Function at 0x4c4c00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x54f1e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x78
push ebx
push ebp
push esi
push edi
mov esi, ecx
xor edi, edi
lea ecx, [esp + 0x38]
mov dword [esp + 0x90], edi
call fcn.004861d0
mov eax, dword [0x5ab980]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov ebx, dword [esp + 0x9c]
xor eax, eax
mov byte [esp + 0x90], 5
mov ecx, dword [ebx + 0x38]
cmp ecx, 2
mov ecx, esi
sete al
mov ebp, eax
mov dword [esp + 0x28], ebp
call fcn.004c36d0
mov ecx, dword [ebx + 0x38]
mov edx, dword [esp + 0x98]
mov dword [esi + 0x14], ecx
cmp dword [edx - 8], edi
jne 0x4c4e57
lea edx, [ebx + 0xc8]
lea ecx, [esi + 4]
push edx
mov word [esi + 0x24], di
call fcn.00512a1d
lea ebp, [esi + 0x10]
lea eax, [ebx + 0xd0]
push eax
mov ecx, ebp
call fcn.00512a1d
lea eax, [ebx + 0xd8]
lea edi, [esi + 8]
push eax
mov ecx, edi
call fcn.00512a1d
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4c4d00
mov ecx, dword [ebp]
lea edx, [esp + 0x18]
push ecx
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
push 0x59b600
push edx
call fcn.0050e6c7
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x24]
push 0
push eax
push str.ProfileImagePath
push ecx
call fcn.0041efa0
mov edx, dword [esp + 0x34]
add esp, 0x20
mov eax, dword [edx - 8]
test eax, eax
jne 0x4c4d4a
jmp 0x4c4f3e
mov eax, dword [ebx + 0x764]
test eax, eax
je 0x4c4d4a
mov eax, dword [esi + 4]
lea ecx, [esp + 0x18]
push eax
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionProfileList
push 0x59b600
push ecx
call fcn.0050e6c7
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x24]
push 0
push edx
push str.ProfileImagePath
push eax
call fcn.0041efa0
mov ecx, dword [esp + 0x34]
add esp, 0x20
mov eax, dword [ecx - 8]
test eax, eax
je 0x4c4f3e
mov edx, dword [esp + 0x14]
mov eax, dword [edx - 8]
test eax, eax
je 0x4c4d8b
lea eax, [esp + 0x14]
lea ecx, [esi + 0x2c]
push eax
call fcn.00512a1d
lea ecx, [esp + 0x14]
lea ebp, [esi + 0x30]
push ecx
mov ecx, ebp
call fcn.00512a1d
push ebp
mov ecx, ebx
call fcn.00495d30
lea eax, [esi + 0x2c]
push eax
call fcn.0041f9c0
push ebp
call fcn.0041f9c0
add esp, 8
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4c5337
lea edx, [esi + 0x30]
push str.NTUSER.DAT
lea eax, [esp + 0x34]
push edx
push eax
call fcn.00512b79
push eax
lea ecx, [esi + 0xc]
mov byte [esp + 0x94], 6
call fcn.00512a1d
lea ecx, [esp + 0x30]
mov byte [esp + 0x90], 5
call fcn.005128e4
mov eax, dword [edi]
mov ecx, dword [ebx + 0xcc]
push eax
push ecx
call fcn.004f9670
xor ebp, ebp
add esp, 8
cmp eax, ebp
jne 0x4c4de9
mov dword [esi + 0x18], ebp
jmp 0x4c4e0f
mov eax, dword [edi]
mov edx, dword [ebx + 0xd8]
push eax
push edx
call fcn.004f9670
add esp, 8
cmp eax, ebp
jne 0x4c4e08
mov dword [esi + 0x18], 1
jmp 0x4c4e0f
mov dword [esi + 0x18], 2
mov eax, dword [esp + 0xa0]
mov dword [esi + 0x1c], ebp
cmp eax, ebp
je 0x4c5337
lea eax, [esi + 0x6c]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push ebp
push ecx
mov ecx, esi
call fcn.004c4ad0
call fcn.00440b90
lea eax, [esi + 0x10]
lea edx, [esi + 0x620]
push eax
lea eax, [esi + 4]
push eax
push edi
push edx
call fcn.00440dc0
add esp, 0x18
jmp 0x4c5337
cmp ebp, edi
je 0x4c4ef5
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
xor edi, edi
test ecx, ecx
jle 0x4c4e82
cmp byte [eax + edx], 0x2d
jne 0x4c4e78
inc edi
inc eax
cmp eax, ecx
jl 0x4c4e71
cmp edi, 7
jge 0x4c4ef5
lea ecx, [esp + 0x20]
mov byte [esp + 0x90], 4
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x90], 3
call fcn.005128e4
lea ecx, [esp + 0x14]
mov byte [esp + 0x90], 2
call fcn.005128e4
lea ecx, [esp + 0x18]
mov byte [esp + 0x90], 1
call fcn.005128e4
lea ecx, [esp + 0x38]
mov byte [esp + 0x90], 0
call fcn.00486260
lea ecx, [esp + 0x98]
mov dword [esp + 0x90], 0xffffffff
call fcn.005128e4
xor eax, eax
jmp 0x4c56ad
test ebp, ebp
mov word [esi + 0x24], 1
mov eax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
jne 0x4c4f09
mov eax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionProfileList
push edx
push eax
lea eax, [esp + 0x20]
push 0x59b600
push eax
call fcn.0050e6c7
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x24]
push 0
push ecx
push str.ProfileImagePath
push edx
call fcn.0041efa0
mov eax, dword [esp + 0x34]
add esp, 0x20
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x4c4fb2
lea ecx, [esp + 0x20]
mov byte [esp + 0x90], 4
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x90], 3
call fcn.005128e4
lea ecx, [esp + 0x14]
mov byte [esp + 0x90], 2
call fcn.005128e4
lea ecx, [esp + 0x18]
mov byte [esp + 0x90], 1
call fcn.005128e4
lea ecx, [esp + 0x38]
mov byte [esp + 0x90], 0
call fcn.00486260
lea ecx, [esp + 0x98]
mov dword [esp + 0x90], 0xffffffff
call fcn.005128e4
or eax, 0xffffffff
jmp 0x4c56ad
lea ecx, [esp + 0x14]
lea ebp, [esi + 0x2c]
push ecx
mov ecx, ebp
call fcn.00512a1d
lea edi, [esi + 0x30]
lea edx, [esp + 0x14]
push edx
mov ecx, edi
call fcn.00512a1d
push edi
mov ecx, ebx
call fcn.00495d30
push ebp
call fcn.0041f9c0
push edi
call fcn.0041f9c0
mov eax, dword [esp + 0x30]
xor ebp, ebp
add esp, 8
cmp eax, ebp
je 0x4c52bc
push str.NTUSER.DAT
lea eax, [esp + 0x28]
push edi
push eax
call fcn.00512b79
lea ecx, [esi + 0xc]
push eax
mov byte [esp + 0x94], 7
call fcn.00512a1d
lea ecx, [esp + 0x24]
mov byte [esp + 0x90], 5
call fcn.005128e4
lea ecx, [esp + 0x98]
lea ebp, [esi + 0x10]
push ecx
mov ecx, ebp
call fcn.00512a1d
mov eax, dword [esp + 0xa0]
test eax, eax
je 0x4c519f
mov eax, dword [ebx + 0x8e0]
test eax, eax
je 0x4c50fb
lea edx, [esp + 0x2c]
lea eax, [esp + 0x1c]
push edx
lea ecx, [esp + 0x3c]
push eax
push ecx
push ebx
mov ecx, esi
mov dword [esi + 0x20], 0x534
call fcn.004c4930
test eax, eax
jle 0x4c519f
lea edx, [esp + 0x1c]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
lea eax, [esp + 0x28]
push edx
push eax
call fcn.00512b79
mov eax, dword [eax]
lea ecx, [esp + 0x20]
push 0
push ecx
push str.Logon_User_Name
push eax
mov byte [esp + 0xa0], 8
call fcn.0041efa0
add esp, 0x10
lea ecx, [esp + 0x24]
test eax, eax
setg byte [esp + 0x13]
mov byte [esp + 0x90], 5
call fcn.005128e4
mov al, byte [esp + 0x13]
test al, al
je 0x4c519f
lea edx, [esp + 0x20]
lea ecx, [esi + 4]
push edx
call fcn.00512a1d
lea eax, [ebx + 0xcc]
lea ecx, [esi + 8]
push eax
call fcn.00512a1d
mov dword [esi + 0x20], 0
jmp 0x4c519f
mov eax, dword [ebp]
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esi + 8]
lea ecx, [esi + 4]
push edx
push ecx
push eax
push 0
call fcn.00421d20
add esp, 0x14
test eax, eax
jg 0x4c519f
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x4c519c
lea ecx, [esp + 0x20]
mov byte [esp + 0x90], 4
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x90], 3
call fcn.005128e4
lea ecx, [esp + 0x14]
mov byte [esp + 0x90], 2
call fcn.005128e4
lea ecx, [esp + 0x18]
mov byte [esp + 0x90], 1
call fcn.005128e4
lea ecx, [esp + 0x38]
mov byte [esp + 0x90], 0
call fcn.00486260
lea ecx, [esp + 0x98]
mov dword [esp + 0x90], 0xffffffff
call fcn.005128e4
mov eax, 0xfffffffe
jmp 0x4c56ad
mov dword [esi + 0x20], eax
mov eax, dword [esi + 8]
mov edx, dword [ebx + 0xcc]
lea edi, [esi + 8]
push eax
push edx
call fcn.004f9670
add esp, 8
test eax, eax
jne 0x4c51be
mov dword [esi + 0x18], eax
jmp 0x4c51e4
mov eax, dword [edi]
push eax
mov eax, dword [ebx + 0xd8]
push eax
call fcn.004f9670
add esp, 8
test eax, eax
jne 0x4c51dd
mov dword [esi + 0x18], 1
jmp 0x4c51e4
mov dword [esi + 0x18], 2
mov eax, dword [esp + 0xa0]
mov dword [esi + 0x1c], 0
test eax, eax
je 0x4c5304
mov eax, dword [ebx + 0x8e0]
test eax, eax
je 0x4c5288
mov ecx, dword [0x5ab980]
mov dword [esp + 0x24], ecx
lea edx, [ebx + 0xe4]
push str.configSAM
lea eax, [esp + 0x38]
push edx
push eax
mov byte [esp + 0x9c], 9
call fcn.00512b79
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x94], 0xa
call fcn.00512a1d
lea ecx, [esp + 0x34]
mov byte [esp + 0x90], 9
call fcn.005128e4
lea ecx, [esp + 0x24]
push ecx
lea ecx, [ebx + 0x8e4]
call fcn.0042b970
lea edx, [esi + 0x6c]
lea eax, [esp + 0x24]
push edx
push ebp
push eax
call fcn.00440930
add esp, 0xc
lea ecx, [esp + 0x24]
mov byte [esp + 0x90], 5
call fcn.005128e4
jmp 0x4c52a5
lea ecx, [esi + 0x6c]
push ecx
push ecx
mov edx, esp
mov dword [esp + 0x3c], esp
push 0
push edx
mov ecx, esi
call fcn.004c4ad0
call fcn.00440b90
add esp, 8
lea eax, [esi + 4]
push ebp
push eax
lea ecx, [esi + 0x620]
push edi
push ecx
call fcn.00440dc0
add esp, 0x10
jmp 0x4c5304
push str.USER.DAT
lea edx, [esp + 0x38]
push edi
push edx
call fcn.00512b79
lea ecx, [esi + 0xc]
push eax
mov byte [esp + 0x94], 0xb
call fcn.00512a1d
lea ecx, [esp + 0x34]
mov byte [esp + 0x90], 5
call fcn.005128e4
lea eax, [esp + 0x98]
lea ecx, [esi + 4]
push eax
call fcn.00512a1d
mov dword [esi + 0x18], ebp
mov dword [esi + 0x1c], ebp
lea eax, [esi + 0xc]
lea ecx, [esp + 0x30]
push eax
push ecx
lea ecx, [ebx + 0x8e4]
call fcn.0042ba10
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov dword [esi + 0x28], ecx
lea ecx, [esp + 0x30]
call fcn.005128e4
push str._userprofile_
lea ecx, [esp + 0x34]
call fcn.00512952
lea edx, [esi + 0x30]
lea eax, [esp + 0x30]
push edx
push eax
mov ecx, ebx
mov byte [esp + 0x98], 0xc
call fcn.00495bd0
lea ecx, [esp + 0x30]
mov byte [esp + 0x90], 5
call fcn.005128e4
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x1c]
push ecx
lea eax, [esp + 0x3c]
push edx
push eax
push ebx
mov ecx, esi
call fcn.004c4930
test eax, eax
jle 0x4c5624
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4c53e5
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push ecx
push str._sSoftwareMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders
push edx
call fcn.0050e6c7
add esp, 0xc
lea ecx, [esp + 0x30]
push str._user
call fcn.00512952
lea eax, [esp + 0x30]
lea ecx, [esp + 0x18]
push eax
push ecx
push ebx
mov ecx, esi
mov byte [esp + 0x9c], 0xd
call fcn.004c3e70
lea ecx, [esp + 0x30]
mov byte [esp + 0x90], 5
call fcn.005128e4
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push edx
push str._sSoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push eax
call fcn.0050e6c7
add esp, 0xc
lea ecx, [esp + 0x28]
push 0x5b0738
call fcn.00512952
lea ecx, [esp + 0x28]
lea edx, [esp + 0x18]
push ecx
push edx
push ebx
mov ecx, esi
mov byte [esp + 0x9c], 0xe
call fcn.004c3e70
lea ecx, [esp + 0x28]
mov byte [esp + 0x90], 5
call fcn.005128e4
cmp word [esi + 0x24], 0
jne 0x4c5444
push ebx
mov ecx, esi
call fcn.004c4380
push ebx
mov ecx, esi
call fcn.004c4210
push 0x50
call fcn.00516a15
add esp, 4
mov dword [esp + 0x34], eax
test eax, eax
mov byte [esp + 0x90], 0xf
je 0x4c546f
mov ecx, eax
call fcn.0048c8c0
jmp 0x4c5471
xor eax, eax
lea edi, [esi + 0x50]
push eax
mov ecx, edi
mov byte [esp + 0x94], 5
call fcn.0048bae0
push 0x48
call fcn.00516a15
add esp, 4
mov dword [esp + 0x34], eax
test eax, eax
mov byte [esp + 0x90], 0x10
je 0x4c54a7
mov ecx, eax
call fcn.0048d7b0
jmp 0x4c54a9
xor eax, eax
push eax
mov ecx, edi
mov byte [esp + 0x94], 5
call fcn.0048bae0
push 0x48
call fcn.00516a15
add esp, 4
mov dword [esp + 0x34], eax
test eax, eax
mov byte [esp + 0x90], 0x11
je 0x4c54dc
mov ecx, eax
call fcn.0048e600
jmp 0x4c54de
xor eax, eax
push eax
mov ecx, edi
mov byte [esp + 0x94], 5
call fcn.0048bae0
push 0x5c
call fcn.00516a15
add esp, 4
mov dword [esp + 0x34], eax
test eax, eax
mov byte [esp + 0x90], 0x12
je 0x4c5511
mov ecx, eax
call fcn.00490760
jmp 0x4c5513
xor eax, eax
push eax
mov ecx, edi
mov byte [esp + 0x94], 5
call fcn.0048bae0
push 0x48
call fcn.00516a15
add esp, 4
mov dword [esp + 0x34], eax
test eax, eax
mov byte [esp + 0x90], 0x13
je 0x4c5546
mov ecx, eax
call fcn.00490af0
jmp 0x4c5548
xor eax, eax
push eax
mov ecx, edi
mov byte [esp + 0x94], 5
call fcn.0048bae0
push 0x38
call fcn.00516a15
add esp, 4
mov dword [esp + 0x34], eax
test eax, eax
mov byte [esp + 0x90], 0x14
je 0x4c557b
mov ecx, eax
call fcn.0048d970
jmp 0x4c557d
xor eax, eax
push eax
mov ecx, edi
mov byte [esp + 0x94], 5
call fcn.0048bae0
push 0x34
call fcn.00516a15
add esp, 4
mov dword [esp + 0x34], eax
test eax, eax
mov byte [esp + 0x90], 0x15
je 0x4c55b0
mov ecx, eax
call fcn.0048c3e0
jmp 0x4c55b2
xor eax, eax
push eax
mov ecx, edi
mov byte [esp + 0x94], 5
call fcn.0048bae0
push 0x74
call fcn.00516a15
add esp, 4
mov dword [esp + 0x34], eax
test eax, eax
mov byte [esp + 0x90], 0x16
je 0x4c55e5
mov ecx, eax
call fcn.0048be50
jmp 0x4c55e7
xor eax, eax
push eax
mov ecx, edi
mov byte [esp + 0x94], 5
call fcn.0048bae0
mov ebp, dword [esi + 0x54]
test ebp, ebp
je 0x4c5624
mov eax, ebp
mov ebp, dword [ebp]
lea ecx, [esp + 0x1c]
mov edi, dword [eax + 8]
push ecx
mov ecx, edi
mov eax, dword [edi]
mov dword [edi + 0x24], esi
mov dword [edi + 0x28], ebx
call dword [eax + 0x14]
xor eax, eax
cmp ebp, eax
mov dword [edi + 0x28], eax
mov dword [edi + 0x24], eax
jne 0x4c55fe
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str._userprofile_
call fcn.00512952
mov ecx, ebx
call fcn.00495ce0
lea ecx, [esp + 0x20]
mov byte [esp + 0x90], 4
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x90], 3
call fcn.005128e4
lea ecx, [esp + 0x14]
mov byte [esp + 0x90], 2
call fcn.005128e4
lea ecx, [esp + 0x18]
mov byte [esp + 0x90], 1
call fcn.005128e4
lea ecx, [esp + 0x38]
mov byte [esp + 0x90], 0
call fcn.00486260
lea ecx, [esp + 0x98]
mov dword [esp + 0x90], 0xffffffff
call fcn.005128e4
mov eax, 1
mov ecx, dword [esp + 0x88]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x84
ret 0xc