Function at 0x4413b0
Capabilities:
Check if file exists
Get file attributes
Get file system object information

Disassembly:
push 0xffffffffffffffff
push 0x4aed11
mov eax, dword fs:[0]
push eax
mov eax, 0x3b64
call fcn.0049ebb0
mov eax, dword [0x4c03a0]
xor eax, esp
mov dword [esp + 0x3b60], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c03a0]
xor eax, esp
push eax
lea eax, [esp + 0x3b78]
mov dword fs:[0], eax
mov eax, dword [esp + 0x3b88]
inc dword [0x4dbda0]
mov esi, ecx
mov ecx, dword [esp + 0x3b8c]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], ecx
xor edi, edi
mov dword [esp + 0x3b80], edi
mov edx, dword [esi]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 1
push 0xffffffffffffffff
push 0x100c
push edx
call ebx
push 1
mov ecx, 0x4dc218
mov dword [esp + 0x24], eax
call fcn.00464e20
push 0x1c2
call fcn.0045be10
push eax
mov ecx, 0x4dc218
call fcn.00464e90
mov eax, dword [0x4dbda4]
cmp eax, edi
je 0x441469
push eax
call dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov dword [0x4dbda4], 0xffffffff
push 0x400
lea eax, [esp + 0x2f78]
push eax
lea ecx, [esp + 0x2b7c]
push ecx
mov byte [esp + 0x22], 0
call fcn.0047e470
cmp byte [esi + 0xc1e], 0
je 0x4414a0
mov ecx, 0x4dff28
call fcn.00406ff0
jmp 0x4415b0
push edi
lea edx, [esp + 0x2b78]
push edx
call fcn.0044d8b0
test al, al
jne 0x441520
cmp word [esp + 0x2f74], di
jne 0x4414ea
lea eax, [esp + 0x2b74]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4414e0
lea ecx, [esp + 0x2b74]
push ecx
call fcn.0044daf0
test eax, eax
jne 0x44150e
cmp word [esp + 0x2f74], di
je 0x441520
lea edx, [esp + 0x2f74]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x441520
lea eax, [esp + 0x2f74]
push eax
call fcn.0044db70
test eax, eax
je 0x441520
push edi
push 0x4b1a5c
call fcn.0047f4d0
test al, al
sete byte [esp + 0x16]
lea ecx, [esp + 0x2b74]
push ecx
call fcn.0044daf0
lea edx, [esp + 0x2f74]
push edx
mov ebp, eax
call fcn.0044db70
cmp byte [ebp], 0
jne 0x441549
lea ebp, [esp + 0x2b74]
movzx ecx, word [eax]
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push ebp
call fcn.00490b40
lea edx, [esp + 0x2b74]
push edx
call fcn.0044df30
mov ebp, eax
cmp ebp, 0xffffffff
je 0x441583
call fcn.0047e400
mov edx, 1
mov ecx, ebp
shl edx, cl
test edx, eax
je 0x441ce6
cmp byte [esp + 0x16], 0
jne 0x4415b0
mov ecx, 0x4dff28
call fcn.00406900
mov ecx, 0x4dff10
call fcn.0046b9b0
lea eax, [esp + 0x2b74]
push eax
mov ecx, 0x4dff10
call fcn.0046b4d0
mov ecx, dword [esi]
push edi
push edi
push 0xb
push ecx
call ebx
mov ecx, esi
call fcn.0043e950
mov edx, dword [esi + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.COMCTL32.dll_ImageList_Remove]
cmp byte [esp + 0x16], 0
mov ebp, dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
jne 0x4415f7
push 0x4401
push 0x160
lea eax, [esp + 0xac]
push eax
push edi
push 0x4b2160
call ebp
cmp eax, edi
jne 0x441631
push 0x400
lea ecx, [esp + 0x3778]
push ecx
call fcn.0047e340
cmp byte [esp + 0x16], 0
je 0x441614
xor eax, eax
jmp 0x441631
push 0x4401
push 0x160
lea edx, [esp + 0xac]
push edx
push edi
lea eax, [esp + 0x3784]
push eax
call ebp
mov ecx, dword [esi]
push eax
push 1
push 0x1003
push ecx
call ebx
push 1
push str.AllowUppercase
push str.FileList
call fcn.00456940
push edi
push str.ShowSeconds
test eax, eax
push str.FileList
setne byte [esp + 0x2a]
call fcn.00456940
test eax, eax
setne byte [esp + 0x1d]
cmp byte [esi + 0xc1e], 0
je 0x441682
mov ecx, esi
call fcn.0043d300
jmp 0x441bd7
lea ecx, [esp + 0x1ed4]
call fcn.00433040
mov byte [esp + 0x3b80], 1
push 0x4b175c
lea ecx, [esp + 0x1ed8]
call fcn.00433080
lea ecx, [esp + 0x1a48]
call fcn.004680f0
lea ecx, [esp + 0x1a6c]
call fcn.004680f0
lea ecx, [esp + 0x1a90]
call fcn.004680f0
push 0x1f4
lea ecx, [esp + 0x88]
mov dword [esp + 0x1c], edi
mov byte [esp + 0x1b], 0
call fcn.0047f560
mov byte [esp + 0x3b80], 2
cmp byte [esp + 0x16], 0
jne 0x441aa8
jmp 0x441700
push edi
lea edx, [esp + 0xe38]
push edx
lea ecx, [esp + 0x1edc]
call fcn.004334e0
test al, al
je 0x441aa8
test byte [esp + 0x18], 0x1f
jne 0x441730
lea ecx, [esp + 0x84]
call fcn.0047ec00
mov ecx, 0x4b2160
lea eax, [esp + 0xe34]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x441760
test dl, dl
je 0x44175c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x441760
add eax, 2
add ecx, 2
test dl, dl
jne 0x441740
xor eax, eax
jmp 0x441765
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x441700
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0xe34]
mov dword [esp + 0x58], eax
mov dword [esp + 0x68], ecx
mov dword [esp + 0x54], 7
mov dword [esp + 0x70], 0xffffffff
mov dword [esp + 0x5c], edi
mov ecx, 0x4b1a5c
lea eax, [esp + 0xe34]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4417c0
test dl, dl
je 0x4417bc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4417c0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4417a0
xor eax, eax
jmp 0x4417c5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
sete al
mov byte [esp + 0x1f], al
test al, al
je 0x4417f8
lea edx, [esp + 0x2b74]
push edx
call fcn.0044daf0
cmp byte [eax], 0
je 0x441700
mov eax, dword [esp + 0xa8]
mov dword [esp + 0x70], eax
mov byte [esp + 0x17], 1
push 0xc30
lea ecx, [esp + 0x208]
push edi
push ecx
call fcn.0049ebe0
add esp, 0xc
xor eax, eax
mov cl, byte [esp + eax + 0xe34]
mov byte [esp + eax + 0x204], cl
inc eax
test cl, cl
jne 0x441810
lea edx, [esp + 0x1234]
push edx
lea eax, [esp + 0x608]
push eax
call fcn.0046db30
lea ecx, [esp + 0x1234]
push ecx
lea edx, [esp + 0xe38]
push edx
mov ecx, esi
call fcn.0043d540
test al, al
je 0x44185d
xor eax, eax
mov word [esp + 0x1234], ax
mov eax, dword [esp + 0x1a3c]
mov ecx, dword [esp + 0x1a34]
mov edx, dword [esp + 0x1a38]
mov dword [esp + 0xe14], eax
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0xe04], ecx
mov ecx, dword [esp + 0x1ec4]
mov dword [esp + 0x18], eax
mov dword [esp + 0xe28], eax
mov dword [esp + 0xe08], edx
mov edx, dword [esp + 0x1ec8]
lea eax, [esp + 0x204]
mov dword [esp + 0xe18], ecx
push eax
mov ecx, 0x4ecc70
mov dword [esp + 0xe10], edi
mov dword [esp + 0xe14], edi
mov dword [esp + 0xe20], edx
call fcn.0043ceb0
cmp byte [esp + 0x1e], 0
mov dword [esp + 0x74], eax
jne 0x4418e8
mov ecx, dword [esp + 0x68]
push ecx
call fcn.00445440
call fcn.0043cdb0
test eax, eax
je 0x441916
cmp word [esp + 0x1234], di
je 0x441916
mov ecx, dword [esi]
lea eax, [esp + 0x54]
push eax
push edi
lea edx, [esp + 0x123c]
push 0x104d
mov dword [esp + 0x74], edx
push ecx
jmp 0x441924
mov eax, dword [esi]
lea edx, [esp + 0x54]
push edx
push edi
push 0x1007
push eax
call ebx
cmp byte [esp + 0x1a44], 0
mov ebp, eax
jne 0x44196c
mov edx, dword [esp + 0xe08]
mov eax, dword [esp + 0xe04]
push 0x32
lea ecx, [esp + 0x2b44]
push ecx
push edx
push eax
call fcn.00444e50
mov eax, dword [esi]
lea edx, [esp + 0x24]
push edx
push ebp
lea ecx, [esp + 0x2b48]
push 0x102e
mov dword [esp + 0x44], ecx
push eax
jmp 0x441982
mov edx, dword [esi]
lea ecx, [esp + 0x24]
push ecx
push ebp
push 0x102e
mov dword [esp + 0x44], 0x4b1914
push edx
mov dword [esp + 0x3c], 1
call ebx
cmp byte [esp + 0x1f], 0
mov dword [esp + 0x2c], 2
je 0x4419b6
mov edx, dword [esi]
lea ecx, [esp + 0x24]
push ecx
push ebp
lea eax, [esp + 0x1bc]
push 0x102e
mov dword [esp + 0x44], eax
push edx
jmp 0x4419cc
mov ecx, dword [esi]
lea eax, [esp + 0x24]
push eax
push ebp
push 0x102e
mov dword [esp + 0x44], 0x4b1914
push ecx
call ebx
lea edx, [esp + 0x7c]
push edx
lea eax, [esp + 0x1ec8]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea ecx, [esp + 0x94]
push ecx
lea edx, [esp + 0x80]
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0x64
lea eax, [esp + 0x2ae0]
push eax
push 0
lea ecx, [esp + 0xa0]
push ecx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_GetDateFormatA]
lea edi, [esp + 0x2adc]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x441a20
mov dx, word [0x4b2b0c]
lea eax, [esp + 0x2adc]
mov word [edi], dx
lea ecx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x441a40
xor edx, edx
sub eax, ecx
cmp byte [esp + 0x1d], dl
push 0x64
setne dl
lea eax, [esp + eax + 0x2ae0]
push eax
push 0
lea ecx, [esp + 0xa0]
push ecx
dec edx
and edx, 2
push edx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
mov edx, dword [esi]
lea ecx, [esp + 0x24]
push ecx
push ebp
push 0x102e
lea eax, [esp + 0x2ae8]
push edx
mov dword [esp + 0x3c], 3
mov dword [esp + 0x48], eax
call ebx
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
xor edi, edi
jmp 0x441700
cmp byte [esp + 0x2b74], 0x5c
jne 0x441ae2
cmp byte [esp + 0x2b75], 0x5c
jne 0x441ae2
lea ecx, [esp + 0x2b76]
push 0x5c
push ecx
call fcn.0049e290
add esp, 8
cmp eax, edi
je 0x441aed
inc eax
push 0x5c
push eax
call fcn.0049e290
add esp, 8
test eax, eax
je 0x441aed
cmp byte [esp + 0x17], 0
jne 0x441baf
lea edx, [esp + 0x2b74]
push edx
call fcn.0044daf0
cmp byte [eax], 0
je 0x441baf
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0xa8]
push 0xc30
lea edx, [esp + 0x208]
push edi
push edx
mov dword [esp + 0x60], 7
mov dword [esp + 0x64], eax
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x68], edi
mov dword [esp + 0x74], 0x4b1a5c
call fcn.0049ebe0
mov cl, byte [0x4b1a5e]
mov ax, word [0x4b1a5c]
add esp, 0xc
lea edx, [esp + 0x204]
mov byte [esp + 0x206], cl
push edx
mov ecx, 0x4ecc70
mov word [esp + 0x208], ax
mov dword [esp + 0xe18], 0x10
call fcn.0043ceb0
mov ecx, dword [esi]
mov dword [esp + 0x74], eax
lea eax, [esp + 0x54]
push eax
push edi
push 0x1007
push ecx
call ebx
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x1b8]
push eax
mov dword [esp + 0x40], edx
mov edx, dword [esi]
push 0x102e
push edx
mov dword [esp + 0x3c], 2
call ebx
mov byte [esp + 0x3b80], 1
lea ecx, [esp + 0x84]
call fcn.0047ec40
mov byte [esp + 0x3b80], 0
lea ecx, [esp + 0x1ed4]
call fcn.00433060
mov ecx, 0x4ecc70
call fcn.0043d140
mov ecx, esi
call fcn.004407a0
mov ebp, dword [esp + 0x4c]
cmp ebp, edi
je 0x441c37
cmp byte [ebp], 0
jne 0x441c26
mov eax, dword [esi]
push edi
push edi
push 0x1004
push eax
call ebx
mov ecx, dword [esp + 0x20]
cmp ecx, eax
jl 0x441c11
cmp eax, edi
jle 0x441c11
lea ecx, [eax - 1]
lea edx, [esp + 0x24]
mov eax, 3
push edx
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], eax
push ecx
jmp 0x441c59
mov ecx, dword [esp + 0x50]
push ecx
push ebp
mov ecx, esi
call fcn.00440ed0
cmp eax, edi
jne 0x441c63
mov eax, 3
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x20]
cmp eax, 0xffffffff
je 0x441c51
cmp ebp, edi
jne 0x441c53
xor eax, eax
lea edx, [esp + 0x24]
push edx
push eax
mov eax, dword [esi]
push 0x102b
push eax
call ebx
mov ecx, dword [esi]
push 1
push 0xffffffffffffffff
push 0x100c
push ecx
call ebx
push edi
mov ecx, 0x4dc218
mov ebp, eax
call fcn.00464e90
mov edx, dword [esi]
push edi
push 1
push 0xb
push edx
call ebx
mov eax, dword [esi]
push edi
push edi
push 0x102a
push eax
call ebx
mov ecx, dword [esi]
push edi
push ebp
push 0x1013
push ecx
call ebx
mov ecx, esi
call fcn.0043fda0
mov ecx, esi
call fcn.0043db70
push edi
mov ecx, 0x4dc218
call fcn.00464e20
mov ecx, 0x4e2ed8
call fcn.00468c60
cmp byte [esp + 0x16], 0
jne 0x441ce6
cmp byte [esi + 0xc1e], 0
jne 0x441ce6
push 3
push edi
push 0x4b2160
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationA]
mov dword [0x4dbda4], eax
mov dword [esp + 0x3b80], 0xffffffff
cmp dword [0x4dbda0], edi
jle 0x441cff
dec dword [0x4dbda0]
mov ecx, dword [esp + 0x3b78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3b60]
xor ecx, esp
call fcn.0049e626
add esp, 0x3b70
ret 8