Function at 0x1800a6100
Capabilities:
Create directory
Delete directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x40
mov r12, r8
mov rsi, rdx
mov rbp, rcx
mov rdi, 0xffffffffffffffff
inc rdi
cmp word [rdx + rdi*2], 0
jne 0x1800a6126
mov ebx, 4
lea rdx, str.__
mov r8d, ebx
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
xor r13d, r13d
test eax, eax
mov r15d, r13d
sete r15b
test eax, eax
je 0x1800a61a4
cmp edi, 3
jl 0x1800a618a
movzx ecx, word [rsi]
lea eax, [rcx - 0x61]
cmp ax, 0x19
jbe 0x1800a6173
sub cx, 0x41
cmp cx, 0x19
ja 0x1800a618a
cmp word [rsi + 2], 0x3a
jne 0x1800a618a
movzx eax, word [rsi + 4]
cmp ax, 0x5c
je 0x1800a61a4
cmp ax, 0x2f
je 0x1800a61a4
mov qword [rbp + 0x88], 0xfffffffffffff019
mov dword [rbp + 0x14c], 0x32
jmp 0x1800a643d
lea eax, [rdi*4 + 0x20]
mov qword [rsp + 0x70], r14
movsxd rcx, eax
call fcn.180001aeb
mov r14, rax
test rax, rax
je 0x1800a6457
mov r9, 0xffffffffffffffff
lea r8, str.___
mov rdx, rbx
lea rcx, [rax + 0x10]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
lea eax, [r15*4]
mov r8d, r13d
movzx ecx, word [rsi + rax*2]
mov r15d, 0x5c
mov r11d, eax
lea r10, [rsi + rax*2]
test cx, cx
je 0x1800a624c
mov r9d, r11d
mov rdx, r10
cmp cx, r15w
je 0x1800a6235
cmp cx, 0x2f
je 0x1800a6235
test r8d, r8d
je 0x1800a6228
movsxd rax, ebx
mov r8d, r13d
inc ebx
mov word [r14 + rax*2 + 0x10], r15w
movzx ecx, word [rdx]
movsxd rax, ebx
inc ebx
mov word [r14 + rax*2 + 0x10], cx
jmp 0x1800a623b
mov r8d, 1
inc r9
movzx ecx, word [rsi + r9*2]
lea rdx, [rsi + r9*2]
test cx, cx
jne 0x1800a6206
movsxd rax, ebx
mov edx, r13d
inc ebx
mov word [r14 + rax*2 + 0x10], r15w
movzx eax, bx
add ax, ax
mov word [r14 + 8], r13w
mov word [r14 + 0xa], ax
movsxd rax, ebx
inc ebx
mov r8d, ebx
mov word [r14 + rax*2 + 0x10], r13w
movzx ecx, word [r10]
test cx, cx
je 0x1800a62c6
cmp cx, r15w
je 0x1800a62b0
cmp cx, 0x2f
je 0x1800a62b0
test edx, edx
je 0x1800a62a3
movsxd rax, ebx
mov edx, r13d
inc ebx
mov word [r14 + rax*2 + 0x10], r15w
movzx ecx, word [r10]
movsxd rax, ebx
inc ebx
mov word [r14 + rax*2 + 0x10], cx
jmp 0x1800a62b5
mov edx, 1
inc r11
movzx ecx, word [rsi + r11*2]
lea r10, [rsi + r11*2]
test cx, cx
jne 0x1800a6281
mov eax, ebx
sub eax, r8d
cmp eax, 2
jne 0x1800a62e0
movsxd rax, ebx
inc ebx
mov word [r14 + rax*2 + 0x10], r15w
mov eax, 3
add ax, ax
lea edi, [rbx*2 + 0x12]
mov word [r14 + 0xe], ax
add r8w, r8w
movsxd rax, ebx
xor edx, edx
mov word [r14 + 0xc], r8w
mov rcx, r12
mov word [r14 + rax*2 + 0x10], r13w
lea eax, [rdi - 8]
mov word [r14 + 4], ax
mov dword [r14], 0xa0000003
mov word [r14 + 6], r13w
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1800a634e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov dword [rbp + 0x14c], eax
call fcn.180001f37
movsxd rcx, eax
mov qword [rbp + 0x88], rcx
mov rcx, r14
call fcn.180003bf2
jmp 0x1800a6438
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov dword [rsp + 0x28], 0x2200000
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 3
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1800a63b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov dword [rbp + 0x14c], eax
call fcn.180001f37
movsxd rcx, eax
mov qword [rbp + 0x88], rcx
mov rcx, r14
call fcn.180003bf2
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x1800a6438
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov r9d, edi
mov dword [rsp + 0x28], r13d
mov r8, r14
mov edx, 0x900a4
mov qword [rsp + 0x20], r13
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1800a6420
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov dword [rbp + 0x14c], eax
call fcn.180001f37
movsxd rcx, eax
mov qword [rbp + 0x88], rcx
mov rcx, r14
call fcn.180003bf2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x1800a6438
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call fcn.180003bf2
mov qword [rbp + 0x88], r13
mov r14, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
lea rdx, str.uv__malloc
mov ecx, select
call fcn.180002982
int3
push rbx
sub rsp, 0x20
mov rdx, qword [rcx + 0x150]
mov rbx, rcx
mov rcx, qword [rcx + 0x160]
mov r8d, dword [rbx + 0x168]
test r8b, 2
je 0x1800a86a4
mov r8, rcx
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1800a6100
mov rax, qword [0x18012e0f0]
test rax, rax
je 0x1800a86ec
and r8d, 1
call rax
test al, al
jne 0x1800a86dd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov dword [rbx + 0x14c], eax
call fcn.180001f37
movsxd rcx, eax
mov qword [rbx + 0x88], rcx
add rsp, 0x20
pop rbx
ret
xor ecx, ecx
mov qword [rbx + 0x88], rcx
add rsp, 0x20
pop rbx
ret
mov qword [rbx + 0x88], 0xfffffffffffff02a
mov dword [rbx + 0x14c], 0x32
add rsp, 0x20
pop rbx
ret