Function at 0x140076810
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc8
mov rcx, qword [0x1400d8fb0]
xor r13d, r13d
lea edx, [r13 + 8]
lea r8d, [r13 + 0x58]
mov r12d, r13d
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbp, rax
mov qword [rsp + 0x128], rax
test rax, rax
jne 0x140076860
mov rbp, r13
mov qword [rsp + 0x128], r13
jmp 0x14007687a
lea rcx, str.settings
mov dword [rax], r13d
mov dword [rax + 0x48], 1
call sym.ProcessHacker.exe_PhDuplicateAnsiStringZSafe
mov qword [rbp + 0x30], rax
mov ecx, 5
xor eax, eax
lock cmpxchg qword [0x1400d7940], rcx
je 0x140076898
lea rcx, [0x1400d7940]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov r14, r13
or r15, 0xffffffffffffffff
nop
mov rdx, qword [0x1400d7998]
mov ecx, dword [rdx + 0x40]
cmp r12d, ecx
jae 0x1400768d6
mov edi, dword [rdx]
add rdi, 0x10
mov rax, rdi
imul rax, r14
add rax, qword [rdx + 0x30]
mov rsi, rax
inc r12d
inc r14
add rax, rdi
cmp dword [rsi], 0xffffffff
jne 0x1400768f1
cmp r12d, ecx
jb 0x1400768c0
mov rax, qword [0x1400d7968]
cmp dword [rax], 0
jbe 0x140076d89
xor r12d, r12d
mov r14, r12
jmp 0x140076c03
mov rcx, qword [0x1400d8fb0]
mov edx, 8
lea r8d, [rdx + 0x50]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
jne 0x140076917
mov rbx, r13
jmp 0x1400769a3
mov dword [rax], r13d
mov dword [rax + 0x48], 1
test rbp, rbp
je 0x140076958
cmp qword [rax + 0x18], 0
je 0x140076935
mov rcx, rax
call fcn.140094490
mov qword [rbx + 0x18], rbp
mov rax, qword [rbp + 0x28]
mov qword [rbx + 0x10], rax
mov rax, qword [rbp + 0x28]
test rax, rax
je 0x140076950
mov qword [rax + 8], rbx
jmp 0x140076954
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rbx
xor eax, eax
lea rdi, str.setting
mov rcx, r15
repne scasb al, byte [rdi]
xor edx, edx
not rcx
mov r8, rcx
lea rbp, [rcx - 1]
mov rcx, qword [0x1400d8fb0]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
jne 0x14007698c
mov rdi, r13
jmp 0x14007699f
lea r8, [rbp + 1]
lea rdx, str.setting
mov rcx, rax
call fcn.140094930
mov qword [rbx + 0x30], rdi
mov r8, qword [rsi + 0x10]
xor eax, eax
mov rcx, r15
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
lea rdx, [rcx + rcx - 2]
mov rcx, r8
call sym.ProcessHacker.exe_PhCreateAnsiStringFromUnicodeEx
mov rbp, rax
lea rcx, [rax + 0x10]
test rbx, rbx
je 0x140076a0d
cmp dword [rbx], 0
jne 0x140076a0d
test rcx, rcx
je 0x1400769e2
call sym.ProcessHacker.exe_PhDuplicateAnsiStringZSafe
mov rdi, rax
jmp 0x1400769e5
mov rdi, r13
lea rdx, str.name
mov r8, rdi
mov rcx, rbx
call fcn.140090ca0
test eax, eax
je 0x140076a0d
mov rcx, qword [0x1400d8fb0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
lea rcx, [rbp - 0x20]
mov eax, r15d
lock xadd dword [rcx], eax
add eax, 0xffffffff
jne 0x140076a22
call fcn.14001fcd0
mov ecx, dword [rsi + 8]
mov rdi, qword [rsi + 0x20]
test ecx, ecx
je 0x140076aa9
sub ecx, 1
je 0x140076a96
cmp ecx, 1
je 0x140076a7f
mov rdi, qword [0x1400d91a8]
xor r8d, r8d
lea edx, [r8 + 0x12]
mov rcx, rdi
call fcn.14001fbe0
lock add dword [rdi + 0x18], 1
mov qword [rax + 0x10], rdi
mov dword [rax], 1
mov qword [rax + 8], 0x12
lea rdi, [rax + 0x20]
lea rax, [rdi + 0x10]
mov word [rdi], r13w
mov word [rdi + 2], r13w
mov qword [rdi + 8], rax
mov word [rax], r13w
jmp 0x140076afb
mov r8d, dword [rdi + 4]
mov edx, dword [rdi]
lea rcx, str._u__u
call sym.ProcessHacker.exe_PhFormatString
mov rdi, rax
jmp 0x140076afb
lea rcx, [0x1400b8e58]
mov edx, edi
call sym.ProcessHacker.exe_PhFormatString
mov rdi, rax
jmp 0x140076afb
test rdi, rdi
jne 0x140076af6
mov rdi, qword [0x1400d91a8]
xor r8d, r8d
lea edx, [r8 + 0x12]
mov rcx, rdi
call fcn.14001fbe0
lock add dword [rdi + 0x18], 1
mov qword [rax + 0x10], rdi
mov dword [rax], 1
mov qword [rax + 8], 0x12
lea rdi, [rax + 0x20]
lea rax, [rdi + 0x10]
mov word [rdi], r13w
mov word [rdi + 2], r13w
mov qword [rdi + 8], rax
mov word [rax], r13w
jmp 0x140076afb
lock add dword [rdi - 0x20], 1
movzx edx, word [rdi]
lea rcx, [rdi + 0x10]
call sym.ProcessHacker.exe_PhCreateAnsiStringFromUnicodeEx
lea rcx, [rdi - 0x20]
mov edx, r15d
mov r13, rax
lock xadd dword [rcx], edx
add edx, 0xffffffff
jne 0x140076b1f
call fcn.14001fcd0
lea rbp, [r13 + 0x10]
test rbp, rbp
je 0x140076bd0
mov rcx, qword [0x1400d8fb0]
mov edx, 8
lea r8d, [rdx + 0x50]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
test rax, rax
je 0x140076bd0
mov dword [rax], 2
mov dword [rax + 0x48], 1
test rbx, rbx
je 0x140076b92
cmp qword [rax + 0x18], 0
je 0x140076b6f
mov rcx, rax
call fcn.140094490
mov qword [rsi + 0x18], rbx
mov rax, qword [rbx + 0x28]
mov qword [rsi + 0x10], rax
mov rax, qword [rbx + 0x28]
test rax, rax
je 0x140076b8a
mov qword [rax + 8], rsi
jmp 0x140076b8e
mov qword [rbx + 0x20], rsi
mov qword [rbx + 0x28], rsi
xor eax, eax
mov rcx, r15
mov rdi, rbp
repne scasb al, byte [rdi]
xor edx, edx
not rcx
mov r8, rcx
lea rbx, [rcx - 1]
mov rcx, qword [0x1400d8fb0]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
je 0x140076bcc
lea r8, [rbx + 1]
mov rdx, rbp
mov rcx, rax
call fcn.140094930
mov qword [rsi + 0x30], rdi
lea rcx, [r13 - 0x20]
mov eax, r15d
lock xadd dword [rcx], eax
add eax, 0xffffffff
mov rbp, qword [rsp + 0x128]
mov r13d, 0
jne 0x1400768a0
call fcn.14001fcd0
jmp 0x1400768a0
xor r12d, r12d
mov rax, qword [rax + 8]
mov rcx, qword [rsp + 0x128]
xor edx, edx
mov rbp, qword [r14 + rax]
call fcn.1400944f0
mov rbx, rax
test rax, rax
je 0x140076c6d
xor eax, eax
lea rdi, str.setting
mov rcx, r15
repne scasb al, byte [rdi]
xor edx, edx
not rcx
mov r8, rcx
lea rsi, [rcx - 1]
mov rcx, qword [0x1400d8fb0]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
jne 0x140076c56
mov rdi, r12
jmp 0x140076c69
lea r8, [rsi + 1]
lea rdx, str.setting
mov rcx, rax
call fcn.140094930
mov qword [rbx + 0x30], rdi
mov r8, qword [rbp + 8]
xor eax, eax
mov rcx, r15
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
lea rdx, [rcx + rcx - 2]
mov rcx, r8
call sym.ProcessHacker.exe_PhCreateAnsiStringFromUnicodeEx
mov rsi, rax
lea rcx, [rax + 0x10]
test rbx, rbx
je 0x140076cd7
cmp dword [rbx], 0
jne 0x140076cd7
test rcx, rcx
je 0x140076cac
call sym.ProcessHacker.exe_PhDuplicateAnsiStringZSafe
mov rdi, rax
jmp 0x140076caf
mov rdi, r12
lea rdx, str.name
mov r8, rdi
mov rcx, rbx
call fcn.140090ca0
test eax, eax
je 0x140076cd7
mov rcx, qword [0x1400d8fb0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
lea rcx, [rsi - 0x20]
mov eax, r15d
lock xadd dword [rcx], eax
add eax, 0xffffffff
jne 0x140076cec
call fcn.14001fcd0
mov rcx, qword [rbp + 0x18]
add rcx, 0x10
movzx edx, word [rcx - 0x10]
call sym.ProcessHacker.exe_PhCreateAnsiStringFromUnicodeEx
mov r12, rax
lea rsi, [rax + 0x10]
test rsi, rsi
je 0x140076d5c
mov edx, 2
mov rcx, rbx
call fcn.1400944f0
mov rbp, rax
test rax, rax
je 0x140076d5c
xor eax, eax
mov rcx, r15
mov rdi, rsi
repne scasb al, byte [rdi]
xor edx, edx
not rcx
mov r8, rcx
lea rbx, [rcx - 1]
mov rcx, qword [0x1400d8fb0]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
je 0x140076d58
lea r8, [rbx + 1]
mov rdx, rsi
mov rcx, rax
call fcn.140094930
mov qword [rbp + 0x30], rdi
lea rcx, [r12 - 0x20]
mov eax, r15d
lock xadd dword [rcx], eax
add eax, 0xffffffff
jne 0x140076d72
call fcn.14001fcd0
mov rax, qword [0x1400d7968]
inc r13d
add r14, 8
cmp r13d, dword [rax]
jb 0x140076c00
mov eax, 5
xor edi, edi
lock cmpxchg qword [0x1400d7940], rdi
je 0x140076da7
lea rcx, [0x1400d7940]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
mov rsi, qword [rsp + 0x110]
lea rdx, [rsp + 0x118]
mov rcx, rsi
call sym.ProcessHacker.exe_PhGetFullPath
mov rbx, rax
test rax, rax
je 0x140076e1f
mov eax, dword [rsp + 0x118]
cmp eax, 0xffffffff
je 0x140076e0b
mov rdx, rax
lea rcx, [rbx + 0x10]
add rdx, rdx
call sym.ProcessHacker.exe_PhCreateStringEx
xor r8d, r8d
xor ecx, ecx
lea rdx, [rax + 0x10]
mov rdi, rax
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea rcx, [rdi - 0x20]
mov eax, r15d
lock xadd dword [rcx], eax
add eax, 0xffffffff
jne 0x140076e09
call fcn.14001fcd0
xor edi, edi
lea rcx, [rbx - 0x20]
lock xadd dword [rcx], r15d
add r15d, 0xffffffff
jne 0x140076e1f
call fcn.14001fcd0
lea rdx, [rsp + 0x68]
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
test al, al
jne 0x140076e50
mov rcx, qword [rsp + 0x128]
mov edi, 0xc0000034
call fcn.140094260
mov eax, edi
jmp 0x140076f48
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], 5
lea rax, [rsp + 0x68]
mov dword [rsp + 0x30], 1
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x88]
lea rcx, [rsp + 0x60]
mov edx, 0x120116
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x88], 0x30
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x90], rdi
mov dword [rsp + 0xa0], 0x40
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xb0], rdi
call qword [sym.imp.ntdll.dll_NtCreateFile]
xor edx, edx
mov edi, eax
mov rax, qword gs:[0x30]
mov r8, qword [rsp + 0x70]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rbx, qword [rsp + 0x118]
test edi, edi
cmovns rbx, qword [rsp + 0x60]
test edi, edi
jns 0x140076f1b
mov rcx, qword [rsp + 0x128]
call fcn.140094260
mov eax, edi
jmp 0x140076f48
mov rdi, qword [rsp + 0x128]
lea r8, [0x140076780]
mov rdx, rbx
mov rcx, rdi
call fcn.140090f40
mov rcx, rdi
call fcn.140094260
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
xor eax, eax
add rsp, 0xc8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret