Function at 0x443b00
Capabilities:
Check if file exists
Enumerate files on windows
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x53e933
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1a0
mov eax, dword [0x5ab980]
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov dword [esp + 0x38], ebp
mov dword [esp + 0x10], eax
mov dword [esp + 0x1b8], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], eax
mov ebx, dword [esp + 0x1c8]
mov ecx, dword [esp + 0x1c4]
mov edi, 1
mov byte [esp + 0x1b8], 2
mov dword [ebx], 0
mov eax, dword [ecx]
push edi
call dword [eax + 0xc]
mov esi, dword [esp + 0x1d4]
test esi, esi
jne 0x443b78
mov esi, 0x5966e4
mov ecx, dword [esp + 0x1c0]
push ecx
lea ecx, [esp + 0x14]
call fcn.00512a1d
mov ecx, dword [ebp + 8]
xor ebp, ebp
cmp ecx, ebp
je 0x443b9c
lea edx, [esp + 0x10]
push edx
call fcn.0042b970
lea eax, [esp + 0x10]
push esi
lea ecx, [esp + 0x24]
push eax
push ecx
call fcn.00512b79
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1bc], 3
call fcn.00512a1d
lea ecx, [esp + 0x20]
mov byte [esp + 0x1b8], 2
call fcn.005128e4
mov eax, dword [esp + 0x1cc]
cmp eax, ebp
je 0x443be3
cmp eax, 2
mov dword [esp + 0x18], ebp
jne 0x443be7
mov dword [esp + 0x18], edi
cmp eax, ebp
je 0x443bf3
cmp eax, edi
mov dword [esp + 0x28], ebp
jne 0x443bf7
mov dword [esp + 0x28], edi
mov edx, dword [0x5ab980]
mov dword [esp + 0x14], edx
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x70]
push eax
push ecx
mov byte [esp + 0x1c0], 4
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
or ebp, 0xffffffff
mov dword [esp + 0x2c], eax
cmp eax, ebp
jne 0x443ddb
mov edx, dword [0x5ab980]
mov dword [esp + 0x18], edx
mov byte [esp + 0x1b8], 5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 2
je 0x443ce2
lea eax, [esp + 0x20]
push esi
push eax
mov dword [ebx], esi
call fcn.004226f0
add esp, 8
mov ecx, dword [eax]
mov edx, dword [esp + 0x10]
push ecx
push edx
lea eax, [esp + 0x20]
push 0x4f78
push eax
mov byte [esp + 0x1c8], 6
call fcn.0050e6da
add esp, 0x10
lea ecx, [esp + 0x20]
mov byte [esp + 0x1b8], 5
call fcn.005128e4
cmp esi, 3
je 0x443c9f
cmp esi, 0xce
jne 0x443d3a
lea ecx, [esp + 0x20]
push 0x4f79
push ecx
call fcn.00422640
push 0x69
push 0x31
lea edx, [esp + 0x28]
push eax
push edx
mov byte [esp + 0x1d0], 7
call fcn.0042e190
add esp, 0x18
cmp eax, edi
lea ecx, [esp + 0x20]
mov byte [esp + 0x1b8], 5
sete bl
call fcn.005128e4
test bl, bl
je 0x443d3a
lea ecx, [esp + 0x18]
mov byte [esp + 0x1b8], 4
call fcn.005128e4
lea ecx, [esp + 0x14]
mov byte [esp + 0x1b8], 2
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x1b8], 1
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1b8], 0
call fcn.005128e4
lea ecx, [esp + 0x10]
mov dword [esp + 0x1b8], ebp
call fcn.005128e4
xor eax, eax
jmp 0x443daf
mov eax, dword [esp + 0x18]
push 0xffffff60
push eax
call fcn.004227e0
add esp, 8
cmp esi, 5
je 0x443dca
cmp esi, 0x10b
je 0x443dca
mov byte [esp + 0x1b8], 4
lea ecx, [esp + 0x18]
call fcn.005128e4
lea ecx, [esp + 0x14]
mov byte [esp + 0x1b8], 2
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x1b8], 1
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1b8], 0
call fcn.005128e4
lea ecx, [esp + 0x10]
mov dword [esp + 0x1b8], ebp
call fcn.005128e4
mov eax, ebp
mov ecx, dword [esp + 0x1b0]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1ac
ret 0x18
mov byte [esp + 0x1b8], 4
lea ecx, [esp + 0x18]
jmp 0x4442c9
mov esi, dword [esp + 0x70]
lea ecx, [esp + 0x9c]
push ecx
lea ecx, [esp + 0x18]
and esi, 0x10
call fcn.00512a6d
test esi, esi
je 0x443fcb
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4441b4
mov edi, dword [esp + 0x14]
mov esi, 0x598c70
mov ecx, edi
mov al, byte [ecx]
mov bl, byte [esi]
mov dl, al
cmp al, bl
jne 0x443e3a
test dl, dl
je 0x443e36
mov al, byte [ecx + 1]
mov bl, byte [esi + 1]
mov dl, al
cmp al, bl
jne 0x443e3a
add ecx, 2
add esi, 2
test dl, dl
jne 0x443e12
xor ecx, ecx
jmp 0x443e3e
sbb ecx, ecx
sbb ecx, ebp
test ecx, ecx
je 0x4441b4
mov esi, 0x599358
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x443e75
test cl, cl
je 0x443e71
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x443e75
add eax, 2
add esi, 2
test cl, cl
jne 0x443e4d
xor eax, eax
jmp 0x443e79
sbb eax, eax
sbb eax, ebp
test eax, eax
je 0x4441b4
push 0xe0
call fcn.00516a15
add esp, 4
mov dword [esp + 0x34], eax
test eax, eax
mov byte [esp + 0x1b8], 8
je 0x443ea9
mov ecx, eax
call fcn.00441270
mov ebp, eax
jmp 0x443eab
xor ebp, ebp
mov eax, dword [ebp + 8]
push 0x5971e8
and al, 0x31
lea ecx, [esp + 0x18]
or al, 0x31
mov byte [esp + 0x1bc], 4
mov dword [ebp + 8], eax
call fcn.00512cc0
lea ecx, [esp + 0x14]
push ecx
lea ecx, [ebp + 0x34]
call fcn.00512a1d
lea ebx, [ebp + 0x38]
mov ecx, ebx
call fcn.0051286f
mov al, byte [esp + 0x1a0]
test al, al
je 0x443f68
lea esi, [esp + 0x1a0]
lea eax, [esp + 0x9c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x443f1f
test cl, cl
je 0x443f1b
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x443f1f
add eax, 2
add esi, 2
test cl, cl
jne 0x443efb
xor eax, eax
jmp 0x443f24
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x443f68
mov edi, 0x5971e8
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1a0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x1a0]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
call fcn.00512a6d
mov ecx, dword [esp + 0x74]
push ebp
mov dword [ebp + 0x40], ecx
mov edx, dword [esp + 0x7c]
mov dword [ebp + 0x44], edx
mov eax, dword [esp + 0x80]
mov dword [ebp + 0x50], eax
mov ecx, dword [esp + 0x84]
mov dword [ebp + 0x54], ecx
mov edx, dword [esp + 0x88]
mov dword [ebp + 0x48], edx
mov eax, dword [esp + 0x8c]
mov dword [ebp + 0x4c], eax
mov ecx, dword [esp + 0x74]
mov dword [ebp + 0x3c], ecx
mov edx, dword [esp + 0x94]
mov ecx, dword [esp + 0x1c8]
mov dword [ebp + 0x58], edx
mov eax, dword [esp + 0x90]
mov dword [ebp + 0x5c], eax
call fcn.004431a0
jmp 0x4441b1
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4441b4
push 0xe0
call fcn.00516a15
add esp, 4
mov dword [esp + 0x34], eax
test eax, eax
mov byte [esp + 0x1b8], 9
je 0x443fff
mov ecx, eax
call fcn.00441270
mov esi, eax
jmp 0x444001
xor esi, esi
mov ecx, dword [esi + 8]
lea ebp, [esi + 0x34]
and cl, 0x42
lea edx, [esp + 0x14]
or ecx, 0x42
push edx
mov dword [esi + 8], ecx
mov ecx, ebp
mov byte [esp + 0x1bc], 4
call fcn.00512a1d
mov al, byte [esp + 0x1a0]
test al, al
je 0x44407e
lea edi, [esp + 0x1a0]
lea eax, [esp + 0x9c]
mov dl, byte [eax]
mov bl, byte [edi]
mov cl, dl
cmp dl, bl
jne 0x444065
test cl, cl
je 0x444061
mov dl, byte [eax + 1]
mov bl, byte [edi + 1]
mov cl, dl
cmp dl, bl
jne 0x444065
add eax, 2
add edi, 2
test cl, cl
jne 0x44403d
xor eax, eax
jmp 0x44406a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x44407e
lea eax, [esp + 0x1a0]
lea ecx, [esi + 0x38]
push eax
call fcn.00512a6d
mov ecx, dword [esp + 0x74]
mov dword [esi + 0x40], ecx
mov edx, dword [esp + 0x78]
mov dword [esi + 0x44], edx
mov eax, dword [esp + 0x7c]
mov dword [esi + 0x50], eax
mov ecx, dword [esp + 0x80]
mov dword [esi + 0x54], ecx
mov edx, dword [esp + 0x84]
mov dword [esi + 0x48], edx
mov eax, dword [esp + 0x88]
mov dword [esi + 0x4c], eax
mov ecx, dword [esp + 0x70]
mov dword [esi + 0x3c], ecx
mov edx, dword [esp + 0x90]
mov dword [esi + 0x58], edx
mov eax, dword [esp + 0x8c]
mov ecx, esi
mov dword [esi + 0x5c], eax
call fcn.00442ab0
mov ecx, dword [esp + 0x38]
cmp dword [ecx], 0x14
jge 0x4441a4
test dword [esi + 8], 0x10000
je 0x4441a4
lea edx, [esp + 0x20]
mov ecx, esi
push edx
call fcn.004421f0
mov eax, dword [esp + 0x20]
mov edi, 0x5967c4
mov dl, byte [eax]
mov bl, byte [edi]
mov cl, dl
cmp dl, bl
jne 0x44412a
test cl, cl
je 0x444126
mov dl, byte [eax + 1]
mov bl, byte [edi + 1]
mov cl, dl
cmp dl, bl
jne 0x44412a
add eax, 2
add edi, 2
test cl, cl
jne 0x444102
xor eax, eax
jmp 0x44412f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
and eax, 0xff
lea ecx, [esp + 0x20]
mov edi, eax
call fcn.005128e4
test edi, edi
je 0x4441a4
lea ecx, [esp + 0x10]
push ebp
lea edx, [esp + 0x34]
push ecx
push edx
call fcn.00512b13
lea ecx, [esp + 0x3c]
mov byte [esp + 0x1b8], 0xa
push ecx
push eax
call fcn.004c62d0
add esp, 8
lea ecx, [esp + 0x30]
test eax, eax
sete bl
mov byte [esp + 0x1b8], 4
call fcn.005128e4
test bl, bl
je 0x4441a4
mov edx, dword [esp + 0x48]
mov dword [esi + 0x60], edx
mov eax, dword [esp + 0x44]
mov dword [esi + 0x64], eax
mov ecx, dword [esp + 0x50]
mov dword [esi + 0x68], ecx
mov edx, dword [esp + 0x4c]
mov dword [esi + 0x6c], edx
mov ecx, dword [esp + 0x1c4]
push esi
call fcn.0051154c
or ebp, 0xffffffff
mov edi, dword [esp + 0x2c]
lea eax, [esp + 0x70]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x443ddb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp esi, 0xce
ja case.0x4441eb.1
xor ecx, ecx
mov cl, byte [esi + 0x444324]
jmp dword [ecx*4 + 0x44431c]
mov edx, dword [esp + 0x1c4]
lea ecx, [esp + 0x14]
mov byte [esp + 0x1b8], 2
mov esi, dword [edx + 0xc]
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x1b8], 1
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1b8], 0
call fcn.005128e4
lea ecx, [esp + 0x10]
mov dword [esp + 0x1b8], ebp
call fcn.005128e4
mov eax, esi
jmp 0x443daf
mov eax, dword [esp + 0x1c8]
mov dword [eax], esi
mov ecx, dword [0x5ab980]
mov dword [esp + 0x28], ecx
lea edx, [esp + 0x2c]
mov bl, 0xb
push esi
push edx
mov byte [esp + 0x1c0], bl
call fcn.004226f0
add esp, 8
mov eax, dword [eax]
mov ecx, dword [esp + 0x10]
push eax
push ecx
lea edx, [esp + 0x30]
push 0x4f78
push edx
mov byte [esp + 0x1c8], 0xc
call fcn.0050e6da
add esp, 0x10
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1b8], bl
call fcn.005128e4
mov eax, dword [esp + 0x28]
push 0xffffff5f
push eax
call fcn.004227e0
add esp, 8
cmp esi, 5
mov byte [esp + 0x1b8], 4
lea ecx, [esp + 0x28]
jne 0x443d65
call fcn.005128e4
lea ecx, [esp + 0x14]
mov byte [esp + 0x1b8], 2
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x1b8], 1
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1b8], 0
call fcn.005128e4
lea ecx, [esp + 0x10]
mov dword [esp + 0x1b8], ebp
call fcn.005128e4
mov eax, 0xfffffffb
jmp 0x443daf