Function at 0x18001c9f0
Capabilities:
Create directory

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xb0
mov r14, rcx
xor r12d, r12d
mov qword [rbp + 0x77], r12
mov qword [rbp + 0x6f], r12
mov qword [rbp + 0x7f], r12
xorps xmm0, xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
movups xmmword [rbp + 0x17], xmm0
mov esi, r12d
mov r15d, r12d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x18001cb9e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x18001cb9e
xorps xmm0, xmm0
movups xmmword [rbp - 0x49], xmm0
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x31], r12
mov r8, 0xffffffffffffffff
inc r8
cmp byte [r14 + r8], sil
jne 0x18001ca63
mov rdx, r14
lea rcx, [rbp - 0x49]
call fcn.1800090b0
nop
mov rbx, r12
mov rdx, qword [rbp - 0x39]
mov rcx, qword [rbp - 0x31]
mov r9, qword [rbp - 0x49]
test rdx, rdx
je 0x18001cb67
nop dword [rax]
nop word [rax + rax]
lea rax, [rbp - 0x49]
cmp rcx, 0x10
setae r10b
cmovae rax, r9
cmp byte [rax + rbx], 0x5c
jne 0x18001cb5b
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], r12
mov qword [rbp - 0x11], r12
mov r8, rbx
cmp rdx, rbx
cmovb r8, rdx
lea rdx, [rbp - 0x49]
test r10b, r10b
cmovne rdx, r9
lea rcx, [rbp - 0x29]
call fcn.1800090b0
lea rcx, [rbp - 0x29]
cmp qword [rbp - 0x11], 0x10
cmovae rcx, qword [rbp - 0x29]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edi, eax
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x18001cb3a
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001cb35
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001cd0f
call fcn.18001fd10
test edi, edi
jne 0x18001cb4f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 3
je 0x18001ccd3
mov rcx, qword [rbp - 0x31]
mov rdx, qword [rbp - 0x39]
mov r9, qword [rbp - 0x49]
inc rbx
cmp rbx, rdx
jb 0x18001caa0
cmp rcx, 0x10
jb 0x18001cb9e
lea rdx, [rcx + 1]
mov rax, r9
cmp rdx, 0x1000
jb 0x18001cb96
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001cd15
mov rcx, r9
call fcn.18001fd10
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x18001cbbe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 3
je 0x18001cc87
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea edx, [r9 + 1]
lea r8d, [r9 + 4]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoA]
mov edi, eax
test eax, eax
jne 0x18001cc87
lea ecx, [rax + 9]
call fcn.1800201a4
mov rsi, rax
mov word [rax + 7], 0x65
mov dword [rax], 0x72657645
mov word [rax + 4], 0x6f79
mov byte [rax + 6], 0x6e
mov dword [rbp - 9], 0x1f01ff
mov dword [rbp - 5], 1
mov dword [rbp - 1], 3
mov dword [rbp + 0x13], 1
mov qword [rbp + 0x1f], rax
lea r9, [rbp + 0x6f]
mov r8, qword [rbp + 0x77]
lea rdx, [rbp - 9]
lea ecx, [rdi + 1]
call qword [sym.imp.ADVAPI32.dll_SetEntriesInAclA]
mov edi, eax
test eax, eax
jne 0x18001cc87
mov rcx, r14
call fcn.180013f50
mov r15, rax
mov qword [rsp + 0x30], r12
mov rcx, qword [rbp + 0x6f]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea edx, [rdi + 1]
lea r8d, [rdi + 4]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoA]
mov edi, eax
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x18001cc96
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp + 0x6f]
test rcx, rcx
je 0x18001cca5
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rsi, rsi
je 0x18001ccb2
mov rcx, rsi
call fcn.18001fd10
test r15, r15
je 0x18001ccbf
mov rcx, r15
call fcn.18001fd10
mov eax, edi
add rsp, 0xb0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rdx, qword [rbp - 0x31]
cmp rdx, 0x10
jb 0x18001cc87
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001cd05
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001cd15
call fcn.18001fd10
jmp 0x18001cc87
call fcn.180026dac
nop
call fcn.180026dac
int3