Function at 0x416fa0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, edx
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 4], eax
push eax
mov esi, eax
mov dword [ebp - 0x10], ecx
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x416fe6
mov ecx, esi
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x11d
push edi
call fcn.0047ab10
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
and eax, 0x10
mov dword [ebp - 0x18], eax
je 0x41701a
mov ecx, esi
mov ebx, 1
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417000
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
mov dword [ebp - 0x10], eax
lea esi, [esi + eax*2]
jmp 0x41701c
xor eax, eax
cmp word [esi], 0
je 0x417054
lea edi, [eax + ebx]
xor ebx, ebx
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417030
sub ecx, edx
sar ecx, 1
lea esi, [esi + ecx*2]
lea eax, [ecx + 1]
add esi, 2
add eax, edi
add ebx, eax
cmp word [esi], 0
jne 0x417027
jmp 0x417056
xor ebx, ebx
lea eax, [ebx*2 + 0x16]
push eax
push 0x2042
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x4171e6
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4171e6
mov edx, dword [ebp - 4]
lea esi, [eax + 0x14]
lea ecx, [esi + 2]
mov dword [eax], 0x14
mov dword [eax + 0x10], 1
lea ecx, [ecx + ebx*2]
mov eax, dword [ebp - 0x18]
mov edi, edx
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], esi
mov dword [ebp - 0x14], ecx
test eax, eax
je 0x4170bc
mov ecx, dword [ebp - 0x10]
lea edi, [edx + ecx*2]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xc], edi
xor edx, edx
test eax, eax
mov eax, dword [ebp - 4]
cmove eax, edx
mov dword [ebp - 4], eax
cmp word [edi], dx
je 0x4171d7
test eax, eax
je 0x41717e
mov edx, esi
mov ebx, edi
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4170e1
sub eax, esi
sar eax, 1
je 0x41710e
mov ecx, dword [ebp - 4]
lea ecx, [ecx + eax*2]
add ecx, 0xfffffffe
nop dword [eax + eax]
cmp word [ecx], 0x5c
jne 0x41710e
sub ecx, 2
sub eax, 1
jne 0x417100
cmp word [edi], 0x5c
jne 0x41711d
add ebx, 2
cmp word [ebx], 0x5c
je 0x417114
mov edi, ebx
lea esi, [edi + 2]
mov cx, word [edi]
add edi, 2
test cx, cx
jne 0x417122
sub edi, esi
sar edi, 1
test eax, eax
je 0x41714c
lea esi, [eax + eax]
push esi
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0047ef80
mov edx, dword [ebp - 8]
add esp, 0xc
add edx, esi
test edi, edi
je 0x417171
mov eax, 0x5c
lea esi, [edi + edi]
push esi
mov word [edx], ax
add edx, 2
push ebx
push edx
mov dword [ebp - 0x18], edx
call fcn.0047ef80
mov edx, dword [ebp - 0x18]
add esp, 0xc
add edx, esi
mov esi, dword [ebp - 8]
xor eax, eax
mov edi, dword [ebp - 0xc]
mov word [edx], ax
jmp 0x41718c
mov eax, ecx
sub eax, esi
push edi
sar eax, 1
push eax
push esi
call fcn.00403240
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417191
sub ecx, edx
sar ecx, 1
lea edi, [edi + ecx*2]
mov ecx, esi
add edi, 2
mov dword [ebp - 0xc], edi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4171b0
sub ecx, edx
sar ecx, 1
lea esi, [esi + ecx*2]
mov ecx, dword [ebp - 0x14]
add esi, 2
cmp word [edi], ax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], esi
jne 0x4170d2
xor eax, eax
mov word [esi], ax
mov esi, dword [ebp - 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret