Function at 0x10caf6b
Capabilities:
Check if file exists
Create directory
Get file attributes
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
mov ebx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x34]
xor ecx, ecx
cmp word [eax + 0x8c], cx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
je 0x10cb0aa
cmp word [0x10f75f0], cx
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, 0x104
jne 0x10cafc1
push esi
push 0x10f75f0
push 0x1013a90
call edi
push esi
push 0x10f77f8
push 0x1013a54
call edi
cmp word [0x10f7e10], 0
jne 0x10cafd8
push esi
push 0x10f7e10
push 0x1013a08
call edi
cmp word [0x10f7c08], 0
jne 0x10caffc
push esi
push 0x10f7c08
push 0x1013988
call edi
push esi
push 0x10f7a00
push 0x1013a08
call edi
mov eax, dword [ebx + 0x7c]
mov esi, dword [sym.imp.msvcrt.dll__wcsicmp]
push 0x10f7c0e
push dword [eax + 0x18]
call esi
test eax, eax
pop ecx
pop ecx
je 0x10cb028
mov eax, dword [ebx + 0x7c]
push 0x10f7e16
push dword [eax + 0x18]
call esi
test eax, eax
pop ecx
pop ecx
jne 0x10cb034
mov eax, dword [ebp - 0xc]
mov word [eax + 0x90], 1
cmp word [0x10f8018], 0
jne 0x10cb04f
push 0x104
push 0x10f8018
push 0x10138f8
call edi
mov eax, dword [ebx + 0x7c]
push 0x10f801e
push dword [eax + 0x18]
call esi
test eax, eax
pop ecx
pop ecx
jne 0x10cb06e
mov eax, dword [ebp - 0xc]
mov word [eax + 0x92], 1
cmp word [0x10f8220], 0
jne 0x10cb089
push 0x104
push 0x10f8220
push 0x1013890
call edi
mov eax, dword [ebx + 0x7c]
push 0x10f8226
push dword [eax + 0x18]
call esi
test eax, eax
pop ecx
pop ecx
jne 0x10cb0b0
mov eax, dword [ebp - 0xc]
mov word [eax + 0x94], 1
jmp 0x10cb0b0
mov esi, dword [sym.imp.msvcrt.dll__wcsicmp]
xor eax, eax
lea edi, [ebp - 0x34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ebp - 0x2c], 0
push 0
lea eax, [ebp - 0x30]
push eax
push 1
push 0x1013828
mov dword [ebp - 0x34], 0xc
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
mov eax, dword [eax + 0x5c]
push 0x1011168
push dword [eax + 0x14]
call dword [sym.imp.msvcrt.dll_wcscmp]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x7c]
mov eax, dword [eax + 0x18]
push 0x10f75f6
push eax
mov dword [ebp - 4], eax
call esi
add esp, 0x10
test eax, eax
jne 0x10cb116
mov dword [ebp - 4], 0x10f77fc
jmp 0x10cb13d
push 0x10f7e16
push dword [ebp - 4]
call esi
test eax, eax
pop ecx
pop ecx
je 0x10cb136
push 0x10f7c0e
push dword [ebp - 4]
call esi
test eax, eax
pop ecx
pop ecx
jne 0x10cb13d
mov dword [ebp - 4], 0x10f7a04
push 0x10125f2
push dword [ebp - 4]
call esi
test eax, eax
pop ecx
pop ecx
jne 0x10cb16b
mov esi, 0x10125f0
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push esi
push edi
call fcn.010ace89
jmp 0x10cb486
mov eax, dword [ebp - 4]
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
push eax
mov dword [ebp - 0x1c], eax
call esi
test eax, eax
pop ecx
je 0x10cb3de
mov edi, dword [ebp + 8]
xor eax, eax
push eax
push eax
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 4]
push edi
call fcn.010bab05
test ax, ax
jne 0x10cb412
mov ax, word [ebx + 0x84]
test al, 0x11
jne 0x10cb1ca
test al, 2
je 0x10cb1ca
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 0x9c]
shr eax, 0x16
and eax, 1
push eax
push 1
push 0
push edi
call fcn.010ab410
push dword [ebp - 4]
call esi
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0x7c]
push dword [eax + 0x18]
call esi
push dword [ebp - 4]
mov dword [ebp - 0x10], eax
call esi
and dword [ebp - 0x20], 0
mov edi, eax
mov eax, dword [ebp - 0x10]
add esp, 0xc
push 0
sub edi, eax
lea eax, [ebp - 0x24]
push eax
push 1
push 0x1013758
mov dword [ebp - 0x28], 0xc
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
push dword [ebp - 4]
call esi
mov edx, dword [ebp - 4]
pop ecx
lea ecx, [edx + eax*2]
mov al, byte [ebx + 0x2a]
cmp al, 2
je 0x10cb22b
cmp al, 3
jbe 0x10cb225
cmp al, 7
jbe 0x10cb22b
and dword [ebp - 0x10], 0
jmp 0x10cb231
lea eax, [ebp - 0x28]
mov dword [ebp - 0x10], eax
movsx edi, di
shl edi, 1
lea eax, [edi + edx]
cmp ecx, eax
jbe 0x10cb2af
push dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10cb2af
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov cl, byte [ebx + 0x2a]
cmp cl, 2
je 0x10cb269
cmp cl, 3
jbe 0x10cb263
cmp cl, 7
jbe 0x10cb269
and dword [ebp - 0x10], 0
jmp 0x10cb26f
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x10], ecx
cmp eax, 0xb7
je 0x10cb2af
cmp word [ebp - 0x14], 0
jne 0x10cb290
cmp eax, 5
jne 0x10cb290
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10cb2af
push 0x5c
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_wcsrchr]
test eax, eax
pop ecx
pop ecx
je 0x10cb2dd
and word [eax], 0
mov edx, dword [ebp - 4]
lea ecx, [edi + edx]
cmp eax, ecx
ja 0x10cb23d
push dword [ebp - 4]
call esi
cmp ax, word [ebp - 0x18]
pop ecx
jae 0x10cb31d
push dword [ebp - 4]
call esi
pop ecx
mov ecx, dword [ebp - 4]
mov word [ecx + eax*2], 0x5c
mov al, byte [ebx + 0x2a]
cmp al, 2
je 0x10cb2e9
cmp al, 3
jbe 0x10cb2d9
cmp al, 7
jbe 0x10cb2e9
xor edi, edi
jmp 0x10cb2ec
mov dword [ebp - 8], 0xfffffe05
jmp 0x10cb3de
lea edi, [ebp - 0x28]
push dword [ebp - 4]
call esi
pop ecx
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10cb316
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10cb316
push eax
call fcn.010ac058
mov dword [ebp - 8], eax
cmp word [ebp - 8], 0
je 0x10cb2af
cmp word [ebp - 8], 0
jne 0x10cb3de
push 4
push 0x1003824
push dword [ebp + 8]
call fcn.010ace89
test ax, ax
mov dword [ebp - 8], eax
jne 0x10cb39c
mov eax, dword [ebx + 0x7c]
mov edi, dword [eax + 0x18]
push 0x10f75f6
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x10cb35e
mov edi, 0x10f77fe
jmp 0x10cb387
push 0x10f7e16
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x10cb382
push 0x10f7c0e
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x10cb387
mov edi, 0x10f7a06
push edi
call esi
pop ecx
lea eax, [eax + eax + 2]
push eax
push edi
push dword [ebp + 8]
call fcn.010acf31
mov dword [ebp - 8], eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, 0x4000
test ecx, eax
je 0x10cb3b7
mov eax, dword [ebp - 0xc]
mov word [eax + 0x30], 1
test dword [ebx + 0x40], ecx
je 0x10cb3cd
test byte [ebx + 0x16], 2
jne 0x10cb3de
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_EncryptFileW]
jmp 0x10cb3de
test byte [ebx + 0x16], 2
jne 0x10cb3de
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_DecryptFileW]
push dword [ebp + 8]
call fcn.010ba429
xor edi, edi
cmp word [ebp - 8], di
je 0x10cb483
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
push 1
mov ebx, eax
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp - 0x1c]
push dword [ebp + 8]
call fcn.010bab05
test ax, ax
je 0x10cb418
or ax, 0xffff
jmp 0x10cb486
mov esi, dword [sym.imp.msvcrt.dll_wcsncmp]
push 8
push 0x1012740
push dword [ebp - 4]
call esi
add esp, 0xc
test eax, eax
jne 0x10cb440
add dword [ebp - 4], 0xc
mov eax, dword [ebp - 4]
mov dword [eax], 0x5c005c
jmp 0x10cb457
push 4
push 0x1005efc
push dword [ebp - 4]
call esi
add esp, 0xc
test eax, eax
jne 0x10cb457
add dword [ebp - 4], 8
push dword [ebp - 4]
push 0x232f
push ebx
push edi
push dword [ebp + 8]
call fcn.0108dc85
push dword [ebp + 8]
call fcn.010ba429
xor eax, eax
cmp word [ebp - 8], 0xfe30
sete al
add eax, 0xfffffe3f
jmp 0x10cb486
xor ax, ax
pop edi
pop esi
pop ebx
leave
ret 4