Function at 0x1002cf50
Capabilities:
Check if file exists
Create directory
Get file attributes
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d33f1
mov eax, dword fs:[0]
push eax
sub esp, 0xae8
mov eax, dword [0x101120a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0xaa0]
push eax
call sym.XNewLookSch.dll_public:_class_LString___thiscall_LString::get_real_file_from_env_format_void_
push 1
lea eax, [ebp - 0xaf4]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0xad0], 0xc8
mov dword [ebp - 0xacc], 0xc8
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 2
push 0x800
lea eax, [ebp - 0xa68]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
lea eax, [ebp - 0xae0]
push eax
lea eax, [ebp - 0xacc]
push eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0xad0]
push eax
lea eax, [ebp - 0xd8]
push eax
push str.Everyone
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
lea eax, [ebp - 0xd8]
push eax
push 0x10000000
push 2
lea eax, [ebp - 0xa68]
push eax
call dword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
lea eax, [ebp - 0xac4]
mov dword [ebp - 0xac4], 0
push eax
push 0
lea eax, [ebp - 0xa68]
push eax
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x1002d043
mov eax, dword [ebp - 0xac4]
mov byte [eax + 1], 3
push 0
lea eax, [ebp - 0xa68]
push eax
push 1
lea eax, [ebp - 0xaf4]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp - 0xaf4]
mov dword [ebp - 0xadc], 0xc
mov dword [ebp - 0xad8], eax
xor eax, eax
mov dword [ebp - 0xad4], 0
mov dword [ebp - method.LString.virtual_0], vtable.LString.0
mov dword [ebp - 0xa70], 0
mov dword [ebp - 0xa6c], 7
mov word [ebp - 0xa80], ax
mov byte [ebp - 4], 1
lea eax, [ebp - 0xa9c]
inc dword [sym.XNewLookSch.dll_unsigned_int_LString::_ui_instance_count]
lea ecx, [ebp - 0xa80]
cmp dword [ebp - 0xa88], 8
push dword [ebp - 0xa8c]
cmovae eax, dword [ebp - 0xa9c]
push eax
call fcn.10002b70
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0xa70]
test ecx, ecx
je 0x1002d114
cmp dword [ebp - 0xa6c], 8
lea eax, [ebp - 0xa80]
cmovae eax, dword [ebp - 0xa80]
movzx eax, word [eax + ecx*2 - 2]
cmp eax, 0x5c
je 0x1002d103
cmp eax, 0x2f
jne 0x1002d114
lea eax, [ecx - 1]
push 0
push eax
lea ecx, [ebp - 0xa80]
call fcn.10011230
lea eax, [ebp - 0xabc]
push eax
lea ecx, [ebp - 0xa84]
call sym.XNewLookSch.dll_public:_class_LString___thiscall_LString::get_real_file_from_env_format_void_
cmp dword [ebp - 0xaa4], 8
lea eax, [ebp - 0xab8]
cmovae eax, dword [ebp - 0xab8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
lea ecx, [ebp - 0xabc]
setne bl
call sym.XNewLookSch.dll_public_virtual:_void___thiscall_LString::destructor_void_
lea eax, [ebp - 0xa80]
test bl, bl
je 0x1002d215
cmp dword [ebp - 0xa6c], 8
lea ecx, [ebp - 0xac0]
push ecx
cmovae eax, dword [ebp - 0xa80]
lea ecx, [ebp - 0xac8]
push 0
push ecx
push 0
push 0
push 4
push 1
push eax
mov dword [ebp - 0xac8], 0
mov dword [ebp - 0xac0], 0
call dword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
test eax, eax
jne 0x1002d1d7
mov ecx, dword [ebp - 0xac8]
test ecx, ecx
je 0x1002d1d7
mov edx, dword [ebp - 0xae4]
test edx, edx
je 0x1002d1d7
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1002d1d7
mov eax, dword [ecx + 4]
cmp eax, dword [edx + 4]
jne 0x1002d1d7
push dword [ebp - 0xac0]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor esi, esi
jmp 0x1002d23e
mov eax, dword [ebp - 0xac0]
test eax, eax
je 0x1002d1e8
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0xa6c], 8
lea ecx, [ebp - 0xaf4]
push ecx
lea eax, [ebp - 0xa80]
cmovae eax, dword [ebp - 0xa80]
push 4
push eax
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
test eax, eax
jne 0x1002d235
or esi, 0xffffffff
jmp 0x1002d23e
cmp dword [ebp - 0xa6c], 8
lea ecx, [ebp - 0xadc]
push ecx
cmovae eax, dword [ebp - 0xa80]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1002d239
xor esi, esi
jmp 0x1002d23e
mov esi, 0xfffffffe
lea ecx, [ebp - 0xa84]
call sym.XNewLookSch.dll_public_virtual:_void___thiscall_LString::destructor_void_
lea ecx, [ebp - 0xaa0]
call sym.XNewLookSch.dll_public_virtual:_void___thiscall_LString::destructor_void_
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008bffe
mov esp, ebp
pop ebp
ret