Function at 0x415320
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4ad7eb
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x18d4
call fcn.0049e650
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x18d0], eax
push ebx
push esi
push edi
mov eax, dword [0x4c0390]
xor eax, esp
push eax
lea eax, [esp + 0x18e8]
mov dword fs:[0], eax
cmp byte [0x4e592c], 0
mov edi, ecx
mov dword [esp + 0x10], edi
mov ebx, 1
je 0x41538c
push ebx
xor eax, eax
push 0x4e75ac
mov word [0x4e79ac], ax
call fcn.0044e0c0
cmp byte [0x4e6148], 0
jne 0x4153be
call fcn.00446370
xor ecx, ecx
mov esi, eax
cmp esi, ebx
setg cl
push ecx
push 0x4b1ba4
push str.General
call fcn.00456400
neg eax
sbb eax, eax
and eax, esi
mov dword [0x4e6144], eax
cmp dword [0x4dbc60], ebx
jne 0x415476
cmp byte [0x4e32c0], 0
je 0x415476
push 0x4b177c
push 0x4e75ac
call fcn.0044d920
test al, al
jne 0x415476
push 0x4b1778
push 0x4e75ac
call fcn.0044d920
test al, al
jne 0x415476
push 0x4b1774
push 0x4e75ac
call fcn.0044d920
test al, al
jne 0x415462
push 0x4b19b8
push 0x4e75ac
call fcn.0044d920
test al, al
jne 0x415462
mov eax, 0x4e75ac
dec eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x415430
mov edx, dword [str..ext]
mov cl, byte [0x4b1770]
mov dword [eax], edx
mov byte [eax + 4], cl
cmp word [0x4e79ac], 0
je 0x415462
push 0x4b1760
push 0x4e79ac
call fcn.0046d690
push 0x4e75ac
call fcn.0044f030
push 0x4e79ac
call fcn.0044f050
mov eax, dword [0x4e5780]
mov ecx, dword [0x4e5784]
mov edx, eax
or edx, ecx
je 0x4154d0
cmp eax, 0x7fffffff
jne 0x4154b7
cmp ecx, eax
jne 0x4154b7
cmp byte [0x4e57b1], 0
jne 0x4154b7
push 0x4e75ac
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4154b7
xor eax, eax
mov dword [0x4e5780], eax
mov dword [0x4e5784], eax
mov eax, dword [0x4eaa78]
and eax, 0x18
je 0x4154d0
cmp dword [0x4e5768], 0
je 0x4154d0
or dword [0x4e5768], eax
cmp dword [0x4dbc60], ebx
jne 0x4154e1
cmp byte [0x4e2ec0], 0
jne 0x4154f2
push 0x4e2ec0
push 0x4e75ac
mov ecx, edi
call fcn.00411360
cmp byte [0x4e57b7], 0
je 0x41551a
cmp dword [0x4e614c], 0
je 0x41551a
push 0
push 0x4e57b8
push 0x4e79ac
push 0x4e75ac
call fcn.0044e490
push 0x4e79ac
push 0x4e75ac
call fcn.0042f890
test al, al
je 0x4155d4
cmp dword [0x4dbc5c], 0
je 0x415540
mov byte [edi + 0x1c42], bl
push 0
push ebx
push 0x4e79ac
push 0x4e75ac
mov ecx, edi
call fcn.00414420
cmp eax, ebx
jne 0x4155d4
lea esi, [edi + 0x320]
mov ecx, 0x28
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x41559b
cmp eax, ebx
je 0x41559b
push 0x30
push 0x65
call fcn.0045b8f0
push eax
push 0x1fd
call fcn.0045b8f0
push eax
mov eax, dword [0x4dc1c8]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4156aa
cmp dword [esp + 0x84], 0
jbe 0x4155d0
cmp byte [0x4e32c0], 0x2a
jne 0x4155d0
cmp byte [0x4e42c0], 0
jne 0x4155d0
cmp byte [0x4e6151], 0
jne 0x4155d0
cmp byte [0x4e6551], 0
jne 0x4155d0
mov byte [0x4e32c0], 0
mov edi, dword [esp + 0x10]
mov ecx, dword [0x4e614c]
push ecx
call fcn.0048ff10
push 0x4e2eb0
lea ecx, [esp + 0xb8]
call fcn.004624d0
mov dword [esp + 0x18f0], 0
mov edx, dword [ebp + 8]
push 0
push edx
push 0x4e75ac
push 0
call fcn.00481590
mov bl, al
mov eax, dword [0x4e614c]
mov ecx, dword [edi + eax*4 + 0x104]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
cmp dword [0x4dbc60], 0
jne 0x41563d
test bl, bl
je 0x41563d
mov ecx, dword [0x4db83c]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
lea edx, [esp + 0x14dc]
push edx
push 0x4e75ac
call fcn.0042f9c0
lea eax, [esp + 0x14dc]
push 0x5c
push eax
call fcn.0049ddf0
add esp, 8
test eax, eax
je 0x415679
lea ecx, [esp + 0x14dc]
cmp eax, ecx
je 0x415679
cmp byte [eax - 1], 0x3a
je 0x415679
mov byte [eax], 0
push 0
lea edx, [esp + 0x14e0]
push edx
push 0x2001
push 0x1000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov dword [esp + 0x18f0], 0xffffffff
lea ecx, [esp + 0xb4]
call fcn.0045f0f0
mov ecx, dword [esp + 0x18e8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18d0]
xor ecx, esp
call fcn.0049e0c6
mov esp, ebp
pop ebp
ret 4