Function at 0x495f40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x495f5c
call fcn.0049728c
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x495f78
test bl, 1
je 0x495f78
call fcn.0049d810
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x49615c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.00496e28
test byte [ebp + 0xd], 0xc0
jne 0x496180
mov eax, dword [0x4a9c8c]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x49618d
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x4961ba
je 0x4961cc
sub ecx, 0x100
je 0x4961da
sub ecx, 0x100
je 0x4961e1
sub ecx, 0x100
je 0x4961d3
jmp 0x4961e8
sub ecx, 0x600
je 0x4961e1
sub ecx, 0x100
je 0x4961cc
jmp 0x4961e8
mov edi, 1
jmp 0x4961ed
mov edi, 2
jmp 0x4961ed
mov edi, 4
jmp 0x4961ed
mov edi, 5
jmp 0x4961ed
mov edi, 3
test byte [ebp + 0xd], 1
je 0x496214
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x4a9704]
test al, 0x80
je 0x49620d
mov ebx, 0x80
jmp 0x496226
mov ebx, 1
jmp 0x496226
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x496226
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x496238
je 0x496241
dec eax
je 0x49624a
jmp 0x496253
mov dword [ebp - 4], SysStringLen
jmp 0x496262
mov dword [ebp - 4], 0x40000000
jmp 0x496262
mov dword [ebp - 4], 0xc0000000
jmp 0x496262
push 1
call fcn.00497220
pop ecx
mov ebx, eax
jmp 0x496352
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x49627e
sub eax, 0x10
je 0x496285
sub eax, 0x10
je 0x49628e
sub eax, 0x10
je 0x496297
jmp 0x496297
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x49629e
mov dword [ebp - 8], 1
jmp 0x49629e
mov dword [ebp - 8], 2
jmp 0x49629e
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x49630b
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x496300
test byte [ebp + 0xd], 1
je 0x4962fb
mov ebx, 0x50
jmp 0x496300
mov ebx, 2
push ebx
call fcn.00497220
pop ecx
mov ebx, eax
jmp 0x496352
mov edi, esi
push edi
call fcn.004960c0
pop ecx
test eax, eax
je 0x49631f
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x49632b
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.00496f48
add esp, 8
mov ebx, eax
inc eax
jne 0x496352
push 4
call fcn.00497220
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.00496e5c
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret