Function at 0x140032800
Capabilities:
Check if file exists
Create directory
Get file attributes
Print debug messages
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rax, qword [0x14012a210]
xor rax, rsp
mov qword [rbp + 0x120], rax
mov edi, r8d
mov rsi, rdx
mov r14, rcx
mov qword [rbp - 0x70], rdx
xor r12d, r12d
mov r15d, r12d
mov dword [rbp + 0x24], r12d
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], reloc.ACTIVEDS.dll_FreeADsMem
mov byte [rbp - 0x20], r12b
mov qword [rsp + 0x78], r12
mov eax, 0xfeff
mov word [rbp - 0x28], ax
mov dword [rbp + 0x20], r12d
mov qword [rbp + 0x80], r12
mov qword [rbp + 0x90], r12
mov ebx, 7
mov qword [rbp + 0x98], rbx
mov word [rbp + 0x80], r12w
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xb8], rbx
mov word [rbp + 0xa0], r12w
xor r8d, r8d
lea rdx, [0x1400ff490]
lea rcx, [rbp + 0xa0]
call fcn.140011160
nop
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], rbx
mov word [rbp - 0x68], r12w
xor r8d, r8d
lea rdx, [0x1400ff490]
lea rcx, [rbp - 0x68]
call fcn.140011160
nop
lea rdx, [rbp - 0x68]
call fcn.140033570
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae rcx, qword [rbp - 0x68]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140032a86
test edi, edi
jne 0x140032a02
lea rdx, [rbp - 0x20]
mov rcx, r14
call fcn.1400306b0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x58], xmm0
movups xmmword [rbp + 0x68], xmm0
mov qword [rbp + 0x78], rax
xor edx, edx
lea rcx, [rbp + 0x58]
call fcn.140063740
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
movups xmmword [rbp + 0x38], xmm0
movups xmmword [rbp + 0x48], xmm0
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.1400061c0
mov rdx, rax
lea rcx, [rbp + 0x28]
call fcn.140004310
nop
cmp byte [rbp + 0x28], dil
je 0x140032989
lea rcx, [rbp + 0x30]
call fcn.140065be0
test al, al
je 0x140032989
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x58]
call fcn.140063ae0
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm0
lea rdx, [rbp - 0x20]
lea rcx, [rbp]
call fcn.1400061c0
mov rdx, rax
lea rcx, [rbp + 0xc0]
call fcn.140004310
nop
lea rdx, [rbp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.140063560
lea r8, [rbp - 0x20]
mov rdx, rax
lea rcx, [rbp + 0xc0]
call fcn.140005880
nop
lea rcx, [rbp + 0xc8]
call fcn.140063a70
nop
lea rcx, [rbp + 0x30]
call fcn.140063a70
nop
lea rcx, [rbp + 0x58]
call fcn.140063a70
jmp 0x140032a25
lea rax, [rbp - 0x20]
cmp rax, rsi
je 0x140032a25
mov rdx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x140032a18
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
lea rcx, [rbp - 0x20]
call fcn.140006590
lea rcx, str._EnhSecSettings__Reloading_as_config_was_changed___
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x110], xmm0
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x50]
call fcn.1400061c0
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.140004310
nop
lea rdx, [rbp + 0xf0]
call fcn.14002c650
nop
lea rcx, [rbp + 0xf8]
call fcn.140063a70
jmp 0x140032d53
mov qword [rbp], r12
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], rbx
mov word [rbp], r12w
xor r8d, r8d
lea rdx, [0x1400ff490]
lea rcx, [rbp]
call fcn.140011160
nop
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], rbx
xor r8d, r8d
lea rdx, [0x1400ff490]
lea rcx, [rsp + 0x50]
call fcn.140011160
lea r8, [rbp]
lea rdx, [rsp + 0x50]
call fcn.140033280
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
movups xmmword [rbp + 0x38], xmm0
movups xmmword [rbp + 0x48], xmm0
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.1400061c0
mov rdx, rax
lea rcx, [rbp + 0x28]
call fcn.140004310
nop
lea rax, [rsp + 0x48]
mov qword [rbp - 0x78], rax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x80], rax
lea rdi, [rbp]
cmp qword [rbp + 0x18], 8
cmovae rdi, qword [rbp]
call fcn.140004080
mov rcx, rax
test rax, rax
je 0x14003323f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
test rdi, rdi
je 0x140032b7c
cmp rdi, 0x10000
jae 0x140032b62
movzx edx, di
lea rcx, [rsp + 0x48]
call fcn.1400112e0
jmp 0x140032b90
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x140032b70
jmp 0x140032b7f
mov eax, r12d
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.140011410
nop
call fcn.140004080
mov rcx, rax
test rax, rax
je 0x14003324a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rdx, str.agentId
cmp rdx, 0x10000
jae 0x140032bcf
movzx edx, dx
lea rcx, [rsp + 0x40]
call fcn.1400112e0
jmp 0x140032bee
mov rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x140032bd6
mov r8d, eax
lea rcx, [rsp + 0x40]
call fcn.140011410
nop
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x28]
call fcn.140005a90
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x58], xmm0
movups xmmword [rbp + 0x68], xmm0
mov qword [rbp + 0x78], rax
xor edx, edx
lea rcx, [rbp + 0x58]
call fcn.140063740
nop
cmp byte [rbp + 0x28], 0
je 0x140032c3e
lea rcx, [rbp + 0x30]
call fcn.140065be0
test al, al
je 0x140032c3e
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x58]
call fcn.140063ae0
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x58]
call fcn.140066640
mov rdi, rax
lea rax, [rbp - 0x20]
cmp rax, rdi
je 0x140032cc1
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140032c93
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032c8e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033255
call fcn.1400a59a4
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], reloc.ACTIVEDS.dll_FreeADsMem
mov byte [rbp - 0x20], 0
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x20], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp - 0x10], xmm1
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], reloc.ACTIVEDS.dll_FreeADsMem
mov byte [rdi], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140032cff
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032cf9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033255
call fcn.1400a59a4
nop
lea rcx, [rbp + 0x58]
call fcn.140063a70
nop
lea rcx, [rbp + 0x30]
call fcn.140063a70
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 8
jb 0x140032d53
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032d4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003325b
call fcn.1400a59a4
mov r8, 0xffffffffffffffff
lea rdx, [0x14010058c]
lea rcx, [rbp - 0x68]
call fcn.1400189f0
mov r8, rax
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], rbx
mov word [rbp - 0x48], r12w
cmp qword [rbp - 0x58], rax
cmovb r8, qword [rbp - 0x58]
lea rdx, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae rdx, qword [rbp - 0x68]
lea rcx, [rbp - 0x48]
call fcn.140011160
nop
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140032dd1
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rdx, qword [rbp - 0x48]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae rcx, qword [rbp - 0x68]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140032ea8
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x140032e52
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032e4d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033267
call fcn.1400a59a4
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], rbx
mov word [rbp - 0x48], r12w
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x140033002
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032e9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033233
call fcn.1400a59a4
jmp 0x140033002
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rdx, qword [rbp - 0x20]
lea rcx, [rbp]
call fcn.140013cc0
movups xmm0, xmmword [rbp]
movups xmmword [rbp + 0x80], xmm0
movups xmm0, xmmword [rbp + 0x10]
movups xmmword [rbp + 0x90], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], reloc.ACTIVEDS.dll_FreeADsMem
mov r8d, 0x26
lea rdx, str.EA52333F_290A_40F5_86FD_98309C3BF487
lea rcx, [rsp + 0x50]
call fcn.140006590
lea r8, [rbp + 0x80]
movups xmm1, xmmword [rbp + 0x10]
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 8
cmovae r8, qword [rbp]
movq rax, xmm1
lea r9d, [rax + rax]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
call fcn.140051290
mov r14, qword [rsp + 0x78]
test al, al
jne 0x14003314b
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x140032f8b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140032f86
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033267
call fcn.1400a59a4
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], rbx
mov word [rbp - 0x48], r12w
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x140032fd8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032fd3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033233
call fcn.1400a59a4
mov word [rbp - 0x68], r12w
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x58], r12
test r14, r14
je 0x140032ff2
mov rcx, r14
call fcn.1400a59a4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbp + 0x98]
mov rdx, qword [rbp + 0xb8]
cmp rdx, 8
jb 0x140033049
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140033043
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033261
call fcn.1400a59a4
nop
cmp rbx, 8
jb 0x140033089
lea rdx, [rbx*2 + 2]
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140033083
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003326d
call fcn.1400a59a4
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x1400330c4
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400330bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003322d
call fcn.1400a59a4
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], reloc.ACTIVEDS.dll_FreeADsMem
mov byte [rbp - 0x20], 0
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x14003310e
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x140033109
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140033239
mov rcx, r8
call fcn.1400a59a4
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], reloc.ACTIVEDS.dll_FreeADsMem
mov byte [rsi], 0
mov eax, r15d
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.1400a5460
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x20]
mov r8d, 2
lea rdx, [rbp - 0x28]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140032f4b
mov r8d, dword [rbp + 0x90]
add r8d, r8d
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x24]
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140032f4b
mov r15d, 1
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x1400331dc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400331d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033267
call fcn.1400a59a4
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], rbx
mov word [rbp - 0x48], r12w
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x140032fd8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032fd3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033233
jmp 0x140032fd3
call fcn.1400b4704
nop
call fcn.1400b4704
nop
call fcn.1400b4704
nop
mov ecx, 0x80004005
call fcn.140003f50
nop
mov ecx, 0x80004005
call fcn.140003f50
nop
call fcn.1400b4704
nop
call fcn.1400b4704
nop
call fcn.1400b4704
nop
call fcn.1400b4704
nop
call fcn.1400b4704
int3