Function at 0x140115ac0
Capabilities:
Create directory
Delete directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
and dword [rsp + 0x98], 0
mov rdi, rcx
mov rcx, rdx
mov r13, r8
mov r15, rdx
or rbp, 0xffffffffffffffff
call fcn.140155960
lea ebx, [rbp + 5]
mov rcx, r15
mov r8d, ebx
lea rdx, [0x14018aa20]
mov rsi, rax
call fcn.1401587e0
xor r12d, r12d
lea edx, [rbp + 0x5d]
test eax, eax
sete r12b
test eax, eax
je 0x140115b6e
cmp esi, 3
jl 0x140115b54
movzx ecx, word [r15]
lea eax, [rcx - 0x61]
cmp ax, 0x19
jbe 0x140115b3d
sub cx, 0x41
cmp cx, 0x19
ja 0x140115b54
cmp word [r15 + 2], 0x3a
jne 0x140115b54
cmp word [r15 + 4], dx
je 0x140115b6e
cmp word [r15 + 4], 0x2f
je 0x140115b6e
mov qword [rdi + 0x88], 0xfffffffffffff019
mov dword [rdi + 0x14c], 0x32
jmp 0x140115dc2
lea eax, [rsi*4 + 0x20]
movsxd rcx, eax
call fcn.14010c380
mov rsi, rax
test rax, rax
je 0x140115de0
mov r8, rbx
lea rdx, [0x14018aa10]
lea rcx, [rax + 0x10]
call fcn.140158810
lea eax, [r12*4]
xor r9d, r9d
xor r12d, r12d
mov r11d, eax
lea r10, [r15 + rax*2]
movzx ecx, word [r10]
test cx, cx
je 0x140115c0f
mov r8d, r11d
lea eax, [r9 + 0x5c]
mov rdx, r10
cmp cx, ax
je 0x140115bfa
cmp cx, 0x2f
je 0x140115bfa
test r9d, r9d
je 0x140115be9
movsxd rax, ebx
mov ecx, 0x5c
inc ebx
mov r9d, r12d
mov word [rsi + rax*2 + 0x10], cx
movzx ecx, word [rdx]
movsxd rax, ebx
inc ebx
mov word [rsi + rax*2 + 0x10], cx
mov eax, 0x5c
jmp 0x140115c00
mov r9d, 1
inc r8
lea rdx, [r15 + r8*2]
movzx ecx, word [rdx]
test cx, cx
jne 0x140115bc4
movsxd rax, ebx
mov r9d, 0x5c
inc ebx
mov edx, r12d
mov word [rsi + rax*2 + 0x10], r9w
movzx eax, bx
add ax, ax
mov word [rsi + 8], r12w
mov word [rsi + 0xa], ax
movsxd rax, ebx
inc ebx
mov r8d, ebx
mov word [rsi + rax*2 + 0x10], r12w
jmp 0x140115c7c
cmp cx, r9w
je 0x140115c70
cmp cx, 0x2f
je 0x140115c70
test edx, edx
je 0x140115c64
movsxd rax, ebx
mov edx, r12d
inc ebx
mov word [rsi + rax*2 + 0x10], r9w
movzx ecx, word [r10]
movsxd rax, ebx
inc ebx
mov word [rsi + rax*2 + 0x10], cx
jmp 0x140115c75
mov edx, 1
inc r11
lea r10, [r15 + r11*2]
movzx ecx, word [r10]
test cx, cx
jne 0x140115c42
mov eax, ebx
sub eax, r8d
cmp eax, 2
jne 0x140115c9f
movsxd rax, ebx
inc ebx
mov word [rsi + rax*2 + 0x10], r9w
mov eax, 3
add ax, ax
add r8w, r8w
mov word [rsi + 0xe], ax
xor edx, edx
movsxd rax, ebx
mov rcx, r13
mov word [rsi + 0xc], r8w
lea ebx, [rbx*2 + 0x12]
mov word [rsi + rax*2 + 0x10], r12w
lea eax, [rbx - 8]
mov word [rsi + 4], ax
mov dword [rsi], 0xa0000003
mov word [rsi + 6], r12w
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140115cfd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov dword [rdi + 0x14c], eax
call fcn.14011bfd0
mov r14d, dword [rsp + 0x98]
jmp 0x140115d79
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], 0x2200000
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 3
mov rcx, r13
mov r14d, 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140115d66
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov r9d, ebx
mov dword [rsp + 0x28], r12d
mov r8, rsi
mov edx, 0x900a4
mov qword [rsp + 0x20], r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x140115daa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov dword [rdi + 0x14c], eax
call fcn.14011bfd0
movsxd rcx, eax
mov qword [rdi + 0x88], rcx
mov rcx, rsi
call fcn.14010c1f0
cmp rbp, 0xffffffffffffffff
je 0x140115d9a
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14d, r14d
je 0x140115dc2
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x140115dc2
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.14010c1f0
mov qword [rdi + 0x88], r12
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rdx, str.uv__malloc
mov ecx, reloc.WS2_32.dll_ntohl
call fcn.14011bf20
int3