Function at 0x1400fb680
Capabilities:
Delete file
Write file on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x578]
sub rsp, 0x670
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
lea rax, vtable.CFunctionEnterExit.0
mov qword [rsp + 0x48], rax
lea rsi, str.ncsLIBValidateApplicationDataPaths
mov qword [rsp + 0x50], rsi
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x60]
call fcn.140249b10
mov r8, rsi
lea rdx, [0x1402862f8]
lea rcx, [rbp + 0x60]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp + 0x60]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
nop
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x160]
call fcn.140249b10
lea rdx, [0x14034eb30]
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, str.sas_data.tmp
lea rcx, [rbp + 0x160]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
xor edi, edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [rdi + 3]
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400fb811
mov r9d, 1
mov r8d, r9d
lea rdx, str.All_Users___Create_Success
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov dword [rsp + 0x60], 0x534153
xor edx, edx
mov r8d, 0xfc
lea rcx, [rsp + 0x64]
call fcn.140249b10
mov dword [rbp + 0x580], edi
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x580]
lea r8d, [rdi + 3]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400fb7dd
cmp dword [rbp + 0x580], 3
je 0x1400fb7f9
mov r9d, 1
mov r8d, r9d
lea rdx, str.All_Users___Failed_Write
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x1400fb873
xor edx, edx
mov r8d, 0x100
lea rcx, [rsp + 0x60]
call fcn.140249b10
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Failed_All_Users____d
lea rcx, [rsp + 0x60]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rsp + 0x60]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp + 0x160]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
lea rdx, [0x14034ec34]
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, str.sas_data.tmp
lea rcx, [rbp + 0x160]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 3]
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400fb973
mov r9d, 1
mov r8d, r9d
lea rdx, str.Current_User___Create_Success
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov dword [rsp + 0x60], 0x534153
xor edx, edx
mov r8d, 0xfc
lea rcx, [rsp + 0x64]
call fcn.140249b10
mov dword [rbp + 0x580], edi
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x580]
mov r8d, 3
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400fb93f
cmp dword [rbp + 0x580], 3
je 0x1400fb95b
mov r9d, 1
mov r8d, r9d
lea rdx, str.Current_User___Failed_Write
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x1400fb9d6
xor edx, edx
mov r8d, 0x100
lea rcx, [rsp + 0x60]
call fcn.140249b10
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Failed_All_Users____d
lea rcx, [rsp + 0x60]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rsp + 0x60]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp + 0x160]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
nop
xor edx, edx
mov r8d, 0x100
lea rcx, [rsp + 0x60]
call fcn.140249b10
mov r8, rsi
lea rdx, str._s___Leavex
lea rcx, [rsp + 0x60]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rsp + 0x60]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
nop
lea r11, [rsp + 0x670]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret