Function at 0x140001fb0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x3a0
mov rax, qword [0x140028008]
xor rax, rsp
mov qword [rsp + 0x398], rax
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
nop
lea rcx, [rsp + 0x160]
call qword [sym.imp.ole32.dll_CoCreateGuid]
lea rdx, [rsp + 0x128]
lea rcx, [rsp + 0x160]
call qword [sym.imp.ole32.dll_StringFromIID]
mov ebx, 0x104
mov r8d, ebx
lea rdx, [rsp + 0x180]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, 0x5c
lea rcx, [rsp + 0x180]
call fcn.1400044d8
xor edi, edi
mov word [rax], di
mov ecx, ebx
lea rax, [rsp + 0x180]
cmp word [rax], di
je 0x140002044
add rax, 2
sub rcx, 1
jne 0x140002035
mov rax, rbx
sub rax, rcx
test rcx, rcx
cmove rax, rdi
je 0x1400020a0
sub rbx, rax
lea rcx, [rsp + 0x180]
lea rcx, [rcx + rax*2]
je 0x140002092
mov eax, 0x7ffffffe
lea r8, str.etw
sub r8, rcx
test rax, rax
je 0x140002092
movzx edx, word [r8 + rcx]
test dx, dx
je 0x140002092
mov word [rcx], dx
add rcx, 2
dec rax
sub rbx, 1
jne 0x140002073
lea rax, [rcx - 2]
test rbx, rbx
cmovne rax, rcx
mov word [rax], di
xor edx, edx
lea rcx, [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop
mov qword [rsp + 0x130], rdi
lea rax, [rsp + 0x130]
mov qword [rsp + 0x20], rax
lea r9, [0x1400248e0]
xor edx, edx
lea r8d, [rdx + 4]
lea rcx, [0x140028a50]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x140002364
lea rax, [rsp + 0x140]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x158]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x144]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xf0]
lea r8, [rsp + 0x148]
lea rdx, [rsp + 0x14c]
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.ole32.dll_CoQueryProxyBlanket]
test eax, eax
jne 0x140002387
mov eax, dword [rsp + 0x140]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 3
mov eax, dword [rsp + 0x144]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0xf0]
mov r8d, dword [rsp + 0x148]
mov edx, dword [rsp + 0x14c]
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jne 0x1400023aa
mov qword [rsp + 0xfc], rdi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x108], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x118], xmm1
mov dword [rsp + 0xf8], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x104], eax
lea rcx, [rsp + 0x108]
call qword [sym.imp.ole32.dll_CoCreateGuid]
mov ecx, 0x18
call fcn.1400027d4
mov rbx, rax
mov qword [rsp + 0x150], rax
test rax, rax
je 0x14000222d
mov qword [rax], rdi
mov qword [rax + 0x10], 1
mov qword [rax + 8], rdi
lea rcx, [rsp + 0x180]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x1400023d4
jmp 0x140002230
mov rbx, rdi
mov qword [rsp + 0x150], rbx
test rbx, rbx
je 0x1400023df
mov rax, qword [rbx]
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x138], rdi
mov rcx, qword [rsp + 0x130]
test rcx, rcx
je 0x140002359
mov qword [rsp + 0x138], rdi
mov rax, qword [rcx]
lea r9, [rsp + 0x138]
xor r8d, r8d
lea rdx, [rsp + 0xf8]
call qword [rax + 0x18]
test eax, eax
jne 0x1400023ea
lea rcx, [rsp + 0x170]
call qword [sym.imp.ole32.dll_CoCreateGuid]
mov rcx, qword [rsp + 0x138]
test rcx, rcx
je 0x14000243c
mov rax, qword [rcx]
lea r8, [rsp + 0x170]
lea rdx, str.license.rtf
call qword [rax + 0x28]
test eax, eax
jne 0x140002413
mov rcx, qword [rsp + 0x138]
test rcx, rcx
je 0x1400022de
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14000231e
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400022fe
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], rdi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140002310
call fcn.1400027a0
mov qword [rbx + 8], rdi
mov edx, 0x18
mov rcx, rbx
call fcn.1400027a0
nop
mov rcx, qword [rsp + 0x130]
test rcx, rcx
je 0x140002332
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, qword [rsp + 0x398]
xor rcx, rsp
call fcn.140002780
mov rbx, qword [rsp + 0x3b0]
add rsp, 0x3a0
pop rdi
ret
mov ecx, 0x80004003
call fcn.1400033e0
nop
xor r9d, r9d
xor r8d, r8d
mov edx, eax
lea rcx, [rsp + 0x48]
call fcn.140001bc0
lea rdx, [0x140026958]
lea rcx, [rsp + 0x48]
call fcn.140004588
xor r9d, r9d
xor r8d, r8d
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.140001bc0
lea rdx, [0x140026958]
lea rcx, [rsp + 0x68]
call fcn.140004588
xor r9d, r9d
xor r8d, r8d
mov edx, eax
lea rcx, [rsp + 0x88]
call fcn.140001bc0
lea rdx, [0x140026958]
lea rcx, [rsp + 0x88]
call fcn.140004588
nop
mov ecx, 0x8007000e
call fcn.1400033e0
nop
mov ecx, 0x8007000e
call fcn.1400033e0
nop
xor r9d, r9d
xor r8d, r8d
mov edx, eax
lea rcx, [rsp + 0xa8]
call fcn.140001bc0
lea rdx, [0x140026958]
lea rcx, [rsp + 0xa8]
call fcn.140004588
xor r9d, r9d
xor r8d, r8d
mov edx, eax
lea rcx, [rsp + 0xc8]
call fcn.140001bc0
lea rdx, [0x140026958]
lea rcx, [rsp + 0xc8]
call fcn.140004588
mov ecx, 0x80004003
call fcn.1400033e0
int3