Function at 0x4353f9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x1f8
mov eax, 0x44aaae
call fcn.0043bccd
mov esi, edx
mov dword [ebp - 0x18c], esi
mov edi, ecx
mov ebx, dword [ebp + 8]
xor eax, eax
mov byte [edi], al
test esi, esi
jne 0x435450
test ebx, ebx
je 0x435423
mov byte [ebx], al
mov byte [ebp - 0x17d], al
lea ecx, [ebp - 0x17d]
mov dword [ebp - 4], eax
call fcn.0043545c
test al, al
jne 0x457e78
cmp byte [ebp - 0x17d], 0
jne 0x435454
call fcn.0043bc1f
ret 4
mov byte [esi], al
jmp 0x43541d
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_RevertToSelf]
jmp 0x435448
call dword [sym.imp.ext_ms_win_edputil_policy_l1_1_0.dll_EdpGetIsManaged]
test eax, eax
setne al
mov byte [edi], al
test esi, esi
jne 0x457e91
test ebx, ebx
je 0x43543f
push ecx
push 0x20019
push 0x407210
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x17c]
call fcn.00431e7e
lea ecx, [ebp - 0xb4]
call fcn.004253b2
mov eax, ecx
mov byte [ebp - 4], 3
push eax
push 0x407504
lea ecx, [ebp - 0x17c]
call fcn.00424cf0
test eax, eax
jne 0x457eee
mov ecx, dword [ebp + 4]
mov edx, 0xb0
push 0x8000ffff
push 0x40ffb8
call fcn.004649e6
jmp 0x45806b
lea ecx, [ebp - 0xb4]
call fcn.0046f1b7
mov eax, dword [ebp - 0xb4]
push 0xffffffffffffffff
push dword [ebp - 0xa8]
mov esi, dword [eax + 0x10]
mov ecx, esi
push 0x40fff8
call dword [0x4a3670]
lea ecx, [ebp - 0xb4]
call esi
test ebx, ebx
je 0x45800c
push 0x68
xor esi, esi
lea eax, [ebp - 0x200]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x204], 0x6c
xor eax, eax
lea edi, [ebp - 0xd8]
push 9
pop ecx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xd8]
push eax
push esi
push dword [ebp - 0xb0]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesExW]
test eax, eax
je 0x457f82
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x200], eax
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x1fc], eax
lea ecx, [ebp - 0x184]
mov dword [ebp - 0x184], esi
call fcn.004736e7
test eax, eax
js 0x45800c
lea eax, [ebp - 0x188]
mov dword [ebp - 0x188], esi
mov esi, dword [ebp - 0x184]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push 0
push 2
call dword [sym.imp.FeClient.dll_EdpQueryCredServiceInfo]
test eax, eax
jns 0x457fdb
mov ecx, dword [ebp + 4]
mov edx, 0xcc
push eax
push 0x40ffb8
call fcn.0045e47c
mov esi, dword [ebp - 0x184]
jmp 0x457ffc
mov eax, dword [ebp - 0x188]
cmp dword [eax + 0x10], 0
jne 0x457ff1
cmp dword [eax + 0xc], 0
jne 0x457ff1
xor cl, cl
jmp 0x457ff3
mov cl, 1
push eax
mov byte [ebx], cl
call dword [sym.imp.FeClient.dll_EdpFree]
push esi
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0x18c]
test esi, esi
je 0x45806b
push dword [ebp - 0xb0]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45806b
test al, 0x10
je 0x45806b
lea eax, [ebp - 0x190]
push eax
push dword [ebp - 0xb0]
call dword [sym.imp.efswrt.dll_EnterpriseDataGetStatus]
test eax, eax
jns 0x458057
mov ecx, dword [ebp + 4]
mov edx, 0xe3
push eax
push 0x40ffb8
call fcn.0045e47c
jmp 0x45806b
cmp dword [ebp - 0x190], 3
sete al
mov byte [esi], al
jmp 0x45806b
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xb4], 0x401028
test eax, eax
je 0x458091
lea ecx, [ebp - 0xa4]
cmp eax, ecx
je 0x458091
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
lea ecx, [ebp - 0x17c]
mov dword [ebp - 0xb4], 0x401558
call fcn.0042535f
jmp 0x43543f