Function at 0x41096a
Capabilities:
Check if file exists
Clear file content
Delete file
Get file attributes
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x46c
mov eax, dword [0x4291b0]
xor eax, esp
mov dword [esp + 0x468], eax
mov eax, dword [0x42a92c]
and dword [esp + 0x18], 0
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x20], eax
xor esi, esi
call fcn.00423c02
xor ebx, ebx
inc ebx
cmp byte [ebp + 8], 0
je 0x4109da
push 3
pop ebx
push dword [0x42a8cc]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4109da
test eax, 0x4000
je 0x4109da
push esi
push 0x80
push 2
push dword [edi]
push dword [0x42a8cc]
call dword [sym.imp.ADVAPI32.dll_DuplicateEncryptionInfoFile]
push dword [edi]
call dword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathFileExistsW]
push 0
push 0x80
push 4
push 0
push ebx
push 0xc0000000
push dword [edi]
mov dword [esp + 0x44], eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov dword [0x429d8c], eax
cmp eax, 0xffffffff
je 0x410e62
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
setne cl
mov dword [esp + 0x2c], ecx
cmp dword [0x42ab94], esi
je 0x410a2e
call fcn.004108d3
xor ebx, ebx
push ebx
push ebx
push 0xe
push dword [0x42adac]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push ebx
push 0xbd
push dword [0x42adac]
mov dword [esp + 0x28], eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
test ebx, ebx
je 0x410e1b
push ebx
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalLock]
mov dword [esp + 0x10], eax
test eax, eax
je 0x410e1b
mov ecx, dword [0x429e14]
lea eax, [ecx - 1]
sub eax, 1
je 0x410bae
sub eax, 1
je 0x410b4e
sub eax, 1
jne 0x410ab3
push eax
lea eax, [esp + 0x20]
push eax
push 3
push 0x4292d0
push dword [0x429d8c]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
mov ecx, dword [0x429e14]
cmp ecx, 6
jne 0x410abf
mov eax, 0xd698
jmp 0x410adf
cmp ecx, 4
je 0x410ada
cmp ecx, 5
je 0x410ada
call dword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetACP]
lea ecx, [esp + 0x24]
mov esi, 0x400
jmp 0x410ae3
mov eax, 0xfde9
xor ecx, ecx
xor esi, esi
push ecx
xor ecx, ecx
mov dword [esp + 0x18], eax
push ecx
push ecx
push ecx
push dword [esp + 0x28]
push dword [esp + 0x24]
push esi
push eax
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_WideCharToMultiByte]
cmp dword [esp + 0x24], 0
mov ecx, eax
jne 0x410b12
mov eax, dword [esp + 0x18]
test eax, eax
je 0x410b3a
test ecx, ecx
jne 0x410b3a
mov edx, dword [0x42929c]
mov ecx, dword [esp + 0x20]
push 0x31
push dword [edi]
push dword [0x42924c]
call fcn.0040f89d
cmp eax, 2
je 0x410e1b
mov eax, dword [esp + 0x18]
xor esi, esi
mov edx, dword [esp + 0x14]
push eax
push dword [esp + 0x14]
push esi
call fcn.0041081e
jmp 0x410be6
push 0
lea eax, [esp + 0x20]
push eax
push 2
push 0x4292c8
push dword [0x429d8c]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
mov edx, dword [esp + 0x10]
mov ecx, edx
push dword [esp + 0x18]
call fcn.004107e6
push 0
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
add eax, eax
push eax
push dword [esp + 0x1c]
push dword [0x429d8c]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
mov edx, dword [esp + 0x10]
mov ecx, edx
push dword [esp + 0x18]
mov dword [esp + 0x24], eax
call fcn.004107e6
mov eax, dword [esp + 0x20]
jmp 0x410be6
push 0
lea eax, [esp + 0x20]
push eax
push 2
push 0x4292cc
push dword [0x429d8c]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
push 0
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
add eax, eax
push eax
push dword [esp + 0x1c]
push dword [0x429d8c]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
test eax, eax
je 0x410e1b
push dword [0x429d8c]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetEndOfFile]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalUnlock]
mov eax, dword [0x429e14]
xor ebx, ebx
push ebx
push ebx
push 0xb9
push dword [0x42adac]
mov dword [0x429e18], eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x429e14], 1
mov dword [0x4292c0], ebx
jne 0x410c3e
test esi, esi
jne 0x410c3e
xor edx, edx
mov ecx, edi
push ebx
inc edx
call fcn.00410f0c
push dword [0x429d8c]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
or dword [0x429d8c], 0xffffffff
lea eax, [esp + 0x30]
push 0x218
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
cmp byte [ebp + 8], bl
je 0x410cb8
push dword [edi]
call dword [sym.imp.api_ms_win_shcore_path_l1_1_0.dll_Ordinal_170]
push dword [edi]
mov dword [esp + 0x38], eax
call dword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathFindExtensionW]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x24c]
push eax
push ebx
push dword [edi]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesExW]
mov ecx, dword [edi]
lea edx, [esp + 0x3c]
neg eax
sbb eax, eax
and eax, dword [esp + 0x26c]
mov dword [esp + 0x30], eax
call fcn.00410e81
mov eax, dword [0x429e14]
mov dword [esp + 0x244], eax
cmp dword [0x42ab94], ebx
je 0x410cc5
call fcn.00410924
cmp word [0x42a968], bx
je 0x410d26
and dword [esp + 0x14], ebx
cmp dword [esp + 0x28], ebx
jne 0x410cdd
xor ebx, ebx
inc ebx
jmp 0x410d26
push ecx
mov ecx, dword [edi]
lea edx, [esp + 0x18]
call fcn.00411a26
mov esi, dword [esp + 0x14]
test eax, eax
js 0x410d1b
and dword [esp + 0x14], ebx
lea eax, [esp + 0x14]
push eax
push ecx
lea edx, [esp + 0x278]
mov ecx, esi
call fcn.004252f7
test eax, eax
js 0x410d19
cmp dword [esp + 0x14], 2
je 0x410d19
xor ebx, ebx
inc ebx
jmp 0x410d1b
xor ebx, ebx
test esi, esi
je 0x410d26
push esi
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
cmp dword [ebp + 0xc], 0
jne 0x410d34
test ebx, ebx
je 0x410df9
push ecx
mov ecx, dword [edi]
lea edx, [esp + 0x14]
xor ebx, ebx
mov dword [esp + 0x14], ebx
call fcn.00411a26
mov esi, dword [esp + 0x10]
test eax, eax
js 0x410dee
push 0x1fa
lea eax, [esp + 0x274]
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov eax, dword [ebp + 0xc]
add esp, 0xc
test eax, eax
jne 0x410d74
mov eax, 0x42a968
push eax
mov edx, 0xfd
lea ecx, [esp + 0x274]
call fcn.0040675d
test eax, eax
jns 0x410da3
cmp dword [esp + 0x10], ebx
je 0x410e62
push dword [esp + 0x10]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
jmp 0x410e62
lea edx, [esp + 0x270]
mov ecx, esi
call fcn.00425d49
test eax, eax
js 0x410dee
cmp word [esp + 0x270], bx
je 0x410de6
lea ecx, [esp + 0x270]
call fcn.0040fdef
test eax, eax
jne 0x410ddd
mov edx, dword [0x429e18]
mov ecx, edi
push ebx
call fcn.00410f0c
inc word [0x42a94c]
jmp 0x410dee
xor ecx, ecx
inc ecx
call fcn.0040fe53
test esi, esi
je 0x410df9
push esi
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
push dword [0x429e94]
call dword [sym.imp.USER32.dll_SetCursor]
call fcn.0040f0f0
movzx edx, byte [ebp + 8]
lea ecx, [esp + 0x30]
call fcn.00423c5a
mov al, 1
jmp 0x410e64
push dword [0x429e94]
call dword [sym.imp.USER32.dll_SetCursor]
push dword [0x429d8c]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
or dword [0x429d8c], 0xffffffff
test ebx, ebx
je 0x410e45
push ebx
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalUnlock]
cmp dword [esp + 0x2c], 0
je 0x410e54
push dword [edi]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
cmp dword [0x42ab94], 0
je 0x410e62
call fcn.00410924
xor al, al
mov ecx, dword [esp + 0x474]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00426f20
mov esp, ebp
pop ebp
ret 8