Function at 0x403990
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa44
mov eax, dword [0x439004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.004117f0
push 0x500
call fcn.00414f63
add esp, 4
mov dword [esi + 0x370], eax
mov ecx, esi
mov dword [esi + 0x374], 0
mov dword [esi + 0x378], 0x40
push str._windows.bt
call fcn.00411890
push str._windows.ls
mov ecx, esi
call fcn.00411890
push str.winpepge.sys
mov ecx, esi
call fcn.00411890
push str.WindowsCSC
mov ecx, esi
call fcn.00411890
push str.Recycled
mov ecx, esi
call fcn.00411890
push str.Recycler
mov ecx, esi
call fcn.00411890
push str._Recycle.Bin
mov ecx, esi
call fcn.00411890
push str.System_Volume_Information
mov ecx, esi
call fcn.00411890
push str._swapfile.sys
mov ecx, esi
call fcn.00411890
push str.pagefile.sys
mov ecx, esi
call fcn.00411890
push str.hiberfil.sys
mov ecx, esi
call fcn.00411890
mov ecx, esi
call fcn.00411900
push 0x500
call fcn.00414f63
add esp, 4
mov dword [esi + 0x37c], eax
mov ecx, esi
mov dword [esi + 0x380], 0
mov dword [esi + 0x384], 0x40
push str..mp3
call fcn.004119a0
push str..zip
mov ecx, esi
call fcn.004119a0
push str..cab
mov ecx, esi
call fcn.004119a0
push str..rar
mov ecx, esi
call fcn.004119a0
push str..7z
mov ecx, esi
call fcn.004119a0
push str..pnf
mov ecx, esi
call fcn.004119a0
push 0x434ff4
mov ecx, esi
call fcn.004119a0
mov ecx, esi
call fcn.00411a10
push 0x500
call fcn.00414f63
add esp, 4
mov dword [esi + 0x388], eax
mov dword [esi + 0x38c], 0
mov dword [esi + 0x390], 0x40
cmp dword [esi + 0x120], 0
jne 0x403bf6
push 0x104
lea eax, [ebp - 0x41c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x104
lea eax, [ebp - 0x834]
push eax
push 0x104
lea eax, [ebp - 0xa40]
push eax
push 0x104
lea eax, [ebp - 0x628]
push eax
push 0x104
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.00419abe
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00419b0f
lea ecx, [ebp - 0x210]
add esp, 0x30
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403b87
sub ecx, edx
sar ecx, 1
cmp word [ebp + ecx*2 - 0x212], 0x5c
je 0x403bba
push 0x434d40
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00419b0f
add esp, 0xc
push str.wimscript.ini
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00419b0f
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x403c1c
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00414df1
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x124], 8
lea eax, [esi + 0x110]
jb 0x403c07
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00418211
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0xa40]
push 0xcd
push eax
call fcn.00411d30
add esp, 0xc
mov ecx, esi
push eax
call fcn.004112e0
push 0x43501c
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0xa44]
push eax
call fcn.00419c45
mov eax, dword [ebp - 0xa44]
add esp, 0xc
test eax, eax
jne 0x403cc0
push 0x104
mov word [ebp - 0x41c], ax
lea eax, [ebp - 0x41c]
push eax
push 0xce
push 0
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x403ca1
push 0x435be4
lea eax, [ebp - 0x41c]
push 0x104
push eax
call fcn.00418211
add esp, 0xc
lea eax, [ebp - 0x41c]
mov ecx, esi
push eax
call fcn.004112e0
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00414df1
mov esp, ebp
pop ebp
ret
push eax
mov ecx, esi
call fcn.00403cf0
push dword [ebp - 0xa44]
call fcn.00419d02
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov al, 1
pop esi
call fcn.00414df1
mov esp, ebp
pop ebp
ret