Function at 0x14008e810
Capabilities:
Create directory
Set file attributes
Write file on windows

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x350
lea rbp, [rsp + 0x60]
mov qword [rbp + 0x50], 0xfffffffffffffffe
mov qword [rbp + 0x328], rbx
mov qword [rbp + 0x330], rsi
mov qword [rbp + 0x338], rdi
movaps xmmword [rbp + 0x2e0], xmm6
mov rax, qword [0x14017c430]
xor rax, rbp
mov qword [rbp + 0x2d0], rax
mov r13, rcx
mov rax, qword [rcx]
movsxd rcx, dword [rax + 4]
lea rcx, [rcx + r13 + 0x78]
call fcn.140078010
test eax, eax
je 0x14008ec82
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x10], rax
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x20], rax
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp], rbx
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
xor r15d, r15d
mov qword [rbp + 0x68], r15
movaps xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rbp + 0x80], xmm0
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0x80]
call qword [sym.imp.OLEAUT32.dll_VariantTimeToSystemTime]
movsd xmm6, qword [rbp + 0x28]
test eax, eax
je 0x14008e919
movzx eax, word [rbp + 0x8e]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm0, qword [0x140132ba8]
addsd xmm6, xmm0
movsd qword [rbp + 0x28], xmm6
lea rdx, [rbp + 0xb0]
movapd xmm0, xmm6
call qword [sym.imp.OLEAUT32.dll_UnRegisterTypeLib]
test eax, eax
je 0x14008e941
mov r8d, eax
lea rdx, [rbp + 0xb0]
movapd xmm0, xmm6
call fcn.140016470
lea rdx, [rbp + 0x18]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov r8d, 0xa
lea rdx, [rbp + 0xc0]
mov ecx, dword [rbp + 0x18]
call fcn.1400da6c8
xor eax, eax
or rsi, 0xffffffffffffffff
mov rcx, rsi
lea rdi, [rbp + 0xc0]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x14008e9e5
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14008ea66
cmp dword [rdx + 0x10], eax
jge 0x14008e9b9
cmp dword [rbx - 0xc], eax
jge 0x14008e9ac
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov dword [rbx - 0x10], r15d
mov word [rbx], r15w
jmp 0x14008ea66
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14008e9cf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp], rax
jmp 0x14008ea66
mov r14d, dword [rbx - 0x10]
lea r12, [rbp + 0xc0]
sub r12, rbx
sar r12, 1
test ecx, ecx
jns 0x14008ea05
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14008ea25
mov edx, edi
lea rcx, [rbp]
call fcn.1400020c0
mov rbx, qword [rbp]
movsxd rax, edi
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
add rdx, rdx
cmp r12, r14
lea r14, [rax + rax]
mov r9, r14
ja 0x14008ea49
lea r8, [rbx + r12*2]
call fcn.1400d4ebc
jmp 0x14008ea55
lea r8, [rbp + 0xc0]
call fcn.1400d4e34
cmp edi, dword [rbx - 0xc]
jg 0x14008efc3
mov dword [rbx - 0x10], edi
mov word [r14 + rbx], r15w
mov r8d, 1
lea rdx, [0x14012ffcc]
lea rcx, [rbp]
call fcn.14003bd50
mov r8d, 0xa
lea rdx, [rbp + 0xc0]
mov ecx, dword [rbp + 0x1c]
call fcn.1400da6c8
xor eax, eax
mov rcx, rsi
lea rdi, [rbp + 0xc0]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rbp + 0xc0]
lea rcx, [rbp]
call fcn.14003bd50
mov r8d, 1
lea rdx, reloc.msi.dll_MsiGetActiveDatabase
lea rcx, [rbp]
call fcn.14003bd50
mov eax, 0x3b
mov dword [rbp + 0x68], 0x3b0017
mov word [rbp + 0x6c], ax
mov eax, 0x3e7
mov word [rbp + 0x6e], ax
movaps xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rbp + 0x90], xmm0
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x90]
call qword [sym.imp.OLEAUT32.dll_VariantTimeToSystemTime]
movsd xmm6, qword [rbp + 0x30]
test eax, eax
je 0x14008eb2c
movzx eax, word [rbp + 0x9e]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm0, qword [0x140132ba8]
addsd xmm6, xmm0
movsd qword [rbp + 0x30], xmm6
lea rdx, [rbp + 0xa0]
movapd xmm0, xmm6
call qword [sym.imp.OLEAUT32.dll_UnRegisterTypeLib]
test eax, eax
je 0x14008eb54
mov r8d, eax
lea rdx, [rbp + 0xa0]
movapd xmm0, xmm6
call fcn.140016470
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov rcx, qword [rbp + 0x48]
mov qword [rbp + 0x18], rcx
mov r8d, 0xa
lea rdx, [rbp + 0xc0]
call fcn.1400da6c8
xor eax, eax
mov rcx, rsi
lea rdi, [rbp + 0xc0]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rbp + 0xc0]
lea rcx, [rbp]
call fcn.14003bd50
mov r8d, 1
lea rdx, [0x14012ffcc]
lea rcx, [rbp]
call fcn.14003bd50
mov r8d, 0xa
lea rdx, [rbp + 0xc0]
mov ecx, dword [rbp + 0x1c]
call fcn.1400da6c8
xor eax, eax
mov rcx, rsi
lea rdi, [rbp + 0xc0]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rbp + 0xc0]
lea rcx, [rbp]
call fcn.14003bd50
mov r8d, 1
lea rdx, [0x14012ffcc]
lea rcx, [rbp]
call fcn.14003bd50
mov r8d, 5
lea rdx, [0x14012a310]
lea rcx, [rbp]
call fcn.14003bd50
mov rdi, qword [rbp]
cmp dword [rdi - 0x10], r15d
jne 0x14008ec89
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14008ec47
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rbp + 0x20]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14008ec66
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rbp + 0x10]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x14008ec82
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor eax, eax
jmp 0x14008efce
lea rcx, [rbp + 8]
call fcn.1400853d0
nop
mov rax, qword [0x140183758]
test rax, rax
je 0x14008ecc2
cmp dword [rax + 0x2a0], 0
je 0x14008ecc2
mov rax, qword [r13]
movsxd rcx, dword [rax + 4]
mov rdx, qword [rcx + r13 + 0x78]
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 8]
call fcn.14003bd50
xor r8d, r8d
mov rdx, qword [rbp + 8]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov edx, 2
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea r8, [0x14012a2a0]
lea rdx, [0x14012f530]
lea rcx, [rbp + 8]
call fcn.140045040
xor r8d, r8d
mov rdx, qword [rbp + 8]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov edx, 2
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x38], rax
mov r9, rdi
mov r8, qword [rbp + 8]
lea rdx, [0x14012f290]
lea rcx, [rbp + 0x38]
call fcn.140016060
lea rdx, [0x140131ba8]
mov rcx, qword [rbp + 0x38]
call fcn.1400d9d24
mov r14, rax
test rax, rax
je 0x14008ef42
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rcx, [0x14017bd30]
mov rdx, qword [0x14017bd30]
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp + 0x40], rax
movzx eax, word [rbp + 0x70]
movzx ecx, word [rbp + 0x72]
movzx edx, word [rbp + 0x76]
movzx edi, word [rbp + 0x7c]
movzx r9d, word [rbp + 0x7a]
movzx r8d, word [rbp + 0x78]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], edi
lea rdx, str._0.2u:_0.2u:_0.2u__0.2u._0.2u._0.2u
lea rcx, [rbp + 0x40]
call fcn.140016060
movzx edx, byte [r13 + 0xc9]
movzx ecx, byte [r13 + 0x108]
movzx edi, byte [r13 + 0xc8]
mov rax, qword [r13 + 0xe8]
mov qword [rsp + 0x50], rax
mov rax, qword [r13 + 0xf8]
mov qword [rsp + 0x48], rax
mov rax, qword [r13 + 0xf0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edi
mov rax, qword [r13 + 0xd0]
mov qword [rsp + 0x20], rax
mov r9, qword [r13 + 0xe0]
mov rbx, qword [rbp + 0x40]
mov r8, rbx
lea rdx, [0x140132368]
lea rcx, [rbp + 0x20]
call fcn.140016060
mov rdi, qword [rbp + 0x20]
test rdi, rdi
jne 0x14008ee3e
mov rdx, r15
jmp 0x14008ee9b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x14008ee55
mov rdx, r15
jmp 0x14008ee9b
lea r8d, [rax + rax]
cdqe
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14008ee71
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400e2af0
sub rsp, rcx
lea rcx, [rsp + 0x60]
mov r9d, 3
mov rdx, rdi
call fcn.140034900
mov rdx, rax
test rax, rax
jne 0x14008eea0
mov ecx, r15d
jmp 0x14008eeb0
xor eax, eax
mov rcx, rsi
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
mov r8d, ecx
lea rcx, [rbp + 0x10]
call fcn.1400147e0
mov rcx, qword [rbp + 0x10]
movsxd r12, dword [rcx - 0x10]
cmp dword [rcx - 8], 1
jle 0x14008eeda
mov edx, dword [rcx - 0x10]
lea rcx, [rbp + 0x10]
call fcn.140002b80
mov rcx, qword [rbp + 0x10]
mov rdx, rsi
test r12d, r12d
je 0x14008ef0d
mov rdi, rcx
mov r8d, r12d
lea r9, [0x14017e9a4]
nop
cmp rdx, 4
jl 0x14008eefb
mov rdx, r15
jmp 0x14008eefe
inc rdx
movzx eax, byte [rdx + r9]
xor byte [rdi], al
inc rdi
dec r8
jne 0x14008eef0
mov rdx, r12
mov r9, r14
mov r8d, 1
call fcn.1400d6c94
mov rcx, r14
call fcn.1400d79b4
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14008ef42
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rbp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14008ef61
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rbp + 8]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14008ef80
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rbp]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14008ef9f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rbp + 0x20]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14008efbe
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
jmp 0x14008ec66
mov ecx, 0x80070057
call fcn.1400022b0
nop
mov rcx, qword [rbp + 0x2d0]
xor rcx, rbp
call fcn.1400d4d90
mov rbx, qword [rbp + 0x328]
mov rsi, qword [rbp + 0x330]
mov rdi, qword [rbp + 0x338]
movaps xmm6, xmmword [rbp + 0x2e0]
lea rsp, [rbp + 0x2f0]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret