Function at 0x4c08ae
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x532e2f
mov eax, dword fs:[0]
push eax
push ecx
push ecx
push ebx
push esi
push edi
mov eax, dword [0x585698]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov eax, ecx
shr eax, 0x10
xor edi, edi
cmp ax, di
jne 0x4c0adf
mov eax, 0x9c43
cmp dword [0x593800], edi
jne 0x4c094d
mov edx, eax
cmp dx, cx
je 0x4c0924
mov edx, 0x4e2a
cmp dx, cx
je 0x4c0924
add edx, 0xfffffffb
cmp dx, cx
je 0x4c0924
mov edx, 0x4e2b
cmp dx, cx
je 0x4c0924
add edx, 0xfffffffb
cmp dx, cx
jne 0x4c094d
push dword [ebx + 0x30]
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
push 0xcf
push 0x111
push dword [0x5937f0]
call esi
push edi
push edi
push 0x10
push dword [ebx + 0x30]
call esi
jmp 0x4c0adf
movzx ecx, cx
cmp ecx, eax
jg case.0x4c096d.20007
je 0x4c0b67
sub ecx, 0x4e20
cmp ecx, 0xf
ja case.0x4c096d.20007
jmp dword [ecx*4 + 0x4c0b76]
xor esi, esi
call fcn.004b289c
jmp case.0x4c096d.20007
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], edi
call fcn.004bb01f
pop ecx
cmp eax, edi
je 0x4c09a2
cmp dword [esp + 0x10], edi
jne 0x4c09a2
push edi
push edi
push 0x475
jmp 0x4c0a03
mov esi, str._runupdate
jmp 0x4c0976
mov esi, 0x593e48
mov eax, esi
call fcn.0044a435
test al, al
je 0x4c09d1
mov ecx, dword [0x5937f4]
cmp ecx, edi
je 0x4c09d7
push ecx
call fcn.004986a4
test al, al
jne 0x4c0adf
mov ecx, dword [0x5937f4]
mov eax, esi
call fcn.0044a435
test al, al
jne 0x4c09f6
cmp ecx, edi
je 0x4c09f6
push 1
push ecx
call fcn.004985af
test al, al
je 0x4c0adf
push dword [ebx + 0x30]
push 0xca
push 0x111
push dword [0x5937f0]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp case.0x4c096d.20007
mov esi, str._settings
jmp 0x4c0976
mov esi, str._runprotection
jmp 0x4c0976
mov esi, str._logs
jmp 0x4c0976
call fcn.004c07c6
jmp case.0x4c096d.20007
lea eax, [esp + 0x10]
push eax
call fcn.004c1959
pop ecx
mov dword [esp + 0x20], edi
push dword [esp + 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4c0a64
push dword [esp + 0x10]
call fcn.00448ada
jmp 0x4c0a72
mov eax, dword [esp + 0x10]
push 5
push edi
call fcn.004493b5
pop ecx
pop ecx
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
call fcn.00405521
jmp case.0x4c096d.20007
lea esi, [ebx + 0x1a8]
mov eax, dword [esi]
mov dword [esp + 0x10], edi
mov edi, dword [eax]
call fcn.00449525
mov ecx, dword [esi]
push eax
call dword [edi + 0x24]
test eax, eax
je 0x4c0ab6
push str.true
push eax
call fcn.004f5171
pop ecx
pop ecx
test eax, eax
jne 0x4c0ab6
mov dword [esp + 0x10], 1
mov eax, dword [0x59376c]
test eax, eax
je 0x4c0ad0
xor ecx, ecx
push ecx
cmp dword [esp + 0x14], ecx
je 0x4c0af6
push 0xb
push eax
call fcn.0048b91c
xor edi, edi
push edi
push edi
push 0x10
push dword [ebx + 0x30]
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 4
jmp 0x4c0aca
mov eax, dword [0x590e04]
mov ecx, 0x590e04
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
push str._quarantine
push str._settings
lea eax, [esp + 0x18]
push str._s__s
push eax
mov dword [esp + 0x30], 1
call fcn.0040450f
mov esi, dword [esp + 0x20]
add esp, 0x10
call fcn.004b289c
lea eax, [esi - 0x10]
jmp 0x4c0a79
push dword [ebx + 0x30]
push 0xd5
jmp 0x4c09fe
push 0x322
call fcn.0048f96c
pop ecx
jmp case.0x4c096d.20007
push 0x3b6
jmp 0x4c0b55
push dword [ebx + 0x30]
push 0xd0
jmp 0x4c09fe