Function at 0x443cd3
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
mov eax, edx
mov dword [ebp - 4], ecx
xor edx, edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], edx
mov dword [ebp - 0x1c], edx
push esi
mov esi, edx
push edi
mov edi, edx
mov dword [ebp - 0xc], edi
test eax, eax
je 0x443d07
mov ebx, dword [eax]
jmp 0x443d0a
or ebx, 0xffffffff
push edx
lea edx, [ebp - 0x1c]
call fcn.0042fd2c
mov eax, dword [ebp + 0xc]
test byte [eax + 0x10], 0x10
je 0x443d74
push dword [ebp + 8]
mov dword [ebp - 0x14], 3
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x443d74
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x443d74
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00411710
test eax, eax
jns 0x443d60
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00411710
mov esi, eax
jmp 0x443d65
mov esi, 0x80004005
test esi, esi
jns 0x443d74
push esi
push 0x682
jmp 0x443e12
cmp ebx, 0xffffffff
jne 0x443e1c
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
xor edx, edx
call fcn.004369e5
mov edi, dword [ebp - 0xc]
mov ebx, eax
test edi, edi
je 0x443de3
mov edx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 4]
push edi
push ebx
lea edx, [edx + 0x14]
call fcn.004405e6
test eax, eax
je 0x443db2
mov dword [ebp - 0x18], 1
jmp 0x443e1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00411710
test eax, eax
jns 0x443dd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00411710
mov esi, eax
jmp 0x443dd7
mov esi, 0x80004005
test esi, esi
jns 0x443e24
push esi
push 0x6a0
jmp 0x443e12
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00411710
test eax, eax
jns 0x443e03
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00411710
mov esi, eax
jmp 0x443e08
mov esi, 0x80004005
test esi, esi
jns 0x443e24
push esi
push 0x6aa
mov ecx, 0x408cb0
call fcn.0043f87d
test esi, esi
js 0x443ec6
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x10]
and dword [ebp - 0x10], 0
xor edx, edx
push eax
call fcn.0042fd2c
test dword [ebp - 0x10], 0x20000
je 0x443ec6
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x14]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_OpenEncryptedFileRawW]
test eax, eax
jne 0x443eaa
push 6
pop ecx
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x38], ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push dword [ebp - 8]
lea eax, [ebp - 0x38]
push eax
push 0x443c40
call dword [sym.imp.ADVAPI32.dll_WriteEncryptedFileRaw]
test eax, eax
je 0x443e9f
push eax
call fcn.00411710
mov esi, eax
test esi, esi
jns 0x443e9f
push esi
push 0x6dd
mov ecx, 0x408cb0
call fcn.0043f87d
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CloseEncryptedFileRaw]
jmp 0x443ec6
push eax
call fcn.00411710
mov esi, eax
test esi, esi
jns 0x443ec6
push esi
push 0x6f2
mov ecx, 0x408cb0
call fcn.0043f87d
cmp ebx, 0xffffffff
je 0x443ed8
cmp dword [ebp - 0x18], 0
je 0x443ed8
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0xc]
test edi, edi
je 0x443ef6
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x443f7f
mov edi, dword [ebp - 0x20]
test edi, edi
je 0x443f7f
cmp dword [edi], 0xffffffff
je 0x443f12
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
push 0
and eax, 0x10000
push 0x2200000
neg eax
push 3
sbb eax, eax
push 0
and eax, 0x10c0000
push 7
add eax, 0x120100
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi], eax
cmp eax, 0xffffffff
jne 0x443f7f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00411710
test eax, eax
jns 0x443f66
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00411710
mov esi, eax
jmp 0x443f6b
mov esi, 0x80004005
test esi, esi
jns 0x443f7f
push esi
push 0x733
mov ecx, 0x408cb0
call fcn.0043f87d
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8