Function at 0x415ed0
Capabilities:
Access peb ldr_data
Check if file exists
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4a6f77
mov eax, dword fs:[0]
push eax
sub esp, 0x428
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4cdbb4]
xor eax, esp
push eax
lea eax, [esp + 0x43c]
mov dword fs:[0], eax
lea ecx, [esp + 0x30]
call fcn.00403590
mov eax, dword [0x4cf698]
mov edx, dword [eax + 0xc]
mov ecx, 0x4cf698
mov dword [esp + 0x444], 0
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x44c]
mov eax, dword [ecx + 0x18]
mov ebp, dword [eax]
mov edi, dword [ecx]
mov byte [esp + 0x444], 1
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], edi
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx]
test edi, edi
je 0x415f52
cmp edi, eax
je 0x415f57
call fcn.004870d6
cmp ebp, esi
je 0x416152
test edi, edi
jne 0x4160ea
call fcn.004870d6
xor eax, eax
cmp ebp, dword [eax + 0x18]
jne 0x415f78
call fcn.004870d6
mov eax, dword [esp + 0x450]
lea esi, [ebp + 0xc]
push esi
push eax
lea ecx, [esp + 0x30]
push ecx
call fcn.00413530
mov eax, dword [eax]
add esp, 0xc
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov eax, dword [esp + 0x28]
sete bl
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x415fbf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
jne 0x416105
sub esp, 8
mov ecx, esp
mov dword [esp + 0x34], esp
push 0
call fcn.004033a0
mov byte [esp + 0x44c], 2
test edi, edi
jne 0x4160f1
call fcn.004870d6
xor eax, eax
cmp ebp, dword [eax + 0x18]
jne 0x415ff8
call fcn.004870d6
mov ecx, dword [esp + 0x458]
push esi
push ecx
lea edx, [esp + 0x30]
push edx
call fcn.00413530
add esp, 0xc
mov eax, dword [eax]
mov byte [esp + 0x44c], 3
push 1
push eax
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x44]
mov byte [esp + 0x458], 4
call fcn.00403650
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x448], 5
call fcn.00410d70
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov byte [esp + 0x444], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41606b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov byte [esp + 0x444], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416093
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x14]
push ecx
call fcn.00440550
add esp, 4
test edi, edi
jne 0x4160f8
call fcn.004870d6
xor eax, eax
cmp ebp, dword [eax + 0x18]
jne 0x4160b5
call fcn.004870d6
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x416148
mov eax, dword [esp + 0x14]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4160fc
test dx, dx
je 0x4160e6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4160fc
add eax, 4
add ecx, 4
test dx, dx
jne 0x4160c4
xor eax, eax
jmp 0x416101
mov eax, dword [edi]
jmp 0x415f6e
mov eax, dword [edi]
jmp 0x415fee
mov eax, dword [edi]
jmp 0x4160ab
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x416127
test edi, edi
jne 0x416144
call fcn.004870d6
xor eax, eax
cmp ebp, dword [eax + 0x18]
jne 0x41611a
call fcn.004870d6
mov ecx, dword [esp + 0x454]
push esi
call fcn.004123f0
lea ecx, [esp + 0x18]
call fcn.00412d00
mov ebp, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x44c]
jmp 0x415f45
mov eax, dword [edi]
jmp 0x416110
push 0x80004005
call fcn.004033e0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x444], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41617a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x444], 0xffffffff
call fcn.00403610
mov ecx, dword [esp + 0x43c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x434
ret