Function at 0x4c1d00
Capabilities:
Check if file exists
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x2d0
mov eax, dword [0x5f3418]
xor eax, ebp
mov dword [esp + 0x2c8], eax
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [esp + 0x88], eax
cmp eax, 0xffffffff
jne 0x4c1d54
mov esi, 2
cmp esi, 2
setne bl
and bl, bh
mov ecx, dword [esp + 0x2c8]
xor ecx, ebp
call fcn.00512ee3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea edi, [esp + 0x80]
mov dword [edi], fcn.004c22c0
lea eax, [esp + 0x88]
mov dword [edi + 4], eax
lea esi, [esp + 0x8c]
push 0x23c
push 0xff
push esi
call fcn.005191b0
add esp, 0xc
mov ecx, esi
push edi
call fcn.0056e6e0
mov ecx, esi
call fcn.0056b3e0
test eax, eax
jne 0x4c1da2
mov esi, 2
jmp 0x4c2001
push dword [eax + 8]
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
xor ebx, ebx
test eax, eax
je 0x4c1dd9
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp esi, 0xffffffff
je 0x4c21e3
call fcn.004ee180
mov ebx, esi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebx + 1]
cmp eax, 2
mov dword [esp + 0x14], ebx
jae 0x4c1def
mov esi, 2
jmp 0x4c1fcb
mov dword [esp + 0x10], eax
xor eax, eax
lea ecx, [esp + 0x7c]
mov dword [ecx], eax
lea esi, [esp + 0x20]
mov dword [esi], eax
mov dword [esi + 4], ecx
push esi
push 0x2000000
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edi, eax
mov ebx, dword [esi]
mov esi, dword [esi + 4]
cmp dword [esi], ebx
je 0x4c1e49
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x4c2012
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4c1e40
mov dword [esi], ebx
call fcn.004ee180
push dword [esp]
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x4c1e57
mov esi, 2
jmp 0x4c1f86
xor eax, eax
lea ecx, [esp + 0x78]
mov dword [ecx], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x7c]
sub esp, 0x18
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], ecx
movdqa xmm0, xmmword [0x5d8080]
movdqu xmmword [esp + 4], xmm0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov edi, eax
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
cmp dword [esi], ebx
je 0x4c1ec8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x4c2058
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4c1ebf
mov dword [esi], ebx
call fcn.004ee180
push dword [esp]
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x4c1ed3
mov esi, 2
jmp 0x4c1f45
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x60], xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
lea edi, [esp + 0x20]
mov ecx, edi
call fcn.0056b2f0
mov eax, dword [esp + 0x78]
mov dword [esp + 0x44], eax
lea esi, [esp + 0x18]
push edi
push dword [0x6bedd8]
push esi
call fcn.0056dc10
add esp, 0xc
mov eax, dword [esi]
inc eax
cmp eax, 1
ja 0x4c21ea
cmp byte [esp + 0x1c], 0
setne bh
cmp eax, 2
jae 0x4c21f1
lea ecx, [esp + 0x20]
call fcn.0056b340
xor esi, esi
inc esi
mov eax, dword [esp + 0x78]
inc eax
cmp eax, 2
jb 0x4c1f86
call fcn.004ee180
mov eax, dword [esp + 0x78]
mov dword [esp], eax
cmp dword [0x6cebf0], 0
je 0x4c2120
mov eax, dword [0x6cebf0]
mov dword [esp + 4], eax
mov eax, dword [eax]
mov edi, dword [eax]
mov ecx, edi
call dword [section..00cfg]
mov ecx, dword [esp + 4]
push dword [esp]
call edi
mov eax, dword [esp + 0x7c]
inc eax
cmp eax, 2
jb 0x4c1fc7
call fcn.004ee180
mov eax, dword [esp + 0x7c]
mov dword [esp], eax
cmp dword [0x6cebf0], 0
je 0x4c20df
mov eax, dword [0x6cebf0]
mov dword [esp + 4], eax
mov eax, dword [eax]
mov edi, dword [eax]
mov ecx, edi
call dword [section..00cfg]
mov ecx, dword [esp + 4]
push dword [esp]
call edi
mov eax, dword [esp + 0x10]
cmp eax, 2
jb 0x4c2001
call fcn.004ee180
cmp dword [0x6cebf0], 0
je 0x4c209e
mov eax, dword [0x6cebf0]
mov dword [esp + 0x10], eax
mov eax, dword [eax]
mov edi, dword [eax]
mov ecx, edi
call dword [section..00cfg]
mov ecx, dword [esp + 0x10]
push dword [esp + 0x14]
call edi
lea ecx, [esp + 0x8c]
call fcn.0056e740
jmp 0x4c1d34
call fcn.004ee180
mov eax, dword [esi]
mov dword [esp + 4], eax
cmp dword [0x6cebf0], 0
je 0x4c2161
mov eax, dword [0x6cebf0]
mov dword [esp + 0xc], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [esp + 8], ecx
call dword [section..00cfg]
mov ecx, dword [esp + 0xc]
push dword [esp + 4]
call dword [esp + 0xc]
mov dword [esi], 0
jmp 0x4c1e31
call fcn.004ee180
mov eax, dword [esi]
mov dword [esp + 4], eax
cmp dword [0x6cebf0], 0
je 0x4c21a2
mov eax, dword [0x6cebf0]
mov dword [esp + 0xc], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [esp + 8], ecx
call dword [section..00cfg]
mov ecx, dword [esp + 0xc]
push dword [esp + 4]
call dword [esp + 0xc]
mov dword [esi], 0
jmp 0x4c1eb0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x5e3e9d
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4c2224
mov ecx, eax
cmp eax, sym.360se.exe_GetHandleVerifier
je 0x4c222c
call dword [section..00cfg]
call ecx
push 0
push eax
call fcn.00415e60
add esp, 8
jmp 0x4c1fe2
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x5e3e9d
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4c2235
mov ecx, eax
cmp eax, sym.360se.exe_GetHandleVerifier
je 0x4c223d
call dword [section..00cfg]
call ecx
push 0
push eax
call fcn.00415e60
add esp, 8
jmp 0x4c1fa9
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x5e3e9d
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4c227c
mov ecx, eax
cmp eax, sym.360se.exe_GetHandleVerifier
je 0x4c2284
call dword [section..00cfg]
call ecx
push 0
push eax
call fcn.00415e60
add esp, 8
jmp 0x4c1f68
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x5e3e9d
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4c228d
mov ecx, eax
cmp eax, sym.360se.exe_GetHandleVerifier
je 0x4c2295
call dword [section..00cfg]
call ecx
push 0
push eax
call fcn.00415e60
add esp, 8
jmp 0x4c202a
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x5e3e9d
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4c229e
mov ecx, eax
cmp eax, sym.360se.exe_GetHandleVerifier
je 0x4c22a6
call dword [section..00cfg]
call ecx
push 0
push eax
call fcn.00415e60
add esp, 8
jmp 0x4c2070
xor ebx, ebx
jmp 0x4c1dd2
mov bh, 1
jmp 0x4c1f30
call fcn.004ee180
mov eax, dword [esp + 0x18]
mov dword [esp], eax
cmp dword [0x6cebf0], 0
je 0x4c2246
mov esi, dword [0x6cebf0]
mov eax, dword [esi]
mov edi, dword [eax]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push dword [esp]
call edi
jmp 0x4c1f39
xor eax, eax
push eax
jmp 0x4c20d1
push 1
push 0
jmp 0x4c20d2
xor eax, eax
push eax
jmp 0x4c2112
push 1
push 0
jmp 0x4c2113
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x5e3e9d
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4c22af
mov ecx, eax
cmp eax, sym.360se.exe_GetHandleVerifier
je 0x4c22b4
call dword [section..00cfg]
call ecx
push 0
push eax
call fcn.00415e60
add esp, 8
jmp 0x4c2206
xor eax, eax
push eax
jmp 0x4c2153
push 1
push 0
jmp 0x4c2154
xor eax, eax
push eax
jmp 0x4c2194
push 1
push 0
jmp 0x4c2195
xor eax, eax
push eax
jmp 0x4c21d5
push 1
push 0
jmp 0x4c21d6
xor eax, eax
push eax
jmp 0x4c2271
push 1
push 0
jmp 0x4c2272