Function at 0x409a00
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc0
mov dword [ebp - 0xcc], edx
mov esi, dword [ebp + 0xc]
mov edi, ecx
mov eax, dword [0x43000c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x409a52
mov ecx, eax
and ecx, 0x10
je 0x409a52
and eax, 0x400
sete dl
cmp esi, 1
sete cl
jne 0x409a5a
xor ebx, ebx
test eax, eax
je 0x40a0bc
jmp 0x409a5a
cmp esi, 1
sete cl
xor edx, edx
mov byte [ebp - 0xc8], cl
mov esi, edi
lea ecx, [ebp - 0xac]
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0xc4], edx
mov dword [ebp - 0x9c], 0
mov word [ebp - 0x98], 0x500
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0xac], 0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x221
push 0x20
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov ebx, eax
mov eax, dword [ebp - 0x94]
mov edi, dword [ebp - 0xac]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x409ba5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
mov dword [ebp - 0x94], edi
je 0x409d42
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x88], 0x1f01ff
mov dword [ebp - 0x84], 2
mov dword [ebp - 0x80], 3
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 2
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0xb8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x9c]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov ebx, eax
mov eax, dword [ebp - 0x90]
mov edi, dword [ebp - 0xb8]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x409c35
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
mov dword [ebp - 0x90], edi
je 0x409df0
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x68], 0x1f01ff
mov dword [ebp - 0x64], 2
mov dword [ebp - 0x60], 3
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 2
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0xc0]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x12
push 1
lea eax, [ebp - 0x9c]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov ebx, eax
mov eax, dword [ebp - 0x8c]
mov edi, dword [ebp - 0xc0]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x409cbc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
mov dword [ebp - 0x8c], edi
je 0x409df0
mov ecx, dword [ebp - 0xc0]
mov dword [ebp - 0x48], 0x1f01ff
mov dword [ebp - 0x44], 2
mov dword [ebp - 0x40], 3
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 1
lea eax, [ebp - 0x88]
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0xb0]
push ecx
push 0
push eax
push 3
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
mov ebx, eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xb0]
test eax, eax
mov dword [ebp - 0x28], ecx
je 0x409d31
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
test ebx, ebx
je 0x409d60
test ebx, ebx
jg 0x409dfc
jmp 0x409e05
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x409e05
movzx ebx, bx
or ebx, 0x80070000
jmp 0x40a05a
push 0x14
call fcn.0040c661
add esp, 4
mov ecx, dword [ebp - 0x24]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0xc], 0
mov dword [eax + 8], 0
mov dword [ebp - 0x24], eax
test ecx, ecx
je 0x409daa
push ecx
call fcn.0040c66a
add esp, 4
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x40a0ec
mov dword [ebp - 0x20], eax
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x409df0
push 0
push dword [ebp - 0xb0]
push 1
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x409df0
mov dword [ebp - 0x1c], 0xc
xor ebx, ebx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
test ebx, ebx
jns 0x409e0d
jmp 0x40a05a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x409e05
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0x40a05a
lea ecx, [ebp - 0xb8]
mov edx, esi
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 0
call fcn.0040a1e0
cmp dword [ebp - 0xb8], 0
je 0x409e64
push 0
push dword [ebp - 0x28]
push 0
push 0
push 4
push 1
push dword [ebp - 0xb4]
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
test eax, eax
sete al
xor ebx, ebx
test byte [ebp - 0xc4], al
je 0x409e76
jmp 0x409f11
cmp byte [ebp - 0xc4], 0
mov ebx, 0x8007000e
jne 0x409f11
mov ecx, esi
call fcn.0040a290
lea eax, [ebp - 0x1c]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor ebx, ebx
test eax, eax
jne 0x40a042
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x409f02
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov dl, byte [ebp - 0xc8]
mov ebx, 0x800700b7
sete cl
test al, 0x10
sete al
or al, cl
xor ecx, ecx
or dl, al
test al, al
cmove ebx, ecx
test dl, dl
jne 0x409f11
lea ecx, [ebp - 0xb8]
mov edx, esi
call fcn.0040a1e0
cmp dword [ebp - 0xb8], 0
je 0x40a0fe
push 0
push dword [ebp - 0x28]
push 0
push 0
push 4
push 1
push dword [ebp - 0xb4]
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov ebx, eax
test eax, eax
jle 0x409f11
movzx ebx, bx
or ebx, 0x80070000
cmp dword [ebp + 0xc], 2
jne 0x40a042
mov al, byte [ebp + 8]
test al, al
je 0x40a020
movsd xmm0, qword [0x429424]
movsd xmm1, qword [str.updates]
mov edi, dword [ebp - 0xcc]
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0xb0], 0x30
lea eax, [ebp - 0xac]
mov dword [ebp - 0xc4], esi
movsd qword [ebp - 0xa4], xmm0
movsd qword [ebp - 0xac], xmm1
mov ecx, dword [edi]
mov dword [ebp - 0xc8], ecx
push eax
call fcn.004157a2
add esp, 4
mov esi, eax
lea eax, [ebp - 0xb0]
push eax
call fcn.004157a2
add esp, 4
add esi, dword [ebp - 0xc8]
lea ecx, [ebp - 0xc0]
lea esi, [eax + esi + 2]
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0xac]
push eax
push dword [edi + 4]
push str._s_s_s
push esi
push ecx
call fcn.00409920
add esp, 0x18
test ebx, ebx
mov edi, 0x80004005
mov edx, dword [ebp - 0xcc]
mov ecx, dword [ebp - 0xc4]
lea eax, [ebp - 0xc0]
cmovs edi, ebx
cmp dword [ebp - 0xc0], esi
cmove edx, eax
cmove edi, ebx
lea eax, [ebp - 0x9c]
push eax
call fcn.0040a3b0
add esp, 4
mov esi, eax
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0xbc], 0
test eax, eax
je 0x40a03b
push eax
call fcn.0040c66a
add esp, 4
jmp 0x40a03b
mov edx, dword [ebp - 0xcc]
lea eax, [ebp - 0x9c]
mov ecx, esi
push eax
call fcn.0040a3b0
add esp, 4
mov esi, eax
mov edi, ebx
test edi, edi
cmovs esi, edi
mov ebx, esi
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0xb4], 0
test eax, eax
jne 0x40a0de
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], 0
test eax, eax
jne 0x40a0d3
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], 0
test eax, eax
je 0x40a07d
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x8c]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x40a092
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x90]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x40a0a7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x94]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x40a0bc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040ce4a
mov eax, ebx
add esp, 0xc0
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call fcn.0040c66a
add esp, 4
jmp 0x40a068
push eax
call fcn.0040c66a
add esp, 4
jmp 0x40a05a
mov ebx, 0x8007000e
test ebx, ebx
jns 0x409e0d
jmp 0x40a05a
mov ebx, 0x8007000e
cmp dword [ebp + 0xc], 2
je 0x409f1b
jmp 0x40a042