Function at 0x1001d3c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x100ae4ab
mov eax, dword fs:[0]
push eax
sub esp, 0x890
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x888], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x8a4]
mov dword fs:[0], eax
mov edi, ecx
mov ebp, dword [esp + 0x8b4]
lea eax, [esp + 0x7e]
push 0x40e
push 0
push eax
call fcn.10037070
xor eax, eax
mov dword [esp + 0x84], 0x207
add esp, 0xc
mov word [esp + 0x7c], ax
lea eax, [esp + 0x78]
mov edx, str.SOFTWARE2345Explorer
mov ecx, 0x80000002
push eax
lea eax, [esp + 0x80]
push eax
push str.Path
call fcn.1001ca00
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0xc
test al, al
je 0x1001d485
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0x7c]
push 0x100cc0e0
push eax
call esi
push str.2345Explorer.exe
lea eax, [esp + 0x80]
push eax
call esi
lea eax, [esp + 0x7c]
push eax
call ebx
cmp eax, 0xffffffff
jne 0x1001d48c
xor eax, eax
mov word [esp + 0x7c], ax
lea eax, [esp + 0x7c]
mov byte [esp + 0x17], 0
push eax
call ebx
cmp eax, 0xffffffff
je 0x1001d95d
xor eax, eax
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], 0
mov word [esp + 0x30], ax
cmp word [esp + 0x7c], ax
jne 0x1001d4d3
xor ecx, ecx
jmp 0x1001d4ef
lea ecx, [esp + 0x7c]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001d4e0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x80]
push eax
lea ecx, [esp + 0x38]
call fcn.10008230
mov dword [esp + 0x8ac], 0
lea edx, [esp + 0x30]
lea ecx, [esp + 0x18]
call fcn.1002a760
mov byte [esp + 0x8ac], 2
cmp dword [esp + 0x44], 8
jb 0x1001d534
push dword [esp + 0x30]
call fcn.10034183
add esp, 4
xor eax, eax
mov dword [esp + 0x44], 7
mov word [esp + 0x30], ax
lea ecx, [esp + 0x48]
lea eax, [esp + 0x18]
mov dword [esp + 0x40], 0
xorps xmm0, xmm0
push eax
movdqu xmmword [esp + 0x4c], xmm0
call fcn.1001e610
cmp dword [esp + 0x48], 7
mov eax, 1
movzx ebx, byte [esp + 0x17]
cmovge ebx, eax
mov dword [esp + 0x8ac], 0xffffffff
cmp dword [esp + 0x2c], 8
jb 0x1001d592
push dword [esp + 0x18]
call fcn.10034183
add esp, 4
xor eax, eax
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
mov word [esp + 0x18], ax
test bl, bl
je 0x1001d95d
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], eax
mov word [esp + 0x30], ax
mov dword [esp + 0x8ac], 3
lea ecx, [esp + 0x30]
cmp dword [edi + 0x10], eax
je 0x1001d5e7
push 0x25
push str.__set_default_launch_actioninstaller
jmp 0x1001d5ee
push 0x23
push str.__only_set_default_actioninstaller
call fcn.10008230
xor eax, eax
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x74], 7
mov dword [esp + 0x70], 0
mov word [esp + 0x60], ax
mov byte [esp + 0x8ac], 4
cmp dword [ebp + 0x10], eax
je 0x1001d645
push 0x13
push str.__set_default_from
lea ecx, [esp + 0x68]
call fcn.10008230
push 0xffffffffffffffff
push 0
push ebp
lea ecx, [esp + 0x6c]
call fcn.1000bd60
xor eax, eax
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x5c], 7
mov dword [esp + 0x58], 0
mov word [esp + 0x48], ax
mov byte [esp + 0x8ac], 5
lea ecx, [esp + 0x48]
push 0xffffffffffffffff
push eax
lea eax, [esp + 0x38]
push eax
call fcn.1000bd60
cmp dword [esp + 0x70], 0
je 0x1001d6ae
push 1
push 0x100cd3a8
lea ecx, [esp + 0x50]
call fcn.1000be30
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x54]
call fcn.1000bd60
cmp dword [edi + 0x10], 0
je 0x1001d6f2
push 1
push 0x100cd3a8
lea ecx, [esp + 0x50]
call fcn.1000be30
push 1
push 0x100cd1e4
lea ecx, [esp + 0x50]
call fcn.1000be30
push 0xffffffffffffffff
push 0
push edi
lea ecx, [esp + 0x54]
call fcn.1000bd60
push 1
push 0x100cd1e4
lea ecx, [esp + 0x50]
call fcn.1000be30
xor eax, eax
xor bl, bl
push 0x40e
push eax
mov word [esp + 0x494], ax
lea eax, [esp + 0x496]
push eax
call fcn.10037070
add esp, 0xc
lea ecx, [esp + 0x48c]
call fcn.1001cc20
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test al, al
je 0x1001d7c7
push str.Shlwapi.dll
lea ecx, [esp + 0x1c]
call fcn.10007750
mov byte [esp + 0x8ac], 6
lea eax, [esp + 0x18]
push eax
call fcn.1001f960
mov ecx, eax
call fcn.1001f9e0
mov esi, eax
mov byte [esp + 0x8ac], 5
cmp dword [esp + 0x2c], 8
jb 0x1001d772
push dword [esp + 0x18]
call fcn.10034183
add esp, 4
xor eax, eax
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
mov word [esp + 0x18], ax
test esi, esi
je 0x1001d7c7
push str.StrStrIW
push esi
call ebp
mov esi, eax
test esi, esi
je 0x1001d7c7
push str.2345ExplorerHTML
lea eax, [esp + 0x490]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1001d7c5
push str.2345Explorer.exe
lea eax, [esp + 0x490]
push eax
call esi
test eax, eax
je 0x1001d7c7
mov bl, 1
xor esi, esi
lea ecx, [esp + 0x18]
push 0xb
xor eax, eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
push 0x100cd1e8
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], esi
mov word [esp + 0x20], ax
call fcn.10008230
mov byte [esp + 0x8ac], 7
mov eax, dword [0x100ef4e8]
test al, 1
jne 0x1001d835
or eax, 1
mov dword [0x100ef4e8], eax
mov byte [esp + 0x8ac], 8
mov dword [0x100ef4e4], esi
call fcn.1001f820
push 0x100baf40
call fcn.1003414c
add esp, 4
mov byte [esp + 0x8ac], 7
lea eax, [esp + 0x18]
mov ecx, 0x100ef4e4
push eax
call fcn.1001f9e0
mov edi, eax
mov byte [esp + 0x8ac], 5
cmp dword [esp + 0x2c], 8
jb 0x1001d861
push dword [esp + 0x18]
call fcn.10034183
add esp, 4
xor eax, eax
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
mov word [esp + 0x18], ax
test edi, edi
je 0x1001d8c0
push str.ShellExecuteW
push edi
call ebp
test eax, eax
je 0x1001d8c0
cmp dword [esp + 0x5c], 8
lea ecx, [esp + 0x48]
push 1
cmovae ecx, dword [esp + 0x4c]
push 0
push ecx
lea ecx, [esp + 0x88]
push ecx
push str.open
push 0
call eax
cmp eax, 0x20
jbe 0x1001d8c0
test bl, bl
mov esi, 0x12
mov eax, 2
cmovne esi, eax
mov byte [esp + 0x8ac], 4
cmp dword [esp + 0x5c], 8
jb 0x1001d8db
push dword [esp + 0x48]
call fcn.10034183
add esp, 4
xor eax, eax
mov dword [esp + 0x5c], 7
mov dword [esp + 0x58], 0
mov word [esp + 0x48], ax
mov byte [esp + 0x8ac], 3
cmp dword [esp + 0x74], 8
jb 0x1001d90d
push dword [esp + 0x60]
call fcn.10034183
add esp, 4
xor eax, eax
mov dword [esp + 0x74], 7
mov dword [esp + 0x70], 0
mov word [esp + 0x60], ax
mov dword [esp + 0x8ac], 0xffffffff
cmp dword [esp + 0x44], 8
jb 0x1001d942
push dword [esp + 0x30]
call fcn.10034183
add esp, 4
xor eax, eax
mov dword [esp + 0x44], 7
mov word [esp + 0x30], ax
mov eax, esi
mov dword [esp + 0x40], 0
jmp 0x1001d978
cmp dword [edi + 0x10], 0
jne 0x1001d967
xor eax, eax
jmp 0x1001d978
cmp dword [edi + 0x14], 8
jb 0x1001d96f
mov edi, dword [edi]
push edi
call fcn.1001d140
add esp, 4
mov ecx, dword [esp + 0x8a4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x888]
xor ecx, esp
call fcn.10033901
add esp, 0x89c
ret