Function at 0x14002a010
Capabilities:
Create directory
Write file on windows

Disassembly:
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x60
mov rsi, rdx
mov r13d, 1
mov edx, r13d
mov r12d, r9d
mov r15, r8
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x14002a496
cmp qword [rdi + 0x38], 0xffffffffffffffff
je 0x14002a496
mov qword [rsp + 0x98], rbp
xor ebp, ebp
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0xa0], r14
mov dword [rdi + 0x10], ebp
test r13b, r12b
je 0x14002a0f5
cmp word [rdi + 0x80], bp
jne 0x14002a096
mov rdx, r15
mov rcx, rdi
call fcn.140029410
cmp dword [rdi + 0x10], ebp
jne 0x14002a486
mov word [rdi + 0x80], r13w
mov r8, qword [r15 + 0x28]
mov rdx, rsi
mov rcx, rdi
call fcn.1400297c0
mov qword [r15 + 0x28], rax
cmp dword [rdi + 0x10], ebp
jne 0x14002a0e1
cmp qword [rdi + 0xf8], rbp
je 0x14002a0e1
mov eax, 5
mov rbx, qword [rsp + 0x90]
mov r14, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x98]
add rsp, 0x60
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
mov rcx, rdi
mov word [rdi + 0x80], bp
call fcn.1400292b0
mov eax, dword [rdi + 0x10]
jmp 0x14002a0bc
test byte [r15 + 8], 0x10
je 0x14002a25e
test r12b, 2
je 0x14002a1bf
mov dword [rsp + 0x48], reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rsi
mov qword [rsp + 0x50], rbp
mov dword [rsp + 0x58], r13d
test r12d, r12d
jns 0x14002a1d1
movzx eax, word [rsi]
test ax, ax
je 0x14002a13f
cmp word [rsi + 2], 0x3a
jne 0x14002a13f
movzx eax, word [rsi + 4]
lea rcx, [rsi + 4]
cmp ax, 0x5c
lea rbx, [rcx + 2]
cmovne rbx, rcx
movzx eax, word [rbx]
test ax, ax
je 0x14002a1b4
mov r14d, 0x5c
nop dword [rax]
cmp ax, r14w
je 0x14002a178
movzx eax, word [rbx + 2]
add rbx, 2
test ax, ax
jne 0x14002a160
mov rbx, rbp
jmp 0x14002a180
test rbx, rbx
je 0x14002a180
mov word [rbx], bp
lea rdx, [rsp + 0x48]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14002a19f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14002a1c6
test rbx, rbx
je 0x14002a1b4
mov word [rbx], r14w
add rbx, 2
movzx eax, word [rbx]
test ax, ax
jne 0x14002a160
mov ebp, r13d
test ebp, ebp
je 0x14002a482
xor eax, eax
jmp 0x14002a0bc
test rbx, rbx
je 0x14002a1b7
mov word [rbx], r14w
jmp 0x14002a1b7
movzx eax, byte [rsi]
test al, al
je 0x14002a1e6
cmp byte [rsi + 1], 0x3a
jne 0x14002a1e6
movzx eax, byte [rsi + 2]
lea rcx, [rsi + 2]
cmp al, 0x5c
lea rbx, [rcx + 1]
cmovne rbx, rcx
movzx eax, byte [rbx]
test al, al
je 0x14002a1b4
cmp al, 0x5c
je 0x14002a20b
movzx eax, byte [rbx + 1]
inc rbx
test al, al
jne 0x14002a1f7
mov rbx, rbp
jmp 0x14002a213
test rbx, rbx
je 0x14002a213
mov byte [rbx], bpl
lea rdx, [rsp + 0x48]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x14002a232
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14002a24d
test rbx, rbx
je 0x14002a1b4
mov byte [rbx], 0x5c
inc rbx
movzx eax, byte [rbx]
test al, al
jne 0x14002a1f7
jmp 0x14002a1b4
test rbx, rbx
je 0x14002a1b7
mov byte [rbx], 0x5c
jmp 0x14002a1b7
cmp r12d, 4
je 0x14002a3af
mov dword [rsp + 0x48], reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rsi
mov qword [rsp + 0x50], rbp
mov dword [rsp + 0x58], r13d
test r12d, r12d
jns 0x14002a301
movzx eax, word [rsi]
test ax, ax
je 0x14002a299
cmp word [rsi + 2], 0x3a
jne 0x14002a299
movzx eax, word [rsi + 4]
lea rcx, [rsi + 4]
cmp ax, 0x5c
lea rbx, [rcx + 2]
cmovne rbx, rcx
movzx eax, word [rbx]
test ax, ax
je 0x14002a335
mov r14d, 0x5c
cmp ax, r14w
je 0x14002a2cc
movzx eax, word [rbx + 2]
add rbx, 2
test ax, ax
jne 0x14002a2b7
jmp 0x14002a335
test rbx, rbx
je 0x14002a335
lea rdx, [rsp + 0x48]
mov word [rbx], bp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14002a2f3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14002a2f9
mov word [rbx], r14w
jmp 0x14002a2bd
mov word [rbx], r14w
mov eax, ebp
jmp 0x14002a338
movzx eax, byte [rsi]
test al, al
je 0x14002a316
cmp byte [rsi + 1], 0x3a
jne 0x14002a316
movzx eax, byte [rsi + 2]
lea rcx, [rsi + 2]
cmp al, 0x5c
lea rbx, [rcx + 1]
cmovne rbx, rcx
movzx eax, byte [rbx]
test al, al
je 0x14002a335
cmp al, 0x5c
je 0x14002a370
inc rbx
movzx eax, byte [rbx]
test al, al
jne 0x14002a327
mov eax, r13d
test eax, eax
je 0x14002a482
mov eax, dword [r15 + 8]
xor r9d, r9d
mov qword [rsp + 0x30], rbp
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, rsi
test r12d, r12d
jns 0x14002a3a6
call qword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x14002a3ac
test rbx, rbx
je 0x14002a335
lea rdx, [rsp + 0x48]
mov byte [rbx], bpl
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x14002a397
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14002a39f
mov byte [rbx], 0x5c
inc rbx
jmp 0x14002a32e
mov byte [rbx], 0x5c
mov eax, ebp
jmp 0x14002a338
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rsi, 0xffffffffffffffff
je 0x14002a482
mov rdx, r15
mov rcx, rdi
call fcn.140029410
cmp dword [rdi + 0x10], ebp
jne 0x14002a463
cmp qword [rdi + 0x58], rbp
jne 0x14002a3f0
mov edx, 0x4000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rdi + 0x58], rax
test rax, rax
jne 0x14002a3f0
mov dword [rdi + 0x10], 2
cmp dword [rdi + 0x10], ebp
jne 0x14002a463
nop word [rax + rax]
mov rdx, qword [rdi + 0x58]
mov r8d, 0x4000
mov rcx, rdi
call fcn.1400297c0
mov rbx, rax
test eax, eax
je 0x14002a449
mov rdx, qword [rdi + 0x58]
lea r9, [rsp + 0x40]
mov r8d, ebx
mov qword [rsp + 0x20], rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14002a43d
cmp dword [rsp + 0x40], ebx
je 0x14002a444
mov dword [rdi + 0x10], 3
cmp dword [rdi + 0x10], ebp
je 0x14002a400
cmp dword [rdi + 0x10], ebp
jne 0x14002a463
lea r9, [r15 + 0x1c]
mov rcx, rsi
lea r8, [r15 + 0xc]
lea rdx, [r15 + 0x14]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
cmp r12d, 4
je 0x14002a486
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.1400292b0
mov eax, dword [rdi + 0x10]
jmp 0x14002a0bc
mov dword [rdi + 0x10], r13d
mov rcx, rdi
call fcn.1400292b0
mov eax, dword [rdi + 0x10]
jmp 0x14002a0bc
mov eax, 9
add rsp, 0x60
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret