Function at 0x1004f2f7
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
mov eax, edx
mov dword [ebp - 4], ecx
xor edx, edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], edx
mov dword [ebp - 0x1c], edx
push esi
mov esi, edx
push edi
mov edi, edx
mov dword [ebp - 0xc], edi
test eax, eax
je 0x1004f32b
mov ebx, dword [eax]
jmp 0x1004f32e
or ebx, 0xffffffff
push edx
lea edx, [ebp - 0x1c]
call fcn.10030a2b
mov eax, dword [ebp + 0xc]
test byte [eax + 0x10], 0x10
je 0x1004f3a5
push dword [ebp + 8]
mov dword [ebp - 0x14], 3
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1004f3a5
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1004f3a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1004f378
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x1004f391
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1004f398
movzx esi, si
or esi, 0x80070000
jmp 0x1004f396
mov esi, 0x80004005
test esi, esi
jns 0x1004f3a5
push esi
push 0x63e
jmp 0x1004f460
cmp ebx, 0xffffffff
jne 0x1004f46a
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
xor edx, edx
call fcn.100372e6
mov edi, dword [ebp - 0xc]
mov ebx, eax
test edi, edi
je 0x1004f424
mov edx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 4]
push edi
push ebx
lea edx, [edx + 0x14]
call fcn.1004d006
test eax, eax
je 0x1004f3e6
mov dword [ebp - 0x18], 1
jmp 0x1004f46a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1004f3fa
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x1004f413
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1004f41a
movzx esi, si
or esi, 0x80070000
jmp 0x1004f418
mov esi, 0x80004005
test esi, esi
jns 0x1004f472
push esi
push 0x65c
jmp 0x1004f460
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1004f438
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x1004f451
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1004f458
movzx esi, si
or esi, 0x80070000
jmp 0x1004f456
mov esi, 0x80004005
test esi, esi
jns 0x1004f472
push esi
push 0x666
mov ecx, 0x1000ab80
call fcn.1003a254
test esi, esi
js 0x1004f521
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x10]
and dword [ebp - 0x10], 0
xor edx, edx
push eax
call fcn.10030a2b
test dword [ebp - 0x10], 0x20000
je 0x1004f521
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x14]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_OpenEncryptedFileRawW]
test eax, eax
jne 0x1004f4fe
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x30]
push eax
push ebx
mov dword [ebp - 0x38], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push dword [ebp - 8]
lea eax, [ebp - 0x38]
push eax
push 0x1004f260
call dword [sym.imp.ADVAPI32.dll_WriteEncryptedFileRaw]
test eax, eax
je 0x1004f4f3
jg 0x1004f4d6
mov esi, eax
jmp 0x1004f4df
movzx esi, ax
or esi, 0x80070000
test esi, esi
jns 0x1004f4f3
push esi
push 0x699
mov ecx, 0x1000ab80
call fcn.1003a254
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CloseEncryptedFileRaw]
jmp 0x1004f521
jg 0x1004f504
mov esi, eax
jmp 0x1004f50d
movzx esi, ax
or esi, 0x80070000
test esi, esi
jns 0x1004f521
push esi
push 0x6ae
mov ecx, 0x1000ab80
call fcn.1003a254
cmp ebx, 0xffffffff
je 0x1004f533
cmp dword [ebp - 0x18], 0
je 0x1004f533
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0xc]
test edi, edi
je 0x1004f551
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x1004f5eb
mov edi, dword [ebp - 0x20]
test edi, edi
je 0x1004f5eb
cmp dword [edi], 0xffffffff
je 0x1004f571
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
push 0
and eax, 0x10000
push 0x2200000
neg eax
push 3
sbb eax, eax
push 0
and eax, 0x10c0000
push 7
add eax, 0x120100
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi], eax
cmp eax, 0xffffffff
jne 0x1004f5eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1004f5b9
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x1004f5d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1004f5d9
movzx esi, si
or esi, 0x80070000
jmp 0x1004f5d7
mov esi, 0x80004005
test esi, esi
jns 0x1004f5eb
push esi
push 0x6ef
mov ecx, 0x1000ab80
call fcn.1003a254
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8