Function at 0x10001da98
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Get file size

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
xor ebx, ebx
xor r15d, r15d
xor r12d, r12d
and qword [rax + 0x20], rbx
mov r13, r9
mov rsi, rdx
mov rbp, rcx
lea r14d, [rbx + 1]
test rdx, rdx
je 0x10001dad5
mov rdi, qword [rdx]
jmp 0x10001dad9
or rdi, 0xffffffffffffffff
test byte [r9 + 0x1c], 0x10
mov qword [rsp + 0xa8], rdi
je 0x10001db2c
mov rcx, r8
mov r14d, 3
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10001db2c
mov rcx, qword [rsp + 0xb0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10001db2c
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x10001dc5d
cmp rdi, 0xffffffffffffffff
jne 0x10001dba4
mov rcx, rbp
call fcn.100019360
mov rcx, rax
call fcn.100026324
mov r12, rax
test rax, rax
je 0x10001db90
and dword [rsp + 0x28], r15d
lea rax, [rsp + 0xa8]
lea rdx, [r13 + 0x20]
xor r9d, r9d
mov r8, r12
mov rcx, rbp
mov qword [rsp + 0x20], rax
call fcn.100020024
test eax, eax
je 0x10001db80
lea r15d, [rdi + 2]
mov rdi, qword [rsp + 0xa8]
jmp 0x10001dba4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [rsp + 0xa8]
jmp 0x10001db96
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x10001dc5d
xor eax, eax
mov dword [rsp + 0xa8], eax
test rbp, rbp
je 0x10001dbc8
mov rax, qword [rbp + 0x40]
test rax, rax
cmovne rbp, rax
mov eax, dword [rbp + 0x28]
bt eax, 0x11
mov rbp, qword [rsp + 0xb0]
jae 0x10001dc65
lea r8, [rsp + 0xb8]
mov edx, r14d
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_OpenEncryptedFileRawW]
test eax, eax
jne 0x10001dc4d
xor eax, eax
lea rdx, [rsp + 0x48]
mov rcx, rdi
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], rdi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov r8, qword [rsp + 0xb8]
lea rdx, [rsp + 0x40]
lea rcx, [0x10001d9d0]
call qword [sym.imp.ADVAPI32.dll_WriteEncryptedFileRaw]
test eax, eax
je 0x10001dc3d
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ADVAPI32.dll_CloseEncryptedFileRaw]
jmp 0x10001dc65
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x10001dc65
mov rbp, qword [rsp + 0xb0]
cmp rdi, 0xffffffffffffffff
je 0x10001dc79
test r15d, r15d
je 0x10001dc79
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12, r12
je 0x10001dc9b
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
js 0x10001dcfb
test rsi, rsi
je 0x10001dcfb
cmp qword [rsi], 0xffffffffffffffff
je 0x10001dcb3
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rsp + 0x30], 0
xor r9d, r9d
mov edx, 0x11e0100
lea r8d, [r9 + 7]
mov rcx, rbp
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsi], rax
cmp rax, 0xffffffffffffffff
jne 0x10001dcfb
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret