Function at 0x1400040b0
Capabilities:
Create directory
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
mov eax, 0x52f8
call fcn.140012420
sub rsp, rax
mov rax, qword [0x140016008]
xor rax, rsp
mov qword [rsp + 0x52e0], rax
mov byte [rsp + 0x70], 0
lea rdi, [rsp + 0x71]
xor eax, eax
mov ecx, 0x1ff
rep stosb byte [rdi], al
mov byte [rsp + 0xa90], 0
lea rdi, [rsp + 0xa91]
xor eax, eax
mov ecx, 0x484f
rep stosb byte [rdi], al
lea r8, [0x140018770]
lea rdx, str._sLog
lea rcx, [rsp + 0x70]
call fcn.1400059f0
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.1400123f0
test eax, eax
je 0x140004145
xor edx, edx
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rcx, [rsp + 0x60]
call fcn.140004090
lea rcx, [rsp + 0x60]
call fcn.140004070
mov qword [rsp + 0x280], rax
cmp dword [rsp + 0x5310], 1
jne 0x1400041a4
mov rax, qword [rsp + 0x280]
mov r9d, dword [rax + 0x10]
add r9d, 1
mov rax, qword [rsp + 0x280]
mov r8d, dword [rax + 0x14]
add r8d, 0x76c
lea rdx, str.TCLOG__04d__02d.txt
lea rcx, [rsp + 0xa90]
call fcn.1400059f0
jmp 0x1400041ec
cmp dword [rsp + 0x5310], 2
jne 0x1400041e7
mov rax, qword [rsp + 0x280]
mov r9d, dword [rax + 0x10]
add r9d, 1
mov rax, qword [rsp + 0x280]
mov r8d, dword [rax + 0x14]
add r8d, 0x76c
lea rdx, str.TC_BK__04d__02d.tcbak
lea rcx, [rsp + 0xa90]
call fcn.1400059f0
jmp 0x1400041ec
jmp 0x1400043a3
lea rdi, [rsp + 0x70]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
sub rdi, 1
lea rdx, [rsp + 0xa90]
xor ecx, ecx
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx], al
add rcx, 1
test al, al
jne 0x14000420a
mov qword [rsp + 0x278], 0
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.1400123f0
test eax, eax
jne 0x140004250
lea rdx, [0x140014688]
lea rcx, [rsp + 0x70]
call fcn.140005cc8
mov qword [rsp + 0x278], rax
jmp 0x140004269
lea rdx, [0x14001468c]
lea rcx, [rsp + 0x70]
call fcn.140005cc8
mov qword [rsp + 0x278], rax
cmp qword [rsp + 0x278], 0
jne 0x140004279
jmp 0x1400043a3
mov byte [rsp + 0x290], 0
lea rdi, [rsp + 0x291]
xor eax, eax
mov ecx, 0x7ff
rep stosb byte [rdi], al
lea rax, [rsp + 0x5320]
mov qword [rsp + 0x270], rax
mov r8, qword [rsp + 0x270]
mov rdx, qword [rsp + 0x5318]
lea rcx, [rsp + 0xa90]
call fcn.140005b0c
mov qword [rsp + 0x270], 0
mov rax, qword [rsp + 0x280]
mov ebx, dword [rax + 0x10]
add ebx, 1
mov rax, qword [rsp + 0x280]
mov edi, dword [rax + 0x14]
add edi, 0x76c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9d, eax
lea rax, [rsp + 0xa90]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x280]
mov eax, dword [rax]
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x280]
mov eax, dword [rax + 4]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x280]
mov eax, dword [rax + 8]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x280]
mov eax, dword [rax + 0xc]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], edi
mov r8d, dword [0x140018560]
lea rdx, str.PID__d__08d__04d__02d__02d__02d:_02d:_02d___s_r_n
lea rcx, [rsp + 0x290]
call fcn.1400059f0
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x290]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov r9, qword [rsp + 0x278]
mov r8d, 1
mov rdx, rcx
lea rcx, [rsp + 0x290]
call fcn.140005e70
mov rcx, qword [rsp + 0x278]
call fcn.140006344
mov rcx, qword [rsp + 0x52e0]
xor rcx, rsp
call fcn.1400059d0
add rsp, 0x52f8
pop rdi
pop rbx
ret