Function at 0x140004370
Capabilities:
Create directory
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push r12
push r14
lea rbp, [rsp - 0x2a8]
sub rsp, 0x3a8
mov rax, qword [0x140029508]
mov rsi, r8
mov qword [rbp - 0x30], rax
test r8, r8
je 0x1400043ae
mov dword [r8], 0xffffffff
mov qword [rsp + 0x3d0], rbx
xor r14d, r14d
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov qword [rsp + 0x3a0], rdi
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov qword [rsp + 0x398], r13
call qword [sym.imp.KERNEL32.dll_CreateFileA]
lea r9, [rbp + 0x2f0]
mov qword [rsp + 0x20], r14
cmp rax, 0xffffffffffffffff
lea rdx, [rbp - 0x48]
mov r12, rax
mov r8d, reloc.WS2_32.dll_recv
cmove r12, r14
mov rcx, r12
mov qword [rbp - 0x50], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140004b02
cmp dword [rbp + 0x2f0], 0x10
jne 0x140004b02
mov ebx, dword [rbp - 0x40]
mov qword [rsp + 0x70], rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
mov rcx, r12
test rax, rax
je 0x140004afc
lea r9, [rbp + 0x2f0]
mov qword [rsp + 0x20], r14
mov r8d, ebx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140004ae5
cmp dword [rbp + 0x2f0], ebx
jne 0x140004ae5
mov ebx, dword [rbp - 0x3c]
mov qword [rbp + 0x2e8], rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x68], rax
mov rbx, rax
test rax, rax
je 0x140004ae5
lea rax, [rbp + 0x2f0]
mov r8, rdi
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x70]
lea rax, [rbp - 0x48]
mov rcx, rbx
lea rdx, [rbp + 0x2e8]
mov qword [rsp + 0x20], rax
call fcn.1400036e0
test eax, eax
jne 0x140004ad1
mov eax, dword [rbp - 0x3c]
cmp qword [rbp + 0x2e8], rax
jne 0x140004ad1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea r9, [rbp + 0x2e8]
mov dword [rbp + 0x2f0], r14d
mov r8d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], r14
lea rdx, [rbp + 0x60]
mov rcx, r12
mov edi, 1
mov r13d, r14d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140004b02
cmp dword [rbp + 0x2e8], 0x10
jne 0x140004b02
xorps xmm0, xmm0
mov qword [rsp + 0x390], r15
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x20]
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
call fcn.140003510
mov rbx, qword [0x14001cbd8]
mov qword [rbp + 8], r14
mov dword [rbp + 0x44], r14d
mov qword [rbp + 0x20], r14
mov dword [rbp + 0x3c], 0x114
mov qword [rsp + 0x60], r14
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp - 0x68], rax
mov r15, rax
test rax, rax
je 0x1400045ff
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov r8d, 0x6400000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x14000464e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x68]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov r15, qword [rsp + 0x390]
mov r13, qword [rsp + 0x398]
mov rdi, qword [rsp + 0x3a0]
mov rbx, qword [rsp + 0x3d0]
add rsp, 0x3a8
pop r14
pop r12
pop rsi
pop rbp
ret
mov rcx, qword [rbp + 0x2d8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rax, qword [rsp + 0x68]
mov dword [rsp + 0x54], r14d
mov ecx, dword [rax]
lea r15, [rax + 4]
mov dword [rbp - 0x7c], ecx
test ecx, ecx
je 0x140004a50
nop dword [rax + rax]
movzx eax, byte [r15 + 4]
mov rbx, 0xffffffffffffffff
mov r12d, dword [r15]
mov esi, eax
mov edi, eax
mov dword [rbp - 0x80], r12d
mov rax, qword [rbp + 0x2d8]
add r15, 5
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400046a2
test rbx, rbx
je 0x1400046c7
mov r8, rbx
lea rcx, [rbp + 0x70]
mov rdx, rax
call fcn.14001a970
mov byte [rbp + rbx + 0x70], 0x5c
inc rbx
test rsi, rsi
jne 0x1400046dd
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [r15 + rdi], 0
jne 0x1400046d3
lea rcx, [rbp + 0x70]
mov r8, rdi
add rcx, rbx
mov rdx, r15
call fcn.14001a970
lea rax, [rbx + rdi]
xor edx, edx
lea rcx, [rbp + 0x70]
mov byte [rbp + rax + 0x70], 0
add r15, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
xor eax, eax
mov edi, 1
mov dword [rsp + 0x50], eax
test r12d, r12d
je 0x140004a31
nop dword [rax + rax]
mov eax, dword [r15]
mov rbx, 0xffffffffffffffff
mov dword [rbp + 0x2e8], eax
movzx eax, byte [r15 + 4]
add r15, 5
mov esi, eax
mov edi, eax
lea rax, [rbp + 0x70]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140004741
test rbx, rbx
je 0x14000476d
mov r8, rbx
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x180]
call fcn.14001a970
mov byte [rbp + rbx + 0x180], 0x5c
inc rbx
test rsi, rsi
jne 0x14000478a
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp byte [r15 + rdi], 0
jne 0x140004780
lea rcx, [rbp + 0x180]
mov r8, rdi
add rcx, rbx
mov rdx, r15
call fcn.14001a970
lea rax, [rbx + rdi]
add r15, rsi
mov byte [rbp + rax + 0x180], 0
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x28], r15
test rax, rax
je 0x1400047d0
mov r8d, dword [rbp + 0x6c]
lea r9, [rbp + 0x180]
mov edx, r13d
mov ecx, 4
call rax
xor eax, eax
lea rcx, [rbp + 0x180]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov r12, rax
mov r9d, 0
cmove r12, r9
mov qword [rbp - 0x70], r12
test r12, r12
je 0x140004a46
mov ebx, dword [rbp + 0x2e8]
mov edi, 1
test ebx, ebx
je 0x140004a0b
mov r13d, r9d
mov eax, ebx
jmp 0x140004843
xor r9d, r9d
mov rsi, rax
sub rsi, r13
test r14, r14
jne 0x14000486f
mov r8d, dword [0x14001cbd8]
mov rdx, qword [rbp - 0x68]
mov rcx, qword [rbp - 0x50]
mov qword [rsp + 0x20], r9
lea r9, [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_ReadFile]
xor r9d, r9d
mov rax, qword [rbp - 0x68]
mov r15, r9
mov r8, qword [rsp + 0x58]
add rax, r14
mov r12, qword [0x14001cbd8]
mov qword [rbp - 0x58], rax
mov eax, 0x6400000
cmp rsi, rax
mov dword [rsp + 0x78], r9d
mov qword [rsp + 0x70], r8
cmova rsi, rax
mov qword [rbp - 0x78], r9
sub r12, r14
nop word [rax + rax]
mov rbx, qword [rbp + 8]
mov rdx, qword [rbp]
cmp rbx, rdx
mov qword [rbp - 0x60], r12
mov rax, rdx
cmove rbx, r9
sub rax, rbx
mov qword [rbp + 8], rbx
cmp rsi, rax
ja 0x1400048d6
lea rdx, [rbx + rsi]
mov r14, qword [rbp - 0x58]
lea rax, [rsp + 0x78]
mov r8, r14
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x60]
lea rcx, [rbp - 0x20]
call fcn.140003090
mov rcx, qword [rbp - 0x60]
mov edi, eax
mov rdx, qword [rbp - 8]
add r14, rcx
add qword [rbp - 0x78], rcx
add rdx, rbx
mov qword [rbp - 0x58], r14
sub r12, rcx
mov r14, qword [rbp + 8]
sub r14, rbx
mov rbx, qword [rsp + 0x70]
mov rcx, rbx
mov r8, r14
call fcn.14001a970
add rbx, r14
sub rsi, r14
add r15, r14
mov qword [rsp + 0x70], rbx
test edi, edi
jne 0x1400049b4
test r14, r14
je 0x14000494c
mov r9d, 0
test rsi, rsi
jne 0x1400048b0
mov rax, qword [rsp + 0x60]
xor esi, esi
add rax, qword [rbp - 0x78]
mov r14d, esi
cmp rax, qword [0x14001cbd8]
mov rdi, qword [rsp + 0x58]
mov r12, qword [rbp - 0x70]
cmovne r14, rax
add r13, r15
mov qword [rsp + 0x60], r14
test r15, r15
je 0x1400049c7
lea r9, [rsp + 0x7c]
mov qword [rsp + 0x20], rsi
mov r8d, r15d
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400049a4
mov qword [rsp + 0x60], r14
cmp dword [rsp + 0x7c], r15d
je 0x1400049c7
mov rcx, r12
mov edi, esi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140004a49
mov r14, qword [rsp + 0x60]
xor eax, eax
mov r12, qword [rbp - 0x70]
mov r15d, eax
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rbp + 0x2e0]
test rbx, rbx
je 0x1400049ea
mov ecx, dword [rbx]
lea r9, [0x140029d20]
mov r8, r15
mov rdx, rdi
call qword [0x140029d08]
mov dword [rbx], eax
mov ebx, dword [rbp + 0x2e8]
mov edi, 1
mov eax, ebx
cmp r13, rbx
jb 0x140004840
mov r15, qword [rbp - 0x28]
mov r13d, dword [rbp + 0x2f0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rsp + 0x50]
add r13d, ebx
inc ecx
mov dword [rbp + 0x2f0], r13d
mov dword [rsp + 0x50], ecx
cmp ecx, dword [rbp - 0x80]
jne 0x140004720
mov ecx, dword [rsp + 0x54]
inc ecx
mov dword [rsp + 0x54], ecx
cmp ecx, dword [rbp - 0x7c]
jne 0x140004680
jmp 0x140004a49
mov edi, r9d
mov rsi, qword [rbp + 0x2e0]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x58]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp - 0x68]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdx, qword [rbp - 0x18]
lea rcx, [0x14001cbf8]
call qword [0x14001cc00]
mov rdx, qword [rbp - 8]
lea rcx, [0x14001cbf8]
xor eax, eax
mov qword [rbp - 0x18], rax
call qword [0x14001cc00]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x68]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x140004aca
not dword [rsi]
mov eax, edi
jmp 0x140004620
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140004628