Function at 0x140035a00
Capabilities:
Create directory

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
movaps xmmword [rsp + 0xb0], xmm6
mov qword [rsp + 0x28], r8
mov r15, rdx
mov qword [rsp + 0x30], rcx
mov rax, qword [0x14017b750]
xor rax, rsp
mov qword [rsp + 0xa8], rax
lea r12, [rsp + 0x88]
mov rcx, r12
call fcn.14002ec50
xor r13d, r13d
lea r14, [rsp + 0x68]
mov eax, 7
movq xmm6, rax
pslldq xmm6, 8
lea rsi, [rsp + 0x48]
nop word cs:[rax + rax]
movdqu xmmword [rsp + 0x78], xmm6
mov word [rsp + 0x68], 0
cmp r14, r15
je 0x140035acd
mov rbp, qword [r15 + 0x10]
cmp qword [r15 + 0x18], 7
mov rax, r15
jbe 0x140035a93
mov rax, qword [r15]
cmp rbp, 7
jbe 0x140035ab0
mov rcx, r14
mov rdx, rbp
mov r9, rax
call fcn.140006120
jmp 0x140035acd
mov qword [rsp + 0x78], rbp
mov r8, rbp
add r8, rbp
mov rcx, r14
mov rdx, rax
call fcn.14011ea70
mov word [rsp + rbp*2 + 0x68], 0
call sub.KERNEL32.dll_GetCurrentProcessId
mov rcx, rsi
mov edx, eax
call fcn.14003fdc0
mov r8, qword [rsp + 0x58]
cmp qword [rsp + 0x60], 7
mov rax, rsi
jbe 0x140035af1
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rdx, rdi
sub rdx, rcx
cmp rdx, r8
jae 0x140035b20
mov qword [rsp + 0x20], r8
mov rcx, r14
mov rdx, r8
mov r9, rax
call fcn.14000a1a2
jmp 0x140035b4c
lea rbp, [rcx + r8]
mov qword [rsp + 0x78], rbp
mov rbx, r14
cmp rdi, 7
jbe 0x140035b37
mov rbx, qword [rsp + 0x68]
lea rcx, [rbx + rcx*2]
add r8, r8
mov rdx, rax
call fcn.14011ea70
mov word [rbx + rbp*2], 0
mov rax, qword [rsp + 0x60]
cmp rax, 8
jb 0x140035b94
mov rcx, qword [rsp + 0x48]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140035b8f
mov rdx, rcx
add rdx, 0xfffffffffffffff8
mov rcx, qword [rcx - 8]
sub rdx, rcx
cmp rdx, 0x20
jae 0x140035dcc
add rax, rax
add rax, 0x29
mov rdx, rax
call fcn.14011a568
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
cmp rax, rcx
jae 0x140035bd0
lea rdx, [rax + 1]
mov qword [rsp + 0x78], rdx
mov rdx, r14
cmp rcx, 7
jbe 0x140035bbd
mov rdx, qword [rsp + 0x68]
mov word [rdx + rax*2], 0x5f
mov word [rdx + rax*2 + 2], 0
jmp 0x140035be2
mov edx, 1
mov r9w, 0x5f
mov rcx, r14
call fcn.14000e9d0
xor ecx, ecx
mov edx, 0x7fff
call fcn.14006cd10
mov rcx, rsi
mov edx, eax
call fcn.14003fdc0
mov r8, qword [rsp + 0x58]
cmp qword [rsp + 0x60], 7
mov rax, rsi
jbe 0x140035c0d
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rdx, rdi
sub rdx, rcx
cmp rdx, r8
jae 0x140035c40
mov qword [rsp + 0x20], r8
mov rcx, r14
mov rdx, r8
mov r9, rax
call fcn.14000a1a2
jmp 0x140035c6c
lea rbp, [rcx + r8]
mov qword [rsp + 0x78], rbp
mov rbx, r14
cmp rdi, 7
jbe 0x140035c57
mov rbx, qword [rsp + 0x68]
lea rcx, [rbx + rcx*2]
add r8, r8
mov rdx, rax
call fcn.14011ea70
mov word [rbx + rbp*2], 0
mov rax, qword [rsp + 0x60]
cmp rax, 8
jb 0x140035cb4
mov rcx, qword [rsp + 0x48]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140035caf
mov rdx, rcx
add rdx, 0xfffffffffffffff8
mov rcx, qword [rcx - 8]
sub rdx, rcx
cmp rdx, 0x20
jae 0x140035dcc
add rax, rax
add rax, 0x29
mov rdx, rax
call fcn.14011a568
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x80], 7
mov rcx, r14
jbe 0x140035ccc
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x30]
mov rdx, rsi
lea r8, [rsp + 0x38]
call fcn.1400307e0
mov rcx, r12
mov rdx, rsi
call fcn.14002ef10
mov rcx, rsi
call fcn.14002ee30
cmp qword [rsp + 0xa0], 7
mov rcx, r12
jbe 0x140035d11
mov rcx, qword [rsp + 0x88]
xor ebp, ebp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x140035d31
mov rcx, qword [rsp + 0x28]
mov rdx, r12
call fcn.14002eea0
mov ebp, 1
mov rax, qword [rsp + 0x80]
cmp rax, 8
jb 0x140035d78
mov rcx, qword [rsp + 0x68]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140035d73
mov rdx, rcx
add rdx, 0xfffffffffffffff8
mov rcx, qword [rcx - 8]
sub rdx, rcx
cmp rdx, 0x20
jae 0x140035dcc
add rax, rax
add rax, 0x29
mov rdx, rax
call fcn.14011a568
test ebp, ebp
jne 0x140035d8e
add r13d, 1
cmp r13d, 0x31
jbe 0x140035a70
xor esi, esi
jmp 0x140035d91
mov sil, 1
lea rcx, [rsp + 0x88]
call fcn.14002ee30
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.14011a890
mov eax, esi
movaps xmm6, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.140128920
ud2