Function at 0x14011bc60
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xce0]
sub rsp, 0xde0
mov rax, qword [0x14024fa28]
xor rax, rsp
mov qword [rbp + 0xcd0], rax
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
mov r13d, esi
mov dword [rsp + 0x30], esi
lea rcx, [rbp - 0x60]
call fcn.14010f540
nop
mov rax, qword [rax]
test rax, rax
je 0x14011bce4
mov rax, qword [rax + 0x98]
test rax, rax
je 0x14011bce4
mov rax, qword [rax + 8]
test rax, rax
je 0x14011bce4
lea rdx, [rsp + 0x40]
mov ecx, 0x5405
call qword [case.0x14003c8e9.0]
mov ebx, eax
jmp 0x14011bce9
mov ebx, 0x1b67
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x14011bcfb
add rcx, 0x48
call fcn.14007f890
test ebx, ebx
je 0x14011bd09
mov eax, 0x1388
jmp 0x14011ccc8
mov qword [rsp + 0x50], rdi
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp - 0x20], xmm0
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x20]
call fcn.14011d130
nop
mov r9, qword [rsp + 0x40]
lea r8, str.plugins.01000600.settings.Quarantine.UserQuarantineDirPaths
lea rdx, [rbp + 0x70]
mov rcx, rdi
call fcn.140081c00
nop
mov r8d, dword [rbp + 0x80]
mov rcx, qword [rbp + 0x70]
cmp byte [rbp + 0x86], 0
je 0x14011bd61
mov al, 3
jmp 0x14011bdaa
cmp byte [rbp + 0x85], 0
je 0x14011bd6e
mov al, 1
jmp 0x14011bdaa
cmp r8d, 0xffffffff
je 0x14011cca6
mov rdx, qword [rcx + 0x20]
test rdx, rdx
je 0x14011bd8a
mov rax, r8
add rax, qword [rcx + 0x10]
jmp 0x14011bd8d
mov rax, rsi
cmp byte [rax], 7
je 0x14011cca6
test rdx, rdx
je 0x14011bda4
mov rax, r8
add rax, qword [rcx + 0x10]
jmp 0x14011bda7
mov rax, rsi
movzx eax, byte [rax]
movsx edx, al
sub edx, 4
je 0x14011bdb7
cmp edx, 1
jne 0x14011bdd5
cmp qword [rcx + 0x20], 0
je 0x14011bdc7
mov rax, r8
add rax, qword [rcx + 0x10]
jmp 0x14011bdca
mov rax, rsi
mov ecx, dword [rax + 1]
test ecx, ecx
jne 0x14011ccab
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rsi
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x312]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x78], rsi
mov byte [rsp + 0x20], 1
mov r9d, 0x20019
lea r8, [rsp + 0x78]
lea rdx, str.SoftwareESETESET_SecurityCurrentVersionInfo
mov rcx, 0xffffffff80000002
call fcn.1401a5450
mov ebx, 0x104
lea r15d, [rbx - 1]
mov word [rbp + 0x310], si
test al, al
je 0x14011be68
mov rdi, qword [rsp + 0x78]
test rdi, rdi
je 0x14011be6b
mov qword [rsp + 0x20], rsi
mov r9d, ebx
lea r8, [rbp + 0x310]
lea rdx, str.DataDirPrev
mov rcx, rdi
call fcn.1401a57d0
cmp si, word [rbp + 0x310]
setne r14b
jmp 0x14011be77
mov rdi, rsi
xor r14b, r14b
test rdi, rdi
je 0x14011bf0a
mov rcx, rdi
call qword [0x14024f048]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r14b, r14b
je 0x14011bf0a
lea rax, [rbp + 0x310]
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp word [rax + rcx*2], 0
jne 0x14011bea0
lea rax, [rcx + 1]
cmp rax, rbx
jae 0x14011bf03
lea rax, [rcx + 0xc]
lea r8, str.Quarantine_
mov rdx, rbx
cmp rax, rbx
ja 0x14011beda
lea rcx, [rbp + 0x310]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov byte [rsp + 0x34], 1
jmp 0x14011bf0f
lfence
mov r9, r15
sub r9, rcx
sub rdx, rcx
lea rax, [rbp + 0x310]
lea rcx, [rax + rcx*2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov word [rbp + 0x516], si
mov r13d, dword [rsp + 0x30]
mov byte [rsp + 0x34], 1
jmp 0x14011bf0f
mov byte [rsp + 0x34], 0
mov qword [rbp - 0x80], rsi
mov byte [rsp + 0x20], 1
mov r9d, 0x20019
lea r8, [rbp - 0x80]
lea rdx, str.SoftwareESETESET_SecurityCurrentVersionInfo
mov rcx, 0xffffffff80000002
call fcn.1401a5450
mov word [rbp + 0x520], si
test al, al
je 0x14011bf74
mov rdi, qword [rbp - 0x80]
test rdi, rdi
je 0x14011bf77
mov qword [rsp + 0x20], rsi
mov r9, rbx
lea r8, [rbp + 0x520]
lea rdx, str.DataDir
mov rcx, rdi
call fcn.1401a57d0
cmp si, word [rbp + 0x520]
setne r14b
jmp 0x14011bf83
mov rdi, rsi
xor r14b, r14b
test rdi, rdi
je 0x14011cbdc
mov rcx, rdi
call qword [0x14024f048]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r14b, r14b
je 0x14011cbdc
lea rax, [rbp + 0x520]
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x14011bfb0
lea rax, [rcx + 1]
cmp rax, rbx
jae 0x14011c011
lea rax, [rcx + 0xc]
lea r8, str.Quarantine_
cmp rax, rbx
ja 0x14011bfe5
mov rdx, rbx
lea rcx, [rbp + 0x520]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
jmp 0x14011c011
lfence
sub r15, rcx
sub rbx, rcx
lea rax, [rbp + 0x520]
lea rcx, [rax + rcx*2]
mov r9, r15
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov word [rbp + 0x726], si
mov r13d, dword [rsp + 0x30]
mov ecx, 4
call fcn.1401adb30
mov rbx, rax
mov qword [rbp - 0x70], rax
test rax, rax
je 0x14011c02f
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
jmp 0x14011c036
mov rbx, rsi
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], rbx
cmp dword [0x140250710], 1
je 0x14011c05d
lea rcx, [0x140250710]
call fcn.1401ac480
test eax, eax
je 0x14011c0b4
mov dword [0x140250710], 1
mov eax, dword [0x140250728]
mov r12d, esi
mov r15, rsi
cdqe
mov qword [rbp - 0x50], rax
test rax, rax
jle 0x14011c786
nop dword [rax + rax]
cmp dword [0x140250710], 1
je 0x14011c0a3
lea rcx, [0x140250710]
call fcn.1401ac480
test eax, eax
je 0x14011c0b8
mov dword [0x140250710], 1
mov eax, r12d
cmp rax, qword [0x140250728]
jl 0x14011c0c1
mov rcx, rsi
jmp 0x14011c0cc
mov eax, esi
jmp 0x14011c063
mov qword [rbp - 0x78], rsi
jmp 0x14011c772
mov rax, qword [0x140250720]
mov rcx, qword [rax + r15*8]
mov qword [rbp - 0x78], rcx
test rcx, rcx
je 0x14011c772
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x58], rax
mov qword [rbp - 0x58], 0x168
lea r9, [rbp - 0x58]
lea r8, [rbp + 0xa00]
call fcn.1401abc00
test eax, eax
je 0x14011c5b6
mov qword [rbp + 0xe0], rsi
mov qword [rbp + 0xe8], rsi
mov qword [rbp + 0xe0], rsi
mov qword [rbp + 0xe8], 7
mov word [rbp + 0xd0], si
mov r8d, 1
lea rdx, [0x1401f1088]
lea rcx, [rbp + 0xd0]
call fcn.140003530
nop
lea r8, [rbp + 0xd0]
lea rdx, [rbp + 0xa00]
lea rcx, [rbp + 0x170]
call fcn.14011d330
mov rbx, rax
lea rax, [rbp + 0x520]
mov rdx, 0xffffffffffffffff
nop dword [rax + rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x14011c180
mov rcx, qword [rbx + 0x10]
mov r8, qword [rbx + 0x18]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x14011c1cc
lea r14, [rcx + rdx]
mov qword [rbx + 0x10], r14
mov rdi, rbx
cmp r8, 8
jb 0x14011c1b1
mov rdi, qword [rbx]
lea r8, [rdx + rdx]
lea rcx, [rdi + rcx*2]
lea rdx, [rbp + 0x520]
call sub.VCRUNTIME140.dll_memmove
mov word [rdi + r14*2], si
jmp 0x14011c1eb
lfence
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x520]
mov rcx, rbx
call fcn.1400033b0
mov rbx, rax
mov r13d, dword [rsp + 0x30]
mov qword [rbp + 0x140], rsi
mov qword [rbp + 0x148], rsi
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x130], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x140], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
or r13d, 8
mov dword [rsp + 0x30], r13d
lea rdx, [rbp + 0x130]
lea rcx, [rsp + 0x50]
call fcn.14011cd30
and r13d, 0xfffffff7
mov dword [rsp + 0x30], r13d
mov rdx, qword [rbp + 0x148]
cmp rdx, 8
jb 0x14011c286
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011c281
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14011c8d5
call fcn.140007ea0
mov qword [rbp + 0x140], rsi
mov qword [rbp + 0x148], 7
mov word [rbp + 0x130], si
mov rdx, qword [rbp + 0x188]
cmp rdx, 8
jb 0x14011c2e5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011c2e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14011c8dc
call fcn.140007ea0
mov qword [rbp + 0x180], rsi
mov qword [rbp + 0x188], 7
mov word [rbp + 0x170], si
mov rdx, qword [rbp + 0xe8]
cmp rdx, 8
jb 0x14011c344
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011c33f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14011c8e3
call fcn.140007ea0
mov qword [rbp + 0xe0], rsi
mov qword [rbp + 0xe8], 7
mov word [rbp + 0xd0], si
cmp byte [rsp + 0x34], 0
je 0x14011c772
mov qword [rbp + 0x100], rsi
mov qword [rbp + 0x108], rsi
mov qword [rbp + 0x100], rsi
mov qword [rbp + 0x108], 7
mov word [rbp + 0xf0], si
mov r8d, 1
lea rdx, [0x1401f1088]
lea rcx, [rbp + 0xf0]
call fcn.140003530
nop
lea r8, [rbp + 0xf0]
lea rdx, [rbp + 0xa00]
lea rcx, [rbp + 0x190]
call fcn.14011d330
mov rbx, rax
lea rax, [rbp + 0x310]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], 0
jne 0x14011c3d4
mov rcx, qword [rbx + 0x10]
mov r8, qword [rbx + 0x18]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x14011c420
lea r14, [rcx + rdx]
mov qword [rbx + 0x10], r14
mov rdi, rbx
cmp r8, 8
jb 0x14011c405
mov rdi, qword [rbx]
lea r8, [rdx + rdx]
lea rcx, [rdi + rcx*2]
lea rdx, [rbp + 0x310]
call sub.VCRUNTIME140.dll_memmove
mov word [rdi + r14*2], si
jmp 0x14011c43f
lfence
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x310]
mov rcx, rbx
call fcn.1400033b0
mov rbx, rax
mov r13d, dword [rsp + 0x30]
mov qword [rbp + 0x160], rsi
mov qword [rbp + 0x168], rsi
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x150], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x160], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
or r13d, 0x10
mov dword [rsp + 0x30], r13d
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x50]
call fcn.14011cd30
and r13d, 0xffffffef
mov dword [rsp + 0x30], r13d
mov rdx, qword [rbp + 0x168]
cmp rdx, 8
jb 0x14011c4da
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011c4d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14011c8ea
call fcn.140007ea0
mov qword [rbp + 0x160], rsi
mov qword [rbp + 0x168], 7
mov word [rbp + 0x150], si
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 8
jb 0x14011c539
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011c534
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14011c8f1
call fcn.140007ea0
mov qword [rbp + 0x1a0], rsi
mov qword [rbp + 0x1a8], 7
mov word [rbp + 0x190], si
mov rdx, qword [rbp + 0x108]
cmp rdx, 8
jb 0x14011c598
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011c593
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14011c8f8
call fcn.140007ea0
mov qword [rbp + 0x100], rsi
mov qword [rbp + 0x108], 7
mov word [rbp + 0xf0], si
jmp 0x14011c772
mov edx, 0x168
lea rcx, [rbp + 0x730]
call fcn.140195db0
test al, al
je 0x14011c772
lea rax, [rbp + 0x730]
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x14011c5e0
lea rax, [rcx + 1]
cmp rax, 0x168
jae 0x14011c646
lea rax, [rcx + 0xc]
lea r8, str.Quarantine_
mov edx, 0x168
cmp rax, rdx
ja 0x14011c61a
lea rcx, [rbp + 0x730]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
jmp 0x14011c646
lfence
mov r9d, 0x167
sub r9, rcx
sub rdx, rcx
lea rax, [rbp + 0x730]
lea rcx, [rax + rcx*2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov word [rbp + 0x9fe], si
mov r13d, dword [rsp + 0x30]
lea rcx, [rbp + 0x730]
call fcn.1401958c0
test al, al
jne 0x14011c6ad
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], rax
mov dword [rbp - 0x48], 0x18
xor r9d, r9d
lea r8, [rbp - 0x40]
lea edx, [rax + 1]
lea rcx, str.D:_A_OICI_GA___SY__A_OICI_GA___BA__A_OICI_GW___BU_
call fcn.1401bf6e0
test eax, eax
je 0x14011c772
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x730]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
test ebx, ebx
je 0x14011c772
mov qword [rbp + 0x120], rsi
mov qword [rbp + 0x128], rsi
mov qword [rbp + 0x120], rsi
mov qword [rbp + 0x128], 7
mov word [rbp + 0x110], si
lea rax, [rbp + 0x730]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x14011c6e2
lea rdx, [rbp + 0x730]
lea rcx, [rbp + 0x110]
call fcn.140003530
nop
lea rdx, [rbp + 0x110]
lea rcx, [rsp + 0x50]
call fcn.14011cd30
nop
mov rdx, qword [rbp + 0x128]
cmp rdx, 8
jb 0x14011c759
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011c754
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14011c8ff
call fcn.140007ea0
mov qword [rbp + 0x120], rsi
mov qword [rbp + 0x128], 7
mov word [rbp + 0x110], si
inc r12d
inc r15
cmp r15, qword [rbp - 0x50]
jl 0x14011c080
mov rbx, qword [rbp - 0x70]
test rbx, rbx
je 0x14011c79f
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
mov rcx, rbx
call qword [case.0x1401b9e8b.6]
mov r12, qword [rsp + 0x68]
mov r14, qword [rsp + 0x60]
cmp r14, r12
je 0x14011cb1b
add r14, 0x20
nop word [rax + rax]
mov edx, 1
lea rcx, [rbp + 0x1b0]
call fcn.14000d670
nop
lea r15, [r14 - 0x20]
cmp qword [r14 - 8], 8
jb 0x14011c7e0
mov r15, qword [r15]
cmp dword [rbp + 0x2d0], 0
je 0x14011c841
lea rcx, [rbp + 0x2c0]
cmp qword [rbp + 0x2d8], 0x10
cmovae rcx, qword [rbp + 0x2c0]
mov rax, qword [rbp + 0x2d0]
test byte [rcx + rax - 1], 0x10
je 0x14011c841
mov byte [rbp + 0x250], 1
lea rdx, [0x1401f11bc]
lea rcx, [rbp + 0x1d0]
call fcn.14000f370
mov rax, qword [rbp + 0x1d0]
movsxd rcx, dword [rax + 4]
test byte [rbp + rcx + 0x1e0], 6
jne 0x14011cd12
lea rdx, str.Path
lea rcx, [rbp + 0x1b0]
call fcn.14000f560
xor edx, edx
test r15, r15
je 0x14011c906
xor r8d, r8d
mov rcx, r15
call fcn.1401af550
movsxd rbx, eax
mov rcx, rbx
call fcn.1401c538c
mov rdi, rax
mov byte [rbp - 0x10], 0
lea rax, [fcn.1400054a0]
mov qword [rbp - 8], rax
mov qword [rbp], rdi
or r13d, 0x20
mov dword [rsp + 0x30], r13d
mov r8, rbx
mov rdx, rdi
mov rcx, r15
call fcn.1401af550
lea rdx, [0x1401ef380]
test eax, eax
cmovne rdx, rdi
mov r8, 0xffffffffffffffff
lea rcx, [rbp + 0x1b0]
call fcn.14000ed20
and r13d, 0xffffffdf
mov dword [rsp + 0x30], r13d
mov rcx, rdi
call fcn.140007ea0
jmp 0x14011c919
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov r8, 0xffffffffffffffff
lea rcx, [rbp + 0x1b0]
call fcn.14000ed20
mov eax, dword [rbp + 0x2d0]
test eax, eax
je 0x14011c94c
lea rcx, [rbp + 0x2c0]
cmp qword [rbp + 0x2d8], 0x10
cmovae rcx, qword [rbp + 0x2c0]
mov rax, qword [rbp + 0x2d0]
or byte [rcx + rax - 1], 0x10
mov eax, dword [rbp + 0x2d0]
mov r15, r14
cmp qword [r14 + 0x18], 8
jb 0x14011c959
mov r15, qword [r14]
test eax, eax
je 0x14011c9b5
lea rcx, [rbp + 0x2c0]
cmp qword [rbp + 0x2d8], 0x10
cmovae rcx, qword [rbp + 0x2c0]
mov rax, qword [rbp + 0x2d0]
test byte [rax + rcx - 1], 0x10
je 0x14011c9b5
mov byte [rbp + 0x250], 1
lea rdx, [0x1401f11bc]
lea rcx, [rbp + 0x1d0]
call fcn.14000f370
mov rax, qword [rbp + 0x1d0]
movsxd rcx, dword [rax + 4]
test byte [rbp + rcx + 0x1e0], 6
jne 0x14011ccf8
lea rdx, str.UserSID
lea rcx, [rbp + 0x1b0]
call fcn.14000f560
xor edx, edx
test r15, r15
je 0x14011ca45
xor r8d, r8d
mov rcx, r15
call fcn.1401af550
movsxd rbx, eax
mov rcx, rbx
call fcn.1401c538c
mov rdi, rax
mov byte [rbp + 8], 0
lea rax, [fcn.1400054a0]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rdi
or r13d, 0x40
mov dword [rsp + 0x30], r13d
mov r8, rbx
mov rdx, rdi
mov rcx, r15
call fcn.1401af550
lea rdx, [0x1401ef380]
test eax, eax
cmovne rdx, rdi
mov r8, 0xffffffffffffffff
lea rcx, [rbp + 0x1b0]
call fcn.14000ed20
and r13d, 0xffffffbf
mov dword [rsp + 0x30], r13d
mov rcx, rdi
call fcn.140007ea0
jmp 0x14011ca58
mov r8, 0xffffffffffffffff
lea rcx, [rbp + 0x1b0]
call fcn.14000ed20
cmp dword [rbp + 0x2d0], 0
je 0x14011ca84
lea rcx, [rbp + 0x2c0]
cmp qword [rbp + 0x2d8], 0x10
cmovae rcx, qword [rbp + 0x2c0]
mov rax, qword [rbp + 0x2d0]
or byte [rax + rcx - 1], 0x10
mov rbx, qword [rsp + 0x40]
lea rcx, [rbp + 0x1b0]
call fcn.14000d390
cmp qword [rax + 0x18], 0x10
jb 0x14011ca9f
mov rax, qword [rax]
mov r9, rbx
mov r8, rax
lea rdx, str.plugins.01000600.settings.Quarantine.UserQuarantineDirPaths
mov rcx, qword [rsp + 0x48]
call fcn.14000ccd0
nop
test al, al
je 0x14011cb91
lea rcx, [rbp + 0x2e0]
call fcn.140002800
nop
lea rcx, [rbp + 0x2c0]
call fcn.140002800
nop
lea rax, [rbp + 0x260]
mov qword [rbp - 0x68], rax
lea rcx, [rbp + 0x260]
call fcn.14000b780
lea rcx, [rbp + 0x260]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1b0]
call fcn.140002800
add r14, 0x40
lea rax, [r14 - 0x20]
cmp rax, r12
jne 0x14011c7c0
mov qword [rsp + 0x38], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
lea r9, [rsp + 0x38]
xor r8d, r8d
lea edx, [r8 + 4]
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x14011cb75
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
je 0x14011cc59
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
lea r9, [rsp + 0x38]
mov edx, 4
lea r8d, [rdx - 3]
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0x14011cc59
mov rbx, qword [rsp + 0x38]
mov rax, rbx
test rbx, rbx
je 0x14011cc59
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
jmp 0x14011cc5c
lea rcx, [rbp + 0x2e0]
call fcn.140002800
nop
lea rcx, [rbp + 0x2c0]
call fcn.140002800
nop
lea rax, [rbp + 0x260]
mov qword [rbp - 0x68], rax
lea rcx, [rbp + 0x260]
call fcn.14000b780
lea rcx, [rbp + 0x260]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1b0]
call fcn.140002800
mov edi, 0x1388
mov rbx, qword [rsp + 0x60]
test rbx, rbx
je 0x14011ccad
mov r14, qword [rsp + 0x68]
mov qword [rsp + 0x48], rbx
cmp rbx, r14
je 0x14011cc25
nop
lea rcx, [rbx + 0x20]
call fcn.1400036b0
nop
mov rcx, rbx
call fcn.1400036b0
add rbx, 0x40
mov qword [rsp + 0x48], rbx
cmp rbx, r14
jne 0x14011cc00
mov rbx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x70]
sub rdx, rbx
and rdx, 0xffffffffffffffc0
mov rax, rbx
cmp rdx, 0x1000
jb 0x14011cc8e
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14011cc8e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rbx, rsi
mov qword [rbp - 0x30], rbx
mov rdx, qword [rsp + 0x40]
call fcn.1400ebde0
mov edi, esi
test rbx, rbx
je 0x14011cbe1
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
mov rcx, rbx
call qword [case.0x1401b9e8b.6]
jmp 0x14011cbe1
mov rcx, rbx
call fcn.140007ea0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rsi
jmp 0x14011ccad
mov esi, 0x1388
mov edi, esi
lea rcx, [rbp + 0x70]
call fcn.14000b680
nop
cmp byte [rbp + 0x20], 0
jne 0x14011ccc6
mov rdx, qword [rbp + 0x30]
call fcn.1400ebe60
mov eax, edi
mov rcx, qword [rbp + 0xcd0]
xor rcx, rsp
call fcn.1401c5190
lea r11, [rsp + 0xde0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rcx, [rbp + 0x50]
call fcn.14000feb0
lea rdx, [0x14024ab88]
lea rcx, [rbp + 0x50]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
lea rcx, [rbp + 0x38]
call fcn.14000feb0
lea rdx, [0x14024ab88]
lea rcx, [rbp + 0x38]
call sub.VCRUNTIME140.dll__CxxThrowException
int3