Function at 0x10009cfb0
Capabilities:
Check if file exists
Create directory
Get file attributes
Set file attributes
Write file on windows

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x820
mov qword [rsp + 0x210], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov rax, qword [0x100175150]
xor rax, rsp
mov qword [rsp + 0x810], rax
mov byte [rsp + 0x80], dl
mov qword [rsp + 0x1e8], rcx
lea r14, [0x10001d9c0]
mov qword [r11 - 0x7b8], r14
lea rbx, [0x10001da80]
mov qword [r11 - 0x7b0], rbx
lea r15, [0x10001d9a8]
mov qword [r11 - 0x7a8], r15
mov dword [rsp + 0xa8], 0x7c
mov r12d, 1
mov dword [r11 - 0x79c], r12d
mov dword [rsp + 0xb0], 0xff
xor r13d, r13d
mov word [r11 - 0x718], r13w
mov byte [r11 - 0x716], r13b
mov byte [r11 - 0x715], r12b
xor edx, edx
lea r8d, [r12 + 0x77]
lea rcx, [r11 - 0x790]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x150]
call fcn.1000e7c38
nop
mov qword [rsp + 0x138], r13
mov byte [rsp + 0x2e8], r13b
mov byte [rsp + 0x2e9], r13b
mov byte [rsp + 0x2ea], r13b
mov byte [rsp + 0x2eb], r13b
mov byte [rsp + 0x2ec], r13b
mov byte [rsp + 0x2ed], 5
lea edx, [r12 + 0x7f]
lea r8d, [r12 + 1]
lea rcx, [rsp + 0x2f0]
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
cmp eax, r13d
jne 0x10009d1b7
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
mov esi, 0x80070000
or edi, esi
cmp eax, r13d
cmovle edi, eax
mov dword [rsp + 0x158], edi
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xa8], 0x91
mov dword [rsp + 0xac], r12d
mov dword [rsp + 0xb0], 0xff
mov word [rsp + 0x130], r13w
mov byte [rsp + 0x132], r13b
mov byte [rsp + 0x133], r12b
xor edx, edx
lea r8d, [r12 + 0x77]
lea rcx, [rsp + 0xb8]
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x90]
mov qword [rsp + 0x140], r11
cmp edi, r13d
jge 0x10009d1a8
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x240]
call fcn.1000e760c
lea r9, [0x10000a078]
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1000e9408
nop
lea rcx, [rsp + 0x90]
call fcn.1000e7688
jmp 0x10009d1bc
mov esi, 0x80070000
lea rax, [rsp + 0x138]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8d, [r9 + 0x12]
mov dl, r12b
lea rcx, [rsp + 0x2e8]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp eax, r13d
jne 0x10009d2d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, esi
cmp eax, r13d
cmovle edi, eax
mov dword [rsp + 0x158], edi
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xa8], 0xa5
mov dword [rsp + 0xac], r12d
mov dword [rsp + 0xb0], 0xff
mov word [rsp + 0x130], r13w
mov byte [rsp + 0x132], r13b
mov byte [rsp + 0x133], r12b
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xb8]
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x90]
mov qword [rsp + 0x140], r11
cmp edi, r13d
jge 0x10009d2c7
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x240]
call fcn.1000e760c
lea r9, [0x10001dae0]
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1000e9408
nop
lea rcx, [rsp + 0x90]
call fcn.1000e7688
nop
mov r9, qword [rsp + 0x138]
mov edx, 2
mov r8d, 0x101f0000
lea rcx, [rsp + 0x2f0]
call qword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
cmp eax, r13d
jne 0x10009d3ca
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r10d, ax
or r10d, esi
cmp eax, r13d
cmovle r10d, eax
mov dword [rsp + 0x158], r10d
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xa8], 0xb4
mov dword [rsp + 0xac], r12d
mov edi, 0xff
mov dword [rsp + 0xb0], edi
mov word [rsp + 0x130], r13w
mov byte [rsp + 0x132], r13b
mov byte [rsp + 0x133], r12b
movzx ecx, r13w
cmp cx, 0xf
jae 0x10009d38b
movzx eax, cx
mov qword [rdx + rax*8 + 0x28], r13
add cx, r12w
jmp 0x10009d377
mov qword [rsp + 0x88], rdx
cmp r10d, r13d
jge 0x10009d3c0
lea rcx, [rsp + 0x240]
call fcn.1000e760c
lea r9, [0x10000a098]
mov r8d, r10d
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1000e9408
nop
mov rcx, rdx
call fcn.1000e7688
jmp 0x10009d3cf
mov edi, 0xff
mov rcx, qword [rsp + 0x138]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov qword [rsp + 0x138], r13
mov edx, r12d
lea rcx, [rsp + 0x218]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
cmp eax, r13d
jne 0x10009d4c3
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r10d, ax
or r10d, esi
cmp eax, r13d
cmovle r10d, eax
mov dword [rsp + 0x158], r10d
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xa8], 0xbf
mov dword [rsp + 0xac], r12d
mov dword [rsp + 0xb0], edi
mov word [rsp + 0x130], r13w
mov byte [rsp + 0x132], r13b
mov byte [rsp + 0x133], r12b
movzx ecx, r13w
cmp cx, 0xf
jae 0x10009d486
movzx eax, cx
mov qword [rdx + rax*8 + 0x28], r13
add cx, r12w
jmp 0x10009d472
mov qword [rsp + 0x88], rdx
cmp r10d, r13d
jge 0x10009d4bb
lea rcx, [rsp + 0x240]
call fcn.1000e760c
lea r9, [0x10000a0c0]
mov r8d, r10d
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1000e9408
nop
mov rcx, rdx
call fcn.1000e7688
xor r9d, r9d
lea r8, [rsp + 0x2f0]
mov edx, r12d
lea rcx, [rsp + 0x218]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
cmp eax, r13d
jne 0x10009d5ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r10d, ax
or r10d, esi
cmp eax, r13d
cmovle r10d, eax
mov dword [rsp + 0x158], r10d
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xa8], 0xc5
mov dword [rsp + 0xac], r12d
mov dword [rsp + 0xb0], edi
mov word [rsp + 0x130], r13w
mov byte [rsp + 0x132], r13b
mov byte [rsp + 0x133], r12b
movzx ecx, r13w
cmp cx, 0xf
jae 0x10009d56f
movzx eax, cx
mov qword [rdx + rax*8 + 0x28], r13
add cx, r12w
jmp 0x10009d55b
mov qword [rsp + 0x88], rdx
cmp r10d, r13d
jge 0x10009d5a4
lea rcx, [rsp + 0x240]
call fcn.1000e760c
lea r9, [0x10000a100]
mov r8d, r10d
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1000e9408
nop
mov rcx, rdx
call fcn.1000e7688
xor eax, eax
mov qword [rsp + 0x1d0], rax
mov qword [rsp + 0x1d8], rax
mov qword [rsp + 0x1e0], rax
mov dword [rsp + 0x1d0], 0x18
lea rax, [rsp + 0x218]
mov qword [rsp + 0x1d8], rax
mov dword [rsp + 0x1e0], r12d
lea rcx, [rsp + 0x600]
call fcn.10009cd1c
lea r9, [rsp + 0x600]
lea r8, [0x10001db18]
mov edx, 0x144
lea rcx, [rsp + 0x370]
call fcn.100052590
mov r8d, eax
mov dword [rsp + 0x158], eax
cmp eax, r13d
jge 0x10009d6a5
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xa8], 0xdb
mov dword [rsp + 0xac], r12d
mov dword [rsp + 0xb0], edi
mov word [rsp + 0x130], r13w
mov byte [rsp + 0x132], r13b
mov byte [rsp + 0x133], r12b
movzx ecx, r13w
cmp cx, 0xf
jae 0x10009d691
movzx eax, cx
mov qword [rdx + rax*8 + 0x28], r13
add cx, r12w
jmp 0x10009d67d
lea r9, [0x10000a040]
lea rcx, [rsp + 0x150]
call fcn.1000e9a68
lea rcx, [rsp + 0x370]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10009d87f
lea rdx, [rsp + 0x1d0]
lea rcx, [rsp + 0x370]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, r13d
jne 0x10009d79f
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r10d, ax
or r10d, esi
cmp eax, r13d
cmovle r10d, eax
mov dword [rsp + 0x158], r10d
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xa8], 0xe4
mov dword [rsp + 0xac], r12d
mov dword [rsp + 0xb0], edi
mov word [rsp + 0x130], r13w
mov byte [rsp + 0x132], r13b
mov byte [rsp + 0x133], r12b
movzx ecx, r13w
cmp cx, 0xf
jae 0x10009d762
movzx eax, cx
mov qword [rdx + rax*8 + 0x28], r13
add cx, r12w
jmp 0x10009d74e
mov qword [rsp + 0x88], rdx
cmp r10d, r13d
jge 0x10009d797
lea rcx, [rsp + 0x240]
call fcn.1000e760c
lea r9, [0x10001db50]
mov r8d, r10d
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1000e9408
nop
mov rcx, rdx
call fcn.1000e7688
mov edx, 0x2006
lea rcx, [rsp + 0x370]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp eax, r13d
jne 0x10009d87f
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r10d, ax
or r10d, esi
cmp eax, r13d
cmovle r10d, eax
mov dword [rsp + 0x158], r10d
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xa8], 0xf2
mov dword [rsp + 0xac], r12d
mov dword [rsp + 0xb0], edi
mov word [rsp + 0x130], r13w
mov byte [rsp + 0x132], r13b
mov byte [rsp + 0x133], r12b
movzx ecx, r13w
cmp cx, 0xf
jae 0x10009d842
movzx eax, cx
mov qword [rdx + rax*8 + 0x28], r13
add cx, r12w
jmp 0x10009d82e
mov qword [rsp + 0x88], rdx
cmp r10d, r13d
jge 0x10009d877
lea rcx, [rsp + 0x240]
call fcn.1000e760c
lea r9, [0x10001db70]
mov r8d, r10d
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1000e9408
nop
mov rcx, rdx
call fcn.1000e7688
lea rax, [0x10001d890]
lea r12, [0x10001d8f0]
cmp byte [rsp + 0x80], r13b
cmovne r12, rax
mov rsi, qword [rsp + 0x1e8]
movzx eax, byte [rsi + 0x1a3]
movzx ecx, byte [rsi + 0x1a2]
movzx r8d, byte [rsi + 0x1a1]
movzx r9d, byte [rsi + 0x1a0]
movzx r10d, byte [rsi + 0x19f]
movzx r11d, byte [rsi + 0x19e]
movzx edx, byte [rsi + 0x19d]
movzx ebx, byte [rsi + 0x19c]
movzx edi, word [rsi + 0x19a]
movzx esi, word [rsi + 0x198]
mov qword [rsp + 0x78], r12
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], ecx
mov dword [rsp + 0x60], r8d
mov dword [rsp + 0x58], r9d
mov dword [rsp + 0x50], r10d
mov dword [rsp + 0x48], r11d
mov dword [rsp + 0x40], edx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov rcx, qword [rsp + 0x1e8]
mov eax, dword [rcx + 0x194]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x600]
lea r8, [0x10001d740]
mov edx, 0x144
lea rcx, [rsp + 0x370]
call fcn.100052590
mov r8d, eax
mov dword [rsp + 0x158], eax
cmp eax, r13d
jge 0x10009d9ef
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x90], r14
lea rbx, [0x10001da80]
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], r15
mov eax, 0xff
mov dword [rsp + 0xa8], eax
mov r12d, 1
mov dword [rsp + 0xac], r12d
mov dword [rsp + 0xb0], eax
mov word [rsp + 0x130], r13w
mov byte [rsp + 0x132], r13b
mov byte [rsp + 0x133], r12b
movzx ecx, r13w
cmp cx, 0xf
jae 0x10009d9db
movzx eax, cx
mov qword [rdx + rax*8 + 0x28], r13
add cx, r12w
jmp 0x10009d9c7
lea r9, [0x10000a040]
lea rcx, [rsp + 0x150]
call fcn.1000e9a68
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov r12d, 1
mov dword [rsp + 0x20], r12d
lea r9, [rsp + 0x1d0]
mov edx, 0xc0000000
lea r8d, [r12 + 2]
lea rcx, [rsp + 0x370]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
lea rax, [0x10000d460]
mov qword [rsp + 0x1e8], rax
mov qword [rsp + 0x1f0], rdi
cmp rdi, 0xffffffffffffffff
jne 0x10009db21
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r10d, ax
mov esi, 0x80070000
or r10d, esi
cmp eax, r13d
cmovle r10d, eax
mov dword [rsp + 0x158], r10d
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x90], r14
lea rbx, [0x10001da80]
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xa8], 0x112
mov dword [rsp + 0xac], r12d
mov dword [rsp + 0xb0], 0xff
mov word [rsp + 0x130], r13w
mov byte [rsp + 0x132], r13b
mov byte [rsp + 0x133], r12b
movzx ecx, r13w
cmp cx, 0xf
jae 0x10009dae2
movzx eax, cx
mov qword [rdx + rax*8 + 0x28], r13
add cx, r12w
jmp 0x10009dace
mov qword [rsp + 0x88], rdx
cmp r10d, r13d
jge 0x10009db17
lea rcx, [rsp + 0x240]
call fcn.1000e760c
lea r9, [0x10001db98]
mov r8d, r10d
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1000e9408
nop
mov rcx, rdx
call fcn.1000e7688
jmp 0x10009db2d
lea rbx, [0x10001da80]
mov esi, 0x80070000
mov edx, 0x2006
lea rcx, [rsp + 0x370]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp eax, r13d
jne 0x10009dc11
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r10d, ax
or r10d, esi
cmp eax, r13d
cmovle r10d, eax
mov dword [rsp + 0x158], r10d
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xa8], 0x11f
mov dword [rsp + 0xac], r12d
mov dword [rsp + 0xb0], 0xff
mov word [rsp + 0x130], r13w
mov byte [rsp + 0x132], r13b
mov byte [rsp + 0x133], r12b
movzx ecx, r13w
cmp cx, 0xf
jae 0x10009dbd4
movzx eax, cx
mov qword [rdx + rax*8 + 0x28], r13
add cx, r12w
jmp 0x10009dbc0
mov qword [rsp + 0x88], rdx
cmp r10d, r13d
jge 0x10009dc09
lea rcx, [rsp + 0x240]
call fcn.1000e760c
lea r9, [0x10001db70]
mov r8d, r10d
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1000e9408
nop
mov rcx, rdx
call fcn.1000e7688
mov dword [rsp + 0x1c0], 0x9d4feff5
mov dword [rsp + 0x1c4], r12d
mov dword [rsp + 0x1c8], r13d
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x140]
mov r8d, 0xc
lea rdx, [rsp + 0x1c0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, r13d
je 0x10009dc63
cmp dword [rsp + 0x140], 0xc
je 0x10009dd2c
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r10d, ax
or r10d, esi
cmp eax, r13d
cmovle r10d, eax
mov dword [rsp + 0x158], r10d
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xa8], 0x12e
mov dword [rsp + 0xac], r12d
mov dword [rsp + 0xb0], 0xff
mov word [rsp + 0x130], r13w
mov byte [rsp + 0x132], r13b
mov byte [rsp + 0x133], r12b
movzx ecx, r13w
cmp cx, 0xf
jae 0x10009dcee
movzx eax, cx
mov qword [rdx + rax*8 + 0x28], r13
add cx, r12w
jmp 0x10009dcda
mov qword [rsp + 0x88], rdx
cmp r10d, r13d
jge 0x10009dd23
lea rcx, [rsp + 0x240]
call fcn.1000e760c
lea r9, [0x10001dbb0]
mov r8d, r10d
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1000e9408
nop
mov rcx, rdx
call fcn.1000e7688
nop
cmp rdi, 0xffffffffffffffff
je 0x10009dd3c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x10009dd50
mov eax, dword [rsp + 0x158]
cmp eax, r13d
jge 0x10009dd92
mov rcx, qword [rsp + 0x138]
cmp rcx, r13
je 0x10009dd76
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [rsp + 0x158]
mov dword [rsp + 0x148], eax
lea rdx, [0x100172740]
lea rcx, [rsp + 0x148]
call sub.msvcrt.dll__CxxThrowException
nop
lea rcx, [rsp + 0x150]
call fcn.1000e7d24
mov rcx, qword [rsp + 0x810]
xor rcx, rsp
call fcn.1001303c0
lea r11, [rsp + 0x820]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret