Function at 0x403dd0
Capabilities:
Check if file exists
Create directory
Delete directory
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x419cc1
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x422380]
xor eax, esp
mov dword [esp + 0xa4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x422380]
xor eax, esp
push eax
lea eax, [esp + 0xbc]
mov dword fs:[0], eax
mov eax, dword [esp + 0xcc]
xor ebp, ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], ecx
mov ebx, edx
mov dword [esp + 0x98], 0xf
mov dword [esp + 0x94], ebp
mov byte [esp + 0x84], 0
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0xc8], ebp
call fcn.00406830
add esp, 4
push eax
mov edi, str.tmp_hl_
lea esi, [esp + 0x4c]
mov byte [esp + 0xc8], 1
call fcn.004021e0
add esp, 4
mov edi, 0x10
mov byte [esp + 0xc4], 3
cmp dword [esp + 0x44], edi
jb 0x403e86
mov eax, dword [esp + 0x30]
push eax
call fcn.0040bd0f
add esp, 4
push str.kernel32.dll
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], ebp
mov byte [esp + 0x34], 0
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x20], ebp
cmp dword [esp + 0x60], edi
jae 0x403eba
lea eax, [esp + 0x4c]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Wow64DisableWow64FsRedirection
push esi
call ebp
push str.Wow64RevertWow64FsRedirection
push esi
mov edi, eax
call ebp
mov dword [esp + 0x24], eax
test edi, edi
je 0x403ee9
lea ecx, [esp + 0x20]
push ecx
call edi
lea edx, [esp + 0x48]
push edx
mov edi, str.mslmedia.inf
lea esi, [esp + 0x68]
call fcn.004021e0
add esp, 4
lea eax, [esp + 0x48]
push eax
mov edi, str.mslmedia.sys
lea esi, [esp + 0xa0]
mov byte [esp + 0xc8], 4
call fcn.004021e0
add esp, 4
mov byte [esp + 0xc4], 5
mov eax, dword [esp + 0x68]
mov ebp, 0x10
cmp dword [esp + 0x7c], ebp
jae 0x403f3b
lea eax, [esp + 0x68]
mov ecx, dword [ebx]
mov edx, dword [ecx + 0x20]
push eax
push ebx
call edx
mov ecx, dword [esp + 0xa0]
cmp dword [esp + 0xb4], ebp
jae 0x403f5b
lea ecx, [esp + 0xa0]
mov eax, dword [esp + 0x28]
mov edx, dword [eax]
push ecx
push eax
mov eax, dword [edx + 0x20]
call eax
mov eax, dword [esp + 0x68]
cmp dword [esp + 0x7c], ebp
jae 0x403f76
lea eax, [esp + 0x68]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push eax
call edi
xor ecx, ecx
cmp eax, 0xffffffff
mov eax, dword [esp + 0xa0]
setne cl
mov esi, ecx
cmp dword [esp + 0xb4], ebp
jae 0x403fa0
lea eax, [esp + 0xa0]
push eax
call edi
xor edx, edx
cmp eax, 0xffffffff
setne dl
xor ebx, ebx
mov eax, edx
cmp esi, ebx
je 0x404103
cmp eax, ebx
je 0x404103
push 0xf
push str.__SystemRoot___
lea ecx, [esp + 0x88]
call fcn.00401210
call fcn.00406950
mov edx, str.SysNative
cmp eax, 0x40
je 0x403fe6
mov edx, str.system32
mov eax, edx
lea esi, [eax + 1]
jmp 0x403ff0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403ff0
sub eax, esi
push eax
push edx
lea eax, [esp + 0x88]
call fcn.00402290
push 8
push str.drivers
lea eax, [esp + 0x88]
call fcn.00402290
mov edx, dword [esp + 0x84]
cmp dword [esp + 0x98], ebp
jae 0x404031
lea edx, [esp + 0x84]
mov eax, dword [esp + 0x4c]
cmp dword [esp + 0x60], ebp
jae 0x40403f
lea eax, [esp + 0x4c]
mov ecx, dword [esp + 0x68]
cmp dword [esp + 0x7c], ebp
jae 0x40404d
lea ecx, [esp + 0x68]
push 1
push eax
call fcn.00402e10
add esp, 8
mov esi, eax
call fcn.00404240
mov edi, eax
cmp edi, ebx
jne 0x40414a
push esi
push 0x41f530
lea esi, [esp + 0x34]
call fcn.004068d0
add esp, 8
mov byte [esp + 0xc4], 7
cmp dword [eax + 0x18], ebp
jb 0x40408d
mov edx, dword [eax + 4]
jmp 0x404090
lea edx, [eax + 4]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404095
mov ecx, dword [esp + 0x1c]
sub eax, esi
push eax
push edx
call fcn.00401210
mov byte [esp + 0xc4], 5
cmp dword [esp + 0x44], ebp
jb 0x4040c4
mov eax, dword [esp + 0x30]
push eax
call fcn.0040bd0f
add esp, 4
mov edx, dword [esp + 0x84]
cmp dword [esp + 0x98], ebp
jae 0x4040db
lea edx, [esp + 0x84]
mov eax, dword [esp + 0x4c]
cmp dword [esp + 0x60], ebp
jae 0x4040e9
lea eax, [esp + 0x4c]
mov ecx, dword [esp + 0x68]
cmp dword [esp + 0x7c], ebp
jae 0x4040f7
lea ecx, [esp + 0x68]
push ebx
push eax
call fcn.00402e10
add esp, 8
jmp 0x40414a
push eax
push esi
push 0x41f4e8
lea esi, [esp + 0x38]
call fcn.004068d0
add esp, 0xc
mov ecx, dword [esp + 0x1c]
push 0xffffffffffffffff
push ebx
push eax
mov byte [esp + 0xd0], 6
call fcn.004015d0
mov byte [esp + 0xc4], 5
cmp dword [esp + 0x44], ebp
jb 0x404146
mov ecx, dword [esp + 0x30]
push ecx
call fcn.0040bd0f
add esp, 4
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x404159
mov edx, dword [esp + 0x20]
push edx
call eax
mov ecx, dword [esp + 0x4c]
cmp dword [esp + 0x60], ebp
jae 0x404167
lea ecx, [esp + 0x4c]
call fcn.00402c30
mov eax, dword [esp + 0x4c]
cmp dword [esp + 0x60], ebp
jae 0x40417a
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
cmp dword [esp + 0xb4], ebp
jb 0x40419a
mov eax, dword [esp + 0xa0]
push eax
call fcn.0040bd0f
add esp, 4
mov esi, 0xf
mov dword [esp + 0xb4], esi
mov dword [esp + 0xb0], ebx
mov byte [esp + 0xa0], 0
cmp dword [esp + 0x7c], ebp
jb 0x4041c8
mov ecx, dword [esp + 0x68]
push ecx
call fcn.0040bd0f
add esp, 4
mov dword [esp + 0x7c], esi
mov dword [esp + 0x78], ebx
mov byte [esp + 0x68], 0
cmp dword [esp + 0x60], ebp
jb 0x4041e8
mov edx, dword [esp + 0x4c]
push edx
call fcn.0040bd0f
add esp, 4
mov dword [esp + 0x60], esi
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], 0
cmp dword [esp + 0x98], ebp
jb 0x40420e
mov eax, dword [esp + 0x84]
push eax
call fcn.0040bd0f
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0xbc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa4]
xor ecx, esp
call fcn.0040bd00
add esp, 0xb4
ret 4