Function at 0x409940
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x238
mov eax, dword [0x5954a0]
xor eax, esp
mov dword [esp + 0x234], eax
mov eax, dword [esp + 0x240]
push ebx
push ebp
mov ebp, dword [esp + 0x244]
push esi
push edi
mov edi, ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], eax
call fcn.00402330
test eax, eax
jne 0x409991
call fcn.0040e6e0
call fcn.00402330
test eax, eax
jne 0x409991
mov eax, 0xc0000603
jmp 0x409e1f
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edi
call esi
cmp eax, 0xffffffff
je 0x4099a9
push edi
call esi
test eax, 0x10000
je 0x4099be
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x4099be
mov eax, 0xc0000202
jmp 0x409e1f
mov ecx, edi
call fcn.00409760
test eax, eax
jne 0x409e1d
mov ecx, edi
call fcn.00404fc0
push edi
mov dword [esp + 0x3c], eax
call esi
test al, 1
je 0x4099eb
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push 0x20000080
push 3
push 0
push 3
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x409a60
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1ff
lea ecx, [esp + 0x45]
push 0
push ecx
mov byte [esp + 0x4c], 0
call fcn.004f8090
lea edx, [esp + 0x40]
add esp, 0xc
push edx
lea ebx, [esp + 0x44]
mov edx, ebp
mov ecx, edi
call fcn.00408140
mov esi, eax
add esp, 4
test esi, esi
jne 0x409e0b
call fcn.00409710
mov dword [esp + 0x3c], eax
cmp eax, 0xffffffff
jne 0x409a6a
mov esi, 0xc0000204
jmp 0x409e0b
mov esi, 0xc0000302
jmp 0x409e0b
push str.IsWow64Process
push 0x566b24
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x409a9d
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
cmp dword [esp + 0x10], 0
je 0x409b69
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
jmp 0x409ab3
jmp 0x409ab7
lea ebx, [ecx + 0x796f]
xor ebx, 0x501
or ebx, 0x781a
add ebx, 0x12
jmp 0x409acf
lea edx, [ebx - 0xc]
and edx, 0x14
or edx, 0x199d6a
mov eax, pe_nt_image_headers32
sub eax, edx
mov dword [esp + 0x10], eax
jmp 0x409ae9
mov edx, ecx
and edx, 0x3844
xor edx, eax
or edx, 0x41ab
mov edi, 0x796f
sub edi, edx
jmp 0x409b04
jmp 0x409b07
jmp 0x409b0b
jmp 0x409b0f
lea eax, [edi + edi*8]
add eax, eax
cdq
mov ebp, 0x18
idiv ebp
lea esi, [edi + ecx - 0x123]
and esi, 0x332
lea eax, [edi + 0x422b]
and edx, 0x154
xor esi, edx
mov edx, edi
sub edx, ecx
and esi, ebx
xor esi, eax
add edx, 0x332
lea eax, [edi - 0x3f55]
and edx, eax
or esi, edx
mov edx, 0x332
shl edx, cl
add edi, 0xffffbe31
and edi, edx
and edi, dword [esp + 0x10]
or esi, edi
jmp 0x409d57
mov dword [esp + 0x1c], pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebp, eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x10], 0x8456
mov dword [esp + 0x24], 0x4287
mov dword [esp + 0x20], 0x332
mov dword [esp + 0x14], 0x3678
mov dword [esp + 0x18], 0x12
jmp 0x409ba8
pushaw
mov eax, dword [esp + 0x20]
jmp 0x409bb2
mov ebx, dword [esp + 0x34]
jmp 0x409bb9
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
jmp 0x409bc9
mov edi, dword [esp + 0x30]
and eax, ebx
jmp 0x409bd3
or eax, esi
and ebx, dword [esp + 0x38]
jmp 0x409bdd
add ebx, eax
sub ecx, eax
sub esi, eax
mov dword [esp + 0x2c], ebx
jmp 0x409bea
add edi, esi
and ebx, eax
jmp 0x409bf3
xor esi, edi
add esi, ebx
jmp 0x409bfa
sub ecx, esi
add edi, ebx
jmp 0x409c02
xor ecx, edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x34], eax
jmp 0x409c10
mov dword [esp + 0x30], edx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], esi
jmp 0x409c1f
popaw
jmp 0x409c24
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x10]
lea edx, [ecx + eax]
mov eax, dword [esp + 0x14]
add esi, eax
and edx, esi
lea esi, [eax + eax*8]
add esi, esi
and esi, 0x23
xor edx, esi
and ecx, eax
or edx, ecx
or edx, dword [esp + 0x24]
add eax, edx
mov dword [esp + 0x14], eax
jmp 0x409c57
mov edx, dword [esp + 0x20]
sub edx, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
add edx, dword [esp + 0x10]
lea ecx, [eax + ebp]
xor edx, ecx
mov ecx, dword [esp + 0x18]
add eax, ecx
xor eax, 0x19b
or edx, eax
add ecx, edx
mov dword [esp + 0x18], ecx
jmp 0x409c82
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
sub ecx, dword [esp + 0x24]
lea edx, [ecx + eax + 5]
and edx, eax
mov eax, dword [esp + 0x14]
imul eax, eax, 0xd8
sar eax, 2
or edx, eax
sub dword [esp + 0x1c], edx
jmp 0x409caa
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
mov ecx, eax
and ecx, ebp
xor ecx, dword [esp + 0x1c]
add edx, 0x12
xor edx, dword [esp + 0x20]
or ecx, edx
sub eax, ecx
mov dword [esp + 0x14], eax
jmp 0x409ccd
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
add eax, dword [esp + 0x24]
mov ecx, ebp
shl edx, cl
and eax, edx
and dword [esp + 0x1c], eax
jmp 0x409cea
mov esi, dword [esp + 0x10]
mov eax, esi
cdq
idiv dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
lea eax, [ecx + ecx*8]
add eax, eax
mov edi, edx
cdq
mov ebx, 0x18
idiv ebx
mov eax, dword [esp + 0x24]
add ecx, eax
add ecx, esi
add ecx, ebp
and ecx, dword [esp + 0x20]
and edi, edx
xor edi, ecx
and dword [esp + 0x18], edi
jmp 0x409d22
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov esi, ecx
sub esi, dword [esp + 0x24]
mov edx, ecx
add esi, eax
sub edx, ebp
add edx, eax
mov eax, dword [esp + 0x10]
and esi, edx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor eax, dword [esp + 0x18]
or esi, eax
or dword [esp + 0x1c], esi
jmp 0x409d53
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x2c]
jmp 0x409d5f
mov ecx, 0x3d7
lea eax, [esi - 0x75643678]
lea ebx, [ebx]
jmp 0x409d74
sub ecx, 1
jne 0x409d70
jmp 0x409d7d
imul eax, eax, 0x16c6d
mov ecx, eax
and ecx, 0xde8
xor ecx, 0xc960df20
jmp 0x409d96
jmp 0x409d99
jmp 0x409d9d
jmp 0x409da1
imul eax, eax, 0x6c62669
mov ebx, dword [esp + 0x34]
sub eax, 2
imul eax, ecx
not ecx
add eax, 0xd9b
add ecx, 0x16c6d
xor eax, ecx
mov dword [esp + 0x28], eax
lea eax, [esp + 0x28]
push eax
push ebx
lea esi, [esp + 0x48]
call fcn.00415e10
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x264]
mov eax, dword [esp + 0x260]
push ecx
mov ecx, dword [esp + 0x260]
push edx
push eax
push ecx
push ebx
mov ebx, dword [esp + 0x4c]
mov edx, esi
push edx
mov ecx, edi
call fcn.00402530
add esp, 0x20
test eax, eax
jne 0x409e1d
mov esi, 0xc0000205
cmp dword [esp + 0x38], 0
je 0x409e19
mov ecx, edi
call fcn.00404e80
mov eax, esi
jmp 0x409e1f
xor eax, eax
mov ecx, dword [esp + 0x244]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004f8124
add esp, 0x238
ret