40]
movsxd rcx, ecx
mov edx, r13d
lea rcx, [rcx + rdx]
movsxd rax, eax
lea rax, [rcx + rax]
cmp rax, 0x104
jg 0x436595
mov rcx, qword [rbp + 0x28]
mov edx, r14d
mov r8, rdi
mov r9b, 1
call fcn.00436700
test eax, eax
je 0x436577
mov rcx, rdi
lea rdx, [0x004366e4]
call fcn.0041d8c0
test eax, eax
je 0x4364f9
mov rcx, rdi
lea rdx, [0x004366da]
call fcn.0041d8c0
test eax, eax
jne 0x436507
mov eax, 2
mov dword [rbp + 0x44], eax
jmp 0x43661c
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x28]
call fcn.0040b3e0
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
call fcn.0041d660
mov rcx, qword [rbp + 0x68]
call fcn.0040b360
mov rbx, rax
lea rcx, [rbp + 0x50]
call fcn.004275e0
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x50]
call fcn.0041d660
mov rcx, qword [rbp + 0x58]
call fcn.0040b360
mov rcx, rbx
mov rdx, rax
call fcn.0041d8c0
test eax, eax
jne 0x436569
mov eax, 2
mov dword [rbp + 0x44], eax
jmp 0x43661c
mov eax, 1
mov dword [rbp + 0x44], eax
jmp 0x43661c
mov rax, qword [0x0044e5f0]
cmp dword [rax], 2
je 0x436595
mov rax, qword [0x0044e5f0]
cmp dword [rax], 0
jne 0x4365a9
jmp 0x436595
add rdi, 2
cmp word [rdi], 0
jne 0x436591
add rdi, 2
cmp word [rdi], 0
jne 0x436490
nop
mov rax, qword [0x0044e5f0]
cmp dword [rax], 0
je 0x4365c6
mov rax, qword [0x0044e5f0]
cmp dword [rax], 2
jne 0x4361b4
mov rcx, qword [rbp + 0x28]
mov edx, r14d
xor r8, r8
mov r9b, 1
call fcn.00436700
test eax, eax
je 0x4361b4
mov rcx, qword [rbp + 0x28]
lea rdx, [rbp + 0x2a4]
call sub.kernel32.dll_GetBinaryTypeW
test eax, eax
je 0x4361b4
cmp dword [rbp + 0x2a4], 4
jne 0x4361b4
mov eax, 1
mov dword [rbp + 0x44], eax
jmp 0x43661c
lea rcx, [rbp + 0x50]
mov edx, 8
call fcn.0040a780
mov eax, dword [rbp + 0x44]
lea rsp, [rbp + 0x2b8]
pop rbx
pop rsi
pop rdi
pop r13
pop r14
pop rbp
ret