Function at 0x4a9a30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0xe50
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0xe4c], eax
push ebx
xor ebx, ebx
push 0x103
lea eax, [esp + 0x151]
push ebx
push eax
mov byte [esp + 0x158], bl
call fcn.005dfd60
push 0x3ff
lea ecx, [esp + 0x261]
push ebx
push ecx
mov byte [esp + 0x268], bl
call fcn.005dfd60
push 0x3ff
lea edx, [esp + 0xa6d]
push ebx
push edx
mov byte [esp + 0xa74], bl
call fcn.005dfd60
mov eax, dword [esp + 0xe7c]
add esp, 0x24
mov dword [esp + 8], 0x400
cmp eax, ebx
je 0x4a9b25
cmp byte [eax], bl
je 0x4a9b25
lea edx, [esp + 0x250]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x4a9ab8
push 0x60c81c
lea eax, [esp + 0x254]
push 0x60ef68
push eax
call fcn.004e9030
lea ecx, [esp + 0x25c]
push ecx
call fcn.004e1290
add esp, 0x10
lea edx, [esp + 8]
push edx
lea eax, [esp + 0xa54]
push eax
push str.WhlPacString
push 0x613dac
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5770
test al, al
je 0x4a9bb5
mov al, byte [esp + 0xa50]
cmp al, bl
je 0x4a9bb5
cmp al, 0x2a
jne 0x4a9b40
mov eax, 1
pop ebx
mov ecx, dword [esp + 0xe4c]
xor ecx, esp
call fcn.005dfbbe
add esp, 0xe50
ret
push 1
push ebx
push 0x2c
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x660]
push edx
lea eax, [esp + 0xa64]
push eax
mov dword [esp + 0x1c], ebx
call fcn.004e1380
add esp, 0x18
cmp dword [esp + 4], 0xffffffff
je 0x4a9bb5
lea ecx, [ecx]
lea ecx, [esp + 0x250]
push ecx
lea edx, [esp + 0x654]
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4a9b25
push 1
push ebx
push 0x2c
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x660]
push ecx
lea edx, [esp + 0xa64]
push edx
call fcn.004e1380
add esp, 0x18
cmp dword [esp + 4], 0xffffffff
jne 0x4a9b70
lea eax, [esp + 0x250]
push 0x60ef30
push eax
call fcn.005e0a30
add esp, 8
test eax, eax
jne 0x4a9c03
lea ecx, [esp + 0x250]
push ecx
lea edx, [esp + 0xa54]
push str.http:___s
push edx
call fcn.005dfb23
add esp, 0xc
xor eax, eax
lea ecx, [ecx]
mov cl, byte [esp + eax + 0xa50]
mov byte [esp + eax + 0x250], cl
inc eax
cmp cl, bl
jne 0x4a9bf0
lea eax, [esp + 0x250]
push 0x60ef30
push eax
call fcn.005e0a30
add eax, 2
lea edx, [esp + 0xa58]
add esp, 8
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x4a9c24
lea ecx, [esp + 0xa50]
push 0x2f
push ecx
call fcn.005e0a00
add esp, 8
test eax, eax
jne 0x4a9c93
lea eax, [esp + 0x250]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x4a9c50
mov edx, dword [str._proxy.pac]
mov ecx, dword [0x63fecc]
mov dword [eax], edx
mov dx, word [0x63fed0]
mov dword [eax + 4], ecx
mov cl, byte [0x63fed2]
mov word [eax + 8], dx
mov byte [eax + 0xa], cl
xor eax, eax
nop
mov cl, byte [esp + eax + 0x250]
mov byte [esp + eax + 0xa50], cl
inc eax
cmp cl, bl
jne 0x4a9c80
lea edx, [esp + 0xa50]
push 0x2f
push edx
call fcn.005e0a00
add esp, 8
cmp eax, ebx
je 0x4a9ce5
inc eax
push 0x2e
push eax
call fcn.005e0940
add esp, 8
test eax, eax
jne 0x4a9ce5
lea eax, [esp + 0x250]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x4a9cc1
mov ecx, dword [str.proxy.pac]
mov edx, dword [0x63fec0]
mov dword [eax], ecx
mov cx, word [0x63fec4]
mov dword [eax + 4], edx
mov word [eax + 8], cx
lea edx, [esp + 0x250]
push str.file:__
push edx
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x4a9d2a
lea eax, [esp + 0x250]
push eax
call fcn.0040aa20
add esp, 4
test eax, eax
je 0x4a9d78
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xe4c]
xor ecx, esp
call fcn.005dfbbe
add esp, 0xe50
ret
push str.file:__
call fcn.004dd6c0
lea eax, [esp + eax + 0x254]
lea edx, [esp + 0x150]
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x4a9d47
push 0x66da34
lea ecx, [esp + 0x150]
push 0x60cf1c
push ecx
call fcn.004e9030
lea edx, [esp + 0x158]
push edx
call fcn.004e1290
add esp, 0x10
push esi
lea eax, [esp + 0x254]
push 0x2e
push eax
call fcn.005e0a00
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x4aa072
push str..ins
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4a9dbd
push str..pac
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4aa072
cmp byte [esp + 0x150], bl
je 0x4a9ec7
push 0x13c
lea ecx, [esp + 0x18]
push ebx
push ecx
mov dword [esp + 0x1c], ebx
call fcn.005dfd60
lea edx, [esp + 0x1c]
push edx
push ebx
push ebx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x16c]
push ecx
mov dword [esp + 0x28], ebx
call fcn.004ec5a0
add esp, 0x20
test eax, eax
jne 0x4aa072
lea edx, [esp + 0x150]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4a9e4a
test al, 6
je 0x4a9e4a
lea eax, [esp + 0x150]
push eax
call fcn.004a99a0
add esp, 4
neg eax
sbb eax, eax
pop esi
neg eax
pop ebx
mov ecx, dword [esp + 0xe4c]
xor ecx, esp
call fcn.005dfbbe
add esp, 0xe50
ret
push ebx
lea ecx, [esp + 0x154]
push str._temp
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4a9eba
push ebx
lea edx, [esp + 0x154]
push str._startup_
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4a9eba
push ebx
lea eax, [esp + 0x154]
push str.locallow_
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4a9eba
push ebx
lea ecx, [esp + 0x154]
push str._roaming_
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4aa08b
lea edx, [esp + 0x150]
push edx
jmp 0x4a9e25
push 7
lea eax, [esp + 0x258]
push str.http:__
push eax
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4a9ef6
push 0x64
lea ecx, [esp + 0x25f]
push ecx
lea edx, [esp + 0x65c]
push edx
jmp 0x4a9f35
push 8
lea eax, [esp + 0x258]
push str.https:__
push eax
call fcn.004dd670
add esp, 0xc
push 0x64
test eax, eax
jne 0x4a9f25
lea ecx, [esp + 0x260]
push ecx
lea edx, [esp + 0x65c]
push edx
jmp 0x4a9f35
lea eax, [esp + 0x258]
push eax
lea ecx, [esp + 0x65c]
push ecx
call fcn.005e1e30
add esp, 0xc
lea edx, [esp + 0x654]
push 0x2f
push edx
call fcn.005e0a00
add esp, 8
cmp eax, ebx
je 0x4a9f55
mov byte [eax], bl
lea eax, [esp + 0x654]
push 0x3a
push eax
call fcn.005e0a00
add esp, 8
cmp eax, ebx
je 0x4a9f6d
mov byte [eax], bl
lea ecx, [esp + 0x654]
push ebx
push ecx
call fcn.00508760
add esp, 8
test eax, eax
je 0x4a9fcd
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x658]
push eax
mov dword [esp + 0x10], ebx
call fcn.00508cf0
mov esi, eax
mov eax, dword [esp + 0x10]
add esp, 8
cmp eax, ebx
je 0x4a9fae
push eax
call fcn.005e0865
add esp, 4
xor eax, eax
cmp esi, 1
pop esi
sete al
pop ebx
mov ecx, dword [esp + 0xe4c]
xor ecx, esp
call fcn.005dfbbe
add esp, 0xe50
ret
lea ecx, [esp + 0x654]
push 0x2e
push ecx
call fcn.005e0940
add esp, 8
test eax, eax
je 0x4aa08b
push ebx
lea edx, [esp + 0x658]
push str..lan
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4aa08b
push ebx
lea eax, [esp + 0x658]
push str.lan.
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4aa08b
push ebx
lea ecx, [esp + 0x658]
push str._proxy_
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4aa08b
push ebx
lea edx, [esp + 0x658]
push str..proxy
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4aa08b
push ebx
lea eax, [esp + 0x658]
push str.proxy.
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4aa08b
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xe4c]
xor ecx, esp
call fcn.005dfbbe
add esp, 0xe50
ret
mov ecx, dword [esp + 0xe54]
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.005dfbbe
add esp, 0xe50
ret