Function at 0x10024297
Capabilities:
Check if file exists
Create directory
Get file attributes
Get system information on windows
Query environment variable
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x1003b164]
push ebx
push esi
push edi
xor ebx, ebx
mov edi, 0x104
push edi
push 0x1003bc80
push 0x10024328
mov dword [ebp - 4], eax
xor esi, esi
mov dword [ebp - 0x34], ebx
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 1
mov dword [ebp - 0x30], ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, ebx
je 0x10024688
cmp eax, edi
ja 0x10024688
lea eax, [ebp - 0x34]
push eax
call fcn.100277d3
test eax, eax
jne 0x10024372
mov esi, 0x80070003
cmp dword [ebp - 0x30], ebx
je 0x1002430d
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp esi, ebx
jge 0x10024316
call fcn.100240d3
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.10023cf0
leave
ret
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100244e8
lea ecx, [ebp - 0x20]
call fcn.1002bc21
lea ecx, [ebp - 0x20]
call fcn.1002bc86
mov esi, eax
cmp esi, ebx
lea ecx, [ebp - 0x20]
jl 0x10024438
xor edi, edi
inc edi
push edi
push 0x80020000
push dword [0x10005450]
call fcn.1002c0fc
mov esi, eax
cmp esi, ebx
lea ecx, [ebp - 0x20]
jl 0x10024438
push edi
push 0x101f0000
push dword [0x10005460]
call fcn.1002c0fc
mov esi, eax
cmp esi, ebx
lea ecx, [ebp - 0x20]
jl 0x10024438
push edi
push 0x101f0000
push dword [0x10005470]
call fcn.1002c0fc
mov esi, eax
cmp esi, ebx
lea ecx, [ebp - 0x20]
jl 0x10024438
mov eax, 0x1000
push eax
push eax
call fcn.1002bd39
mov esi, eax
cmp esi, ebx
jl 0x10024435
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x34]
mov dword [ebp - 0x48], 0xc
mov dword [ebp - 0x40], ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10024454
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10024442
call esi
mov esi, eax
lea ecx, [ebp - 0x20]
call fcn.1002bc39
jmp 0x100242ff
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x10024435
lea ecx, [ebp - 0x20]
call fcn.1002bc39
push 0x10004b70
push edi
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
cmp eax, ebx
mov dword [0x1003b4b0], eax
je 0x10024502
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0x68]
push ebx
push ebx
push 4
push dword [0x1003b4b0]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, ebx
mov dword [0x1003b4b4], eax
jne 0x10024502
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x100244f0
call esi
mov esi, eax
push ebx
mov dword [ebp - 0x24], 0xc00012d5
push 0x8f
lea eax, [ebp - 0x2c]
push 0x10004ac0
push eax
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x28], 0x63
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], edi
call fcn.1002a981
add esp, 0x10
jmp 0x100242ff
xor edi, edi
inc edi
jmp 0x1002445c
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x100244ad
push dword [ebp - 0x34]
push 0x1003b4b8
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push edi
push 0x1003b6c4
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x10024554
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10024542
call esi
mov esi, eax
push ebx
push 0x9a
mov dword [ebp - 0x24], 0xc00012d3
jmp 0x100244ba
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x10024530
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x10024599
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10024587
call esi
mov esi, eax
push ebx
push 0xa9
jmp 0x10024536
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1002457f
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
add eax, 0x10
push eax
mov dword [ebp - 0x3c], eax
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
cmp eax, ebx
mov dword [ebp - 0x38], eax
jne 0x100245c6
push ebx
mov esi, 0x8007000e
push 0xb3
jmp 0x10024536
push 2
push dword [ebp - 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x1002465b
push dword [ebp - 0x30]
push 0x80000000
push 2
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
test eax, eax
je 0x1002465b
push ebx
push dword [ebp - 0x38]
push edi
push 0x1003b6c4
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
jne 0x10024632
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10024620
call esi
mov esi, eax
push ebx
push 0xc4
jmp 0x10024536
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x10024615
mov dword [0x1003b6dc], 0xc
mov dword [0x1003b6e0], 0x1003b6c4
mov dword [0x1003b6e4], ebx
mov dword [0x1003b6d8], 0x1003b6dc
jmp 0x100242ff
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10024676
call esi
mov esi, eax
push ebx
push 0xbb
jmp 0x10024536
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1002466b
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x100246aa
call esi
mov esi, eax
cmp esi, ebx
jl 0x100242ff
mov esi, 0x80004005
jmp 0x100242ff
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x10024698