Function at 0x4419b2
Capabilities:
Check if file exists
Copy file
Create process on windows
Delete file
Get file attributes
Get graphical window text
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
cmp eax, 0x9c41
jne 0x4419d0
push dword [ebp + 8]
call fcn.0043a22b
jmp 0x441fde
cmp eax, 0x9c42
jne 0x4419e3
push 0
call fcn.00427f9a
jmp 0x441fde
cmp eax, 0x9c43
jne 0x4419f4
call fcn.00429432
jmp 0x441fde
cmp eax, 0x9c4d
jne 0x441a05
call fcn.00428862
jmp 0x441fde
cmp eax, 0x9c44
jne 0x441a47
mov byte [0x45cf22], 0
push 0xffdd
push str.MdiEditChild
call fcn.00446683
push 0x44ed66
push dword [0x4538c4]
call sub.user32.dll_SetWindowTextA
push 0x44ed65
push dword [0x4538c4]
call fcn.004367ec
jmp 0x441fde
cmp eax, 0x9c45
jne 0x441a5b
push dword [ebp + 8]
call fcn.0041512a
jmp 0x441fde
cmp eax, 0xa03d
jne 0x441ad8
push 0x104
push 0x45cf22
push dword [0x4538c4]
call sub.user32.dll_GetWindowTextA
push 0x45cf22
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x441fde
cmp dword [0x4538c8], 0
jne 0x441a9c
cmp dword [0x4538cc], 0
je 0x441ab4
push 0
push 0
push 0x10
push dword [0x4538c4]
call sub.user32.dll_SendMessageA
call fcn.004154b0
jmp 0x441ad3
cmp dword [0x453960], 0
je 0x441ad3
push 0
push 0
push 0x10
push dword [0x4538c4]
call sub.user32.dll_SendMessageA
call fcn.00412ab7
jmp 0x441fde
cmp eax, 0x9c4e
jne 0x441aec
push dword [ebp + 8]
call fcn.00412ada
jmp 0x441fde
cmp eax, 0x9c46
jne 0x441b09
push 0
push 0
push 0x10
push dword [0x4538c4]
call sub.user32.dll_SendMessageA
jmp 0x441fde
cmp eax, 0x9c47
jne 0x441b61
cmp dword [0x4538c8], 0
je 0x441b29
push dword [0x4538c4]
call fcn.0041590f
jmp 0x441fde
cmp dword [0x4538cc], 0
je 0x441b44
push 0
push dword [0x4538c4]
call fcn.00421733
jmp 0x441fde
cmp dword [0x453960], 0
je 0x441fde
push dword [0x4538c4]
call fcn.00412b58
jmp 0x441fde
cmp eax, 0x9c48
jne 0x441bb9
cmp dword [0x4538c8], 0
je 0x441b81
push dword [0x4538c4]
call fcn.00415ab6
jmp 0x441fde
cmp dword [0x4538cc], 0
je 0x441b9c
push 1
push dword [0x4538c4]
call fcn.00421733
jmp 0x441fde
cmp dword [0x453960], 0
je 0x441fde
push dword [0x4538c4]
call fcn.00412c45
jmp 0x441fde
cmp eax, 0x9c49
jne 0x441bcf
push 0x9c49
call fcn.00449209
jmp 0x441fde
cmp eax, 0x5208
jb 0x441c09
cmp eax, 0x5211
ja 0x441c09
sub eax, 0x5208
shl eax, 8
add eax, 0x46fc52
push eax
push 0x45cf22
call fcn.004010a7
call fcn.004154b0
push 0x45cf22
call fcn.00407f64
jmp 0x441fde
cmp eax, 0x9c4a
jne 0x441c6d
call fcn.00416ec8
mov dword [0x463746], 0x54
push dword [0x4538b0]
pop dword [0x46374a]
push dword [0x453904]
pop dword [0x463782]
cmp dword [0x45ee12], 0
je 0x441c47
mov eax, 6
jmp 0x441c4c
mov eax, 0xa
mov dword [0x463756], eax
push 0x463746
call sub.comdlg32.dll_PageSetupDlgA
or eax, eax
je 0x441fde
call fcn.0040b72e
jmp 0x441fde
cmp eax, 0x9c4b
jne 0x441c7e
call fcn.004171eb
jmp 0x441fde
cmp eax, 0x9c4c
jne 0x441cb1
cmp dword [0x44f32d], 0
je 0x441c9e
call fcn.00429432
or eax, eax
je 0x441c9e
xor eax, eax
pop ebx
leave
ret 4
push 0
push 0
push 0x10
push dword [ebp + 8]
call sub.user32.dll_SendMessageA
jmp 0x441fde
cmp eax, 0xc35f
jne 0x441cf5
call fcn.004279ec
push 0x46fa42
push 1
push 0xc2
push dword [0x4538c8]
call sub.user32.dll_SendMessageA
mov dword [0x46fc4a], 0
mov byte [0x46fa42], 0
push dword [0x4538c8]
call sub.user32.dll_SetFocus
jmp 0x441fde
cmp eax, 0xc359
jne 0x441d10
call fcn.004279ec
mov dword [0x46fc4a], 1
jmp 0x441fde
cmp eax, 0xc35a
jne 0x441d2b
call fcn.004279ec
mov dword [0x46fc4a], 0
jmp 0x441fde
cmp eax, 0xc35b
jne 0x441e45
lea eax, [ebp - 0x100]
push eax
call fcn.00427985
push 0x46fb46
lea eax, [ebp - 0x100]
push eax
call fcn.004010c5
push 0x46fa42
lea eax, [ebp - 0x100]
push eax
call fcn.00401105
or eax, eax
jne 0x441d96
lea eax, [ebp - 0x100]
push eax
call fcn.00427985
push str.Copy_Of
lea eax, [ebp - 0x100]
push eax
call fcn.004010c5
push 0x46fb46
lea eax, [ebp - 0x100]
push eax
call fcn.004010c5
lea eax, [ebp - 0x100]
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x441dc8
push 0x24
push 0x44f25f
push 0x44ed08
push dword [0x4538b0]
call sub.user32.dll_MessageBoxA
cmp eax, 6
jne 0x441dc8
mov eax, 0xffffffff
cmp eax, 0xffffffff
jne 0x441fde
push 0
lea eax, [ebp - 0x100]
push eax
push 0x46fa42
call sub.kernel32.dll_CopyFileA
or eax, eax
jne 0x441e01
push 0x10
push 0x44f25f
push 0x44ed20
push dword [0x4538b0]
call sub.user32.dll_MessageBoxA
jmp 0x441e40
push 0x45e066
call fcn.004278a2
cmp dword [0x46fc4a], 0
je 0x441e40
push 0x46fa42
call sub.kernel32.dll_DeleteFileA
or eax, eax
jne 0x441e39
push 0x10
push 0x44f25f
push 0x44ed35
push dword [0x4538b0]
call sub.user32.dll_MessageBoxA
mov byte [0x46fa42], 0
jmp 0x441fde
cmp eax, 0xc35c
jne 0x441f71
call fcn.004279ec
cmp byte [0x46fa42], 0
je 0x441f5d
push 0x46fa42
call fcn.004010ef
mov byte [eax + 0x46fa43], 0
mov dword [0x46fc4a], 0
mov eax, dword [0x4538b0]
mov dword [ebp - 0x11e], eax
mov dword [ebp - 0x11a], 3
mov dword [ebp - 0x116], 0x46fa42
mov dword [ebp - 0x112], 0
mov word [ebp - 0x10e], 0x44
mov dword [ebp - 0x10c], 1
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x108], 0
lea eax, [ebp - 0x11e]
push eax
call sub.shell32.dll_SHFileOperationA
or eax, eax
jne 0x441f4f
cmp dword [ebp - 0x10c], 0
jne 0x441f4f
push 0
push 9
push 0x110a
push dword [0x45391c]
call sub.user32.dll_SendMessageA
mov ebx, eax
push ebx
push 1
push 0x110a
push dword [0x45391c]
call sub.user32.dll_SendMessageA
or eax, eax
jne 0x441f26
push ebx
push 2
push 0x110a
push dword [0x45391c]
call sub.user32.dll_SendMessageA
xchg ebx, eax
push eax
push 0
push 0x1101
push dword [0x45391c]
call sub.user32.dll_SendMessageA
push ebx
push 9
push 0x110b
push dword [0x45391c]
call sub.user32.dll_SendMessageA
jmp 0x441f5d
or eax, eax
je 0x441f5d
push 0x46fa42
call fcn.00430605
mov byte [0x46fa42], 0
push dword [0x45391c]
call sub.user32.dll_SetFocus
jmp 0x441fde
cmp eax, 0xc35d
jne 0x441fa9
push dword [0x45391c]
push 9
push 0x110a
push dword [0x45391c]
call sub.user32.dll_SendMessageA
or eax, eax
je 0x441fde
push eax
push 0
push 0x110e
push dword [0x45391c]
call sub.user32.dll_SendMessageA
jmp 0x441fde
cmp eax, 0xc367
jne 0x441fd9
lea eax, [ebp - 0x100]
push eax
call fcn.00427985
or eax, eax
je 0x441fde
push 0xa
push 0
push 0
lea eax, [ebp - 0x100]
push eax
push 0
push dword [ebp + 8]
call sub.shell32.dll_ShellExecuteA
jmp 0x441fde
pop ebx
leave
ret 4
xor eax, eax
pop ebx
leave
ret 4