Function at 0x43d500
Capabilities:
Create directory
Set file attributes
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4e7f2c
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x53fa2c]
xor eax, esp
mov dword [esp + 0x420], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53fa2c]
xor eax, esp
push eax
lea eax, [esp + 0x438]
mov dword fs:[0], eax
cmp byte [0x103a972], 0
je 0x43d551
cmp byte [0x53ed79], 0
jne 0x43d9e6
push 0x1ff
lea eax, [esp + 0x239]
push 0
push eax
mov byte [esp + 0x240], 0
call sub.MSVCR90.dll_memset
push 0x1ff
lea ecx, [esp + 0x45]
push 0
push ecx
mov byte [esp + 0x4c], 0
call sub.MSVCR90.dll_memset
mov esi, dword [sym.imp.MSVCR90.dll_sprintf]
push 0x10da2e0
lea edx, [esp + 0x250]
push str._sLog
push edx
call esi
add esp, 0x24
cmp byte [0x103a972], 0
je 0x43d5c4
mov ax, word [0x508c24]
mov cl, byte [0x508c26]
mov word [esp + 0x234], ax
mov byte [esp + 0x236], cl
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.MSVCR90.dll__time64]
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.MSVCR90.dll__localtime64]
mov ebp, eax
mov eax, dword [esp + 0x450]
add esp, 8
cmp eax, 1
jne 0x43d60e
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
inc ecx
push ecx
add edx, 0x76c
push edx
lea eax, [esp + 0x3c]
push str.TCLOG_DEBUG__04d__02d.tcbak
push eax
call esi
add esp, 0x10
jmp 0x43d792
cmp eax, 2
jne 0x43d63f
mov ecx, dword [str.TC_BK.tcbak]
mov edx, dword [0x508bf8]
mov eax, dword [0x508bfc]
mov dword [esp + 0x34], ecx
mov cl, byte [0x508c00]
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], eax
mov byte [esp + 0x40], cl
jmp 0x43d792
cmp eax, 4
jne 0x43d670
mov edx, dword [str.TC_BK.tcbak]
mov eax, dword [0x508bf8]
mov ecx, dword [0x508bfc]
mov dword [esp + 0x34], edx
mov dl, byte [0x508c00]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
mov byte [esp + 0x40], dl
jmp 0x43d792
cmp eax, 0x10
jne 0x43d6ac
mov eax, dword [str.TC_BK.tcBkDel]
mov ecx, dword [0x508be8]
mov edx, dword [0x508bec]
mov dword [esp + 0x34], eax
mov ax, word [0x508bf0]
mov dword [esp + 0x38], ecx
mov cl, byte [0x508bf2]
mov dword [esp + 0x3c], edx
mov word [esp + 0x40], ax
mov byte [esp + 0x42], cl
jmp 0x43d792
cmp eax, 0x20
jne 0x43d6e3
lea edx, [esp + 0x18]
push edx
call fcn.00410ab0
lea ecx, [esp + 0x18]
call fcn.00409320
push eax
lea ecx, [esp + 0x1c]
call fcn.004092f0
push eax
lea eax, [esp + 0x3c]
push str.TC_LOG_AUDIT__04d__02d.Txt
push eax
call esi
add esp, 0x10
jmp 0x43d792
lea ecx, [esp + 0x24]
push ecx
call fcn.00410ab0
lea ecx, [esp + 0x24]
call fcn.00409320
push eax
lea ecx, [esp + 0x28]
call fcn.004092f0
push eax
lea edx, [esp + 0x3c]
push 0x508bb0
push edx
call esi
add esp, 0x10
push str._tmp
push 0x10da2e0
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x43d792
push 0x508b98
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x440], 0
push eax
lea eax, [esp + 0x24]
push str.c:Program_Files_
push eax
call fcn.00410070
mov byte [esp + 0x44c], 1
mov ecx, dword [eax]
push ecx
lea edx, [esp + 0x244]
push str._sLog
push edx
call esi
add esp, 0x18
mov byte [esp + 0x440], 0
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov dword [esp + 0x440], 0xffffffff
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ebx, dword [sym.imp.MSVCR90.dll__access]
lea eax, [esp + 0x234]
push 0
push eax
call ebx
add esp, 8
test eax, eax
je 0x43d7bb
push 0
lea ecx, [esp + 0x238]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [esp + 0x34]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43d7c1
lea edi, [esp + 0x234]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x43d7d2
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [esp + 0x234]
and ecx, 3
push 0
push edx
rep movsb byte es:[edi], byte [esi]
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
test eax, eax
jne 0x43d81b
lea eax, [esp + 0x234]
push 0x504ff8
push eax
call dword [sym.imp.MSVCR90.dll_fopen]
add esp, 8
mov edi, eax
jmp 0x43d854
lea ecx, [esp + 0x234]
push 0x504ff4
push ecx
call dword [sym.imp.MSVCR90.dll_fopen]
add esp, 8
cmp byte [0x103a972], 0
mov edi, eax
je 0x43d854
push 1
call ebx
push 2
lea edx, [esp + 0x238]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 1
call ebx
test edi, edi
je 0x43d9e6
mov ecx, dword [esp + 0x44c]
lea eax, [esp + 0x450]
push eax
push ecx
call dword [sym.imp.MSVCR90.dll__vscprintf]
inc eax
push eax
call sub.mfc90.dll_Ordinal_265
mov esi, eax
mov eax, dword [esp + 0x458]
lea edx, [esp + 0x45c]
push edx
push eax
push esi
call dword [sym.imp.MSVCR90.dll_vsprintf]
add esp, 0x18
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov dword [esp + 0x440], 2
mov eax, dword [esp + 0x448]
cmp eax, 2
jne 0x43d92f
test byte [0x1043104], 8
je 0x43d919
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push esi
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x444], 3
lea ecx, [esp + 0x1c]
push ecx
mov byte [esp + 0x448], 2
call fcn.0048ecd0
mov byte [esp + 0x448], 4
mov edx, dword [eax]
push edx
lea eax, [esp + 0x20]
push str._s_r_n
push eax
call dword [sym.imp.mfc90.dll_Ordinal_2539]
add esp, 0x14
mov byte [esp + 0x440], 2
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
jmp 0x43d98e
push esi
lea ecx, [esp + 0x18]
push str._s_r_n
push ecx
call dword [sym.imp.mfc90.dll_Ordinal_2539]
add esp, 0xc
jmp 0x43d98e
push esi
cmp eax, 0x11
jne 0x43d94a
lea edx, [esp + 0x18]
push str._s_r_n
push edx
call dword [sym.imp.mfc90.dll_Ordinal_2539]
add esp, 0xc
jmp 0x43d98e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp]
mov edx, dword [ebp + 4]
lea eax, [eax + eax*4]
add eax, eax
push eax
mov eax, dword [ebp + 8]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0x14]
push ecx
inc edx
push edx
add eax, 0x76c
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea ecx, [esp + 0x38]
push str._08x__04d__02d__02d__02d:_02d:_02d__I_d__s_r_n
push ecx
call dword [sym.imp.mfc90.dll_Ordinal_2539]
add esp, 0x2c
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 0xc]
push edi
push 1
push ecx
push eax
call dword [sym.imp.MSVCR90.dll_fwrite]
push esi
call sub.mfc90.dll_Ordinal_266
push edi
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 0x18
cmp byte [0x103a972], 0
je 0x43d9d1
push 1
call ebx
push 2
lea edx, [esp + 0x238]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 1
call ebx
mov dword [esp + 0x440], 0xffffffff
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x438]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.004e0148
add esp, 0x430
ret