Function at 0x180051890
Capabilities:
Create directory
Get common file path
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x78]
sub rsp, 0x178
mov rax, qword [0x18017a040]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov rdi, rcx
lea r9, [rsp + 0x38]
xor esi, esi
lea rcx, [0x18011f648]
xor r8d, r8d
mov qword [rsp + 0x38], rsi
mov edx, 0x8000
xor bl, bl
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x180051d9a
mov qword [rsp + 0x1a8], r12
movabs rax, 0x1d04a90d5f7c79bb
mov qword [rsp + 0x30], rax
movabs r12, 0xda952d7936bc53c0
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
movabs rax, 0xdaed2d0036d453b0
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
movabs rax, 0x602ebba9a945430
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x1b0], r13
movabs r13, 0x602ebe69af55459
mov qword [rsp + 0x1b8], r14
movabs r14, 0x84c0ea13ef530cc2
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x170], r15
movabs r15, 0x1d77a96c5f5279e7
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x30], r12
mov qword [rbp - 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x28], rax
mov qword [rsp + 0x30], r13
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x20], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
movdqa xmm1, xmmword [rsp + 0x40]
movdqa xmm0, xmmword [rsp + 0x50]
mov rdx, qword [rsp + 0x38]
xorps xmm1, xmmword [rbp - 0x30]
mov qword [rbp - 0x18], rax
mov rax, rdi
xorps xmm0, xmmword [rbp - 0x20]
movzx ecx, word [rdx]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
test cx, cx
je 0x180051a00
sub rdx, rdi
nop word [rax + rax]
mov word [rax], cx
add rax, 2
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x1800519f0
movq rdx, xmm1
mov word [rax], si
test dx, dx
je 0x180051a31
lea r8, [rsp + 0x40]
sub r8, rax
nop word [rax + rax]
mov word [rax], dx
add rax, 2
movzx edx, word [r8 + rax]
test dx, dx
jne 0x180051a20
xor edx, edx
mov word [rax], si
mov rcx, rdi
mov bl, 1
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x180051d7a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x180051d7a
mov dl, 3
call fcn.180075a40
movabs rax, 0x6957cd09333b1881
movabs rcx, 0x375a32458d4b9eec
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x60], rax
movabs rax, 0xbfe14c1c44df73af
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x68], rax
movabs rax, 0x726e9e87fc903079
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
movabs rax, 0xe3ae83789d3c7be2
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
movabs rax, 0x270f93d57fbcb13b
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x80], rax
movabs rax, 0xeb6d87ff46005116
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x78], rax
movabs rax, 0x177a9d1576848258
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x70], rax
movabs rax, 0x2d030468c96b42c9
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x68], rax
movabs rax, 0xdfcb15063f4f3d86
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x60], rax
movabs rax, 0xa1793fe11063d8c1
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x58], rax
movabs rax, 0x7e0cf5bc18120ba4
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x50], rax
movabs rax, 0x1a7aeadcf1fb582a
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x48], rax
movabs rax, 0x5f9cc1d8b650ef3b
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x40], rax
mov qword [rsp + 0x30], rcx
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x38], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x30], r12
mov qword [rbp - 0x10], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x30], r13
mov qword [rbp - 8], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x30], r14
mov qword [rbp], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 8], rax
movabs rax, 0x487bf0b00dd5d51b
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x10], rax
movabs rax, 0x8a0ee29d662c2864
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x18], rax
movabs rax, 0x371ff37a56e1f12d
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x20], rax
lea rdx, [rsp + 0x60]
movabs rax, 0xd667607a44b30a6
mov r8d, edx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x28], rax
movabs rax, 0xbbae78745a3b53ef
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x30], rax
movabs rax, 0xd3105bc17517b9a8
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x38], rax
movabs rax, 0xd699cce776668c1
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x40], rax
movabs rax, 0x7f5a9efb9f943c0a
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x48], rax
movabs rax, 0x5f9cc1d8c2238643
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x50], rax
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x60]
mov rax, qword [rsp + 0x30]
movdqa xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp]
movdqa xmm1, xmmword [rbp - 0x80]
xorps xmm1, xmmword [rbp + 0x10]
movdqa xmm2, xmmword [rsp + 0x60]
xorps xmm2, xmmword [rbp - 0x10]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm0, xmmword [rbp - 0x70]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm1, xmmword [rbp - 0x60]
xorps xmm1, xmmword [rbp + 0x30]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm0, xmmword [rbp - 0x50]
xorps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm1, xmmword [rbp - 0x40]
mov qword [rbp + 0x58], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp + 0x50]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmmword [rsp + 0x60], xmm2
test al, al
je 0x180051d5b
nop
inc rcx
mov r8, rcx
cmp byte [rcx], sil
jne 0x180051d50
mov rcx, qword [0x18017aed8]
sub r8d, edx
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor bl, bl
mov r14, qword [rsp + 0x1b8]
mov r13, qword [rsp + 0x1b0]
mov r12, qword [rsp + 0x1a8]
mov r15, qword [rsp + 0x170]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
movzx eax, bl
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.1800da960
add rsp, 0x178
pop rdi
pop rsi
pop rbx
pop rbp
ret