Function at 0x438e80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push r14
push r13
push rdi
push rsi
push rbx
sub rsp, 0x2b8
mov rbp, rsp
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x80], 0
nop
xor rdi, rdi
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax + 0x18]
call fcn.00471500
mov rbx, rax
mov rcx, rbx
call fcn.0042a8b0
mov dword [rbp + 0x40], eax
mov eax, dword [rbp + 0x40]
cmp eax, 0x104
jl 0x438f22
mov rax, qword [0x0048a1a0]
mov dword [rax], 0x233f
xor rax, rax
mov dword [rbp + 0x44], eax
jmp 0x43973f
mov rax, qword [0x00489cb0]
cmp byte [rax], 0
je 0x438f57
mov rcx, rbx
lea rdx, [0x00439798]
mov r8d, 4
call fcn.0041e730
test eax, eax
jne 0x438f57
lea rcx, [0x004397a2]
call fcn.0042d2d0
mov rbx, rax
lea rcx, [rbp + 0x9a]
xor rdx, rdx
mov r8d, 0x104
call fcn.0042aa40
lea rcx, [rbp + 0x9a]
mov rdx, rbx
call fcn.0042a8d0
lea rcx, [rbp + 0x9a]
mov dx, 0x2f
call fcn.004301e0
mov word [rbp + 0x2aa], 0x5c
mov word [rbp + 0x2ac], 0x3a
mov word [rbp + 0x2ae], 0
lea rcx, [rbp + 0x9a]
lea rdx, [rbp + 0x2aa]
call fcn.0042a910
mov ecx, dword [rbp + 0x40]
cmp eax, ecx
setl al
mov byte [rbp + 0x37], al
mov word [rbp + 0x2ac], 0
movzx rax, byte [rbp + 0x37]
test al, al
je 0x439008
lea rcx, [rbp + 0x9a]
mov dx, 0x5c
call fcn.0042a840
mov rbx, rax
test rbx, rbx
jne 0x439002
lea rcx, [rbp + 0x9a]
mov dx, 0x3a
call fcn.0042a810
mov rbx, rax
add rbx, 2
jmp 0x43900f
lea rbx, [rbp + 0x9a]
test rbx, rbx
je 0x43903a
mov rcx, rbx
lea rdx, [0x004397b2]
call fcn.0041e600
test eax, eax
je 0x43903a
mov rcx, rbx
lea rdx, [0x004397b6]
call fcn.0041e600
test eax, eax
jne 0x439082
mov rax, qword [0x00489cb0]
cmp byte [rax], 0
je 0x43906a
mov rcx, qword [rbp + 0x28]
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x43906a
test eax, 0x10
je 0x43906a
mov eax, 5
mov dword [rbp + 0x44], eax
jmp 0x43973f
mov rax, qword [0x0048a1a0]
mov dword [rax], 0x2331
xor rax, rax
mov dword [rbp + 0x44], eax
jmp 0x43973f
mov ecx, 0x410
call fcn.0046f460
mov rsi, rax
test rsi, rsi
jne 0x4390b0
mov rax, qword [0x0048a1a0]
mov dword [rax], 8
mov eax, 3
mov dword [rbp + 0x44], eax
jmp 0x43973f
mov rcx, qword [rbp + 0x28]
lea rdx, [rbp + 0x9a]
call fcn.0042a8d0
mov rax, rbx
mov rcx, rax
call fcn.0040b270
mov r13d, eax
lea rcx, [rbp + 0x9a]
call fcn.0042a8b0
movsxd rax, eax
mov r13d, r13d
neg r13
lea rax, [rax + r13]
mov rcx, qword [rbp + 0x28]
mov word [rcx + rax*2], 0
lea rdx, [0x004397b2]
call fcn.0042a8f0
mov rcx, rsi
mov rdx, qword [rbp + 0x28]
mov r8d, 0x208
call fcn.0042f720
test eax, eax
je 0x43915c
mov rax, qword [0x00489cb0]
cmp byte [rax], 0
je 0x439144
mov rcx, qword [rbp + 0x28]
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x439144
test eax, 0x10
je 0x439144
mov eax, 5
mov dword [rbp + 0x44], eax
jmp 0x43973f
mov rax, qword [0x0048a1a0]
mov dword [rax], 0x2331
xor rax, rax
mov dword [rbp + 0x44], eax
jmp 0x43973f
mov rcx, rsi
call fcn.0042aa60
cmp word [rax], 0x5c
je 0x439179
mov rcx, rsi
lea rdx, [0x004397bc]
call fcn.0042a8f0
mov rcx, rsi
mov rdx, rbx
call fcn.0042a8f0
mov rcx, rsi
call fcn.0042a8b0
mov rcx, rsi
mov edx, eax
add edx, 1
add edx, edx
call fcn.0046f560
mov rsi, rax
mov rcx, rsi
mov dx, 0x5c
call fcn.0042a840
mov qword [rbp + 0x38], rax
mov word [rax], 0
add rax, 2
mov qword [rbp + 0x38], rax
movzx rax, byte [rbp + 0x37]
test al, al
jne 0x4391d3
lea rcx, [0x004397c0]
call fcn.0042d2d0
mov rdi, rax
mov rcx, rsi
call fcn.0042a8b0
mov ebx, eax
mov rcx, rdi
call fcn.0042a8b0
mov ecx, ebx
add ecx, eax
add ecx, 4
add ecx, ecx
call fcn.0046f460
mov rbx, rax
test rbx, rbx
jne 0x439216
mov rax, qword [0x0048a1a0]
mov dword [rax], 8
mov eax, 3
mov dword [rbp + 0x44], eax
jmp 0x43973f
mov rcx, rbx
lea rdx, [0x004397ca]
call fcn.0042a8f0
mov rcx, rbx
mov rdx, rsi
call fcn.0042a8f0
mov rcx, rbx
lea rdx, [0x004397ca]
call fcn.0042a8f0
movzx rax, byte [rbp + 0x37]
test al, al
jne 0x439262
mov rcx, rbx
lea rdx, [0x004397ce]
call fcn.0042a8f0
mov rcx, rbx
mov rdx, rdi
call fcn.0042a8f0
mov rcx, rbx
call fcn.00439dc0
mov rcx, rbx
lea rdx, [0x004397ce]
mov r8d, 1
call fcn.0046f6c0
mov rbx, rax
mov rcx, qword [rbp + 0x38]
call fcn.0042a8b0
add eax, 1
mov dword [rbp + 0x40], eax
mov rax, qword [0x00489cb0]
cmp byte [rax], 0
je 0x4392af
lea rcx, [0x004397d2]
call fcn.0042d2d0
mov rsi, rax
jmp 0x4392b6
lea rsi, [0x004397e2]
mov rcx, rsi
call fcn.00439dc0
mov rcx, rsi
lea rdx, [0x004397ce]
mov r8d, 1
call fcn.0046f6c0
mov rsi, rax
mov rcx, rbx
call fcn.0042a8b0
mov edi, eax
mov rcx, rbx
call fcn.00471500
mov rcx, rbx
mov rdx, rax
call fcn.0042a8d0
mov rcx, rbx
call fcn.0042a8b0
mov r13d, eax
mov rcx, rbx
call fcn.0042aa60
cmp word [rax], 0x5c
je 0x439319
mov r14b, 1
add edi, 1
add r13d, 1
jmp 0x43931c
xor r14, r14
cmp word [rbx], 0
je 0x439352
mov eax, r13d
mov ecx, dword [rbp + 0x40]
movsxd rcx, ecx
lea rax, [rax + rcx]
cmp rax, 0x104
jle 0x439352
test r14b, r14b
je 0x439348
movsxd rdi, edi
add rdi, rdi
add rbx, rdi
jmp 0x4392d7
movsxd rdi, edi
lea rbx, [rbx + rdi*2 + 2]
jmp 0x4392d7
cmp word [rbx], 0
jne 0x4393a0
movzx rax, byte [rbp + 0x37]
test al, al
je 0x439388
mov rax, qword [0x0048a1a0]
cmp dword [rax], 0
je 0x439379
mov rax, qword [0x0048a1a0]
cmp dword [rax], 2
jne 0x439395
mov rax, qword [0x0048a1a0]
mov dword [rax], 0x2331
jmp 0x439395
mov rax, qword [0x0048a1a0]
mov dword [rax], 0x2331
xor rax, rax
mov dword [rbp + 0x44], eax
jmp 0x43973f
mov rcx, qword [rbp + 0x28]
mov rdx, rbx
call fcn.0042a8d0
test r14b, r14b
je 0x4393bc
movsxd rdi, edi
add rdi, rdi
add rbx, rdi
jmp 0x4393c4
movsxd rdi, edi
lea rbx, [rbx + rdi*2 + 2]
test r14b, r14b
je 0x4393d9
mov rcx, qword [rbp + 0x28]
lea rdx, [rbp + 0x2aa]
call fcn.0042a8f0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x38]
call fcn.0042a8f0
mov rcx, qword [rbp + 0x28]
call fcn.00471500
mov rcx, qword [rbp + 0x28]
mov rdx, rax
call fcn.0042a8d0
mov rcx, qword [rbp + 0x28]
call fcn.0042a8b0
mov r14d, eax
mov rax, qword [rbp + 0x28]
cmp word [rax + 2], 0x3a
jne 0x439427
mov rax, qword [rbp + 0x28]
movzx rcx, word [rax]
call fcn.004713b0
test al, al
je 0x4392d7
mov rcx, qword [rbp + 0x38]
mov dx, 0x2e
call fcn.0042a840
mov rdi, rax
test rdi, rdi
je 0x439551
cmp word [rdi + 2], 0
je 0x439551
mov rcx, qword [rbp + 0x28]
mov dl, 1
call fcn.004300f0
test al, al
jne 0x439477
movzx rax, byte [rbp + 0x37]
test al, al
je 0x439535
mov rax, qword [0x0048a1a0]
cmp dword [rax], 5
jne 0x439535
lea rcx, [rbp + 0x80]
mov rdx, qword [rbp + 0x28]
call fcn.0040be70
lea rcx, [rbp + 0x88]
mov rdx, qword [rbp + 0x80]
call fcn.0041e370
mov rcx, qword [rbp + 0x88]
call fcn.0040bdd0
mov rbx, rax
lea rcx, [rbp + 0x70]
call fcn.0042a710
lea rcx, [rbp + 0x78]
mov rdx, qword [rbp + 0x70]
call fcn.0041e370
mov rcx, qword [rbp + 0x78]
call fcn.0040bdd0
mov rcx, rbx
mov rdx, rax
call fcn.0041e630
test eax, eax
jne 0x4394e5
mov eax, 2
mov dword [rbp + 0x44], eax
jmp 0x43973f
mov rcx, rdi
lea rdx, [0x0043980a]
call fcn.0041e630
test eax, eax
jne 0x439506
mov eax, 2
mov dword [rbp + 0x44], eax
jmp 0x43973f
mov rcx, rdi
lea rdx, [0x00439814]
call fcn.0041e630
test eax, eax
jne 0x439527
mov eax, 2
mov dword [rbp + 0x44], eax
jmp 0x43973f
mov eax, 1
mov dword [rbp + 0x44], eax
jmp 0x43973f
mov rax, qword [0x0048a1a0]
cmp dword [rax], 2
je 0x439551
mov rax, qword [0x0048a1a0]
cmp dword [rax], 0
jne 0x4392d7
mov rcx, qword [rbp + 0x38]
mov dx, 0x2a
call fcn.0042a810
test rax, rax
jne 0x439575
mov rcx, qword [rbp + 0x38]
mov dx, 0x3f
call fcn.0042a810
test rax, rax
je 0x43958d
mov rax, qword [0x0048a1a0]
mov dword [rax], 0x2331
xor rax, rax
mov dword [rbp + 0x44], eax
jmp 0x43973f
mov rdi, rsi
mov rcx, qword [rbp + 0x28]
mov edx, r14d
lea r8, [0x0043981e]
xor r9, r9
call fcn.00439830
test eax, eax
je 0x4396cd
jmp 0x4396c2
mov rcx, rdi
call fcn.0042a8b0
mov ecx, dword [rbp + 0x40]
movsxd rcx, ecx
mov edx, r13d
lea rcx, [rcx + rdx]
movsxd rax, eax
lea rax, [rcx + rax]
cmp rax, 0x104
jg 0x4396b8
mov rcx, qword [rbp + 0x28]
mov edx, r14d
mov r8, rdi
mov r9b, 1
call fcn.00439830
test eax, eax
je 0x43969a
mov rcx, rdi
lea rdx, [0x00439814]
call fcn.0041e630
test eax, eax
je 0x43961c
mov rcx, rdi
lea rdx, [0x0043980a]
call fcn.0041e630
test eax, eax
jne 0x43962a
mov eax, 2
mov dword [rbp + 0x44], eax
jmp 0x43973f
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x28]
call fcn.0040be70
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
call fcn.0041e370
mov rcx, qword [rbp + 0x68]
call fcn.0040bdd0
mov rbx, rax
lea rcx, [rbp + 0x50]
call fcn.0042a710
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x50]
call fcn.0041e370
mov rcx, qword [rbp + 0x58]
call fcn.0040bdd0
mov rcx, rbx
mov rdx, rax
call fcn.0041e630
test eax, eax
jne 0x43968c
mov eax, 2
mov dword [rbp + 0x44], eax
jmp 0x43973f
mov eax, 1
mov dword [rbp + 0x44], eax
jmp 0x43973f
mov rax, qword [0x0048a1a0]
cmp dword [rax], 2
je 0x4396b8
mov rax, qword [0x0048a1a0]
cmp dword [rax], 0
jne 0x4396cc
jmp 0x4396b8
add rdi, 2
cmp word [rdi], 0
jne 0x4396b4
add rdi, 2
cmp word [rdi], 0
jne 0x4395b3
nop
mov rax, qword [0x0048a1a0]
cmp dword [rax], 0
je 0x4396e9
mov rax, qword [0x0048a1a0]
cmp dword [rax], 2
jne 0x4392d7
mov rcx, qword [rbp + 0x28]
mov edx, r14d
xor r8, r8
mov r9b, 1
call fcn.00439830
test eax, eax
je 0x4392d7
mov rcx, qword [rbp + 0x28]
lea rdx, [rbp + 0x2a4]
call sub.kernel32.dll_GetBinaryTypeW
test eax, eax
je 0x4392d7
cmp dword [rbp + 0x2a4], 4
jne 0x4392d7
mov eax, 1
mov dword [rbp + 0x44], eax
jmp 0x43973f
lea rcx, [rbp + 0x50]
mov edx, 8
call fcn.0040abc0
mov eax, dword [rbp + 0x44]
lea rsp, [rbp + 0x2b8]
pop rbx
pop rsi
pop rdi
pop r13
pop r14
pop rbp
ret