Function at 0x4ad03357
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x4ad33b78]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push dword [eax + 0x38]
xor ebx, ebx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x21c], ebx
call fcn.4ad01349
mov esi, eax
cmp esi, ebx
je 0x4ad0b6b2
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov dword [ebp - 0x220], eax
mov edi, 0x104
cmp dword [ebp - 0x220], edi
jae 0x4ad1321a
cmp byte [0x4ad2fa64], 0
je 0x4ad033dc
cmp esi, ebx
je 0x4ad13229
push 4
push 0x4ad03828
push esi
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x4ad13229
push edi
push ebx
lea eax, [ebp - 0x214]
push eax
call fcn.4ad02afb
cmp esi, ebx
je 0x4ad033fe
lea eax, [ebp - 0x214]
push esi
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
xor eax, eax
mov ax, word [0x4ad33b88]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.4ad03841
mov ax, word [0x4ad33b8c]
mov word [ebp - 0xc], ax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x214]
push eax
mov word [ebp - 0xa], 0x3a
mov word [ebp - 8], bx
call fcn.4ad029e3
cmp eax, dword [ebp - 0x220]
mov word [ebp - 0xa], bx
sbb eax, eax
neg eax
mov dword [ebp - 0x220], eax
je 0x4ad03a3a
xor eax, eax
mov ax, word [0x4ad33b8c]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.4ad01a67
mov edi, eax
cmp edi, ebx
je 0x4ad1324c
inc edi
inc edi
cmp word [edi], bx
je 0x4ad0b70b
mov esi, dword [sym.imp.msvcrt.dll_wcscmp]
push 0x4ad01ab0
push edi
call esi
test eax, eax
pop ecx
pop ecx
je 0x4ad0b70b
push 0x4ad01aa8
push edi
call esi
test eax, eax
pop ecx
pop ecx
je 0x4ad0b70b
push 0x410
call fcn.4ad01725
mov ebx, eax
test ebx, ebx
je 0x4ad13261
cmp dword [ebp - 0x218], 0
je 0x4ad034d7
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x218]
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
mov esi, dword [sym.imp.msvcrt.dll_wcscat]
lea eax, [ebp - 0x214]
mov ecx, edi
sub ecx, eax
mov eax, dword [ebp - 0x218]
sar ecx, 1
and word [eax + ecx*2], 0
test eax, eax
je 0x4ad03502
push 0x4ad01ab0
push eax
call esi
pop ecx
pop ecx
push 0x208
push dword [ebp - 0x218]
push ebx
call fcn.4ad01ab9
test eax, eax
jne 0x4ad0b70b
push ebx
call fcn.4ad01a8d
mov ax, word [eax]
cmp ax, word [0x4ad33b8c]
je 0x4ad03537
push 0x4ad0136c
push ebx
call esi
pop ecx
pop ecx
push edi
push ebx
call esi
push ebx
call dword [sym.imp.msvcrt.dll_wcslen]
add esp, 0xc
lea eax, [eax + eax + 2]
push eax
push ebx
call fcn.4ad01790
mov ebx, eax
test ebx, ebx
je 0x4ad13261
xor eax, eax
mov ax, word [0x4ad33b8c]
push eax
push ebx
call fcn.4ad01a67
and word [eax], 0
inc eax
inc eax
cmp dword [ebp - 0x220], 0
mov dword [ebp - 0x224], eax
je 0x4ad03a45
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
push ebx
call esi
mov edi, eax
xor eax, eax
cmp dword [ebp - 0x21c], eax
pop ecx
jne 0x4ad03a5a
add eax, edi
lea eax, [eax + eax + 8]
push eax
call fcn.4ad01725
mov edi, eax
test edi, edi
je 0x4ad13261
mov esi, 0x4ad03838
push esi
push edi
call dword [sym.imp.msvcrt.dll_wcscat]
push ebx
mov ebx, dword [sym.imp.msvcrt.dll_wcscat]
push edi
call ebx
push esi
push edi
call ebx
add esp, 0x18
cmp dword [ebp - 0x220], 0
mov esi, 0x4ad03834
je 0x4ad03a68
push edi
call fcn.4ad03874
push 1
push esi
push edi
call fcn.4ad017ea
cmp dword [ebp - 0x224], 0
mov dword [ebp - 0x21c], eax
je 0x4ad0b6bd
push dword [ebp - 0x224]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov dword [ebp - 0x22c], eax
cmp byte [0x4ad2fa64], 0
je 0x4ad0b6c9
push str.PATHEXT
call fcn.4ad01b84
mov edi, eax
test edi, edi
je 0x4ad0b6c9
push edi
call fcn.4ad03874
push 1
push esi
push edi
call fcn.4ad017ea
mov dword [ebp - 0x230], eax
mov edi, dword [ebp - 0x21c]
test edi, edi
je 0x4ad0b6d3
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov ebx, eax
test edi, edi
je 0x4ad0b6da
push edi
call fcn.4ad01349
test eax, eax
je 0x4ad03687
push edi
call fcn.4ad01349
push eax
push edi
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov esi, eax
push edi
call fcn.4ad01a8d
mov ax, word [eax]
xor edi, edi
cmp ax, word [0x4ad33b8c]
je 0x4ad036a8
inc edi
inc ebx
inc esi
mov ecx, dword [ebp - 0x21c]
xor edx, edx
cmp word [ecx], dx
je 0x4ad0b68b
mov eax, dword [ebp - 0x22c]
lea esi, [esi + eax + 1]
cmp esi, 0x104
mov dword [ebp - 0x238], esi
ja 0x4ad13272
cmp dword [ebp - 0x218], edx
je 0x4ad036f9
push dword [ebp - 0x21c]
push dword [ebp - 0x218]
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x21c]
xor edx, edx
cmp edi, edx
mov eax, ebx
je 0x4ad13289
cmp edi, edx
lea eax, [ecx + eax*2]
mov dword [ebp - 0x21c], eax
je 0x4ad03730
cmp dword [ebp - 0x218], edx
je 0x4ad0b6e1
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x218]
call dword [sym.imp.msvcrt.dll_wcscat]
pop ecx
pop ecx
xor edx, edx
cmp dword [ebp - 0x218], edx
je 0x4ad0b6e1
cmp dword [ebp - 0x224], edx
je 0x4ad03758
push dword [ebp - 0x224]
push dword [ebp - 0x218]
call dword [sym.imp.msvcrt.dll_wcscat]
pop ecx
pop ecx
mov esi, dword [ebp - 0x218]
push esi
call fcn.4ad01349
test eax, eax
je 0x4ad03778
push esi
call fcn.4ad01349
push eax
push esi
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x218]
cmp word [eax + 2], 0x3a
jne 0x4ad037a4
movzx eax, word [eax]
push eax
call fcn.4ad02a73
test eax, eax
je 0x4ad0364d
push 0x2e
push dword [ebp - 0x224]
call fcn.4ad01a67
xor ebx, ebx
cmp eax, ebx
je 0x4ad03973
cmp word [eax + 2], bx
je 0x4ad03973
push 1
push dword [ebp - 0x218]
call fcn.4ad038c4
test eax, eax
je 0x4ad03b5b
push 0x2e
push dword [ebp - 0x218]
call fcn.4ad01a67
mov edi, eax
cmp edi, ebx
je 0x4ad03b67
mov esi, dword [sym.imp.msvcrt.dll__wcsicmp]
push str..CMD
push edi
call esi
test eax, eax
pop ecx
pop ecx
je 0x4ad05f3a
push str..BAT
push edi
call esi
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.4ad01305
leave
ret 8
push 0x2a
push dword [ebp - 0x224]
call fcn.4ad01323
test eax, eax
jne 0x4ad0b6a1
push 0x3f
push dword [ebp - 0x224]
call fcn.4ad01323
test eax, eax
jne 0x4ad0b6a1
mov esi, dword [ebp - 0x230]
push ebx
push 0x4ad03a34
push dword [ebp - 0x228]
push dword [ebp - 0x218]
call fcn.4ad039fe
test eax, eax
jne 0x4ad05f4c
mov eax, dword [0x4ad2ba04]
cmp eax, ebx
je 0x4ad039d4
cmp eax, 2
jne 0x4ad0364d
push 1
push 0x4ad032dc
push dword [ebp - 0x228]
push dword [ebp - 0x218]
call fcn.4ad039fe
test eax, eax
jne 0x4ad132a0
jmp 0x4ad0364d
lea edi, [ebp - 0x214]
jmp 0x4ad03472
push str.PATH
call fcn.4ad01b84
mov dword [ebp - 0x21c], eax
jmp 0x4ad03582
push dword [ebp - 0x21c]
call esi
pop ecx
jmp 0x4ad0359c
push esi
push edi
call ebx
cmp dword [ebp - 0x21c], 0
pop ecx
pop ecx
je 0x4ad035e2
push dword [ebp - 0x21c]
push edi
call ebx
pop ecx
pop ecx
jmp 0x4ad035e2
cmp dword [ebp - 0x220], ebx
jne 0x4ad0b6ec
mov eax, dword [0x4ad2ba04]
cmp eax, 2
jne 0x4ad13291
jmp 0x4ad03973
mov edi, dword [sym.imp.msvcrt.dll__wcsicmp]
push str..BAT
push esi
call edi
test eax, eax
pop ecx
pop ecx
je 0x4ad05f3a
push str..CMD
push esi
call edi
test eax, eax
pop ecx
pop ecx
jne 0x4ad05f92
push 2
pop eax
jmp 0x4ad03819
mov ax, word [esi]
inc esi
inc esi
test ax, ax
jne 0x4ad05f42
cmp word [esi], bx
je 0x4ad039c2
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
add eax, dword [ebp - 0x238]
pop ecx
cmp eax, 0x104
ja 0x4ad05f42
push 1
push esi
push dword [ebp - 0x228]
push dword [ebp - 0x218]
call fcn.4ad039fe
test eax, eax
jne 0x4ad05f18
mov eax, dword [0x4ad2ba04]
cmp eax, 2
jne 0x4ad0b6fe
jmp 0x4ad05f42
xor eax, eax
jmp 0x4ad03818
cmp dword [ebp - 0x220], edx
je 0x4ad0b6a1
mov eax, dword [0x4ad2ba04]
cmp eax, edx
je 0x4ad0b6a1
cmp eax, 2
jne 0x4ad0b6ab
mov dword [0x4ad2ba04], 0x2331
xor eax, eax
jmp 0x4ad03819
mov dword [ebp - 0x220], ebx
jmp 0x4ad033a1
and dword [ebp - 0x22c], 0
jmp 0x4ad03617
mov edi, str..COM_.EXE_.BAT_.CMD_.VBS_.JS_.WS
jmp 0x4ad03638
xor ebx, ebx
jmp 0x4ad03665
xor esi, esi
jmp 0x4ad03691
mov dword [ebp - 0x228], edx
jmp 0x4ad03786
cmp dword [0x4ad2ba04], 5
jne 0x4ad03b67
jmp 0x4ad037da
cmp eax, ebx
jne 0x4ad039cb
jmp 0x4ad05f42
cmp byte [0x4ad2fa64], 0
je 0x4ad0b6a1
jmp 0x4ad132cd
mov dword [0x4ad2ba04], 0x233f
jmp 0x4ad0b6ab
push str.COMSPEC
call fcn.4ad01b84
mov esi, eax
cmp esi, ebx
jne 0x4ad033dc
mov dword [0x4ad2ba04], 0x23d2
jmp 0x4ad0b6ab
push 0x3a
lea eax, [ebp - 0x214]
push eax
call fcn.4ad01323
mov edi, eax
jmp 0x4ad03470
mov dword [0x4ad2ba04], 8
push 3
jmp 0x4ad05f3c
cmp edi, edx
mov eax, ebx
jne 0x4ad1327b
lea eax, [ebx + 1]
lea eax, [ecx + eax*2]
mov dword [ebp - 0x21c], eax
jmp 0x4ad0364d
lea eax, [ebx + 1]
jmp 0x4ad03703
cmp eax, ebx
jne 0x4ad0364d
xor ebx, ebx
jmp 0x4ad03973
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0x218]
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
test eax, eax
je 0x4ad0364d
cmp dword [ebp - 0x234], 4
jne 0x4ad0364d
jmp 0x4ad05f92
push dword [ebp - 0x218]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4ad0b6a1
test al, 0x10
je 0x4ad0b6a1
push 5
jmp 0x4ad05f3c