Function at 0x442a80
Capabilities:
Check if file exists
Get file attributes
Get file system object information
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4b53b1
mov eax, dword fs:[0]
push eax
mov eax, 0x3548
call fcn.004a4220
mov eax, dword [0x4ca3b0]
xor eax, esp
mov dword [esp + 0x3544], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ca3b0]
xor eax, esp
push eax
lea eax, [esp + 0x355c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x356c]
inc dword [0x4e8434]
mov esi, ecx
mov dword [esp + 0x4c], eax
xor ebp, ebp
mov dword [esp + 0x3564], ebp
mov ecx, dword [esi]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0xffffffffffffffff
push 0x100c
push ecx
call ebx
push 1
mov ecx, 0x4e8cd8
mov dword [esp + 0x24], eax
call fcn.00469a10
push 0x1c2
call fcn.00460760
push eax
mov ecx, 0x4e8cd8
call fcn.00469a80
mov eax, dword [0x4e8438]
cmp eax, ebp
je 0x442b2e
push eax
call dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov dword [0x4e8438], 0xffffffff
push 0x400
lea edx, [esp + 0x2d5c]
push edx
mov byte [esp + 0x1e], 0
call fcn.00484e80
cmp byte [esi + 0x81a], 0
je 0x442b5d
mov ecx, 0x4ee468
call fcn.004072a0
jmp 0x442c1a
lea eax, [esp + 0x2d58]
push eax
push ebp
call fcn.00450df0
test al, al
jne 0x442ba4
lea ecx, [esp + 0x2d58]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x442ba4
lea edx, [esp + 0x2d58]
push edx
call fcn.004513d0
test eax, eax
je 0x442ba4
push 0x4b8bac
call fcn.00483d60
test al, al
sete byte [esp + 0x16]
lea eax, [esp + 0x2d58]
push eax
call fcn.004513d0
cmp word [eax], bp
jne 0x442bbd
lea eax, [esp + 0x2d58]
push eax
call fcn.00495a80
lea ecx, [esp + 0x2d58]
push ecx
call fcn.00451840
mov edi, eax
cmp edi, 0xffffffff
je 0x442bed
call fcn.00483d40
mov edx, 1
mov ecx, edi
shl edx, cl
test edx, eax
je 0x443319
cmp byte [esp + 0x16], 0
jne 0x442c1a
mov ecx, 0x4ee468
call fcn.00406c90
mov ecx, 0x4ee450
call fcn.00470700
lea eax, [esp + 0x2d58]
push eax
mov ecx, 0x4ee450
call fcn.00470230
mov ecx, dword [esi]
push ebp
push ebp
push 0xb
push ecx
call ebx
mov ecx, esi
call fcn.00442090
cmp byte [esp + 0x16], 0
mov edi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jne 0x442c55
push 0x4401
push 0x2b4
lea edx, [esp + 0x8d8]
push edx
push ebp
push 0x4b96dc
call edi
cmp eax, ebp
jne 0x442c8f
push 0x400
lea eax, [esp + 0xa4]
push eax
call fcn.00483c50
cmp byte [esp + 0x16], 0
je 0x442c72
xor eax, eax
jmp 0x442c8f
push 0x4401
push 0x2b4
lea ecx, [esp + 0x8d8]
push ecx
push ebp
lea edx, [esp + 0xb0]
push edx
call edi
push eax
mov eax, dword [esi]
push 1
push 0x1003
push eax
call ebx
push 1
push str.AllowUppercase
push 0x4b8cc0
call fcn.0045afb0
push ebp
push str.ShowSeconds
test eax, eax
push 0x4b8cc0
setne byte [esp + 0x2a]
call fcn.0045afb0
test eax, eax
setne byte [esp + 0x1d]
cmp byte [esi + 0x81a], 0
je 0x442ce0
mov ecx, esi
call fcn.0043ee80
jmp 0x443203
lea ecx, [esp + 0x2024]
call fcn.004348b0
mov byte [esp + 0x3564], 1
push 0x4b876c
lea ecx, [esp + 0x2028]
call fcn.004348f0
lea ecx, [esp + 0x1798]
call fcn.0046cee0
lea ecx, [esp + 0x17bc]
call fcn.0046cee0
lea ecx, [esp + 0x17e0]
call fcn.0046cee0
push 0x1f4
lea ecx, [esp + 0x94]
mov dword [esp + 0x1c], ebp
mov byte [esp + 0x1b], 0
call fcn.00484ac0
mov byte [esp + 0x3564], 2
cmp byte [esp + 0x16], 0
jne 0x4430ce
push ebp
lea ecx, [esp + 0xb88]
push ecx
lea ecx, [esp + 0x202c]
call fcn.00434d10
test al, al
je 0x4430ce
test byte [esp + 0x18], 0x1f
jne 0x442d86
lea ecx, [esp + 0x90]
call fcn.00484280
mov ecx, 0x4b96dc
lea eax, [esp + 0xf84]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x442db8
cmp dx, bp
je 0x442db4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x442db8
add eax, 4
add ecx, 4
cmp dx, bp
jne 0x442d92
xor eax, eax
jmp 0x442dbd
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebp
je 0x442d56
mov edx, dword [esp + 0x18]
lea eax, [esp + 0xf84]
mov dword [esp + 0x50], 7
mov dword [esp + 0x54], edx
mov dword [esp + 0x6c], 0xffffffff
mov dword [esp + 0x58], ebp
mov dword [esp + 0x64], eax
mov ecx, 0x4b8bac
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x442e16
cmp dx, bp
je 0x442e12
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x442e16
add eax, 4
add ecx, 4
cmp dx, bp
jne 0x442df0
xor eax, eax
jmp 0x442e1b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebp
sete al
mov byte [esp + 0x1f], al
test al, al
je 0x442e4e
lea ecx, [esp + 0x2d58]
push ecx
call fcn.004513d0
cmp word [eax], bp
je 0x442d56
mov edx, dword [esp + 0x8d4]
mov dword [esp + 0x6c], edx
mov byte [esp + 0x17], 1
push 0x830
lea eax, [esp + 0xa4]
push ebp
push eax
call fcn.004a4250
add esp, 0xc
xor eax, eax
jmp 0x442e70
movzx ecx, word [esp + eax + 0xf84]
mov word [esp + eax + 0xa0], cx
add eax, 2
cmp cx, bp
jne 0x442e70
lea ecx, [esp + 0xf84]
push ecx
mov ecx, esi
call fcn.0043f110
mov eax, dword [esp + 0x1788]
mov ecx, dword [esp + 0x178c]
mov edx, dword [esp + 0x1784]
mov dword [esp + 0x8a4], eax
mov eax, dword [esp + 0x2018]
mov dword [esp + 0x8b0], ecx
mov dword [esp + 0x8b8], eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0xa0]
mov dword [esp + 0x8a0], edx
mov edx, dword [esp + 0x2014]
inc eax
push ecx
mov ecx, 0x4fea40
mov dword [esp + 0x8ac], ebp
mov dword [esp + 0x8b0], ebp
mov dword [esp + 0x8b8], edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x8c8], eax
call fcn.0043e980
cmp byte [esp + 0x1e], 0
mov dword [esp + 0x70], eax
jne 0x442f22
mov edx, dword [esp + 0x64]
push edx
call fcn.00446330
mov edx, dword [esi]
lea ecx, [esp + 0x50]
push ecx
push 0
push 0x104d
lea eax, [esp + 0xf90]
push edx
mov dword [esp + 0x74], eax
call ebx
cmp byte [esp + 0x1794], 0
mov ebp, eax
jne 0x442f84
mov ecx, dword [esp + 0x8a4]
mov edx, dword [esp + 0x8a0]
push 0x32
lea eax, [esp + 0x2cf8]
push eax
push ecx
push edx
call fcn.00445fe0
mov edx, dword [esi]
lea ecx, [esp + 0x24]
push ecx
push ebp
lea eax, [esp + 0x2cfc]
push 0x1074
mov dword [esp + 0x44], eax
push edx
jmp 0x442f9a
mov ecx, dword [esi]
lea eax, [esp + 0x24]
push eax
push ebp
push 0x1074
mov dword [esp + 0x44], 0x4b8d0c
push ecx
mov dword [esp + 0x3c], 1
call ebx
cmp byte [esp + 0x1f], 0
mov dword [esp + 0x2c], 2
je 0x442fce
mov ecx, dword [esi]
lea eax, [esp + 0x24]
push eax
push ebp
lea edx, [esp + 0xaec]
push 0x1074
mov dword [esp + 0x44], edx
push ecx
jmp 0x442fe4
mov eax, dword [esi]
lea edx, [esp + 0x24]
push edx
push ebp
push 0x1074
mov dword [esp + 0x44], 0x4b8d0c
push eax
call ebx
lea ecx, [esp + 0x78]
push ecx
lea edx, [esp + 0x2018]
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea eax, [esp + 0x80]
push eax
lea ecx, [esp + 0x7c]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0x64
lea edx, [esp + 0x2c30]
push edx
push 0
lea eax, [esp + 0x8c]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
lea edi, [esp + 0x2c2c]
add edi, 0xfffffffe
jmp 0x443040
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x443040
mov ecx, dword [0x4ba320]
lea eax, [esp + 0x2c2c]
mov dword [edi], ecx
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x443060
sub eax, edx
xor ecx, ecx
sar eax, 1
cmp byte [esp + 0x1d], cl
push 0x64
setne cl
lea edx, [esp + eax*2 + 0x2c30]
push edx
push 0
lea eax, [esp + 0x8c]
push eax
dec ecx
and ecx, 2
push ecx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
mov ecx, dword [esi]
lea eax, [esp + 0x24]
push eax
push ebp
push 0x1074
lea edx, [esp + 0x2c38]
push ecx
mov dword [esp + 0x3c], 3
mov dword [esp + 0x48], edx
call ebx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x18], edx
xor ebp, ebp
jmp 0x442d56
mov edi, 0x5c
cmp word [esp + 0x2d58], di
jne 0x44310d
cmp word [esp + 0x2d5a], di
jne 0x44310d
lea eax, [esp + 0x2d5c]
push edi
push eax
call fcn.004a4990
add esp, 8
cmp eax, ebp
je 0x443118
add eax, 2
push edi
push eax
call fcn.004a4990
add esp, 8
test eax, eax
je 0x443118
cmp byte [esp + 0x17], 0
jne 0x4431db
lea ecx, [esp + 0x2d58]
push ecx
call fcn.004513d0
cmp word [eax], bp
je 0x4431db
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x8d4]
push 0x830
lea ecx, [esp + 0xa4]
push ebp
push ecx
mov dword [esp + 0x5c], 7
mov dword [esp + 0x60], edx
mov dword [esp + 0x78], eax
mov dword [esp + 0x64], ebp
mov dword [esp + 0x70], 0x4b8bac
call fcn.004a4250
add esp, 0xc
xor eax, eax
lea ecx, [ecx]
movzx ecx, word [eax + 0x4b8bac]
mov word [esp + eax + 0xa0], cx
add eax, 2
cmp cx, bp
jne 0x443170
lea edx, [esp + 0xa0]
push edx
mov ecx, 0x4fea40
mov dword [esp + 0x8b4], 0x10
call fcn.0043e980
mov ecx, dword [esi]
mov dword [esp + 0x70], eax
lea eax, [esp + 0x50]
push eax
push ebp
push 0x104d
push ecx
call ebx
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0xae8]
push eax
mov dword [esp + 0x40], edx
mov edx, dword [esi]
push 0x1074
push edx
mov dword [esp + 0x3c], 2
call ebx
mov byte [esp + 0x3564], 1
lea ecx, [esp + 0x90]
call fcn.004842c0
mov byte [esp + 0x3564], 0
lea ecx, [esp + 0x2024]
call fcn.004348d0
mov ecx, 0x4fea40
call fcn.0043ebf0
mov ecx, esi
call fcn.004426e0
mov edi, dword [esp + 0x4c]
cmp edi, ebp
je 0x44326a
cmp word [edi], bp
jne 0x443259
mov eax, dword [esi]
push ebp
push ebp
push 0x1004
push eax
call ebx
mov ecx, dword [esp + 0x20]
cmp ecx, eax
jl 0x44323c
cmp eax, ebp
jle 0x44323c
lea ecx, [eax - 1]
lea edx, [esp + 0x24]
push edx
mov eax, 3
push ecx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], eax
mov eax, dword [esi]
push 0x102b
push eax
jmp 0x443294
push edi
mov ecx, esi
call fcn.004424d0
test eax, eax
setne al
test al, al
jne 0x443296
mov eax, 3
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x20]
cmp eax, 0xffffffff
je 0x443284
cmp edi, ebp
jne 0x443286
xor eax, eax
mov edx, dword [esi]
lea ecx, [esp + 0x24]
push ecx
push eax
push 0x102b
push edx
call ebx
mov eax, dword [esi]
push 1
push 0xffffffffffffffff
push 0x100c
push eax
call ebx
push ebp
mov ecx, 0x4e8cd8
mov edi, eax
call fcn.00469a80
mov ecx, dword [esi]
push ebp
push 1
push 0xb
push ecx
call ebx
mov edx, dword [esi]
push ebp
push ebp
push 0x102a
push edx
call ebx
mov eax, dword [esi]
push ebp
push edi
push 0x1013
push eax
call ebx
mov ecx, esi
call fcn.00440d10
mov ecx, esi
call fcn.00440f30
push ebp
mov ecx, 0x4e8cd8
call fcn.00469a10
mov ecx, 0x4f0c78
call fcn.0046d8c0
cmp byte [esp + 0x16], 0
jne 0x443319
cmp byte [esi + 0x81a], 0
jne 0x443319
push 3
push ebp
push 0x4b96dc
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
mov dword [0x4e8438], eax
mov dword [esp + 0x3564], 0xffffffff
cmp dword [0x4e8434], ebp
jle 0x443332
dec dword [0x4e8434]
mov ecx, dword [esp + 0x355c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3544]
xor ecx, esp
call fcn.004a39f3
add esp, 0x3554
ret 4