Function at 0x441e60
Capabilities:
Check if file exists
Check os version
Get disk information
Get disk size
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5401ae
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x5ac020]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor eax, eax
mov dword [ebp - 0xec], 0
mov dword [ebp - 0xe8], 0
mov dword [ebp - 0xe8], 7
mov dword [ebp - 0xec], 0
mov word [ebp - 0xfc], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x7c], 7
mov dword [ebp - 0x80], eax
mov word [ebp - 0x90], ax
mov byte [ebp - 4], 1
mov dword [ebp - 0x94], vtable.cafx::tstring_ex_wchar_t__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___.0
mov byte [ebp - 4], 2
lea ebx, [edi + 0x548]
mov ecx, dword [ebx + 0xf4]
test ecx, ecx
je 0x441f0d
add ecx, 0xa0
cmp dword [ecx + 0x14], 8
jb 0x441f0f
mov ecx, dword [ecx]
jmp 0x441f0f
xor ecx, ecx
lea eax, [ebp - 0x90]
xor edx, edx
push eax
call fcn.004bfe20
add esp, 4
lea ecx, [ebp - 0x90]
cmp dword [ebp - 0x7c], 8
cmovae ecx, dword [ebp - 0x90]
call fcn.00485ec0
cmp dword [ebp - 0x7c], 8
lea ecx, [ebp - 0x90]
mov esi, eax
cmovae ecx, dword [ebp - 0x90]
push ecx
mov dword [ebp - 0x228], esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
lea eax, [ebp - 0x90]
jne 0x441f91
cmp dword [ebp - 0x7c], 8
mov ecx, edi
cmovae eax, dword [ebp - 0x90]
push eax
mov eax, dword [edi]
push 0xefffffff
push 1
push 1
push str.0042
push 4
call dword [eax + 0x3c]
push eax
call fcn.004a3b30
add esp, 0x1c
jmp 0x442316
cmp dword [ebp - 0x7c], 8
cmovae eax, dword [ebp - 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x441faf
lea eax, [ebp - 0x90]
jmp 0x441f60
test esi, esi
jne 0x44209c
push 3
push esi
lea eax, [ebp - 0xac]
push eax
lea ecx, [ebp - 0x90]
call fcn.00412420
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 8
jb 0x441fd8
mov eax, dword [eax]
push 0x32
lea ecx, [ebp - 0x78]
push ecx
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
sete al
mov byte [ebp - 0x221], al
mov byte [ebp - 4], 2
cmp dword [ebp - 0x98], 8
jb 0x44201b
push dword [ebp - 0xac]
call fcn.0051d3d0
mov al, byte [ebp - 0x221]
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x98], 7
mov dword [ebp - 0x9c], 0
mov word [ebp - 0xac], cx
test al, al
je 0x44209c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [edi]
mov ecx, edi
mov esi, eax
call dword [edx + 0x3c]
mov edx, esi
mov ecx, eax
call fcn.004a4000
test byte [ebx + 0x60], 1
je 0x442316
mov eax, dword [ebx + 0x64]
test al, 0x40
jne 0x442316
shr eax, 7
and eax, 1
je 0x442316
mov ecx, dword [ebx + 0x78]
test ecx, ecx
je 0x442316
push 0
push ebx
call fcn.004c78d0
test eax, eax
je 0x442316
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x20]
jmp 0x442316
cmp dword [ebp - 0x7c], 8
lea ecx, [ebp - 0x248]
push 0
push 0
lea eax, [ebp - 0x90]
cmovae eax, dword [ebp - 0x90]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x442316
mov eax, dword [ebp - 0x244]
mov ecx, edi
mov esi, dword [ebp - 0x248]
mov dword [ebp - 0x230], eax
call fcn.00441da0
mov ecx, dword [ebx + 0xf4]
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x234], edx
test ecx, ecx
je 0x442106
add ecx, 0xa0
cmp dword [ecx + 0x14], 8
jb 0x442108
mov ecx, dword [ecx]
jmp 0x442108
xor ecx, ecx
push ecx
lea ecx, [ebp - 0xe4]
call fcn.00403a00
mov byte [ebp - 4], 4
lea eax, [ebp - 0xe0]
cmp dword [ebp - 0xcc], 8
push 0
cmovae eax, dword [ebp - 0xe0]
push eax
call fcn.005008a4
add esp, 8
cmp eax, 0xffffffff
je 0x4421a1
cmp dword [ebp - 0xcc], 8
lea eax, [ebp - 0xe0]
push 0
cmovae eax, dword [ebp - 0xe0]
push 0x80
push 3
push 0
push 0
push Ordinal_1
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4421a1
lea eax, [ebp - 0x240]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x44219a
add esi, dword [ebp - 0x240]
mov eax, dword [ebp - 0x230]
adc eax, dword [ebp - 0x23c]
mov dword [ebp - 0x230], eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x230]
mov edx, dword [ebp - 0x234]
cmp edx, eax
jb 0x442391
ja 0x4421c5
mov ecx, dword [ebp - 0x22c]
cmp ecx, esi
jbe 0x442397
xor ecx, ecx
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x98], 7
mov dword [ebp - 0x9c], 0
mov word [ebp - 0xac], cx
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xac]
push eax
push esi
call fcn.00485640
add esp, 8
cmp dword [ebp - 0x228], 0
je 0x442247
cmp dword [ebp - 0x7c], 8
lea eax, [ebp - 0x90]
mov ecx, edi
cmovae eax, dword [ebp - 0x90]
push eax
mov eax, dword [edi]
push 0xefffffff
push 1
push 1
push str.0013
push 4
call dword [eax + 0x3c]
push eax
call fcn.004a3b30
add esp, 0x1c
jmp 0x4422c3
lea ecx, [ebp - 0xc8]
call fcn.00401760
mov byte [ebp - 4], 6
lea eax, [ebp - 0x90]
cmp dword [ebp - 0x7c], 8
cmovae eax, dword [ebp - 0x90]
movzx eax, word [eax]
push eax
lea eax, [ebp - 0xc8]
push 0x56c3b4
push eax
call fcn.00401a00
add esp, 0xc
lea eax, [ebp - 0xc4]
cmp dword [ebp - 0xb0], 8
mov ecx, edi
cmovae eax, dword [ebp - 0xc4]
push eax
mov eax, dword [edi]
push 0xefffffff
push 1
push 1
push str.0013
push 4
call dword [eax + 0x3c]
push eax
call fcn.004a3b30
add esp, 0x1c
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xc8]
call fcn.004021a0
add edi, 0xf68
test byte [edi + 0x60], 1
je 0x4422f8
mov eax, dword [edi + 0x64]
test al, 0x40
jne 0x4422f8
shr eax, 7
and eax, 1
je 0x4422f8
mov ecx, dword [edi + 0x78]
test ecx, ecx
je 0x4422f8
push 0
push edi
call fcn.004c78d0
test eax, eax
je 0x4422f8
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x20]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xac]
call fcn.00402220
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xe4]
call fcn.004021a0
xor ebx, ebx
mov byte [ebp - 4], 0
mov dword [ebp - 0x94], vtable.cafx::tstring_ex_wchar_t__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___.0
mov byte [ebp - 4], 0
cmp dword [ebp - 0x7c], 8
jb 0x44233e
push dword [ebp - 0x90]
call fcn.0051d3d0
add esp, 4
xor eax, eax
mov dword [ebp - 0x7c], 7
mov dword [ebp - 0x80], 0
mov word [ebp - 0x90], ax
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0xec], eax
mov word [ebp - 0xfc], ax
mov eax, ebx
mov dword [ebp - 0xe8], 7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ffcef
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x22c]
mov eax, ecx
or eax, edx
jne 0x442417
lea esi, [edi + 0xf68]
push 0x5742a0
mov ecx, esi
call fcn.004c7020
mov eax, dword [edi]
mov ecx, edi
push 0xefffffff
push 1
push 1
push str.0006
push 3
call dword [eax + 0x3c]
push eax
call fcn.004a3b30
add esp, 0x18
test byte [esi + 0x60], 1
je 0x442307
mov eax, dword [esi + 0x64]
test al, 0x40
jne 0x442307
shr eax, 7
and eax, 1
je 0x442307
mov ecx, dword [esi + 0x78]
test ecx, ecx
je 0x442307
push 0
push esi
call fcn.004c78d0
test eax, eax
je 0x442307
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
jmp 0x442307
cmp dword [ebp - 0x228], 0
jne 0x4426ea
xor eax, eax
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x98], 7
mov dword [ebp - 0x9c], 0
mov word [ebp - 0xac], ax
mov byte [ebp - 4], 7
lea eax, [ebp - 0x78]
push str.NTFS
push eax
call fcn.00500c00
add esp, 8
test eax, eax
jne 0x4424fa
push 0x11c
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.005032d0
add esp, 0xc
mov dword [ebp - 0x220], 0x11c
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x21c]
cmp eax, 6
jne 0x4424d5
cmp dword [ebp - 0x218], 1
ja 0x4424d7
push str.16TB
lea ecx, [ebp - 0xac]
xor esi, esi
mov ebx, 0x1000
call fcn.00401fc0
xor eax, eax
mov ecx, 0x3000
jmp 0x4425b1
jbe 0x4424b2
push str.256TB
lea ecx, [ebp - 0xac]
xor esi, esi
mov ebx, 0x10000
call fcn.00401fc0
xor eax, eax
mov ecx, 0x3000
jmp 0x4425b1
lea eax, [ebp - 0x78]
push str.FAT32
push eax
call fcn.00500c00
add esp, 8
test eax, eax
jne 0x442530
push 0x576440
lea ecx, [ebp - 0xac]
xor esi, esi
lea ebx, [eax + 1]
call fcn.00401fc0
xor eax, eax
mov ecx, 0x3000
jmp 0x4425b1
lea eax, [ebp - 0x78]
push 0x576448
push eax
call fcn.00500c00
add esp, 8
test eax, eax
jne 0x442565
push 0x576450
lea ecx, [ebp - 0xac]
mov esi, Ordinal_1
xor ebx, ebx
call fcn.00401fc0
xor eax, eax
mov ecx, 0x3000
jmp 0x4425b1
lea eax, [ebp - 0x78]
push str.exFAT
push eax
call fcn.00500c00
add esp, 8
test eax, eax
jne 0x442599
push str.16EB
lea ecx, [ebp - 0xac]
or esi, 0xffffffff
or ebx, 0xffffffff
call fcn.00401fc0
xor eax, eax
mov ecx, 0x3000
jmp 0x4425b1
mov eax, dword [ebp - 0x23c]
mov ecx, dword [ebp - 0x240]
mov ebx, dword [ebp - 0x23c]
mov esi, dword [ebp - 0x240]
cmp dword [ebp - 0x234], eax
ja 0x4425ea
jb 0x4425c5
mov edx, dword [ebp - 0x22c]
cmp edx, ecx
jae 0x4425f0
mov eax, dword [edi]
mov ecx, edi
push 0xefffffff
push 1
push 1
push str.0015
push 4
call dword [eax + 0x3c]
push eax
call fcn.004a3b30
add esp, 0x18
jmp 0x4422c3
mov edx, dword [ebp - 0x22c]
mov eax, esi
or eax, ebx
je 0x4426db
cmp dword [ebp - 0x234], ebx
jb 0x4426db
ja 0x442610
cmp edx, esi
jbe 0x4426db
lea ecx, [ebp - 0xc8]
call fcn.00401760
mov byte [ebp - 4], 8
lea eax, [ebp - 0x90]
cmp dword [ebp - 0x7c], 8
cmovae eax, dword [ebp - 0x90]
movzx eax, word [eax]
push eax
lea eax, [ebp - 0xc8]
push 0x56c3b4
push eax
call fcn.00401a00
add esp, 0xc
lea ecx, [ebp - 0xc4]
cmp dword [ebp - 0xb0], 8
lea eax, [ebp - 0xac]
cmovae ecx, dword [ebp - 0xc4]
cmp dword [ebp - 0x98], 8
push ecx
cmovae eax, dword [ebp - 0xac]
mov ecx, edi
push eax
mov eax, dword [edi]
push 0xefffffff
push 1
push 1
push str.0014
push 4
call dword [eax + 0x3c]
push eax
call fcn.004a3b30
add edi, 0xf68
add esp, 0x20
test byte [edi + 0x60], 1
je 0x4426c7
mov eax, dword [edi + 0x64]
test al, 0x40
jne 0x4426c7
shr eax, 7
and eax, 1
je 0x4426c7
mov ecx, dword [edi + 0x78]
test ecx, ecx
je 0x4426c7
push 0
push edi
call fcn.004c78d0
test eax, eax
je 0x4426c7
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x20]
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xc8]
call fcn.004021a0
jmp 0x4422f8
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xac]
call fcn.00402220
mov ebx, 1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xe4]
call fcn.004021a0
jmp 0x442318