Function at 0x10009d358
Capabilities:
Check if file exists
Create directory
Get file attributes
Set file attributes
Write file on windows

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x820
mov qword [rsp + 0x210], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov rax, qword [0x100176150]
xor rax, rsp
mov qword [rsp + 0x810], rax
mov byte [rsp + 0x80], dl
mov qword [rsp + 0x1e8], rcx
lea r14, [0x10001db10]
mov qword [r11 - 0x7b8], r14
lea rbx, [0x10001dbd0]
mov qword [r11 - 0x7b0], rbx
lea r15, [0x10001daf8]
mov qword [r11 - 0x7a8], r15
mov dword [rsp + 0xa8], 0x7c
mov r12d, 1
mov dword [r11 - 0x79c], r12d
mov dword [rsp + 0xb0], 0xff
xor r13d, r13d
mov word [r11 - 0x718], r13w
mov byte [r11 - 0x716], r13b
mov byte [r11 - 0x715], r12b
xor edx, edx
lea r8d, [r12 + 0x77]
lea rcx, [r11 - 0x790]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x150]
call fcn.1000e8000
nop
mov qword [rsp + 0x138], r13
mov byte [rsp + 0x2e8], r13b
mov byte [rsp + 0x2e9], r13b
mov byte [rsp + 0x2ea], r13b
mov byte [rsp + 0x2eb], r13b
mov byte [rsp + 0x2ec], r13b
mov byte [rsp + 0x2ed], 5
lea edx, [r12 + 0x7f]
lea r8d, [r12 + 1]
lea rcx, [rsp + 0x2f0]
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
cmp eax, r13d
jne 0x10009d55f
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
mov esi, 0x80070000
or edi, esi
cmp eax, r13d
cmovle edi, eax
mov dword [rsp + 0x158], edi
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xa8], 0x91
mov dword [rsp + 0xac], r12d
mov dword [rsp + 0xb0], 0xff
mov word [rsp + 0x130], r13w
mov byte [rsp + 0x132], r13b
mov byte [rsp + 0x133], r12b
xor edx, edx
lea r8d, [r12 + 0x77]
lea rcx, [rsp + 0xb8]
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x90]
mov qword [rsp + 0x140], r11
cmp edi, r13d
jge 0x10009d550
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x240]
call fcn.1000e79d4
lea r9, [0x10000a078]
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1000e97d0
nop
lea rcx, [rsp + 0x90]
call fcn.1000e7a50
jmp 0x10009d564
mov esi, 0x80070000
lea rax, [rsp + 0x138]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8d, [r9 + 0x12]
mov dl, r12b
lea rcx, [rsp + 0x2e8]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp eax, r13d
jne 0x10009d67d
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, esi
cmp eax, r13d
cmovle edi, eax
mov dword [rsp + 0x158], edi
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xa8], 0xa5
mov dword [rsp + 0xac], r12d
mov dword [rsp + 0xb0], 0xff
mov word [rsp + 0x130], r13w
mov byte [rsp + 0x132], r13b
mov byte [rsp + 0x133], r12b
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xb8]
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x90]
mov qword [rsp + 0x140], r11
cmp edi, r13d
jge 0x10009d66f
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x240]
call fcn.1000e79d4
lea r9, [0x10001dc30]
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1000e97d0
nop
lea rcx, [rsp + 0x90]
call fcn.1000e7a50
nop
mov r9, qword [rsp + 0x138]
mov edx, 2
mov r8d, 0x101f0000
lea rcx, [rsp + 0x2f0]
call qword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
cmp eax, r13d
jne 0x10009d772
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r10d, ax
or r10d, esi
cmp eax, r13d
cmovle r10d, eax
mov dword [rsp + 0x158], r10d
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xa8], 0xb4
mov dword [rsp + 0xac], r12d
mov edi, 0xff
mov dword [rsp + 0xb0], edi
mov word [rsp + 0x130], r13w
mov byte [rsp + 0x132], r13b
mov byte [rsp + 0x133], r12b
movzx ecx, r13w
cmp cx, 0xf
jae 0x10009d733
movzx eax, cx
mov qword [rdx + rax*8 + 0x28], r13
add cx, r12w
jmp 0x10009d71f
mov qword [rsp + 0x88], rdx
cmp r10d, r13d
jge 0x10009d768
lea rcx, [rsp + 0x240]
call fcn.1000e79d4
lea r9, [0x10000a098]
mov r8d, r10d
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1000e97d0
nop
mov rcx, rdx
call fcn.1000e7a50
jmp 0x10009d777
mov edi, 0xff
mov rcx, qword [rsp + 0x138]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov qword [rsp + 0x138], r13
mov edx, r12d
lea rcx, [rsp + 0x218]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
cmp eax, r13d
jne 0x10009d86b
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r10d, ax
or r10d, esi
cmp eax, r13d
cmovle r10d, eax
mov dword [rsp + 0x158], r10d
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xa8], 0xbf
mov dword [rsp + 0xac], r12d
mov dword [rsp + 0xb0], edi
mov word [rsp + 0x130], r13w
mov byte [rsp + 0x132], r13b
mov byte [rsp + 0x133], r12b
movzx ecx, r13w
cmp cx, 0xf
jae 0x10009d82e
movzx eax, cx
mov qword [rdx + rax*8 + 0x28], r13
add cx, r12w
jmp 0x10009d81a
mov qword [rsp + 0x88], rdx
cmp r10d, r13d
jge 0x10009d863
lea rcx, [rsp + 0x240]
call fcn.1000e79d4
lea r9, [0x10000a0c0]
mov r8d, r10d
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1000e97d0
nop
mov rcx, rdx
call fcn.1000e7a50
xor r9d, r9d
lea r8, [rsp + 0x2f0]
mov edx, r12d
lea rcx, [rsp + 0x218]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
cmp eax, r13d
jne 0x10009d954
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r10d, ax
or r10d, esi
cmp eax, r13d
cmovle r10d, eax
mov dword [rsp + 0x158], r10d
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xa8], 0xc5
mov dword [rsp + 0xac], r12d
mov dword [rsp + 0xb0], edi
mov word [rsp + 0x130], r13w
mov byte [rsp + 0x132], r13b
mov byte [rsp + 0x133], r12b
movzx ecx, r13w
cmp cx, 0xf
jae 0x10009d917
movzx eax, cx
mov qword [rdx + rax*8 + 0x28], r13
add cx, r12w
jmp 0x10009d903
mov qword [rsp + 0x88], rdx
cmp r10d, r13d
jge 0x10009d94c
lea rcx, [rsp + 0x240]
call fcn.1000e79d4
lea r9, [0x10000a100]
mov r8d, r10d
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1000e97d0
nop
mov rcx, rdx
call fcn.1000e7a50
xor eax, eax
mov qword [rsp + 0x1d0], rax
mov qword [rsp + 0x1d8], rax
mov qword [rsp + 0x1e0], rax
mov dword [rsp + 0x1d0], 0x18
lea rax, [rsp + 0x218]
mov qword [rsp + 0x1d8], rax
mov dword [rsp + 0x1e0], r12d
lea rcx, [rsp + 0x600]
call fcn.10009d0c4
lea r9, [rsp + 0x600]
lea r8, [0x10001dc68]
mov edx, 0x144
lea rcx, [rsp + 0x370]
call fcn.1000526f0
mov r8d, eax
mov dword [rsp + 0x158], eax
cmp eax, r13d
jge 0x10009da4d
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xa8], 0xdb
mov dword [rsp + 0xac], r12d
mov dword [rsp + 0xb0], edi
mov word [rsp + 0x130], r13w
mov byte [rsp + 0x132], r13b
mov byte [rsp + 0x133], r12b
movzx ecx, r13w
cmp cx, 0xf
jae 0x10009da39
movzx eax, cx
mov qword [rdx + rax*8 + 0x28], r13
add cx, r12w
jmp 0x10009da25
lea r9, [0x10000a040]
lea rcx, [rsp + 0x150]
call fcn.1000e9e30
lea rcx, [rsp + 0x370]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10009dc27
lea rdx, [rsp + 0x1d0]
lea rcx, [rsp + 0x370]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, r13d
jne 0x10009db47
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r10d, ax
or r10d, esi
cmp eax, r13d
cmovle r10d, eax
mov dword [rsp + 0x158], r10d
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xa8], 0xe4
mov dword [rsp + 0xac], r12d
mov dword [rsp + 0xb0], edi
mov word [rsp + 0x130], r13w
mov byte [rsp + 0x132], r13b
mov byte [rsp + 0x133], r12b
movzx ecx, r13w
cmp cx, 0xf
jae 0x10009db0a
movzx eax, cx
mov qword [rdx + rax*8 + 0x28], r13
add cx, r12w
jmp 0x10009daf6
mov qword [rsp + 0x88], rdx
cmp r10d, r13d
jge 0x10009db3f
lea rcx, [rsp + 0x240]
call fcn.1000e79d4
lea r9, [0x10001dca0]
mov r8d, r10d
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1000e97d0
nop
mov rcx, rdx
call fcn.1000e7a50
mov edx, 0x2006
lea rcx, [rsp + 0x370]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp eax, r13d
jne 0x10009dc27
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r10d, ax
or r10d, esi
cmp eax, r13d
cmovle r10d, eax
mov dword [rsp + 0x158], r10d
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xa8], 0xf2
mov dword [rsp + 0xac], r12d
mov dword [rsp + 0xb0], edi
mov word [rsp + 0x130], r13w
mov byte [rsp + 0x132], r13b
mov byte [rsp + 0x133], r12b
movzx ecx, r13w
cmp cx, 0xf
jae 0x10009dbea
movzx eax, cx
mov qword [rdx + rax*8 + 0x28], r13
add cx, r12w
jmp 0x10009dbd6
mov qword [rsp + 0x88], rdx
cmp r10d, r13d
jge 0x10009dc1f
lea rcx, [rsp + 0x240]
call fcn.1000e79d4
lea r9, [0x10001dcc0]
mov r8d, r10d
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1000e97d0
nop
mov rcx, rdx
call fcn.1000e7a50
lea rax, [0x10001d9e0]
lea r12, [0x10001da40]
cmp byte [rsp + 0x80], r13b
cmovne r12, rax
mov rsi, qword [rsp + 0x1e8]
movzx eax, byte [rsi + 0x1a3]
movzx ecx, byte [rsi + 0x1a2]
movzx r8d, byte [rsi + 0x1a1]
movzx r9d, byte [rsi + 0x1a0]
movzx r10d, byte [rsi + 0x19f]
movzx r11d, byte [rsi + 0x19e]
movzx edx, byte [rsi + 0x19d]
movzx ebx, byte [rsi + 0x19c]
movzx edi, word [rsi + 0x19a]
movzx esi, word [rsi + 0x198]
mov qword [rsp + 0x78], r12
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], ecx
mov dword [rsp + 0x60], r8d
mov dword [rsp + 0x58], r9d
mov dword [rsp + 0x50], r10d
mov dword [rsp + 0x48], r11d
mov dword [rsp + 0x40], edx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov rcx, qword [rsp + 0x1e8]
mov eax, dword [rcx + 0x194]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x600]
lea r8, [0x10001d890]
mov edx, 0x144
lea rcx, [rsp + 0x370]
call fcn.1000526f0
mov r8d, eax
mov dword [rsp + 0x158], eax
cmp eax, r13d
jge 0x10009dd97
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x90], r14
lea rbx, [0x10001dbd0]
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], r15
mov eax, 0xff
mov dword [rsp + 0xa8], eax
mov r12d, 1
mov dword [rsp + 0xac], r12d
mov dword [rsp + 0xb0], eax
mov word [rsp + 0x130], r13w
mov byte [rsp + 0x132], r13b
mov byte [rsp + 0x133], r12b
movzx ecx, r13w
cmp cx, 0xf
jae 0x10009dd83
movzx eax, cx
mov qword [rdx + rax*8 + 0x28], r13
add cx, r12w
jmp 0x10009dd6f
lea r9, [0x10000a040]
lea rcx, [rsp + 0x150]
call fcn.1000e9e30
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov r12d, 1
mov dword [rsp + 0x20], r12d
lea r9, [rsp + 0x1d0]
mov edx, 0xc0000000
lea r8d, [r12 + 2]
lea rcx, [rsp + 0x370]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
lea rax, [0x10000d458]
mov qword [rsp + 0x1e8], rax
mov qword [rsp + 0x1f0], rdi
cmp rdi, 0xffffffffffffffff
jne 0x10009dec9
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r10d, ax
mov esi, 0x80070000
or r10d, esi
cmp eax, r13d
cmovle r10d, eax
mov dword [rsp + 0x158], r10d
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x90], r14
lea rbx, [0x10001dbd0]
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xa8], 0x112
mov dword [rsp + 0xac], r12d
mov dword [rsp + 0xb0], 0xff
mov word [rsp + 0x130], r13w
mov byte [rsp + 0x132], r13b
mov byte [rsp + 0x133], r12b
movzx ecx, r13w
cmp cx, 0xf
jae 0x10009de8a
movzx eax, cx
mov qword [rdx + rax*8 + 0x28], r13
add cx, r12w
jmp 0x10009de76
mov qword [rsp + 0x88], rdx
cmp r10d, r13d
jge 0x10009debf
lea rcx, [rsp + 0x240]
call fcn.1000e79d4
lea r9, [0x10001dce8]
mov r8d, r10d
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1000e97d0
nop
mov rcx, rdx
call fcn.1000e7a50
jmp 0x10009ded5
lea rbx, [0x10001dbd0]
mov esi, 0x80070000
mov edx, 0x2006
lea rcx, [rsp + 0x370]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp eax, r13d
jne 0x10009dfb9
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r10d, ax
or r10d, esi
cmp eax, r13d
cmovle r10d, eax
mov dword [rsp + 0x158], r10d
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xa8], 0x11f
mov dword [rsp + 0xac], r12d
mov dword [rsp + 0xb0], 0xff
mov word [rsp + 0x130], r13w
mov byte [rsp + 0x132], r13b
mov byte [rsp + 0x133], r12b
movzx ecx, r13w
cmp cx, 0xf
jae 0x10009df7c
movzx eax, cx
mov qword [rdx + rax*8 + 0x28], r13
add cx, r12w
jmp 0x10009df68
mov qword [rsp + 0x88], rdx
cmp r10d, r13d
jge 0x10009dfb1
lea rcx, [rsp + 0x240]
call fcn.1000e79d4
lea r9, [0x10001dcc0]
mov r8d, r10d
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1000e97d0
nop
mov rcx, rdx
call fcn.1000e7a50
mov dword [rsp + 0x1c0], 0x9d4feff5
mov dword [rsp + 0x1c4], r12d
mov dword [rsp + 0x1c8], r13d
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x140]
mov r8d, 0xc
lea rdx, [rsp + 0x1c0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, r13d
je 0x10009e00b
cmp dword [rsp + 0x140], 0xc
je 0x10009e0d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r10d, ax
or r10d, esi
cmp eax, r13d
cmovle r10d, eax
mov dword [rsp + 0x158], r10d
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xa8], 0x12e
mov dword [rsp + 0xac], r12d
mov dword [rsp + 0xb0], 0xff
mov word [rsp + 0x130], r13w
mov byte [rsp + 0x132], r13b
mov byte [rsp + 0x133], r12b
movzx ecx, r13w
cmp cx, 0xf
jae 0x10009e096
movzx eax, cx
mov qword [rdx + rax*8 + 0x28], r13
add cx, r12w
jmp 0x10009e082
mov qword [rsp + 0x88], rdx
cmp r10d, r13d
jge 0x10009e0cb
lea rcx, [rsp + 0x240]
call fcn.1000e79d4
lea r9, [0x10001dd00]
mov r8d, r10d
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1000e97d0
nop
mov rcx, rdx
call fcn.1000e7a50
nop
cmp rdi, 0xffffffffffffffff
je 0x10009e0e4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x10009e0f8
mov eax, dword [rsp + 0x158]
cmp eax, r13d
jge 0x10009e13a
mov rcx, qword [rsp + 0x138]
cmp rcx, r13
je 0x10009e11e
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [rsp + 0x158]
mov dword [rsp + 0x148], eax
lea rdx, [0x100172be0]
lea rcx, [rsp + 0x148]
call sub.msvcrt.dll__CxxThrowException
nop
lea rcx, [rsp + 0x150]
call fcn.1000e80ec
mov rcx, qword [rsp + 0x810]
xor rcx, rsp
call fcn.100130830
lea r11, [rsp + 0x820]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret