Function at 0x4b62b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x527718
mov eax, dword fs:[0]
push eax
push ecx
push ecx
push ebx
push esi
push edi
mov eax, dword [0x577698]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov eax, ecx
shr eax, 0x10
xor edi, edi
cmp ax, di
jne 0x4b64e1
mov eax, 0x9c43
cmp dword [0x585740], edi
jne 0x4b634f
mov edx, eax
cmp dx, cx
je 0x4b6326
mov edx, 0x4e2a
cmp dx, cx
je 0x4b6326
add edx, 0xfffffffb
cmp dx, cx
je 0x4b6326
mov edx, 0x4e2b
cmp dx, cx
je 0x4b6326
add edx, 0xfffffffb
cmp dx, cx
jne 0x4b634f
push dword [ebx + 0x30]
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
push 0xcf
push 0x111
push dword [0x585730]
call esi
push edi
push edi
push 0x10
push dword [ebx + 0x30]
call esi
jmp 0x4b64e1
movzx ecx, cx
cmp ecx, eax
jg case.0x4b636f.20007
je 0x4b6569
sub ecx, 0x4e20
cmp ecx, 0xf
ja case.0x4b636f.20007
jmp dword [ecx*4 + 0x4b6578]
xor esi, esi
call fcn.004a9bbd
jmp case.0x4b636f.20007
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], edi
call fcn.004b0d75
pop ecx
cmp eax, edi
je 0x4b63a4
cmp dword [esp + 0x10], edi
jne 0x4b63a4
push edi
push edi
push 0x475
jmp 0x4b6405
mov esi, str._runupdate
jmp 0x4b6378
mov esi, 0x585d80
mov eax, esi
call fcn.00443792
test al, al
je 0x4b63d3
mov ecx, dword [0x585734]
cmp ecx, edi
je 0x4b63d9
push ecx
call fcn.00490e02
test al, al
jne 0x4b64e1
mov ecx, dword [0x585734]
mov eax, esi
call fcn.00443792
test al, al
jne 0x4b63f8
cmp ecx, edi
je 0x4b63f8
push 1
push ecx
call fcn.00490d0d
test al, al
je 0x4b64e1
push dword [ebx + 0x30]
push 0xca
push 0x111
push dword [0x585730]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp case.0x4b636f.20007
mov esi, str._settings
jmp 0x4b6378
mov esi, str._runprotection
jmp 0x4b6378
mov esi, str._logs
jmp 0x4b6378
call fcn.004b61c8
jmp case.0x4b636f.20007
lea eax, [esp + 0x10]
push eax
call fcn.004b736d
pop ecx
mov dword [esp + 0x20], edi
push dword [esp + 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4b6466
push dword [esp + 0x10]
call fcn.00441e3c
jmp 0x4b6474
mov eax, dword [esp + 0x10]
push 5
push edi
call fcn.00442717
pop ecx
pop ecx
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
call fcn.0040557a
jmp case.0x4b636f.20007
lea esi, [ebx + 0x1a8]
mov eax, dword [esi]
mov dword [esp + 0x10], edi
mov edi, dword [eax]
call fcn.00442887
mov ecx, dword [esi]
push eax
call dword [edi + 0x24]
test eax, eax
je 0x4b64b8
push str.true
push eax
call fcn.004eac41
pop ecx
pop ecx
test eax, eax
jne 0x4b64b8
mov dword [esp + 0x10], 1
mov eax, dword [0x5856ac]
test eax, eax
je 0x4b64d2
xor ecx, ecx
push ecx
cmp dword [esp + 0x14], ecx
je 0x4b64f8
push 0xb
push eax
call fcn.004844c9
xor edi, edi
push edi
push edi
push 0x10
push dword [ebx + 0x30]
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 4
jmp 0x4b64cc
mov eax, dword [0x582d44]
mov ecx, 0x582d44
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
push str._quarantine
push str._settings
lea eax, [esp + 0x18]
push str._s__s
push eax
mov dword [esp + 0x30], 1
call fcn.00404568
mov esi, dword [esp + 0x20]
add esp, 0x10
call fcn.004a9bbd
lea eax, [esi - 0x10]
jmp 0x4b647b
push dword [ebx + 0x30]
push 0xd5
jmp 0x4b6400
push 0x322
call fcn.004881cf
pop ecx
jmp case.0x4b636f.20007
push 0x3b6
jmp 0x4b6557
push dword [ebx + 0x30]
push 0xd0
jmp 0x4b6400