Function at 0x49cd88
Capabilities:
Check if file exists
Get file attributes
Get file size

Disassembly:
push ebx
push esi
push edi
push ebp
push eax
mov eax, 5
add esp, 0xfffff004
push eax
dec eax
jne 0x49cd92
mov eax, dword [esp + 0x5000]
add esp, 0xfffffbd4
cmp dword [0x4d5a4c], 0
je 0x49cdc4
cmp dword [0x4d5a54], 0
je 0x49cdc4
cmp dword [0x4d5a50], 0
jne 0x49cdcb
xor eax, eax
jmp 0x49d653
mov ebx, 0x2000
xor eax, eax
mov dword [esp], eax
push ebx
push 0
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
je 0x49ce2b
lea edx, [esp + 0xc]
push edx
push ebx
mov ecx, dword [esp + 0x18]
push ecx
push 0x10
call dword [0x4d5a4c]
test eax, eax
je 0x49ce2b
mov eax, dword [esp + 0x10]
push eax
call sub.KERNEL32.DLL_GlobalFree
xor edx, edx
mov dword [esp + 0x10], edx
cmp dword [esp + 0xc], 0
jne 0x49ce1e
mov ecx, ebx
add ecx, ecx
mov ebx, ecx
jmp 0x49ce22
mov ebx, dword [esp + 0xc]
inc dword [esp]
cmp dword [esp], 0xa
jl 0x49cdd5
cmp dword [esp + 0x10], 0
jne 0x49ce39
xor eax, eax
jmp 0x49d653
cmp dword [0x4e3018], 0
mov ebp, dword [0x4e3030]
sete dl
and edx, 1
xor eax, eax
mov dword [esp + 8], edx
mov dword [esp], eax
jmp 0x49ce64
and dword [ebp + 8], 0xfffffffd
inc dword [esp]
add ebp, 0x248
mov edx, dword [esp]
cmp edx, dword [0x4e3018]
jl 0x49ce57
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx]
mov dword [esp + 4], eax
mov eax, ebx
sub eax, 4
shr eax, 4
cmp eax, dword [esp + 4]
jae 0x49ce8b
mov dword [esp + 4], eax
mov edx, dword [esp + 0x10]
add edx, 4
mov dword [esp + 0x18], edx
xor ecx, ecx
mov dword [esp], ecx
jmp 0x49d610
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
cmp edx, dword [0x4d5a70]
jne 0x49d608
push 2
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
push 0xffffffffffffffff
mov eax, dword [esp + 0x2c]
mov ecx, dword [0x4d5a68]
movzx edx, word [eax + 6]
push edx
push ecx
call dword [0x4d5a54]
cmp dword [esp + 0x14], 0
je 0x49d608
mov eax, dword [esp + 0x18]
movzx edx, word [eax + 6]
push edx
push 0x4e2f14
call sym.ollydbg.exe__Findsorteddata
add esp, 8
mov ebp, eax
mov eax, dword [esp + 0x18]
movzx edx, word [eax + 6]
mov dword [esp + 0x1148], edx
mov dword [esp + 0x114c], 1
mov dword [esp + 0x1150], 2
test ebp, ebp
je 0x49cf33
mov ecx, dword [ebp + 8]
and ecx, 0x10000
or dword [esp + 0x1150], ecx
jmp 0x49cf42
cmp dword [esp + 8], 0
jne 0x49cf42
or dword [esp + 0x1150], 1
lea eax, [esp + 0xc]
push eax
push 0x38
lea edx, [esp + 0x1398]
push edx
push 0
mov ecx, dword [esp + 0x24]
push ecx
call dword [0x4d5a50]
mov word [esp + 0x33d0], 0
mov word [esp + 0x33d2], 0x1000
lea eax, [esp + 0x3430]
lea edx, [esp + 0xc]
mov dword [esp + 0x33d4], eax
push edx
push 0x2060
lea ecx, [esp + 0x33d8]
push ecx
push 2
mov eax, dword [esp + 0x24]
push eax
call dword [0x4d5a50]
cmp word [esp + 0x33d0], 0
jne 0x49cfb5
xor edx, edx
mov edi, edx
mov byte [esp + edx + 0x24], 0
jmp 0x49cfd9
push 0
push 0
push 0xfff
lea eax, [esp + 0x30]
push eax
push 0xffffffffffffffff
lea ecx, [esp + 0x3444]
push ecx
push 0
push 0
call sub.KERNEL32.DLL_WideCharToMultiByte
mov edi, eax
dec edi
test edi, edi
jle 0x49cff6
push 0x1f
lea eax, [esp + 0x28]
push eax
lea edx, [esp + 0x115c]
push edx
call fcn.004a3530
add esp, 0xc
jmp 0x49d015
mov ecx, dword [esp + 0x18]
xor eax, eax
mov al, byte [ecx + 4]
push eax
push 0x4c9f90
lea edx, [esp + 0x115c]
push edx
call fcn.004a6c2c
add esp, 0xc
mov byte [esp + 0x1173], 0
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx + 0xc]
lea ecx, [esp + 0x13d0]
mov dword [esp + 0x1174], eax
lea eax, [esp + 0xc]
mov edx, dword [esp + 0x139c]
dec edx
mov dword [esp + 0x1178], edx
mov word [esp + 0x13c8], 0
mov word [esp + 0x13ca], 0x1000
mov dword [esp + 0x13cc], ecx
push eax
push 0x2008
lea edx, [esp + 0x13d0]
push edx
push 1
mov ecx, dword [esp + 0x24]
push ecx
call dword [0x4d5a50]
cmp word [esp + 0x13c8], 0
jne 0x49d08d
mov byte [esp + 0x24], 0
jmp 0x49d0ae
push 0
push 0
push 0xfff
lea eax, [esp + 0x30]
push eax
push 0xffffffffffffffff
lea edx, [esp + 0x13e4]
push edx
push 0
push 0
call sub.KERNEL32.DLL_WideCharToMultiByte
push 0xff
lea ecx, [esp + 0x28]
push ecx
lea eax, [esp + 0x1198]
push eax
call fcn.004a3904
add esp, 0xc
xor edx, edx
mov dword [esp + 0x1184], edx
mov dword [esp + 0x1180], edx
mov byte [esp + 0x1290], 0
push 0x4c9f93
lea eax, [esp + 0x1158]
push eax
call fcn.004a38bc
add esp, 8
test eax, eax
jne 0x49d1bf
xor ebx, ebx
mov esi, 0x4c99e4
mov eax, dword [esi]
test eax, eax
je 0x49d1aa
push eax
mov edx, ebx
shl edx, 4
add edx, ebx
shl edx, 4
add edx, str.REGISTRYMACHINESOFTWARECLASSES
push edx
lea ecx, [esp + 0x2c]
push ecx
call fcn.004a3840
add esp, 0xc
test eax, eax
jne 0x49d1aa
mov eax, dword [esi]
mov al, byte [esp + eax + 0x24]
test al, al
je 0x49d146
mov edx, dword [esi]
xor ecx, ecx
mov cl, al
cmp ecx, 0x5c
jne 0x49d1aa
mov eax, dword [esi - 8]
push esi
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
lea esi, [esp + 0x1294]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
lea eax, [esp + 0x1290]
push eax
call fcn.004a36d4
mov edi, eax
mov eax, 0x100
sub eax, edi
pop ecx
dec eax
push eax
lea ecx, [esp + 0x28]
mov edx, dword [esi]
add edx, ecx
push edx
lea eax, [esp + 0x1298]
add edi, eax
push edi
call fcn.004a3904
add esp, 0xc
jmp 0x49d4e7
inc ebx
add esi, 0x110
cmp ebx, 5
jl 0x49d104
jmp 0x49d4e7
push str.File
lea edx, [esp + 0x1158]
push edx
call fcn.004a38bc
add esp, 8
test eax, eax
jne 0x49d485
mov ecx, dword [esp + 0x14]
push ecx
call sub.KERNEL32.DLL_GetFileType
mov ebx, eax
cmp ebx, 3
jne 0x49d203
mov esi, str.File__pipe_
lea edi, [esp + 0x1154]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x49d4e7
cmp ebx, 2
jne 0x49d2d2
mov esi, str.File__char_
lea edi, [esp + 0x1154]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [0x4d5a48], 0
je 0x49d4e7
lea edi, [esp + 0x1024]
mov esi, str.COM0
mov eax, edi
mov ebx, 0x30
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov byte [esp + 0x1027], bl
push 0x104
lea eax, [esp + 0x1048]
push eax
lea edx, [esp + 0x102c]
push edx
call dword [0x4d5a48]
test eax, eax
je 0x49d2c3
lea ecx, [esp + 0x1044]
push ecx
lea eax, [esp + 0x28]
push eax
call fcn.004a38bc
add esp, 8
test eax, eax
jne 0x49d2c3
push 0x4c9fb9
lea edx, [esp + 0x1028]
push edx
call fcn.004a3644
add esp, 8
xor eax, eax
or ecx, 0xffffffff
lea edi, [esp + 0x1024]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [esp + 0x1290]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x49d4e7
inc ebx
cmp ebx, 0x39
jle 0x49d23f
jmp 0x49d4e7
dec ebx
je 0x49d2ed
mov esi, str.File__dev_
lea edi, [esp + 0x1154]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x49d4e7
cmp dword [0x4d5a48], 0
je 0x49d3be
lea edi, [esp + 0x1024]
mov esi, 0x4c9fc6
mov eax, edi
mov ebx, 0x61
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [esp + 0x1024], bl
push 0x104
lea eax, [esp + 0x1048]
push eax
lea edx, [esp + 0x102c]
push edx
call dword [0x4d5a48]
test eax, eax
je 0x49d3b4
lea ecx, [esp + 0x1044]
push ecx
call fcn.004a36d4
pop ecx
mov edi, eax
cmp edi, 2
jl 0x49d3b4
push edi
lea eax, [esp + 0x1048]
push eax
lea edx, [esp + 0x2c]
push edx
call fcn.004a3954
add esp, 0xc
test eax, eax
jne 0x49d3b4
push 2
lea ecx, [esp + 0x1028]
push ecx
lea eax, [esp + 0x2c]
push eax
call fcn.004a3530
add esp, 0xc
lea edx, [esp + 0x24]
add edx, edi
push edx
call fcn.004a36d4
pop ecx
mov ebx, eax
cmp ebx, 0xfd
jle 0x49d398
mov ebx, 0xfd
push ebx
lea eax, [esp + 0x28]
add edi, eax
push edi
lea edx, [esp + 0x2e]
push edx
call fcn.004a3554
add esp, 0xc
mov byte [esp + ebx + 0x26], 0
jmp 0x49d3be
inc ebx
cmp ebx, 0x7a
jle 0x49d310
lea ecx, [esp + 0x24]
push ecx
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x49d3e4
mov esi, str.File______
lea edi, [esp + 0x1154]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x49d42e
test bl, 0x10
je 0x49d3fe
mov esi, str.File__dir_
lea edi, [esp + 0x1154]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x49d42e
test bl, 4
je 0x49d418
mov esi, str.File__sys_
lea edi, [esp + 0x1154]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x49d42e
test bh, 1
je 0x49d42e
mov esi, str.File__temp_
lea edi, [esp + 0x1154]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp ebx, 0xffffffff
je 0x49d45b
test bl, 0x10
jne 0x49d45b
push 0
mov edx, dword [esp + 0x18]
push edx
call sub.KERNEL32.DLL_GetFileSize
mov ebx, eax
mov dword [esp + 0x1180], ebx
cmp ebx, 0xffffffff
jne 0x49d45b
xor eax, eax
mov dword [esp + 0x1180], eax
xor eax, eax
lea edi, [esp + 0x24]
or ecx, 0xffffffff
lea esi, [esp + 0x1290]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x49d4e7
push str.Semaphore
lea eax, [esp + 0x1158]
push eax
call fcn.004a38bc
add esp, 8
test eax, eax
jne 0x49d4e7
cmp dword [0x4d5a58], 0
je 0x49d4e7
push 8
push 0
lea edx, [esp + 0x24]
push edx
call fcn.004a35a0
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push 8
lea eax, [esp + 0x24]
push eax
push 0
mov edx, dword [esp + 0x24]
push edx
call dword [0x4d5a58]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x1180], ecx
mov eax, dword [esp + 0x20]
mov dword [esp + 0x1184], eax
mov byte [esp + 0x128f], 0
mov byte [esp + 0x138f], 0
test ebp, ebp
jne 0x49d527
mov edx, dword [esp + 0x1178]
mov dword [esp + 0x117c], edx
mov ecx, dword [esp + 0x1180]
mov dword [esp + 0x1188], ecx
mov eax, dword [esp + 0x1184]
mov dword [esp + 0x118c], eax
jmp 0x49d545
mov edx, dword [ebp + 0x30]
mov dword [esp + 0x117c], edx
mov ecx, dword [ebp + 0x38]
mov dword [esp + 0x1188], ecx
mov eax, dword [ebp + 0x3c]
mov dword [esp + 0x118c], eax
cmp dword [0x4e3164], 0
jne 0x49d555
xor eax, eax
jmp 0x49d5e5
cmp byte [esp + 0x1190], 0
je 0x49d5dc
push str.WindowStation
lea edx, [esp + 0x1158]
push edx
call fcn.004a38bc
add esp, 8
test eax, eax
je 0x49d5dc
push str.Desktop
lea ecx, [esp + 0x1158]
push ecx
call fcn.004a38bc
add esp, 8
test eax, eax
je 0x49d5dc
push str.Directory
lea eax, [esp + 0x1158]
push eax
call fcn.004a38bc
add esp, 8
test eax, eax
je 0x49d5dc
push str.Mutant
lea edx, [esp + 0x1158]
push edx
call fcn.004a38bc
add esp, 8
test eax, eax
jne 0x49d5e3
push str.NlsCacheMutant
lea ecx, [esp + 0x1194]
push ecx
call fcn.004a38bc
add esp, 8
test eax, eax
jne 0x49d5e3
mov eax, 1
jmp 0x49d5e5
xor eax, eax
test eax, eax
jne 0x49d5fe
lea edx, [esp + 0x1148]
push edx
push 0x4e2f14
call sym.ollydbg.exe__Addsorteddata
add esp, 8
mov ecx, dword [esp + 0x14]
push ecx
call sub.KERNEL32.DLL_CloseHandle
inc dword [esp]
add dword [esp + 0x18], 0x10
mov eax, dword [esp]
cmp eax, dword [esp + 4]
jge 0x49d626
cmp dword [0x4d5a70], 0
jne 0x49cea0
push 0x4e2f14
call sym.ollydbg.exe__Deletenonconfirmedsorteddata
pop ecx
mov eax, dword [0x4e2f10]
test eax, eax
je 0x49d644
push 0
push 0
push eax
call sub.USER32.DLL_InvalidateRect
mov edx, dword [esp + 0x10]
push edx
call sub.KERNEL32.DLL_GlobalFree
mov eax, dword [0x4e3018]
add esp, 0x5430
pop ebp
pop edi
pop esi
pop ebx
ret