Function at 0x7ff6cc726f00
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
call fcn.7ff6cc772240
cmp byte [0x7ff6cc859a46], 0
je 0x7ff6cc726f17
call fcn.7ff6cc78db20
cmp byte [0x7ff6cc859d52], 0
je 0x7ff6cc726f25
call fcn.7ff6cc73c0d0
call fcn.7ff6cc73fc50
mov edx, dword [0x7ff6cc85c2e4]
lea rcx, str.IconNotifyMask
call sym.ProcessHacker.exe_PhSetIntegerSetting
mov r8, qword [sym.ProcessHacker.exe_PhMainWndHandle]
lea rdx, str.MainWindowSize
lea rcx, str.MainWindowPosition
call sym.ProcessHacker.exe_PhSaveWindowPlacementToSetting
call fcn.7ff6cc726f80
mov rcx, qword [0x7ff6cc859d28]
test rcx, rcx
je 0x7ff6cc726f74
mov rcx, qword [rcx + 8]
add rsp, 0x28
jmp 0x7ff6cc78bde0
add rsp, 0x28
ret
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r13, rcx
xor edx, edx
xor ecx, ecx
call fcn.7ff6cc7a6dd0
mov r15, rax
test rax, rax
je 0x7ff6cc78be18
lea rcx, str.settings
call sym.ProcessHacker.exe_PhDuplicateBytesZSafe
mov qword [r15 + 0x30], rax
mov edi, 5
xor eax, eax
lock cmpxchg qword [0x7ff6cc85b108], rdi
je 0x7ff6cc78be36
lea rcx, [0x7ff6cc85b108]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rcx, qword [0x7ff6cc85e988]
mov r14d, dword [rcx]
mov ebp, dword [rcx + 0x40]
add r14d, 8
mov rbx, qword [rcx + 0x30]
imul rbp, r14
add rbp, rbx
or r12d, 0xffffffff
cmp rbx, rbp
je 0x7ff6cc78be74
nop dword [rax + rax]
mov rax, rbx
add rbx, r14
cmp dword [rax], 0xffffffff
jne 0x7ff6cc78bf84
cmp rbx, rbp
jne 0x7ff6cc78be60
mov rax, qword [0x7ff6cc85ea40]
xor esi, esi
mov ebx, esi
cmp dword [rax], ebx
jbe 0x7ff6cc78beaa
mov rax, qword [rax + 8]
mov ecx, ebx
mov rdx, qword [rax + rcx*8]
mov rcx, r15
mov r8, qword [rdx + 0x28]
add rdx, 8
call fcn.7ff6cc78bcc0
mov rax, qword [0x7ff6cc85ea40]
inc ebx
cmp ebx, dword [rax]
jb 0x7ff6cc78be83
mov eax, 5
lock cmpxchg qword [0x7ff6cc85b108], rsi
je 0x7ff6cc78bec6
lea rcx, [0x7ff6cc85b108]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
lea rdx, [rsp + 0x88]
mov rcx, r13
call sym.ProcessHacker.exe_PhGetFullPath
mov rdi, rax
test rax, rax
je 0x7ff6cc78bf35
mov eax, dword [rsp + 0x88]
cmp eax, 0xffffffff
je 0x7ff6cc78bf20
mov rcx, qword [rdi + 8]
mov edx, eax
add rdx, rdx
call sym.ProcessHacker.exe_PhCreateStringEx
xor r8d, r8d
xor ecx, ecx
mov rbx, rax
mov rdx, qword [rax + 8]
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea rcx, [rbx - 0x10]
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff6cc78bf20
call fcn.7ff6cc7ae900
lea rcx, [rdi - 0x10]
lock xadd dword [rcx + 8], r12d
cmp r12d, 1
jne 0x7ff6cc78bf35
call fcn.7ff6cc7ae900
mov qword [rsp + 0x38], rsi
lea rcx, [rsp + 0x98]
mov dword [rsp + 0x30], 0x60
xor r9d, r9d
mov dword [rsp + 0x28], 5
mov r8d, 0x120116
mov rdx, r13
mov dword [rsp + 0x20], 1
call sym.ProcessHacker.exe_PhCreateFileWin32Ex
mov ebx, eax
mov rcx, r15
test eax, eax
jns 0x7ff6cc78c053
call sym.ProcessHacker.exe_mxmlDelete
mov eax, ebx
jmp 0x7ff6cc78c07f
lea rdi, [rax + 8]
test rdi, rdi
je 0x7ff6cc78be74
mov ecx, dword [rdi]
test ecx, ecx
je 0x7ff6cc78c00a
sub ecx, 1
je 0x7ff6cc78bff6
sub ecx, 1
je 0x7ff6cc78bfde
cmp ecx, 1
je 0x7ff6cc78bfb0
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov rsi, rax
jmp 0x7ff6cc78c025
mov rax, qword [rdi + 0x28]
test rax, rax
jne 0x7ff6cc78bfc3
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov rsi, rax
jmp 0x7ff6cc78c025
mov r9d, dword [rax + 4]
lea rcx, str.__u_d__d
mov r8d, dword [rax]
mov edx, dword [rax + 8]
call sym.ProcessHacker.exe_PhFormatString
mov rsi, rax
jmp 0x7ff6cc78c025
mov r8d, dword [rdi + 0x2c]
lea rcx, str._d__d
mov edx, dword [rdi + 0x28]
call sym.ProcessHacker.exe_PhFormatString
mov rsi, rax
jmp 0x7ff6cc78c025
mov edx, dword [rdi + 0x28]
lea rcx, [0x7ff6cc8319c8]
call sym.ProcessHacker.exe_PhFormatString
mov rsi, rax
jmp 0x7ff6cc78c025
mov rax, qword [rdi + 0x28]
test rax, rax
jne 0x7ff6cc78c01d
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov rsi, rax
jmp 0x7ff6cc78c025
lock inc dword [rax - 8]
mov rsi, qword [rdi + 0x28]
lea rdx, [rdi + 8]
mov r8, rsi
mov rcx, r15
call fcn.7ff6cc78bcc0
lea rcx, [rsi - 0x10]
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff6cc78be56
call fcn.7ff6cc7ae900
jmp 0x7ff6cc78be56
mov rdx, qword [rsp + 0x98]
lea r8, [0x7ff6cc78bc30]
call sym.ProcessHacker.exe_mxmlSaveFd
mov rcx, r15
call sym.ProcessHacker.exe_mxmlDelete
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ntdll.dll_NtClose]
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret