Function at 0x403510
Capabilities:
Check if file exists
Create directory
Create process on windows
Get common file path
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x148
mov eax, dword [0x431040]
xor eax, esp
mov dword [esp + 0x144], eax
push esi
push edi
push 9
xorps xmm0, xmm0
mov dword [esp + 0xd4], 0
push str.SIDF.json
lea ecx, [esp + 0xc8]
movaps xmmword [esp + 0xc8], xmm0
mov dword [esp + 0xdc], 0
call fcn.00406410
lea ecx, [esp + 0xc0]
call fcn.00403210
mov ecx, dword [esp + 0xd4]
cmp ecx, 0xf
jbe 0x4035a8
mov edx, dword [esp + 0xc0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40359e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40402d
push ecx
push edx
call fcn.0040a0b9
add esp, 8
push 0x208
call fcn.00410afa
mov esi, eax
add esp, 4
mov dword [esp + 0x34], esi
test esi, esi
je 0x4035db
push esi
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x403600
push esi
call fcn.004105b1
add esp, 4
push 0
call fcn.004105b1
add esp, 4
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.00409c25
mov esp, ebp
pop ebp
ret 0x10
push str.Direct
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call edi
mov esi, eax
push 0
lea ecx, [esi - 1]
push ecx
lea ecx, [esp + 0xe8]
call fcn.00404440
cmp dword [esp + 0xf4], 0xf
lea ecx, [esp + 0xe0]
push 0
cmova ecx, dword [esp + 0xe4]
push 0
push esi
mov esi, dword [esp + 0x40]
push ecx
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call edi
lea ecx, [esp + 0xf8]
call fcn.004021c0
mov eax, dword [esp + 0x108]
test eax, eax
je 0x403f93
cmp eax, 0xc
jb 0x403f93
mov dword [esp + 0x20], 0
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
mov dword [esp + 0x24], 0
cmp eax, 0x14
jb 0x404032
add eax, 0xffffffec
mov ecx, 0xc
cmp eax, ecx
cmovb ecx, eax
cmp dword [esp + 0x10c], 0xf
lea eax, [esp + 0xf8]
cmova eax, dword [esp + 0xf8]
push ecx
add eax, 0x14
lea ecx, [esp + 0x14]
push eax
call fcn.00406410
mov edx, dword [esp + 0x24]
mov eax, edx
mov ecx, dword [esp + 0x20]
sub eax, ecx
cmp eax, 4
jb 0x403714
lea eax, [ecx + 4]
cmp edx, 0xf
mov dword [esp + 0x20], eax
lea eax, [esp + 0x10]
cmova eax, dword [esp + 0x10]
mov dword [eax + ecx], 0x70697a2e
mov byte [eax + ecx + 4], 0
lea eax, [esp + 0x10]
jmp 0x40372f
push 4
push str..zip
mov byte [esp + 0x10], 0
lea ecx, [esp + 0x18]
push dword [esp + 0x10]
push 4
call fcn.00406a70
movups xmm0, xmmword [eax]
movups xmmword [esp + 0xc0], xmm0
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [esp + 0x24]
movq qword [esp + 0xd0], xmm0
cmp ecx, 0xf
jbe 0x40378f
mov edx, dword [esp + 0x10]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403785
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404037
push ecx
push edx
call fcn.0040a0b9
add esp, 8
mov ecx, 8
mov dword [esp + 0x20], 0
cmp dword [esp + 0x108], ecx
lea eax, [esp + 0xf8]
xorps xmm0, xmm0
mov dword [esp + 0x24], 0
cmovb ecx, dword [esp + 0x108]
cmp dword [esp + 0x10c], 0xf
push ecx
cmova eax, dword [esp + 0xfc]
lea ecx, [esp + 0x14]
push eax
movaps xmmword [esp + 0x18], xmm0
call fcn.00406410
mov edx, dword [esp + 0x24]
mov eax, edx
mov ecx, dword [esp + 0x20]
sub eax, ecx
cmp eax, 4
jb 0x403813
lea eax, [ecx + 4]
cmp edx, 0xf
mov dword [esp + 0x20], eax
lea eax, [esp + 0x10]
cmova eax, dword [esp + 0x10]
mov dword [eax + ecx], 0x6578652e
mov byte [eax + ecx + 4], 0
lea eax, [esp + 0x10]
jmp 0x40382e
push 4
push str..exe
mov byte [esp + 0x10], 0
lea ecx, [esp + 0x18]
push dword [esp + 0x10]
push 4
call fcn.00406a70
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x110], xmm0
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [esp + 0x24]
movq qword [esp + 0x120], xmm0
cmp ecx, 0xf
jbe 0x40388e
mov edx, dword [esp + 0x10]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403884
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40403c
push ecx
push edx
call fcn.0040a0b9
add esp, 8
push ecx
lea edx, [esp + 0xe4]
lea ecx, [esp + 0x14]
call fcn.00405e10
mov ecx, dword [esp + 0xd4]
lea edx, [esp + 0xc4]
mov edi, eax
add esp, 4
cmp dword [esp + 0xd4], 0xf
cmova edx, dword [esp + 0xc0]
mov eax, dword [edi + 0x14]
mov esi, dword [edi + 0x10]
sub eax, esi
cmp ecx, eax
ja 0x4038f8
cmp dword [edi + 0x14], 0xf
lea eax, [esi + ecx]
mov dword [edi + 0x10], eax
mov eax, edi
jbe 0x4038de
mov eax, dword [edi]
push ecx
add esi, eax
push edx
push esi
call fcn.0040b2f0
mov eax, dword [esp + 0xdc]
add esp, 0xc
mov byte [esi + eax], 0
jmp 0x40390d
push ecx
push edx
mov byte [esp + 0x10], 0
push dword [esp + 0x10]
push ecx
mov ecx, edi
call fcn.00406a70
mov edi, eax
mov dword [esp + 0x90], 0
xorps xmm0, xmm0
movaps xmmword [esp + 0x80], xmm0
mov dword [esp + 0x94], 0
movups xmm0, xmmword [edi]
movups xmmword [esp + 0x80], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [esp + 0x90], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov ecx, dword [esp + 0x24]
cmp ecx, 0xf
jbe 0x40398e
mov edx, dword [esp + 0x10]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403984
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404041
push ecx
push edx
call fcn.0040a0b9
add esp, 8
lea eax, [esp + 0xe0]
push eax
lea ecx, [esp + 0x138]
call fcn.00404540
push ecx
lea edx, [esp + 0xe4]
lea ecx, [esp + 0x14]
call fcn.00405e10
mov ecx, dword [esp + 0x124]
lea edx, [esp + 0x114]
mov edi, eax
add esp, 4
cmp dword [esp + 0x124], 0xf
cmova edx, dword [esp + 0x110]
mov eax, dword [edi + 0x14]
mov esi, dword [edi + 0x10]
sub eax, esi
cmp ecx, eax
ja 0x403a0c
cmp dword [edi + 0x14], 0xf
lea eax, [esi + ecx]
mov dword [edi + 0x10], eax
mov eax, edi
jbe 0x4039f2
mov eax, dword [edi]
push ecx
add esi, eax
push edx
push esi
call fcn.0040b2f0
mov eax, dword [esp + 0x12c]
add esp, 0xc
mov byte [esi + eax], 0
jmp 0x403a21
push ecx
push edx
mov byte [esp + 0x10], 0
push dword [esp + 0x10]
push ecx
mov ecx, edi
call fcn.00406a70
mov edi, eax
mov dword [esp + 0xb0], 0
xorps xmm0, xmm0
movaps xmmword [esp + 0xa0], xmm0
mov dword [esp + 0xb4], 0
movups xmm0, xmmword [edi]
movups xmmword [esp + 0xa0], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [esp + 0xb0], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov ecx, dword [esp + 0x24]
cmp ecx, 0xf
jbe 0x403aa2
mov edx, dword [esp + 0x10]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403a98
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404046
push ecx
push edx
call fcn.0040a0b9
add esp, 8
cmp dword [esp + 0xf4], 0xf
lea eax, [esp + 0xe0]
cmova eax, dword [esp + 0xe0]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x403ac9
test al, 0x10
jne 0x403af5
cmp dword [esp + 0xf4], 0xf
lea eax, [esp + 0xe0]
push 0
cmova eax, dword [esp + 0xe4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x403af5
lea esi, [eax + 1]
jmp 0x403dfb
mov eax, dword [esp + 0x34]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esp + 8], 0
mov dword [esp + 0x34], eax
lea edx, [esp + 0x80]
mov ecx, 0x432e54
call fcn.00402780
mov dword [esp + 0xc], eax
test eax, eax
js 0x403bdc
cmp dword [esp + 0x94], 0xf
lea ecx, [esp + 0x80]
push 0
cmova ecx, dword [esp + 0x84]
push 0x80
push 3
push 0
push 1
push SysReAllocString
push ecx
call esi
mov edi, eax
cmp edi, 0xffffffff
je 0x403d77
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
call edi
test esi, esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
je 0x403bdc
cmp dword [esp + 0x94], 0xf
lea eax, [esp + 0x80]
push 0
cmova eax, dword [esp + 0x84]
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
call esi
mov edi, eax
cmp edi, 0xffffffff
je 0x403d77
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
call edi
cmp esi, 0x99
ja 0x403c12
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [esp + 0x38]
mov dword [esp + 0x38], 0xa
mov dword [esp + 0x3c], 0
call fcn.00406300
mov eax, dword [esp + 8]
inc eax
mov dword [esp + 8], eax
cmp eax, 3
jl 0x403b11
cmp dword [esp + 0xc], 0
jl 0x403df9
cmp dword [esp + 0x94], 0xf
lea eax, [esp + 0x80]
push 0
cmova eax, dword [esp + 0x84]
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
je 0x403df9
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push dword [esp + 0xc]
mov esi, eax
call edi
test esi, esi
je 0x403df9
cmp dword [esp + 0x94], 0xf
lea eax, [esp + 0x80]
push 0
cmova eax, dword [esp + 0x84]
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
je 0x403df9
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push dword [esp + 0xc]
mov esi, eax
call edi
cmp esi, 0x99
jbe 0x403df9
lea edx, [esp + 0x134]
lea ecx, [esp + 0x80]
call fcn.00402c40
test al, al
je 0x403df9
xor esi, esi
mov dword [esp + 8], esi
lea edx, [esp + 0xa0]
mov ecx, 0x432e3c
call fcn.00402780
test eax, eax
js 0x403d4b
cmp dword [esp + 0xb4], 0xf
lea eax, [esp + 0xa0]
push 0
cmova eax, dword [esp + 0xa4]
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x403d4b
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
call edi
test esi, esi
jne 0x403d82
mov esi, dword [esp + 8]
lea ecx, [esp + 0x38]
mov dword [esp + 0x38], 0xa
mov dword [esp + 0x3c], 0
call fcn.00406300
inc esi
mov dword [esp + 8], esi
cmp esi, 3
jl 0x403ce3
jmp 0x403df9
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403bdc
call fcn.00402e60
push 0x38
lea eax, [esp + 0x4c]
mov dword [esp + 0x48], 0x3c
push 0
push eax
call fcn.0040b890
add esp, 0xc
mov dword [esp + 0x48], 0x40
cmp dword [esp + 0xb4], 0xf
lea eax, [esp + 0xa0]
mov dword [esp + 0x60], 0
cmova eax, dword [esp + 0xa0]
mov dword [esp + 0x54], eax
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x403df3
mov eax, dword [esp + 0x7c]
test eax, eax
je 0x403df9
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x7c]
call edi
jmp 0x403df9
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
push dword [esp + 0x34]
call fcn.004105b1
mov ecx, dword [esp + 0xb8]
add esp, 4
cmp ecx, 0xf
jbe 0x403e43
mov edx, dword [esp + 0xa0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403e39
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40404b
push ecx
push edx
call fcn.0040a0b9
add esp, 8
mov ecx, dword [esp + 0x148]
mov dword [esp + 0xb0], 0
mov dword [esp + 0xb4], 0xf
mov byte [esp + 0xa0], 0
cmp ecx, 0xf
jbe 0x403e9d
mov edx, dword [esp + 0x134]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403e93
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40404b
push ecx
push edx
call fcn.0040a0b9
add esp, 8
mov ecx, dword [esp + 0x94]
mov dword [esp + 0x144], 0
mov dword [esp + 0x148], 0xf
mov byte [esp + 0x134], 0
cmp ecx, 0xf
jbe 0x403ef7
mov edx, dword [esp + 0x80]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403eed
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40404b
push ecx
push edx
call fcn.0040a0b9
add esp, 8
mov eax, dword [esp + 0x124]
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0xf
mov byte [esp + 0x80], 0
cmp eax, 0xf
jbe 0x403f53
mov edx, dword [esp + 0x110]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x403f49
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40404b
push ecx
push edx
call fcn.0040a0b9
add esp, 8
mov eax, dword [esp + 0xd4]
cmp eax, 0xf
jbe 0x403fa1
mov edx, dword [esp + 0xc0]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x403f87
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40404b
push ecx
push edx
call fcn.0040a0b9
add esp, 8
jmp 0x403fa1
push esi
call fcn.004105b1
add esp, 4
mov esi, 1
mov ecx, dword [esp + 0x10c]
cmp ecx, 0xf
jbe 0x403fdd
mov edx, dword [esp + 0xf8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403fd3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40404b
push ecx
push edx
call fcn.0040a0b9
add esp, 8
mov ecx, dword [esp + 0xf4]
cmp ecx, 0xf
jbe 0x404015
mov edx, dword [esp + 0xe0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40400b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40404b
push ecx
push edx
call fcn.0040a0b9
add esp, 8
mov ecx, dword [esp + 0x14c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.00409c25
mov esp, ebp
pop ebp
ret 0x10
call fcn.00410aa9
call fcn.00405b40
call fcn.00410aa9
call fcn.00410aa9
call fcn.00410aa9
call fcn.00410aa9
call fcn.00410aa9
int3