Function at 0x448c00
Capabilities:
Check if file exists
Get file attributes
Get file system object information
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4c36f1
mov eax, dword fs:[0]
push eax
mov eax, 0x3560
call fcn.004b0000
mov eax, dword [0x4d98f0]
xor eax, esp
mov dword [esp + 0x355c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d98f0]
xor eax, esp
push eax
lea eax, [esp + 0x3574]
mov dword fs:[0], eax
mov eax, dword [esp + 0x3584]
inc dword [0x51b024]
mov esi, ecx
mov dword [esp + 0x24], eax
xor ebp, ebp
mov dword [esp + 0x357c], ebp
mov ecx, dword [esi]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0xffffffffffffffff
push 0x100c
push ecx
call ebx
push 1
mov ecx, 0x51b8d0
mov dword [esp + 0x24], eax
call fcn.0046f700
push 0x1c2
call fcn.00466860
push eax
mov ecx, 0x51b8d0
call fcn.0046f770
mov eax, dword [0x51b02c]
cmp eax, ebp
je 0x448cae
push eax
call dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov dword [0x51b02c], 0xffffffff
push 0x400
lea edx, [esp + 0x2d74]
push edx
mov byte [esp + 0x1e], 0
call fcn.0048c140
cmp byte [esi + 0x81a], 0
je 0x448cdd
mov ecx, 0x521098
call fcn.004076d0
jmp 0x448d9a
lea eax, [esp + 0x2d70]
push eax
push ebp
call fcn.00455790
test al, al
jne 0x448d24
lea ecx, [esp + 0x2d70]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x448d24
lea edx, [esp + 0x2d70]
push edx
call fcn.00455e90
test eax, eax
je 0x448d24
push 0x4c6b28
call fcn.0048b040
test al, al
sete byte [esp + 0x16]
lea eax, [esp + 0x2d70]
push eax
call fcn.00455e90
cmp word [eax], bp
jne 0x448d3d
lea eax, [esp + 0x2d70]
push eax
call fcn.0049cef0
lea ecx, [esp + 0x2d70]
push ecx
call fcn.00456310
mov edi, eax
cmp edi, 0xffffffff
je 0x448d6d
call fcn.0048b020
mov edx, 1
mov ecx, edi
shl edx, cl
test edx, eax
je 0x449494
cmp byte [esp + 0x16], 0
jne 0x448d9a
mov ecx, 0x521098
call fcn.004070a0
mov ecx, 0x521088
call fcn.00476600
lea eax, [esp + 0x2d70]
push eax
mov ecx, 0x521088
call fcn.004760f0
mov ecx, dword [esi]
push ebp
push ebp
push 0xb
push ecx
call ebx
mov ecx, esi
call fcn.00448160
cmp byte [esp + 0x16], 0
mov edi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jne 0x448dd5
push 0x4401
push 0x2b4
lea edx, [esp + 0x8f0]
push edx
push ebp
push 0x4c779c
call edi
cmp eax, ebp
jne 0x448e0f
push 0x400
lea eax, [esp + 0xbc]
push eax
call fcn.0048af30
cmp byte [esp + 0x16], 0
je 0x448df2
xor eax, eax
jmp 0x448e0f
push 0x4401
push 0x2b4
lea ecx, [esp + 0x8f0]
push ecx
push ebp
lea edx, [esp + 0xc8]
push edx
call edi
push eax
mov eax, dword [esi]
push 1
push 0x1003
push eax
call ebx
push 1
push str.AllowUppercase
push str.FileList
call fcn.004604a0
push ebp
push str.ShowSeconds
test eax, eax
push str.FileList
setne byte [esp + 0x2a]
call fcn.004604a0
test eax, eax
setne byte [esp + 0x1d]
cmp byte [esi + 0x81a], 0
je 0x448e60
mov ecx, esi
call fcn.00444fa0
jmp 0x449383
lea ecx, [esp + 0x203c]
call fcn.0043a7e0
mov byte [esp + 0x357c], 1
push 0x4c67ac
lea ecx, [esp + 0x2040]
call fcn.0043a820
lea ecx, [esp + 0x17b0]
call fcn.004128b0
lea ecx, [esp + 0x17d4]
call fcn.004128b0
lea ecx, [esp + 0x17f8]
call fcn.004128b0
push 0x1f4
lea ecx, [esp + 0xac]
mov dword [esp + 0x1c], ebp
mov byte [esp + 0x1b], 0
call fcn.0048bcb0
mov byte [esp + 0x357c], 2
cmp byte [esp + 0x16], 0
jne 0x44924e
push ebp
lea ecx, [esp + 0xba0]
push ecx
lea ecx, [esp + 0x2044]
call fcn.0043ac40
test al, al
je 0x44924e
test byte [esp + 0x18], 0x1f
jne 0x448f06
lea ecx, [esp + 0xa8]
call fcn.0048b500
mov ecx, 0x4c779c
lea eax, [esp + 0xf9c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x448f38
cmp dx, bp
je 0x448f34
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x448f38
add eax, 4
add ecx, 4
cmp dx, bp
jne 0x448f12
xor eax, eax
jmp 0x448f3d
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebp
je 0x448ed6
mov edx, dword [esp + 0x18]
lea eax, [esp + 0xf9c]
mov dword [esp + 0x5c], 7
mov dword [esp + 0x60], edx
mov dword [esp + 0x78], 0xffffffff
mov dword [esp + 0x64], ebp
mov dword [esp + 0x70], eax
mov ecx, 0x4c6b28
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x448f96
cmp dx, bp
je 0x448f92
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x448f96
add eax, 4
add ecx, 4
cmp dx, bp
jne 0x448f70
xor eax, eax
jmp 0x448f9b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebp
sete al
mov byte [esp + 0x1f], al
test al, al
je 0x448fce
lea ecx, [esp + 0x2d70]
push ecx
call fcn.00455e90
cmp word [eax], bp
je 0x448ed6
mov edx, dword [esp + 0x8ec]
mov dword [esp + 0x78], edx
mov byte [esp + 0x17], 1
push 0x830
lea eax, [esp + 0xbc]
push ebp
push eax
call fcn.004b0470
add esp, 0xc
xor eax, eax
jmp 0x448ff0
movzx ecx, word [esp + eax + 0xf9c]
mov word [esp + eax + 0xb8], cx
add eax, 2
cmp cx, bp
jne 0x448ff0
lea ecx, [esp + 0xf9c]
push ecx
mov ecx, esi
call fcn.00445230
mov eax, dword [esp + 0x17a0]
mov ecx, dword [esp + 0x17a4]
mov edx, dword [esp + 0x179c]
mov dword [esp + 0x8bc], eax
mov eax, dword [esp + 0x2030]
mov dword [esp + 0x8c8], ecx
mov dword [esp + 0x8d0], eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0xb8]
mov dword [esp + 0x8b8], edx
mov edx, dword [esp + 0x202c]
inc eax
push ecx
mov ecx, 0x531708
mov dword [esp + 0x8c4], ebp
mov dword [esp + 0x8c8], ebp
mov dword [esp + 0x8d0], edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x8e0], eax
call fcn.00444a90
cmp byte [esp + 0x1e], 0
mov dword [esp + 0x7c], eax
jne 0x4490a2
mov edx, dword [esp + 0x70]
push edx
call fcn.0044c410
mov edx, dword [esi]
lea ecx, [esp + 0x5c]
push ecx
push 0
push 0x104d
lea eax, [esp + 0xfa8]
push edx
mov dword [esp + 0x80], eax
call ebx
cmp byte [esp + 0x17ac], 0
mov ebp, eax
jne 0x449107
mov ecx, dword [esp + 0x8bc]
mov edx, dword [esp + 0x8b8]
push 0x32
lea eax, [esp + 0x2d10]
push eax
push ecx
push edx
call fcn.0044c0c0
mov edx, dword [esi]
lea ecx, [esp + 0x28]
push ecx
push ebp
lea eax, [esp + 0x2d14]
push 0x1074
mov dword [esp + 0x48], eax
push edx
jmp 0x44911d
mov ecx, dword [esi]
lea eax, [esp + 0x28]
push eax
push ebp
push 0x1074
mov dword [esp + 0x48], 0x4c6d80
push ecx
mov dword [esp + 0x40], 1
call ebx
cmp byte [esp + 0x1f], 0
mov dword [esp + 0x30], 2
je 0x449151
mov ecx, dword [esi]
lea eax, [esp + 0x28]
push eax
push ebp
lea edx, [esp + 0xb04]
push 0x1074
mov dword [esp + 0x48], edx
push ecx
jmp 0x449167
mov eax, dword [esi]
lea edx, [esp + 0x28]
push edx
push ebp
push 0x1074
mov dword [esp + 0x48], 0x4c6d80
push eax
call ebx
lea ecx, [esp + 0x90]
push ecx
lea edx, [esp + 0x2030]
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea eax, [esp + 0x98]
push eax
lea ecx, [esp + 0x94]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0x64
lea edx, [esp + 0x2c48]
push edx
push 0
lea eax, [esp + 0xa4]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
lea edi, [esp + 0x2c44]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4491c0
mov ecx, dword [0x4c8434]
lea eax, [esp + 0x2c44]
mov dword [edi], ecx
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4491e0
sub eax, edx
xor ecx, ecx
sar eax, 1
cmp byte [esp + 0x1d], cl
push 0x64
setne cl
lea edx, [esp + eax*2 + 0x2c48]
push edx
push 0
lea eax, [esp + 0xa4]
push eax
dec ecx
and ecx, 2
push ecx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
mov ecx, dword [esi]
lea eax, [esp + 0x28]
push eax
push ebp
push 0x1074
lea edx, [esp + 0x2c50]
push ecx
mov dword [esp + 0x40], 3
mov dword [esp + 0x4c], edx
call ebx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x18], edx
xor ebp, ebp
jmp 0x448ed6
mov edi, 0x5c
cmp word [esp + 0x2d70], di
jne 0x44928d
cmp word [esp + 0x2d72], di
jne 0x44928d
lea eax, [esp + 0x2d74]
push edi
push eax
call fcn.004b0bd2
add esp, 8
cmp eax, ebp
je 0x449298
add eax, 2
push edi
push eax
call fcn.004b0bd2
add esp, 8
test eax, eax
je 0x449298
cmp byte [esp + 0x17], 0
jne 0x44935b
lea ecx, [esp + 0x2d70]
push ecx
call fcn.00455e90
cmp word [eax], bp
je 0x44935b
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x8ec]
push 0x830
lea ecx, [esp + 0xbc]
push ebp
push ecx
mov dword [esp + 0x68], 7
mov dword [esp + 0x6c], edx
mov dword [esp + 0x84], eax
mov dword [esp + 0x70], ebp
mov dword [esp + 0x7c], 0x4c6b28
call fcn.004b0470
add esp, 0xc
xor eax, eax
movzx ecx, word [eax + 0x4c6b28]
mov word [esp + eax + 0xb8], cx
add eax, 2
cmp cx, bp
jne 0x4492f0
lea edx, [esp + 0xb8]
push edx
mov ecx, 0x531708
mov dword [esp + 0x8cc], 0x10
call fcn.00444a90
mov ecx, dword [esi]
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x5c]
push eax
push ebp
push 0x104d
push ecx
call ebx
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0xb00]
push eax
mov dword [esp + 0x44], edx
mov edx, dword [esi]
push 0x1074
push edx
mov dword [esp + 0x40], 2
call ebx
mov byte [esp + 0x357c], 1
lea ecx, [esp + 0xa8]
call fcn.0048b540
mov byte [esp + 0x357c], 0
lea ecx, [esp + 0x203c]
call fcn.0043a800
mov ecx, 0x531708
call fcn.00444d00
mov ecx, esi
call fcn.00448850
mov edi, dword [esp + 0x24]
cmp edi, ebp
je 0x4493e5
cmp word [edi], bp
jne 0x4493d9
mov eax, dword [esi]
push ebp
push ebp
push 0x1004
push eax
call ebx
mov ecx, dword [esp + 0x20]
cmp ecx, eax
jl 0x4493bc
cmp eax, ebp
jle 0x4493bc
lea ecx, [eax - 1]
lea edx, [esp + 0x28]
push edx
mov eax, 3
push ecx
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], eax
mov eax, dword [esi]
push 0x102b
push eax
jmp 0x44940f
push edi
mov ecx, esi
call fcn.004485a0
test al, al
jne 0x449411
mov eax, 3
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x20]
cmp eax, 0xffffffff
je 0x4493ff
cmp edi, ebp
jne 0x449401
xor eax, eax
mov edx, dword [esi]
lea ecx, [esp + 0x28]
push ecx
push eax
push 0x102b
push edx
call ebx
mov eax, dword [esi]
push 1
push 0xffffffffffffffff
push 0x100c
push eax
call ebx
push ebp
mov ecx, 0x51b8d0
mov edi, eax
call fcn.0046f770
mov ecx, dword [esi]
push ebp
push 1
push 0xb
push ecx
call ebx
mov edx, dword [esi]
push ebp
push ebp
push 0x102a
push edx
call ebx
mov eax, dword [esi]
push ebp
push edi
push 0x1013
push eax
call ebx
mov ecx, esi
call fcn.00446e40
mov ecx, esi
call fcn.00447060
push ebp
mov ecx, 0x51b8d0
call fcn.0046f700
mov ecx, 0x5238b0
call fcn.004737a0
cmp byte [esp + 0x16], 0
jne 0x449494
cmp byte [esi + 0x81a], 0
jne 0x449494
push 3
push ebp
push 0x4c779c
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
mov dword [0x51b02c], eax
mov dword [esp + 0x357c], 0xffffffff
cmp dword [0x51b024], ebp
jle 0x4494ad
dec dword [0x51b024]
mov ecx, dword [esp + 0x3574]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x355c]
xor ecx, esp
call fcn.004affec
add esp, 0x356c
ret 4