Function at 0x415390
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4add1b
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x18d4
call fcn.0049ebb0
mov eax, dword [0x4c03a0]
xor eax, esp
mov dword [esp + 0x18d0], eax
push ebx
push esi
push edi
mov eax, dword [0x4c03a0]
xor eax, esp
push eax
lea eax, [esp + 0x18e8]
mov dword fs:[0], eax
cmp byte [0x4e5974], 0
mov edi, ecx
mov dword [esp + 0x10], edi
mov ebx, 1
je 0x4153fc
push ebx
xor eax, eax
push 0x4e75f4
mov word [0x4e79f4], ax
call fcn.0044e680
cmp byte [0x4e6190], 0
jne 0x41542e
call fcn.00446920
xor ecx, ecx
mov esi, eax
cmp esi, ebx
setg cl
push ecx
push 0x4b1ba4
push str.General
call fcn.00456940
neg eax
sbb eax, eax
and eax, esi
mov dword [0x4e618c], eax
cmp dword [0x4dbca8], ebx
jne 0x4154e6
cmp byte [0x4e3308], 0
je 0x4154e6
push 0x4b177c
push 0x4e75f4
call fcn.0044dee0
test al, al
jne 0x4154e6
push 0x4b1778
push 0x4e75f4
call fcn.0044dee0
test al, al
jne 0x4154e6
push 0x4b1774
push 0x4e75f4
call fcn.0044dee0
test al, al
jne 0x4154d2
push 0x4b19b8
push 0x4e75f4
call fcn.0044dee0
test al, al
jne 0x4154d2
mov eax, 0x4e75f4
dec eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4154a0
mov edx, dword [str..ext]
mov cl, byte [0x4b1770]
mov dword [eax], edx
mov byte [eax + 4], cl
cmp word [0x4e79f4], 0
je 0x4154d2
push 0x4b1760
push 0x4e79f4
call fcn.0046db90
push 0x4e75f4
call fcn.0044f5f0
push 0x4e79f4
call fcn.0044f610
mov eax, dword [0x4e57c8]
mov ecx, dword [0x4e57cc]
mov edx, eax
or edx, ecx
je 0x415540
cmp eax, 0x7fffffff
jne 0x415527
cmp ecx, eax
jne 0x415527
cmp byte [0x4e57f9], 0
jne 0x415527
push 0x4e75f4
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x415527
xor eax, eax
mov dword [0x4e57c8], eax
mov dword [0x4e57cc], eax
mov eax, dword [0x4eaac0]
and eax, 0x18
je 0x415540
cmp dword [0x4e57b0], 0
je 0x415540
or dword [0x4e57b0], eax
cmp dword [0x4dbca8], ebx
jne 0x415551
cmp byte [0x4e2f08], 0
jne 0x415562
push 0x4e2f08
push 0x4e75f4
mov ecx, edi
call fcn.00411370
cmp byte [0x4e57ff], 0
je 0x41558a
cmp dword [0x4e6194], 0
je 0x41558a
push 0
push 0x4e5800
push 0x4e79f4
push 0x4e75f4
call fcn.0044ea50
push 0x4e79f4
push 0x4e75f4
call fcn.0042fc80
test al, al
je 0x415644
cmp dword [0x4dbca4], 0
je 0x4155b0
mov byte [edi + 0x1c42], bl
push 0
push ebx
push 0x4e79f4
push 0x4e75f4
mov ecx, edi
call fcn.00414490
cmp eax, ebx
jne 0x415644
lea esi, [edi + 0x320]
mov ecx, 0x28
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x41560b
cmp eax, ebx
je 0x41560b
push 0x30
push 0x65
call fcn.0045be10
push eax
push 0x1fd
call fcn.0045be10
push eax
mov eax, dword [0x4dc210]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x41571a
cmp dword [esp + 0x84], 0
jbe 0x415640
cmp byte [0x4e3308], 0x2a
jne 0x415640
cmp byte [0x4e4308], 0
jne 0x415640
cmp byte [0x4e6199], 0
jne 0x415640
cmp byte [0x4e6599], 0
jne 0x415640
mov byte [0x4e3308], 0
mov edi, dword [esp + 0x10]
mov ecx, dword [0x4e6194]
push ecx
call fcn.00490470
push 0x4e2ef8
lea ecx, [esp + 0xb8]
call fcn.004629e0
mov dword [esp + 0x18f0], 0
mov edx, dword [ebp + 8]
push 0
push edx
push 0x4e75f4
push 0
call fcn.00481ad0
mov bl, al
mov eax, dword [0x4e6194]
mov ecx, dword [edi + eax*4 + 0x104]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
cmp dword [0x4dbca8], 0
jne 0x4156ad
test bl, bl
je 0x4156ad
mov ecx, dword [0x4db884]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
lea edx, [esp + 0x14dc]
push edx
push 0x4e75f4
call fcn.0042fda0
lea eax, [esp + 0x14dc]
push 0x5c
push eax
call fcn.0049e350
add esp, 8
test eax, eax
je 0x4156e9
lea ecx, [esp + 0x14dc]
cmp eax, ecx
je 0x4156e9
cmp byte [eax - 1], 0x3a
je 0x4156e9
mov byte [eax], 0
push 0
lea edx, [esp + 0x14e0]
push edx
push 0x2001
push 0x1000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov dword [esp + 0x18f0], 0xffffffff
lea ecx, [esp + 0xb4]
call fcn.0045f610
mov ecx, dword [esp + 0x18e8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18d0]
xor ecx, esp
call fcn.0049e626
mov esp, ebp
pop ebp
ret 4