Function at 0x140005da0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xc90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xc80], rax
mov rbp, rdx
mov r14, rcx
xor r15d, r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, qword [0x14000d940]
mov rsi, rax
test rbx, rbx
je 0x140005e02
mov rdi, rbx
mov rbx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rbx, rbx
jne 0x140005de3
mov rdi, qword [0x14000d958]
mov rcx, rdi
mov qword [0x14000d940], r15
call qword [0x1400092d8]
mov ecx, 0x140406
call rdi
xor eax, eax
lea rdi, [0x14000d940]
mov ecx, 0x18
rep stosb byte [rdi], al
lea rdi, [rsp + 0x40]
mov ecx, 0x410
rep stosb byte [rdi], al
movzx ecx, word [0x14000d980]
lea rax, [rsp + 0x40]
test cx, cx
je 0x140005e70
lea rdx, [0x14000d980]
lea rdi, [rsp + 0x40]
sub rdx, rdi
nop dword [rax]
mov word [rax], cx
add rax, 2
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140005e60
mov word [rax], r15w
lea rcx, [rsp + 0x40]
cmp word [rsp + 0x40], r15w
je 0x140005e8b
add rcx, 2
cmp word [rcx], r15w
jne 0x140005e81
mov edi, 0x53
lea rdx, str.Symbols
movzx eax, di
sub rdx, rcx
nop dword [rax]
mov word [rcx], ax
lea rcx, [rcx + 2]
movzx eax, word [rdx + rcx]
test ax, ax
jne 0x140005ea0
mov word [rcx], r15w
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140005ed6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140006095
lea rcx, str.SRV
lea rdx, [rsp + 0x660]
sub rcx, rdx
lea rax, [rsp + 0x660]
mov word [rax], di
lea rax, [rax + 2]
movzx edi, word [rcx + rax]
test di, di
jne 0x140005ef0
mov word [rax], r15w
lea rax, [rsp + 0x660]
cmp word [rsp + 0x660], r15w
je 0x140005f2a
nop word [rax + rax]
add rax, 2
cmp word [rax], r15w
jne 0x140005f20
movzx ecx, word [rsp + 0x40]
test cx, cx
je 0x140005f50
lea rdx, [rsp + 0x40]
sub rdx, rax
nop dword [rax]
mov word [rax], cx
add rax, 2
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140005f40
mov word [rax], r15w
lea rax, [rsp + 0x660]
cmp word [rsp + 0x660], r15w
je 0x140005f7a
nop word [rax + rax]
add rax, 2
cmp word [rax], r15w
jne 0x140005f70
lea rdx, str.https:__msdl.microsoft.com_download_symbols
mov ecx, 0x2a
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140005f90
mov rdi, qword [0x14000d908]
mov rcx, rdi
mov word [rax], r15w
call qword [0x1400092d8]
xor r8d, r8d
lea rdx, [rsp + 0x660]
mov rcx, rsi
call rdi
test eax, eax
je 0x140006095
xor eax, eax
lea rdi, [rsp + 0x450]
mov ecx, 0x208
rep stosb byte [rdi], al
mov rdi, qword [0x14000d910]
mov rcx, rdi
call qword [0x1400092d8]
mov qword [rsp + 0x38], 0x104
lea rax, [rsp + 0x450]
mov qword [rsp + 0x30], rax
mov r9d, 2
lea rax, [rsp + 0x450]
mov qword [rsp + 0x28], 0x104
mov r8, r14
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rsi
call rdi
test eax, eax
je 0x14000608e
mov rdi, qword [0x14000d8f0]
mov rcx, rdi
call qword [0x1400092d8]
mov dword [rsp + 0x38], r15d
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov r8, r14
mov dword [rsp + 0x28], r15d
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], rbp
call rdi
test rax, rax
je 0x140006095
mov rdi, qword [0x14000d900]
mov rcx, rdi
call qword [0x1400092d8]
lea r9, [0x140005c50]
mov qword [rsp + 0x20], r15
xor r8d, r8d
mov rdx, rbp
mov rcx, rsi
call rdi
test eax, eax
je 0x140006095
mov eax, 1
jmp 0x140006098
mov eax, r15d
mov rcx, qword [rsp + 0xc80]
xor rcx, rsp
call fcn.1400081d0
mov rbx, qword [rsp + 0xcd0]
add rsp, 0xc90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret