Function at 0x140003980
Capabilities:
Create directory
Get common file path
Get hostname
Get session user name
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa10]
sub rsp, 0xb10
mov rax, qword [0x14007e018]
xor rax, rsp
mov qword [rbp + 0xa00], rax
xor r12d, r12d
mov dword [rbp + 0x80], r12d
mov qword [rbp + 0xa8], r12
mov qword [rbp + 0xb8], r12
mov qword [rbp + 0xc0], 7
mov word [rbp + 0xa8], r12w
xor edx, edx
mov r8d, 0xe8
lea rcx, [rbp - 0x70]
call fcn.140037230
lea rcx, [rbp - 0x70]
call fcn.140007420
nop
mov qword [rbp + 0x88], r12
mov qword [rbp + 0x98], r12
mov qword [rbp + 0xa0], 7
mov word [rbp + 0x88], r12w
mov qword [rbp + 0xc8], r12
mov qword [rbp + 0xd8], r12
mov qword [rbp + 0xe0], 0xf
mov byte [rbp + 0xc8], r12b
mov ebx, 4
mov dword [rbp + 0x80], ebx
lea r8, [rbp + 0x80]
lea rdx, [rbp + 0x3d0]
lea ecx, [rbx - 1]
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
lea r8, [rbp + 0x80]
lea rdx, [rbp + 0x3d0]
lea ecx, [rbx - 1]
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x140003a86
mov word [rbp + 0x3e0], r12w
jmp 0x140003a9e
lea r8, str.ospatch
mov edx, 8
lea rcx, [rbp + 0x3d0]
call fcn.14004068c
mov dword [rbp + 0x80], ebx
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x5e0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x140003ac6
mov word [rbp + 0x5f0], r12w
jmp 0x140003ade
lea r8, str.kb117
mov edx, 8
lea rcx, [rbp + 0x5e0]
call fcn.14004068c
lea rdx, [rbp + 0x1c0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
jbe 0x140003b11
lea r8, [0x140074758]
mov edx, 0x104
lea rcx, [rbp + 0x1c0]
call fcn.14004068c
lea r8, [rbp + 0x3d0]
mov edx, 0x104
lea rcx, [rbp + 0x1c0]
call fcn.1400406f4
xor edx, edx
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea r8, [0x140074760]
mov edx, 0x104
lea rcx, [rbp + 0x1c0]
call fcn.1400406f4
lea r8, [rbp + 0x5e0]
mov edx, 0x104
lea rcx, [rbp + 0x1c0]
call fcn.1400406f4
lea r8, str..log
mov edx, 0x104
lea rcx, [rbp + 0x1c0]
call fcn.1400406f4
lea r8, [rbp + 0x1c0]
mov edx, 0x104
lea rcx, [0x1400869f0]
call fcn.14004068c
movups xmm0, xmmword [str.DO_NOT_MODIFY_ANYTHING__SUBMIT_THIS_LOG_TO_COMMANDER._n_n]
movups xmmword [rbp + 0x180], xmm0
movups xmm1, xmmword [0x140074788]
movups xmmword [rbp + 0x190], xmm1
movups xmm0, xmmword [0x140074798]
movups xmmword [rbp + 0x1a0], xmm0
movsd xmm1, qword [0x1400747a8]
movsd qword [rbp + 0x1b0], xmm1
lea r8, [0x140073e40]
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp - 0x80]
call fcn.14003b524
lea rax, [rbp + 0x180]
mov rdx, 0xffffffffffffffff
inc rdx
cmp byte [rax + rdx], 0
jne 0x140003bf7
mov r9, qword [rbp - 0x80]
mov r8d, 1
lea rcx, [rbp + 0x180]
call fcn.14003b90c
mov rcx, qword [rbp - 0x80]
call fcn.14003b658
lea rcx, [rbp + 0xe8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rbp + 0xe8]
lea rcx, [rsp + 0x20]
call fcn.1400035e0
lea rcx, [rbp + 0xa8]
cmp rcx, rax
je 0x140003c6e
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xa8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xb8], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140003cb0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003cab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400041fd
call fcn.140034c90
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x70]
add rcx, rax
cmp qword [rcx + 0x48], 0
cmovne ebx, r12d
xor r8d, r8d
mov edx, ebx
call fcn.1400034b0
lea rdx, str.Create_logfile_at:
lea rcx, [rbp - 0x70]
call fcn.14000b480
mov rcx, rax
lea rdx, [rbp + 0x1c0]
call fcn.14000b480
mov rcx, rax
lea rdx, [0x1400747b0]
call fcn.14000b480
mov dword [rbp + 0x84], 0x104
lea r8, [rbp + 0x84]
lea rdx, [rbp + 0x7f0]
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
lea rdx, [rbp + 0x7f0]
lea rcx, [rbp - 0x70]
call fcn.14000b480
mov rcx, rax
lea rdx, [0x1400747e0]
call fcn.14000b480
lea rdx, [rbp + 0x84]
lea rcx, [rbp + 0x7f0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rdx, [rbp + 0x7f0]
lea rcx, [rbp - 0x70]
call fcn.14000b480
mov rcx, rax
call fcn.14000b6f0
mov qword [rbp + 0x98], r12
lea rax, [rbp + 0x88]
cmp qword [rbp + 0xa0], 8
cmovae rax, qword [rbp + 0x88]
mov word [rax], r12w
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], r12w
mov dword [rbp + 0x80], 2
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rax
mov rcx, qword [rbp + 8]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x140003def
mov rax, qword [rbp - 0x28]
mov rdx, qword [rax]
test rdx, rdx
je 0x140003def
mov rax, qword [rbp - 0x48]
mov r9, qword [rax]
cmp rdx, qword [rbp]
cmovb rdx, qword [rbp]
sub rdx, r9
jmp 0x140003e17
test cl, 4
jne 0x140003e4f
mov rax, qword [rbp - 0x30]
mov rcx, qword [rax]
test rcx, rcx
je 0x140003e4f
mov rax, qword [rbp - 0x50]
mov r9, qword [rax]
mov rax, qword [rbp - 0x18]
movsxd rdx, dword [rax]
add rdx, rdx
sub rdx, r9
add rdx, rcx
mov rax, r9
sar rdx, 1
test rax, rax
je 0x140003e4f
lea rcx, [rsp + 0x20]
cmp rdx, 7
ja 0x140003e49
mov qword [rsp + 0x30], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
call fcn.140036b80
mov word [rsp + rbx + 0x20], r12w
jmp 0x140003e4f
call fcn.14000bbe0
nop
lea r8, str.___CreateLogFile__
lea rdx, [rbp + 0xa8]
lea rcx, [rsp + 0x40]
call fcn.14000b780
nop
lea r9, [rsp + 0x20]
mov r8, rax
lea rcx, [rsp + 0x60]
call fcn.14000cc90
mov rdx, qword [rbp + 0xa0]
cmp rdx, 8
jb 0x140003ec0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003ebb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004203
call fcn.140034c90
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rbp + 0x88], xmm0
movups xmm1, xmmword [rsp + 0x70]
movups xmmword [rbp + 0x98], xmm1
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140003f1a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f15
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004209
call fcn.140034c90
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r12w
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140003f70
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f6b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000420f
call fcn.140034c90
mov qword [rbp + 0xd8], r12
mov byte [rbp + 0xc8], 0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x110], xmm0
movups xmmword [rbp + 0x120], xmm0
movups xmmword [rbp + 0x130], xmm0
movups xmmword [rbp + 0x140], xmm0
movups xmmword [rbp + 0x150], xmm0
movups xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x170], rax
lea rcx, [rbp + 0x100]
call fcn.140007ee0
nop
lea r8, [rbp + 0x88]
cmp qword [rbp + 0xa0], 8
cmovae r8, qword [rbp + 0x88]
mov rax, qword [rbp + 0x98]
lea r9, [r8 + rax*2]
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x100]
call fcn.140009570
nop
lea rcx, [rbp + 0x100]
call fcn.140007df0
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rbp + 0xc8], xmm0
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rbp + 0xd8], xmm1
lea r15, [rbp + 0xc8]
movq r14, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq r13, xmm0
cmp r13, 0x10
cmovae r15, r14
mov edi, r12d
movd eax, xmm1
test eax, eax
jle 0x140004086
mov rsi, qword [rsp + 0x30]
mov eax, esi
sub eax, edi
mov ebx, 0x5000
cmp eax, ebx
cmovl ebx, eax
movsxd r8, ebx
movsxd rdx, edi
add rdx, r15
lea rcx, [0x1400819f0]
call fcn.140036b80
mov dword [0x1400819e8], ebx
add edi, ebx
call fcn.140001260
cmp edi, esi
jl 0x140004052
cmp r13, 0x10
jb 0x1400040be
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x1400040b5
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004215
mov rcx, r14
call fcn.140034c90
nop
mov rdx, qword [rbp + 0xa0]
cmp rdx, 8
jb 0x140004104
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400040ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000421b
call fcn.140034c90
mov qword [rbp + 0x98], r12
mov qword [rbp + 0xa0], 7
mov word [rbp + 0x88], r12w
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + rcx - 0x70], rax
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rbp + rcx - 0x74], edx
lea rcx, [rbp - 0x68]
call fcn.1400070d0
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + rcx - 0x70], rax
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx - 0x74], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x18], rax
lea rcx, [rbp + 0x18]
call fcn.140014958
nop
mov rdx, qword [rbp + 0xc0]
cmp rdx, 8
jb 0x1400041c7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400041c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400041f7
call fcn.140034c90
mov rcx, qword [rbp + 0xa00]
xor rcx, rsp
call fcn.140034c70
lea r11, [rsp + 0xb10]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140041530
nop
call fcn.140041530
nop
call fcn.140041530
nop
call fcn.140041530
nop
call fcn.140041530
nop
call fcn.140041530
nop
call fcn.140041530
int3