Function at 0x1400be6c8
Capabilities:
Create directory
Set file attributes
Write file on windows

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x770
mov qword [r11 - 0x5a8], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x760], rax
mov dil, dl
mov r13, rcx
lea rbx, [0x140023590]
mov qword [r11 - 0x718], rbx
lea rax, [0x140023850]
mov qword [r11 - 0x710], rax
lea rax, [0x140023578]
mov qword [r11 - 0x708], rax
mov dword [rsp + 0x98], 0x7c
mov esi, 1
mov dword [rsp + 0x9c], esi
mov r14d, 0xff
mov dword [r11 - 0x6f8], r14d
xor r15d, r15d
mov dword [rsp + 0x120], 0x1000000
xor edx, edx
lea r8d, [rsi + 0x77]
lea rcx, [r11 - 0x6f0]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x140]
call fcn.140052e50
nop
mov qword [rsp + 0x128], r15
mov dword [rsp + 0x220], r15d
mov word [rsp + 0x224], 0x500
lea edx, [rsi + 0x7f]
lea r8d, [rsi + 1]
lea rcx, [rsp + 0x240]
call qword [sym.imp.api_ms_win_security_base_l1_2_0.dll_InitializeAcl]
test eax, eax
jne 0x1400be85d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov r12d, 0x80070000
test eax, eax
jle 0x1400be7da
movzx eax, ax
or eax, r12d
mov dword [rsp + 0x148], eax
mov qword [rsp + 0x80], rbx
lea rax, [0x140023850]
mov qword [rsp + 0x88], rax
lea rax, [0x140023578]
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x98], 0x91
mov dword [rsp + 0x9c], esi
mov dword [rsp + 0xa0], r14d
mov dword [rsp + 0x120], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xa8]
call sub.msvcrt.dll_memset
lea r8, [0x140010148]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x140]
call fcn.14006dcc8
jmp 0x1400be863
mov r12d, 0x80070000
lea rax, [rsp + 0x128]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8d, [r9 + 0x12]
mov dl, sil
lea rcx, [rsp + 0x220]
call qword [sym.imp.api_ms_win_security_base_l1_2_0.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x1400be940
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
test eax, eax
jle 0x1400be8be
movzx eax, ax
or eax, r12d
mov dword [rsp + 0x148], eax
mov qword [rsp + 0x80], rbx
lea rax, [0x140023850]
mov qword [rsp + 0x88], rax
lea rax, [0x140023578]
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x98], 0xa5
mov dword [rsp + 0x9c], esi
mov dword [rsp + 0xa0], r14d
mov dword [rsp + 0x120], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xa8]
call sub.msvcrt.dll_memset
lea r8, [0x1400238b0]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x140]
call fcn.14006dcc8
nop
mov r9, qword [rsp + 0x128]
mov edx, 2
mov r8d, 0x101f0000
lea rcx, [rsp + 0x240]
call qword [sym.imp.api_ms_win_security_base_l1_2_0.dll_AddAccessAllowedAce]
test eax, eax
jne 0x1400be9fa
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
test eax, eax
jle 0x1400be979
movzx eax, ax
or eax, r12d
mov dword [rsp + 0x148], eax
mov qword [rsp + 0x80], rbx
lea rax, [0x140023850]
mov qword [rsp + 0x88], rax
lea rax, [0x140023578]
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x98], 0xb4
mov dword [rsp + 0x9c], esi
mov dword [rsp + 0xa0], r14d
mov dword [rsp + 0x120], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xa8]
call sub.msvcrt.dll_memset
lea r8, [0x140010168]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x140]
call fcn.14006dcc8
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.api_ms_win_security_base_l1_2_0.dll_FreeSid]
mov qword [rsp + 0x128], r15
mov edx, esi
lea rcx, [rsp + 0x1f8]
call qword [sym.imp.api_ms_win_security_base_l1_2_0.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x1400beab9
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
test eax, eax
jle 0x1400bea38
movzx eax, ax
or eax, r12d
mov dword [rsp + 0x148], eax
mov qword [rsp + 0x80], rbx
lea rax, [0x140023850]
mov qword [rsp + 0x88], rax
lea rax, [0x140023578]
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x98], SetErrorInfo
mov dword [rsp + 0x9c], esi
mov dword [rsp + 0xa0], r14d
mov dword [rsp + 0x120], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xa8]
call sub.msvcrt.dll_memset
lea r8, [0x140010190]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x140]
call fcn.14006dcc8
xor r9d, r9d
lea r8, [rsp + 0x240]
mov edx, esi
lea rcx, [rsp + 0x1f8]
call qword [sym.imp.api_ms_win_security_base_l1_2_0.dll_SetSecurityDescriptorDacl]
test eax, eax
jne 0x1400beb6d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
test eax, eax
jle 0x1400beaec
movzx eax, ax
or eax, r12d
mov dword [rsp + 0x148], eax
mov qword [rsp + 0x80], rbx
lea rax, [0x140023850]
mov qword [rsp + 0x88], rax
lea rax, [0x140023578]
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x98], SetErrorInfo
mov dword [rsp + 0x9c], esi
mov dword [rsp + 0xa0], r14d
mov dword [rsp + 0x120], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xa8]
call sub.msvcrt.dll_memset
lea r8, [0x1400101d0]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x140]
call fcn.14006dcc8
xor eax, eax
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x1b8], rax
mov qword [rsp + 0x1c0], rax
mov dword [rsp + 0x1b0], 0x18
lea rax, [rsp + 0x1f8]
mov qword [rsp + 0x1b8], rax
mov dword [rsp + 0x1c0], esi
lea rcx, [rsp + 0x550]
call fcn.1400bf550
lea r9, [rsp + 0x550]
lea r8, [0x1400238e8]
mov edx, 0x144
lea rcx, [rsp + 0x2c0]
call fcn.14004af20
mov ebx, eax
mov dword [rsp + 0x148], eax
test eax, eax
jns 0x1400bec6c
lea rax, [0x140023590]
mov qword [rsp + 0x80], rax
lea rax, [0x140023850]
mov qword [rsp + 0x88], rax
lea rax, [0x140023578]
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x98], 0xdb
mov dword [rsp + 0x9c], esi
mov dword [rsp + 0xa0], r14d
mov dword [rsp + 0x120], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xa8]
call sub.msvcrt.dll_memset
lea r9, [0x140010120]
mov r8d, ebx
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x140]
call fcn.1401027cc
lea rdx, [rsp + 0x2c0]
call fcn.1400bf530
test al, al
jne 0x1400bedec
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x2c0]
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_CreateDirectoryW]
test eax, eax
jne 0x1400bed39
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
test eax, eax
jle 0x1400becaf
movzx eax, ax
or eax, r12d
mov dword [rsp + 0x148], eax
lea rbx, [0x140023590]
mov qword [rsp + 0x80], rbx
lea rax, [0x140023850]
mov qword [rsp + 0x88], rax
lea rax, [0x140023578]
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x98], 0xe4
mov dword [rsp + 0x9c], esi
mov dword [rsp + 0xa0], r14d
mov dword [rsp + 0x120], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xa8]
call sub.msvcrt.dll_memset
lea r8, [0x140023920]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x140]
call fcn.14006dcc8
jmp 0x1400bed40
lea rbx, [0x140023590]
mov edx, 0x2006
lea rcx, [rsp + 0x2c0]
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_SetFileAttributesW]
test eax, eax
jne 0x1400bedec
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
test eax, eax
jle 0x1400bed6b
movzx eax, ax
or eax, r12d
mov dword [rsp + 0x148], eax
mov qword [rsp + 0x80], rbx
lea rax, [0x140023850]
mov qword [rsp + 0x88], rax
lea rax, [0x140023578]
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x98], 0xf2
mov dword [rsp + 0x9c], esi
mov dword [rsp + 0xa0], r14d
mov dword [rsp + 0x120], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xa8]
call sub.msvcrt.dll_memset
lea r8, [0x140023940]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x140]
call fcn.14006dcc8
lea rdx, [0x1400236a0]
lea rax, [0x140023640]
test dil, dil
cmove rdx, rax
movzx eax, byte [r13 + 0x1a3]
movzx ecx, byte [r13 + 0x1a2]
movzx r8d, byte [r13 + 0x1a1]
movzx r9d, byte [r13 + 0x1a0]
movzx r10d, byte [r13 + 0x19f]
movzx r11d, byte [r13 + 0x19e]
movzx ebx, byte [r13 + 0x19d]
movzx edi, byte [r13 + 0x19c]
movzx esi, word [r13 + 0x19a]
movzx r14d, word [r13 + 0x198]
mov qword [rsp + 0x78], rdx
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], ecx
mov dword [rsp + 0x60], r8d
mov dword [rsp + 0x58], r9d
mov dword [rsp + 0x50], r10d
mov dword [rsp + 0x48], r11d
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], r14d
mov eax, dword [r13 + 0x194]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x550]
lea r8, [0x1400237a0]
mov edx, 0x144
lea rcx, [rsp + 0x2c0]
call fcn.14004af20
mov ebx, eax
mov dword [rsp + 0x148], eax
mov edi, 1
test eax, eax
jns 0x1400bef4c
lea rax, [0x140023590]
mov qword [rsp + 0x80], rax
lea rax, [0x140023850]
mov qword [rsp + 0x88], rax
lea rax, [0x140023578]
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x98], 0xff
mov dword [rsp + 0x9c], edi
mov dword [rsp + 0xa0], 0xff
mov dword [rsp + 0x120], 0x1000000
xor edx, edx
lea r8d, [rdi + 0x77]
lea rcx, [rsp + 0xa8]
call sub.msvcrt.dll_memset
lea r9, [0x140010120]
mov r8d, ebx
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x140]
call fcn.1401027cc
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], edi
lea r9, [rsp + 0x1b0]
mov edx, 0xc0000000
mov r8d, 3
lea rcx, [rsp + 0x2c0]
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_CreateFileW]
mov rbx, rax
lea rax, [0x140001b60]
mov qword [rsp + 0x1d0], rax
mov qword [rsp + 0x1d8], rbx
cmp rbx, 0xffffffffffffffff
jne 0x1400bf03f
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
test eax, eax
jle 0x1400befb2
movzx eax, ax
or eax, r12d
mov dword [rsp + 0x148], eax
lea rsi, [0x140023590]
mov qword [rsp + 0x80], rsi
lea r14, [0x140023850]
mov qword [rsp + 0x88], r14
lea r13, [0x140023578]
mov qword [rsp + 0x90], r13
mov dword [rsp + 0x98], VarUI4FromDisp
mov dword [rsp + 0x9c], edi
mov dword [rsp + 0xa0], 0xff
mov dword [rsp + 0x120], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xa8]
call sub.msvcrt.dll_memset
lea r8, [0x140023968]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x140]
call fcn.14006dcc8
jmp 0x1400bf054
lea rsi, [0x140023590]
lea r14, [0x140023850]
lea r13, [0x140023578]
mov edx, 0x2006
lea rcx, [rsp + 0x2c0]
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_SetFileAttributesW]
test eax, eax
jne 0x1400bf0f5
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
test eax, eax
jle 0x1400bf07f
movzx eax, ax
or eax, r12d
mov dword [rsp + 0x148], eax
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x90], r13
mov dword [rsp + 0x98], 0x11f
mov dword [rsp + 0x9c], edi
mov dword [rsp + 0xa0], 0xff
mov dword [rsp + 0x120], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xa8]
call sub.msvcrt.dll_memset
lea r8, [0x140023940]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x140]
call fcn.14006dcc8
mov dword [rsp + 0x228], 0x9d4feff5
mov qword [rsp + 0x22c], 1
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x134]
mov r8d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rdx, [rsp + 0x228]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_WriteFile]
test eax, eax
je 0x1400bf142
cmp dword [rsp + 0x134], 0xc
je 0x1400bf1c9
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
test eax, eax
jle 0x1400bf152
movzx eax, ax
or eax, r12d
mov dword [rsp + 0x148], eax
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x90], r13
mov dword [rsp + 0x98], 0x12e
mov dword [rsp + 0x9c], edi
mov dword [rsp + 0xa0], 0xff
mov dword [rsp + 0x120], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xa8]
call sub.msvcrt.dll_memset
lea r8, [0x140023980]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x140]
call fcn.14006dcc8
nop
lea rcx, [rsp + 0x1d0]
call fcn.140070dec
nop
jmp 0x1400bf1df
mov eax, dword [rsp + 0x148]
test eax, eax
jns 0x1400bf220
mov rcx, qword [rsp + 0x128]
test rcx, rcx
je 0x1400bf204
call qword [sym.imp.api_ms_win_security_base_l1_2_0.dll_FreeSid]
mov eax, dword [rsp + 0x148]
mov dword [rsp + 0x130], eax
lea rdx, [0x140153178]
lea rcx, [rsp + 0x130]
call sub.msvcrt.dll__CxxThrowException
nop
lea rcx, [rsp + 0x140]
call fcn.140050f50
mov rcx, qword [rsp + 0x760]
xor rcx, rsp
call fcn.14005dc70
lea r11, [rsp + 0x770]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret