Function at 0x49eb90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x709a26
mov eax, dword fs:[0]
push eax
sub esp, 0x76c
mov eax, dword [0x7c0ab4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.006d6325
cmp dword [eax], 0
je 0x49ebd4
call fcn.006d6325
mov ecx, dword [eax]
call fcn.0046df00
lea ecx, [ebp - 0x640]
call fcn.0046cf20
cmp dword [eax + 0x10], 0
jne 0x49ebf3
call fcn.006d631f
cmp dword [eax], 0
je 0x49ebf3
mov bl, 1
jmp 0x49ebf5
xor bl, bl
mov edx, dword [ebp - 0x62c]
cmp edx, 8
jb 0x49ec35
mov ecx, dword [ebp - 0x640]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x49ec2b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49ef42
push edx
push ecx
call fcn.006d0b31
add esp, 8
xor eax, eax
mov dword [ebp - 0x630], 0
mov dword [ebp - 0x62c], 7
mov word [ebp - 0x640], ax
test bl, bl
je 0x49ed10
call fcn.006d631f
push ecx
lea ecx, [ebp - 0x658]
mov edx, dword [eax]
call fcn.0046fa40
add esp, 4
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 0x10
jb 0x49ec7f
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x778]
call fcn.00454350
mov byte [ebp - 4], 1
mov ecx, dword [eax]
call fcn.0046cd90
mov eax, dword [ebp - 0x778]
lea ecx, [ebp - 0x774]
cmp eax, ecx
je 0x49ecaf
push eax
call fcn.006d6340
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x644]
cmp edx, 0x10
jb 0x49ecf0
mov ecx, dword [ebp - 0x658]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x49ece6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49ef47
push edx
push ecx
call fcn.006d0b31
add esp, 8
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 0xf
mov byte [ebp - 0x658], 0
call fcn.0046de10
push 0x104
lea eax, [ebp - 0x628]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
push 0x200
push eax
mov word [ebp - 0x420], ax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x218]
push eax
call fcn.006d4310
add esp, 0xc
lea eax, [ebp - 0x418]
push 0x200
push 0
push eax
call fcn.006d4310
add esp, 0xc
lea eax, [ebp - 0x418]
push 0
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x628]
push eax
call fcn.006e5cdf
add esp, 0x14
lea esi, [ebp - 0x418]
xor edi, edi
xor edx, edx
nop dword [eax]
movzx eax, word [esi]
test ax, ax
je 0x49edcf
cmp edx, 0x1fe
jae 0x49edcf
mov ecx, eax
cmp ecx, 0x30
jb 0x49edac
cmp ecx, 0x39
jbe 0x49edbf
cmp ecx, 0x41
jb 0x49edb6
cmp ecx, 0x5a
jbe 0x49edbf
lea eax, [ecx - 0x61]
cmp ax, 0x19
ja 0x49edca
mov word [edx + 0x7cc8d0], cx
inc edi
add edx, 2
add esi, 2
jne 0x49ed90
add edi, edi
cmp edi, 0x200
jae 0x49ef3d
xor eax, eax
mov word [edi + 0x7cc8d0], ax
lea eax, [ebp - 0x18]
push eax
push 0x7c18f0
call fcn.006e6f13
lea eax, [ebp - 0x218]
push eax
push 0x7c18f0
call fcn.006e8a95
push 0x78f2f4
push 0x7c18f0
call fcn.006e8a95
push str.dumps
push 0x7c18f0
call fcn.006e8a95
add esp, 0x20
lea ecx, [ebp - 0x670]
call fcn.0046cf20
cmp dword [eax + 0x14], 8
jb 0x49ee39
mov eax, dword [eax]
push eax
push 0x7c18f0
call fcn.006e8a95
mov edx, dword [ebp - 0x65c]
add esp, 8
cmp edx, 8
jb 0x49ee87
mov ecx, dword [ebp - 0x670]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x49ee7d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49ef4c
push edx
push ecx
call fcn.006d0b31
add esp, 8
xor eax, eax
mov dword [ebp - 0x660], 0
push 0x78f2f4
push 0x7c18f0
mov dword [ebp - 0x65c], 7
mov word [ebp - 0x670], ax
call fcn.006e8a95
lea eax, [ebp - 0x18]
push eax
push str..kldumper.exe
call fcn.006e6f13
lea eax, [ebp - 0x218]
push eax
push str..kldumper.exe
call fcn.006e8a95
push 0x78f2f4
push str..kldumper.exe
call fcn.006e8a95
push str.kldumper.exe
push str..kldumper.exe
call fcn.006e8a95
add esp, 0x28
push str..kldumper.exe
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x49ef15
push 0x792bd8
push str..kldumper.exe
call fcn.006e6f13
add esp, 8
call fcn.0049ead0
mov byte [0x7c14d6], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006d0856
mov esp, ebp
pop ebp
ret
call fcn.006d0efb
call fcn.006d79b8
call fcn.006d79b8
call fcn.006d79b8
int3