Function at 0x1400415a0
Capabilities:
Create directory
Get file size
Read file on windows
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r15
mov rbp, rsp
sub rsp, 0x50
xor r15d, r15d
mov rsi, rcx
lea rcx, [0x140182ca0]
lea edx, [r15 + 0x5c]
mov qword [rbp + 0x48], r15
mov dword [rbp + 0x38], r15d
mov dword [rbp + 0x40], r15d
call fcn.1400d99e0
mov rdi, rax
test rax, rax
je 0x1400415f7
movzx ebx, word [rax + 2]
lea rdx, [0x140182ca0]
xor r8d, r8d
xor ecx, ecx
mov word [rax + 2], r15w
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov word [rdi + 2], bx
mov qword [rsp + 0x30], r15
lea rcx, [0x140182ca0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140041652
call fcn.1400424a0
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140041652
lea rcx, str.SaveLogToFile1
call fcn.1400015a0
add rsp, 0x50
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea r9, [rbp + 0x38]
lea rdx, [rbp + 0x48]
mov r8d, 4
mov rcx, rdi
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rbp + 0x38], 4
je 0x140041689
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1400424a0
mov qword [rbp + 0x48], r15
mov rdi, rax
lea r9, [rbp + 0x38]
lea rdx, [rbp + 0x40]
mov r8d, 4
mov rcx, rdi
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rbp + 0x40], 2
je 0x1400416c7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1400424a0
mov dword [rbp + 0x40], 2
mov rdi, rax
mov qword [rbp + 0x48], r15
cmp rdi, 0xffffffffffffffff
jne 0x1400416e4
lea rcx, str.SaveLogToFile2
call fcn.1400015a0
add rsp, 0x50
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rbx, qword [rsi + 0x1c8]
mov qword [rsp + 0x48], r13
mov r13, r15
cmp rbx, qword [rsi + 0x1d0]
je 0x140041894
mov rdx, rbx
xor ecx, ecx
call fcn.140001220
add rbx, 0x48
add r13, rax
cmp rbx, qword [rsi + 0x1d0]
jne 0x140041700
test r13, r13
je 0x140041894
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x40], r14
lea rcx, [r13 + rax]
call fcn.1400aefbc
xor edx, edx
mov rcx, rdi
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
lea r9, [rbp + 0x38]
lea r8d, [rax - 8]
mov rdx, r14
mov rcx, rdi
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r8d, dword [rbp + 0x48]
lea r9, [rbp + 0x38]
add r8d, 0xfffffff8
mov rdx, r14
mov rcx, rdi
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r11, qword [rbp + 0x48]
mov rbx, qword [rsi + 0x1c8]
lea r12, [r14 + r11]
cmp rbx, qword [rsi + 0x1d0]
je 0x1400417bb
nop word [rax + rax]
mov rdx, rbx
mov rcx, r12
call fcn.140001220
add rbx, 0x48
add r12, rax
cmp rbx, qword [rsi + 0x1d0]
jne 0x1400417a0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
add qword [rbp + 0x48], r13
lea r9, [rbp + 0x38]
lea rdx, [rbp + 0x48]
mov r8d, 4
mov rcx, rdi
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r9, [rbp + 0x38]
lea rdx, [rbp + 0x40]
mov r8d, 4
mov rcx, rdi
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8d, dword [rbp + 0x48]
lea r9, [rbp + 0x38]
mov rdx, r14
mov rcx, rdi
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call fcn.1400d4d78
mov rcx, qword [rsi + 0x1d0]
mov r8, qword [rsi + 0x1c8]
mov r14, qword [rsp + 0x40]
cmp r8, rcx
je 0x14004187c
mov rdx, rcx
call fcn.1400019a0
mov rdi, qword [rsi + 0x1d0]
mov r12, rax
mov rbx, rax
cmp rax, rdi
je 0x140041875
mov rcx, rbx
call fcn.140001150
add rbx, 0x48
cmp rbx, rdi
jne 0x140041864
mov qword [rsi + 0x1d0], r12
mov r12, qword [rsp + 0x80]
mov r13, qword [rsp + 0x48]
add rsp, 0x50
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13, qword [rsp + 0x48]
add rsp, 0x50
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret