Function at 0x140031538
Capabilities:
Create directory
Delete directory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
xor esi, esi
mov rbx, rcx
mov rcx, qword [rcx + 8]
mov r13d, esi
mov dword [rax - 0x48], esi
mov edi, 1
mov qword [rax - 0x40], rsi
call fcn.140031408
mov rcx, qword [rbx + 0x10]
mov rbp, rax
call fcn.140031408
mov rbx, rax
test rbp, rbp
je 0x140031764
test rax, rax
je 0x140031764
mov r8b, dil
xor edx, edx
mov rcx, rbp
call fcn.140031a40
test eax, eax
jne 0x1400315b9
mov ecx, 0x4000272e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
jmp 0x140031764
mov rcx, rbx
call fcn.140031914
test eax, eax
jne 0x1400315cc
mov ecx, 0x40002749
jmp 0x1400315a8
xor edx, edx
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x140031764
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0x2000000
mov r8d, edi
mov edx, 0x40000000
mov dword [rsp + 0x20], 3
mov rcx, rbp
mov r13d, edi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
nop dword [rax + rax]
or rsi, 0xffffffffffffffff
mov r15, rax
cmp rax, rsi
je 0x140031762
xor r9d, r9d
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
nop dword [rax + rax]
mov rcx, rsi
xor eax, eax
inc rcx
cmp word [rbx + rcx*2], ax
jne 0x140031646
movzx eax, word [rsp + 0x50]
lea ecx, [rcx + 0xa]
lea r12d, [rax + rcx*2]
mov ecx, r12d
call fcn.14000cd90
mov r14, rax
test rax, rax
je 0x14003174f
mov r8d, r12d
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov dword [r14], 0xa0000003
lea eax, [r12 - 8]
mov word [r14 + 4], ax
lea rcx, [r14 + 0x10]
xor eax, eax
mov word [r14 + 8], ax
movzx eax, word [rsp + 0x50]
mov word [r14 + 0xa], ax
movzx r8d, word [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
call sub.msvcrt.dll_memcpy
movzx eax, word [r14 + 0xa]
add ax, 2
mov word [r14 + 0xc], ax
xor eax, eax
inc rsi
cmp word [rbx + rsi*2], ax
jne 0x1400316c2
movzx ecx, word [r14 + 0xa]
add si, si
add rcx, 0x12
movzx r8d, si
add rcx, r14
mov word [r14 + 0xe], r8w
mov rdx, rbx
call sub.msvcrt.dll_memcpy
xor esi, esi
lea rax, [rsp + 0x60]
mov dword [rsp + 0x48], esi
xor r9d, r9d
mov qword [rsp + 0x40], rsi
xor r8d, r8d
mov dword [rsp + 0x38], r12d
xor edx, edx
mov qword [rsp + 0x30], r14
mov rcx, r15
mov dword [rsp + 0x28], 0x900a4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtFsControlFile]
nop dword [rax + rax]
test eax, eax
jns 0x14003174b
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov ecx, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
jmp 0x140031751
mov edi, esi
jmp 0x140031751
xor esi, esi
mov rcx, r15
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
jmp 0x140031764
xor esi, esi
cmp qword [rsp + 0x58], rsi
je 0x14003178b
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rsp + 0x58]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
test edi, edi
je 0x1400317a3
test r13d, r13d
je 0x1400317a3
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_RemoveDirectoryW]
nop dword [rax + rax]
lea r11, [rsp + 0x70]
mov eax, edi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret