Function at 0x40fed6
Capabilities:
Check if file exists
Clear file content
Delete file
Get file attributes
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x46c
mov eax, dword [0x424210]
xor eax, esp
mov dword [esp + 0x468], eax
mov eax, dword [0x425e0c]
and dword [esp + 0x18], 0
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x20], eax
xor ebx, ebx
call fcn.0041e7b6
xor esi, esi
inc esi
cmp byte [ebp + 8], bl
je 0x40ff45
push 3
pop esi
push dword [0x425970]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40ff45
test eax, 0x4000
je 0x40ff45
push ebx
push 0x80
push 2
push dword [edi]
push dword [0x425970]
call dword [sym.imp.ADVAPI32.dll_DuplicateEncryptionInfoFile]
push dword [edi]
call dword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathFileExistsW]
push 0
push 0x80
push 4
push 0
push esi
push 0xc0000000
push dword [edi]
mov dword [esp + 0x44], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x424e30], eax
cmp eax, 0xffffffff
je 0x4103c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
setne cl
mov dword [esp + 0x2c], ecx
cmp dword [0x425bf0], ebx
je 0x40ff99
call fcn.0040fe51
xor esi, esi
push esi
push esi
push 0xe
push dword [0x425e04]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
push esi
push 0xbd
push dword [0x425e04]
mov dword [esp + 0x28], eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
test esi, esi
je 0x410381
push esi
call dword [sym.imp.KERNEL32.dll_LocalLock]
mov dword [esp + 0x10], eax
test eax, eax
je 0x410381
mov ecx, dword [0x424e3c]
lea eax, [ecx - 1]
sub eax, 1
je 0x41010e
sub eax, 1
je 0x4100ae
sub eax, 1
jne 0x41001e
push eax
lea eax, [esp + 0x20]
push eax
push 3
push 0x424324
push dword [0x424e30]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [0x424e3c]
cmp ecx, 4
je 0x410039
cmp ecx, 5
je 0x410039
call dword [sym.imp.KERNEL32.dll_GetACP]
lea ecx, [esp + 0x24]
mov ebx, 0x400
jmp 0x410042
xor ecx, ecx
mov eax, 0xfde9
xor ebx, ebx
push ecx
push 0
push 0
push 0
push dword [esp + 0x28]
mov dword [esp + 0x28], eax
push dword [esp + 0x24]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp dword [esp + 0x24], 0
mov ecx, eax
jne 0x410072
mov eax, dword [esp + 0x18]
test eax, eax
je 0x41009a
test ecx, ecx
jne 0x41009a
mov edx, dword [0x4242f0]
mov ecx, dword [esp + 0x20]
push 0x31
push dword [edi]
push dword [0x4242a0]
call fcn.0040dc13
cmp eax, 2
je 0x410381
mov eax, dword [esp + 0x18]
xor ebx, ebx
mov edx, dword [esp + 0x14]
push eax
push dword [esp + 0x14]
push ebx
call fcn.0040fda0
jmp 0x410146
push 0
lea eax, [esp + 0x20]
push eax
push 2
push 0x42431c
push dword [0x424e30]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [esp + 0x10]
mov ecx, edx
push dword [esp + 0x18]
call fcn.0040fd6e
push 0
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
add eax, eax
push eax
push dword [esp + 0x1c]
push dword [0x424e30]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [esp + 0x10]
mov ecx, edx
push dword [esp + 0x18]
mov dword [esp + 0x24], eax
call fcn.0040fd6e
mov eax, dword [esp + 0x20]
jmp 0x410146
push 0
lea eax, [esp + 0x20]
push eax
push 2
push 0x424320
push dword [0x424e30]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
add eax, eax
push eax
push dword [esp + 0x1c]
push dword [0x424e30]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x410381
push dword [0x424e30]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
mov eax, dword [0x424e3c]
xor esi, esi
push esi
push esi
push 0xb9
push dword [0x425e04]
mov dword [0x424ebc], eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x424e3c], 1
mov dword [0x424314], esi
jne 0x41019e
test ebx, ebx
jne 0x41019e
xor edx, edx
mov ecx, edi
push esi
inc edx
call fcn.00410463
push dword [0x424e30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x424e30], 0xffffffff
lea eax, [esp + 0x30]
push 0x218
push esi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
cmp byte [ebp + 8], 0
je 0x410219
push dword [edi]
call dword [sym.imp.api_ms_win_shcore_path_l1_1_0.dll_Ordinal_170]
push dword [edi]
mov dword [esp + 0x38], eax
call dword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathFindExtensionW]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x24c]
push eax
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov ecx, dword [edi]
lea edx, [esp + 0x3c]
neg eax
sbb eax, eax
and eax, dword [esp + 0x26c]
mov dword [esp + 0x30], eax
call fcn.004103e1
mov eax, dword [0x424e3c]
mov dword [esp + 0x244], eax
cmp dword [0x425bf0], esi
je 0x410226
call fcn.0040fe9c
mov ebx, esi
cmp word [0x4259c8], bx
je 0x41028b
mov dword [esp + 0x14], esi
cmp dword [esp + 0x28], ebx
jne 0x410240
xor ebx, ebx
inc ebx
jmp 0x41028b
push ecx
mov ecx, dword [edi]
lea edx, [esp + 0x18]
call fcn.0041100d
mov esi, dword [esp + 0x14]
test eax, eax
js 0x41027e
and dword [esp + 0x14], ebx
lea eax, [esp + 0x14]
push eax
push ecx
lea edx, [esp + 0x278]
mov ecx, esi
call fcn.0041f490
test eax, eax
js 0x41027c
cmp dword [esp + 0x14], 2
je 0x41027c
xor ebx, ebx
inc ebx
jmp 0x41027e
xor ebx, ebx
test esi, esi
je 0x410289
push esi
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
xor esi, esi
cmp dword [ebp + 0xc], 0
jne 0x410299
test ebx, ebx
je 0x41035f
push ecx
mov ecx, dword [edi]
lea edx, [esp + 0x14]
mov dword [esp + 0x14], esi
call fcn.0041100d
mov esi, dword [esp + 0x10]
test eax, eax
js 0x410354
push 0x1fa
lea eax, [esp + 0x274]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov eax, dword [ebp + 0xc]
add esp, 0xc
test eax, eax
jne 0x4102d8
mov eax, 0x4259c8
push eax
mov edx, 0xfd
lea ecx, [esp + 0x274]
call fcn.00406454
test eax, eax
jns 0x410308
cmp dword [esp + 0x10], 0
je 0x4103c8
push dword [esp + 0x10]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
jmp 0x4103c8
lea edx, [esp + 0x270]
mov ecx, esi
call fcn.0041ff4e
test eax, eax
js 0x410354
cmp word [esp + 0x270], 0
je 0x41034c
lea ecx, [esp + 0x270]
call fcn.0040e109
test eax, eax
jne 0x410343
mov edx, dword [0x424ebc]
mov ecx, edi
push eax
call fcn.00410463
inc word [0x424e1c]
jmp 0x410354
xor ecx, ecx
inc ecx
call fcn.0040e167
test esi, esi
je 0x41035f
push esi
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
push dword [0x424f3c]
call dword [sym.imp.USER32.dll_SetCursor]
call fcn.0040d3e0
movzx edx, byte [ebp + 8]
lea ecx, [esp + 0x30]
call fcn.0041e80d
mov al, 1
jmp 0x4103ca
push dword [0x424f3c]
call dword [sym.imp.USER32.dll_SetCursor]
push dword [0x424e30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x424e30], 0xffffffff
test esi, esi
je 0x4103ab
push esi
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
cmp dword [esp + 0x2c], 0
je 0x4103ba
push dword [edi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [0x425bf0], 0
je 0x4103c8
call fcn.0040fe9c
xor al, al
mov ecx, dword [esp + 0x474]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00421870
mov esp, ebp
pop ebp
ret 8