Function at 0x10009d530
Capabilities:
Check if file exists
Create directory
Get file attributes
Set file attributes
Write file on windows

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x820
mov qword [rsp + 0x210], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov rax, qword [0x100176150]
xor rax, rsp
mov qword [rsp + 0x810], rax
mov byte [rsp + 0x80], dl
mov qword [rsp + 0x1e8], rcx
lea r14, [0x10001db00]
mov qword [r11 - 0x7b8], r14
lea rbx, [0x10001dbc0]
mov qword [r11 - 0x7b0], rbx
lea r15, [0x10001dae8]
mov qword [r11 - 0x7a8], r15
mov dword [rsp + 0xa8], 0x7c
mov r12d, 1
mov dword [r11 - 0x79c], r12d
mov dword [rsp + 0xb0], 0xff
xor r13d, r13d
mov word [r11 - 0x718], r13w
mov byte [r11 - 0x716], r13b
mov byte [r11 - 0x715], r12b
xor edx, edx
lea r8d, [r12 + 0x77]
lea rcx, [r11 - 0x790]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x150]
call fcn.1000e842c
nop
mov qword [rsp + 0x138], r13
mov byte [rsp + 0x2e8], r13b
mov byte [rsp + 0x2e9], r13b
mov byte [rsp + 0x2ea], r13b
mov byte [rsp + 0x2eb], r13b
mov byte [rsp + 0x2ec], r13b
mov byte [rsp + 0x2ed], 5
lea edx, [r12 + 0x7f]
lea r8d, [r12 + 1]
lea rcx, [rsp + 0x2f0]
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
cmp eax, r13d
jne 0x10009d737
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
mov esi, 0x80070000
or edi, esi
cmp eax, r13d
cmovle edi, eax
mov dword [rsp + 0x158], edi
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xa8], 0x91
mov dword [rsp + 0xac], r12d
mov dword [rsp + 0xb0], 0xff
mov word [rsp + 0x130], r13w
mov byte [rsp + 0x132], r13b
mov byte [rsp + 0x133], r12b
xor edx, edx
lea r8d, [r12 + 0x77]
lea rcx, [rsp + 0xb8]
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x90]
mov qword [rsp + 0x140], r11
cmp edi, r13d
jge 0x10009d728
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x240]
call fcn.1000e7e00
lea r9, [0x10000a078]
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1000e9bfc
nop
lea rcx, [rsp + 0x90]
call fcn.1000e7e7c
jmp 0x10009d73c
mov esi, 0x80070000
lea rax, [rsp + 0x138]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8d, [r9 + 0x12]
mov dl, r12b
lea rcx, [rsp + 0x2e8]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp eax, r13d
jne 0x10009d855
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, esi
cmp eax, r13d
cmovle edi, eax
mov dword [rsp + 0x158], edi
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xa8], 0xa5
mov dword [rsp + 0xac], r12d
mov dword [rsp + 0xb0], 0xff
mov word [rsp + 0x130], r13w
mov byte [rsp + 0x132], r13b
mov byte [rsp + 0x133], r12b
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xb8]
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x90]
mov qword [rsp + 0x140], r11
cmp edi, r13d
jge 0x10009d847
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x240]
call fcn.1000e7e00
lea r9, [0x10001dc20]
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1000e9bfc
nop
lea rcx, [rsp + 0x90]
call fcn.1000e7e7c
nop
mov r9, qword [rsp + 0x138]
mov edx, 2
mov r8d, 0x101f0000
lea rcx, [rsp + 0x2f0]
call qword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
cmp eax, r13d
jne 0x10009d94a
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r10d, ax
or r10d, esi
cmp eax, r13d
cmovle r10d, eax
mov dword [rsp + 0x158], r10d
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xa8], 0xb4
mov dword [rsp + 0xac], r12d
mov edi, 0xff
mov dword [rsp + 0xb0], edi
mov word [rsp + 0x130], r13w
mov byte [rsp + 0x132], r13b
mov byte [rsp + 0x133], r12b
movzx ecx, r13w
cmp cx, 0xf
jae 0x10009d90b
movzx eax, cx
mov qword [rdx + rax*8 + 0x28], r13
add cx, r12w
jmp 0x10009d8f7
mov qword [rsp + 0x88], rdx
cmp r10d, r13d
jge 0x10009d940
lea rcx, [rsp + 0x240]
call fcn.1000e7e00
lea r9, [0x10000a098]
mov r8d, r10d
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1000e9bfc
nop
mov rcx, rdx
call fcn.1000e7e7c
jmp 0x10009d94f
mov edi, 0xff
mov rcx, qword [rsp + 0x138]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov qword [rsp + 0x138], r13
mov edx, r12d
lea rcx, [rsp + 0x218]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
cmp eax, r13d
jne 0x10009da43
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r10d, ax
or r10d, esi
cmp eax, r13d
cmovle r10d, eax
mov dword [rsp + 0x158], r10d
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xa8], SetErrorInfo
mov dword [rsp + 0xac], r12d
mov dword [rsp + 0xb0], edi
mov word [rsp + 0x130], r13w
mov byte [rsp + 0x132], r13b
mov byte [rsp + 0x133], r12b
movzx ecx, r13w
cmp cx, 0xf
jae 0x10009da06
movzx eax, cx
mov qword [rdx + rax*8 + 0x28], r13
add cx, r12w
jmp 0x10009d9f2
mov qword [rsp + 0x88], rdx
cmp r10d, r13d
jge 0x10009da3b
lea rcx, [rsp + 0x240]
call fcn.1000e7e00
lea r9, [0x10000a0c0]
mov r8d, r10d
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1000e9bfc
nop
mov rcx, rdx
call fcn.1000e7e7c
xor r9d, r9d
lea r8, [rsp + 0x2f0]
mov edx, r12d
lea rcx, [rsp + 0x218]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
cmp eax, r13d
jne 0x10009db2c
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r10d, ax
or r10d, esi
cmp eax, r13d
cmovle r10d, eax
mov dword [rsp + 0x158], r10d
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xa8], SetErrorInfo
mov dword [rsp + 0xac], r12d
mov dword [rsp + 0xb0], edi
mov word [rsp + 0x130], r13w
mov byte [rsp + 0x132], r13b
mov byte [rsp + 0x133], r12b
movzx ecx, r13w
cmp cx, 0xf
jae 0x10009daef
movzx eax, cx
mov qword [rdx + rax*8 + 0x28], r13
add cx, r12w
jmp 0x10009dadb
mov qword [rsp + 0x88], rdx
cmp r10d, r13d
jge 0x10009db24
lea rcx, [rsp + 0x240]
call fcn.1000e7e00
lea r9, [0x10000a100]
mov r8d, r10d
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1000e9bfc
nop
mov rcx, rdx
call fcn.1000e7e7c
xor eax, eax
mov qword [rsp + 0x1d0], rax
mov qword [rsp + 0x1d8], rax
mov qword [rsp + 0x1e0], rax
mov dword [rsp + 0x1d0], AtlInternalQueryInterface
lea rax, [rsp + 0x218]
mov qword [rsp + 0x1d8], rax
mov dword [rsp + 0x1e0], r12d
lea rcx, [rsp + 0x600]
call fcn.10009d29c
lea r9, [rsp + 0x600]
lea r8, [0x10001dc58]
mov edx, 0x144
lea rcx, [rsp + 0x370]
call fcn.100052890
mov r8d, eax
mov dword [rsp + 0x158], eax
cmp eax, r13d
jge 0x10009dc25
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xa8], 0xdb
mov dword [rsp + 0xac], r12d
mov dword [rsp + 0xb0], edi
mov word [rsp + 0x130], r13w
mov byte [rsp + 0x132], r13b
mov byte [rsp + 0x133], r12b
movzx ecx, r13w
cmp cx, 0xf
jae 0x10009dc11
movzx eax, cx
mov qword [rdx + rax*8 + 0x28], r13
add cx, r12w
jmp 0x10009dbfd
lea r9, [0x10000a040]
lea rcx, [rsp + 0x150]
call fcn.1000ea25c
lea rcx, [rsp + 0x370]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10009ddff
lea rdx, [rsp + 0x1d0]
lea rcx, [rsp + 0x370]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, r13d
jne 0x10009dd1f
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r10d, ax
or r10d, esi
cmp eax, r13d
cmovle r10d, eax
mov dword [rsp + 0x158], r10d
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xa8], 0xe4
mov dword [rsp + 0xac], r12d
mov dword [rsp + 0xb0], edi
mov word [rsp + 0x130], r13w
mov byte [rsp + 0x132], r13b
mov byte [rsp + 0x133], r12b
movzx ecx, r13w
cmp cx, 0xf
jae 0x10009dce2
movzx eax, cx
mov qword [rdx + rax*8 + 0x28], r13
add cx, r12w
jmp 0x10009dcce
mov qword [rsp + 0x88], rdx
cmp r10d, r13d
jge 0x10009dd17
lea rcx, [rsp + 0x240]
call fcn.1000e7e00
lea r9, [0x10001dc90]
mov r8d, r10d
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1000e9bfc
nop
mov rcx, rdx
call fcn.1000e7e7c
mov edx, 0x2006
lea rcx, [rsp + 0x370]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp eax, r13d
jne 0x10009ddff
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r10d, ax
or r10d, esi
cmp eax, r13d
cmovle r10d, eax
mov dword [rsp + 0x158], r10d
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xa8], 0xf2
mov dword [rsp + 0xac], r12d
mov dword [rsp + 0xb0], edi
mov word [rsp + 0x130], r13w
mov byte [rsp + 0x132], r13b
mov byte [rsp + 0x133], r12b
movzx ecx, r13w
cmp cx, 0xf
jae 0x10009ddc2
movzx eax, cx
mov qword [rdx + rax*8 + 0x28], r13
add cx, r12w
jmp 0x10009ddae
mov qword [rsp + 0x88], rdx
cmp r10d, r13d
jge 0x10009ddf7
lea rcx, [rsp + 0x240]
call fcn.1000e7e00
lea r9, [0x10001dcb0]
mov r8d, r10d
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1000e9bfc
nop
mov rcx, rdx
call fcn.1000e7e7c
lea rax, [0x10001d9d0]
lea r12, [0x10001da30]
cmp byte [rsp + 0x80], r13b
cmovne r12, rax
mov rsi, qword [rsp + 0x1e8]
movzx eax, byte [rsi + 0x1a3]
movzx ecx, byte [rsi + 0x1a2]
movzx r8d, byte [rsi + 0x1a1]
movzx r9d, byte [rsi + 0x1a0]
movzx r10d, byte [rsi + 0x19f]
movzx r11d, byte [rsi + 0x19e]
movzx edx, byte [rsi + 0x19d]
movzx ebx, byte [rsi + 0x19c]
movzx edi, word [rsi + 0x19a]
movzx esi, word [rsi + 0x198]
mov qword [rsp + 0x78], r12
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], ecx
mov dword [rsp + 0x60], r8d
mov dword [rsp + 0x58], r9d
mov dword [rsp + 0x50], r10d
mov dword [rsp + 0x48], r11d
mov dword [rsp + 0x40], edx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov rcx, qword [rsp + 0x1e8]
mov eax, dword [rcx + 0x194]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x600]
lea r8, [0x10001d880]
mov edx, 0x144
lea rcx, [rsp + 0x370]
call fcn.100052890
mov r8d, eax
mov dword [rsp + 0x158], eax
cmp eax, r13d
jge 0x10009df6f
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x90], r14
lea rbx, [0x10001dbc0]
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], r15
mov eax, 0xff
mov dword [rsp + 0xa8], eax
mov r12d, 1
mov dword [rsp + 0xac], r12d
mov dword [rsp + 0xb0], eax
mov word [rsp + 0x130], r13w
mov byte [rsp + 0x132], r13b
mov byte [rsp + 0x133], r12b
movzx ecx, r13w
cmp cx, 0xf
jae 0x10009df5b
movzx eax, cx
mov qword [rdx + rax*8 + 0x28], r13
add cx, r12w
jmp 0x10009df47
lea r9, [0x10000a040]
lea rcx, [rsp + 0x150]
call fcn.1000ea25c
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov r12d, 1
mov dword [rsp + 0x20], r12d
lea r9, [rsp + 0x1d0]
mov edx, 0xc0000000
lea r8d, [r12 + 2]
lea rcx, [rsp + 0x370]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
lea rax, [0x10000d458]
mov qword [rsp + 0x1e8], rax
mov qword [rsp + 0x1f0], rdi
cmp rdi, 0xffffffffffffffff
jne 0x10009e0a1
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r10d, ax
mov esi, 0x80070000
or r10d, esi
cmp eax, r13d
cmovle r10d, eax
mov dword [rsp + 0x158], r10d
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x90], r14
lea rbx, [0x10001dbc0]
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xa8], 0x112
mov dword [rsp + 0xac], r12d
mov dword [rsp + 0xb0], 0xff
mov word [rsp + 0x130], r13w
mov byte [rsp + 0x132], r13b
mov byte [rsp + 0x133], r12b
movzx ecx, r13w
cmp cx, 0xf
jae 0x10009e062
movzx eax, cx
mov qword [rdx + rax*8 + 0x28], r13
add cx, r12w
jmp 0x10009e04e
mov qword [rsp + 0x88], rdx
cmp r10d, r13d
jge 0x10009e097
lea rcx, [rsp + 0x240]
call fcn.1000e7e00
lea r9, [0x10001dcd8]
mov r8d, r10d
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1000e9bfc
nop
mov rcx, rdx
call fcn.1000e7e7c
jmp 0x10009e0ad
lea rbx, [0x10001dbc0]
mov esi, 0x80070000
mov edx, 0x2006
lea rcx, [rsp + 0x370]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp eax, r13d
jne 0x10009e191
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r10d, ax
or r10d, esi
cmp eax, r13d
cmovle r10d, eax
mov dword [rsp + 0x158], r10d
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xa8], 0x11f
mov dword [rsp + 0xac], r12d
mov dword [rsp + 0xb0], 0xff
mov word [rsp + 0x130], r13w
mov byte [rsp + 0x132], r13b
mov byte [rsp + 0x133], r12b
movzx ecx, r13w
cmp cx, 0xf
jae 0x10009e154
movzx eax, cx
mov qword [rdx + rax*8 + 0x28], r13
add cx, r12w
jmp 0x10009e140
mov qword [rsp + 0x88], rdx
cmp r10d, r13d
jge 0x10009e189
lea rcx, [rsp + 0x240]
call fcn.1000e7e00
lea r9, [0x10001dcb0]
mov r8d, r10d
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1000e9bfc
nop
mov rcx, rdx
call fcn.1000e7e7c
mov dword [rsp + 0x1c0], 0x9d4feff5
mov dword [rsp + 0x1c4], r12d
mov dword [rsp + 0x1c8], r13d
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x140]
mov r8d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rdx, [rsp + 0x1c0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, r13d
je 0x10009e1e3
cmp dword [rsp + 0x140], 0xc
je 0x10009e2ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r10d, ax
or r10d, esi
cmp eax, r13d
cmovle r10d, eax
mov dword [rsp + 0x158], r10d
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xa8], 0x12e
mov dword [rsp + 0xac], r12d
mov dword [rsp + 0xb0], 0xff
mov word [rsp + 0x130], r13w
mov byte [rsp + 0x132], r13b
mov byte [rsp + 0x133], r12b
movzx ecx, r13w
cmp cx, 0xf
jae 0x10009e26e
movzx eax, cx
mov qword [rdx + rax*8 + 0x28], r13
add cx, r12w
jmp 0x10009e25a
mov qword [rsp + 0x88], rdx
cmp r10d, r13d
jge 0x10009e2a3
lea rcx, [rsp + 0x240]
call fcn.1000e7e00
lea r9, [0x10001dcf0]
mov r8d, r10d
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1000e9bfc
nop
mov rcx, rdx
call fcn.1000e7e7c
nop
cmp rdi, 0xffffffffffffffff
je 0x10009e2bc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x10009e2d0
mov eax, dword [rsp + 0x158]
cmp eax, r13d
jge 0x10009e312
mov rcx, qword [rsp + 0x138]
cmp rcx, r13
je 0x10009e2f6
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [rsp + 0x158]
mov dword [rsp + 0x148], eax
lea rdx, [0x1001731d8]
lea rcx, [rsp + 0x148]
call sub.msvcrt.dll__CxxThrowException
nop
lea rcx, [rsp + 0x150]
call fcn.1000e8518
mov rcx, qword [rsp + 0x810]
xor rcx, rsp
call fcn.100130df0
lea r11, [rsp + 0x820]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret