Function at 0x435a60
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b7958
mov eax, dword fs:[0]
push eax
sub esp, 0xe2c
mov eax, dword [0x5603e8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
xor esi, esi
xor ecx, ecx
push 0x206
mov dword [ebp - 0xe38], edi
push esi
cmp dword [ebp + 0x10], esi
je 0x435dcd
lea edx, [ebp - 0xe32]
xor eax, eax
push edx
mov word [ebp - 0x18], ax
mov dword [ebp - 0x16], esi
mov word [ebp - 0xe34], cx
call sub.MSVCR100.dll_memset
push 0x1fe
lea ecx, [ebp - 0x822]
xor eax, eax
push esi
push ecx
mov word [ebp - 0x824], ax
call sub.MSVCR100.dll_memset
push 0x1fe
lea eax, [ebp - 0xa22]
xor edx, edx
push esi
push eax
mov word [ebp - 0xa24], dx
call sub.MSVCR100.dll_memset
push 0x206
lea edx, [ebp - 0x422]
xor ecx, ecx
push esi
push edx
mov word [ebp - 0x424], cx
call sub.MSVCR100.dll_memset
push 0x1fe
lea ecx, [ebp - 0x21a]
xor eax, eax
push esi
push ecx
mov word [ebp - 0x21c], ax
call sub.MSVCR100.dll_memset
push 0x1fe
lea eax, [ebp - 0x622]
xor edx, edx
push esi
push eax
mov word [ebp - 0x624], dx
call sub.MSVCR100.dll_memset
add esp, 0x48
lea ecx, [ebp - 0xa24]
push ecx
lea edx, [ebp - 0x824]
push edx
lea eax, [ebp - 0xe34]
push eax
lea ecx, [ebp - 0x18]
push ecx
push ebx
call dword [sym.imp.MSVCR100.dll__wsplitpath]
lea eax, [ebp - 0x18]
add esp, 0x14
mov edx, eax
jmp 0x435b80
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x435b80
lea edi, [ebp - 0x424]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
cmp cx, si
jne 0x435b96
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0xe34]
rep movsb byte es:[edi], byte [esi]
mov edx, eax
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x435bc0
lea edi, [ebp - 0x424]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x435bd6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x21c]
rep movsb byte es:[edi], byte [esi]
lea edx, [eax + 2]
jmp 0x435c00
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x435c00
sub eax, edx
sar eax, 1
mov edx, 0x100
sub edx, eax
push edx
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.MSVCR100.dll_wcsncat]
lea eax, [ebp - 0x824]
add esp, 0xc
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x435c36
lea edi, [ebp - 0x21c]
sub eax, edx
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x435c50
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x21c]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x435c75
mov edx, dword [str..fot]
mov ecx, dword [0x4d1b2c]
mov dword [eax], edx
mov dx, word [0x4d1b30]
mov dword [eax + 4], ecx
mov word [eax + 8], dx
lea eax, [ebp - 0x824]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x435ca5
lea edi, [ebp - 0x624]
sub eax, edx
add edi, 0xfffffffe
jmp 0x435cc0
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x435cc0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0xa24]
rep movsb byte es:[edi], byte [esi]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x435ce4
lea edi, [ebp - 0x624]
sub eax, edx
add edi, 0xfffffffe
lea ebx, [ebx]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x435d00
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
inc eax
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
js 0x435e93
mov eax, dword [ebp - 0xe38]
push ebx
push eax
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionFonts
push 0x80000002
call fcn.004356b0
add esp, 0x10
test eax, eax
js 0x435e93
lea ecx, [ebp - 0x424]
push ecx
lea edx, [ebp - 0x624]
push edx
lea eax, [ebp - 0x21c]
push eax
push 0
call dword [sym.imp.GDI32.dll_CreateScalableFontResourceW]
mov edi, dword [sym.imp.GDI32.dll_RemoveFontResourceW]
push ebx
xor esi, esi
call edi
test eax, eax
je 0x435d8e
push ebx
inc esi
call edi
test eax, eax
jne 0x435d86
mov edi, dword [sym.imp.GDI32.dll_AddFontResourceW]
push ebx
call edi
test eax, eax
je 0x435da2
dec esi
test esi, esi
jg 0x435d94
jmp 0x435db5
test esi, esi
jle 0x435db5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x435e93
push 0
push 0
push 0x1d
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
jmp 0x435e98
lea edx, [ebp - 0xc2a]
push edx
mov word [ebp - 0xc2c], cx
call sub.MSVCR100.dll_memset
add esp, 0xc
mov dword [ebp - 0xe38], 0x104
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
push 0x2001f
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionFonts
push 0x80000002
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], esi
call fcn.00412570
test eax, eax
jne 0x435e57
lea eax, [ebp - 0xe38]
push eax
push edi
lea ecx, [ebp - 0xc2c]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00417550
test eax, eax
jne 0x435e57
lea edx, [ebp - 0xc2c]
push ebx
push edx
call dword [sym.imp.MSVCR100.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x435e57
push edi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionFonts
push 0x80000002
call fcn.00435580
add esp, 0xc
mov edi, dword [sym.imp.GDI32.dll_RemoveFontResourceW]
push ebx
call edi
test eax, eax
je 0x435e7f
push ebx
inc esi
call edi
test eax, eax
jne 0x435e64
test esi, esi
jle 0x435e7f
push eax
push eax
push 0x1d
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebp - 0x1c]
xor esi, esi
test eax, eax
je 0x435e8f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x435e98
mov eax, 0x80004005
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b12f6
mov esp, ebp
pop ebp
ret