Function at 0x418ae0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4506c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [0x4981ec]
push ebx
push esi
push edi
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], ebx
mov esi, 0x454f9c
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], esi
lea eax, [ebp - 0x10]
push 0x20019
push eax
push 0x4914a8
push SysStringLen
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.0041b730
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x28]
cmp eax, ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x2c], esi
je 0x418b5a
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call edi
mov dword [ebp - 0x28], ebx
jmp 0x418b60
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x24]
call fcn.00444260
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
cmp eax, ebx
je 0x418bbf
mov ecx, dword [0x4981ec]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x2c], esi
lea edx, [ebp - 0x10]
push 0x20019
push edx
push 0x49151c
push SysReAllocStringLen
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.0041b730
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x28]
cmp eax, ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x2c], esi
je 0x418bb7
push eax
call edi
mov dword [ebp - 0x28], ebx
lea ecx, [ebp - 0x24]
call fcn.00444260
mov eax, dword [0x4981ec]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], esi
lea ecx, [ebp - 0x10]
push 0x20019
push ecx
push 0x491584
push SysStringLen
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.0041b730
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x18]
push edx
push 0x4915b4
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041ba90
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x28]
cmp eax, ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x2c], esi
je 0x418c18
push eax
call edi
mov dword [ebp - 0x28], ebx
lea ecx, [ebp - 0x24]
call fcn.00444260
mov eax, dword [ebp + 0xc]
xor edi, edi
cmp eax, ebx
je 0x418c79
mov ecx, dword [0x4981ec]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x2c], esi
lea edx, [ebp - 0x10]
push 0x20019
push edx
push 0x4915dc
push SysReAllocStringLen
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 5
call fcn.0041b730
mov edi, eax
mov eax, dword [ebp - 0x28]
cmp eax, ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x2c], esi
je 0x418c71
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x28], ebx
lea ecx, [ebp - 0x24]
call fcn.00444260
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.004441d0
push 0x49bdf4
push 0x491644
push SysReAllocStringLen
push esi
call fcn.0041af10
mov eax, dword [esi]
add esp, 0x10
cmp dword [eax - 8], ebx
jne 0x418cba
push 0x49bdf8
push 0x491680
push SysReAllocStringLen
push esi
call fcn.0041af10
add esp, 0x10
mov esi, dword [esi]
cmp dword [esi - 8], ebx
je 0x418ceb
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x418ceb
test al, 0x10
jne 0x418ceb
cmp dword [ebp - 0x1c], ebx
je 0x418cdb
cmp dword [ebp - 0x14], ebx
je 0x418ce4
cmp dword [ebp - 0x20], ebx
je 0x418ceb
cmp edi, ebx
jne 0x418ceb
mov esi, 1
jmp 0x418ced
xor esi, esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call fcn.00444260
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.00444260
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret