Function at 0x100005620
Capabilities:
Create directory

Disassembly:
mov rax, rsp
sub rsp, 0x78
mov qword [rax + 0x20], rbx
mov qword [rax - 8], rbp
mov qword [rax - 0x10], rsi
mov qword [rax - 0x18], rdi
mov qword [rax - 0x38], r15
lea rdi, [0x100012be0]
xor r15d, r15d
mov rbp, rcx
mov ebx, edx
mov rax, rdi
mov esi, r15d
lea rcx, [0x1000130e0]
cmp dword [rax], 1
je 0x100005667
add rax, 0x20
inc esi
cmp rax, rcx
jl 0x100005657
cmp esi, 0x28
jne 0x10000569c
mov rcx, qword [0x100011bc8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4bb
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 0x10
call fcn.100005260
mov rax, 0xffffffffffffffff
jmp 0x100005895
lea rdx, str.MEMCAB
mov rcx, rbp
mov qword [rsp + 0x58], r12
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x10000570f
bt ebx, 8
jb 0x100005703
test bl, 8
jne 0x100005703
test bl, 1
jne 0x100005703
test bl, 2
jne 0x100005703
mov rax, qword [0x1000122a0]
movsxd rdx, esi
mov r12d, 1
mov rcx, rdx
shl rcx, 5
mov qword [rcx + rdi + 8], rax
mov eax, dword [0x1000122a8]
mov dword [rcx + rdi], r15d
mov dword [rcx + rdi + 4], r12d
mov dword [rcx + rdi + 0x10], r15d
mov dword [rcx + rdi + 0x14], eax
jmp 0x10000588d
mov rax, 0xffffffffffffffff
jmp 0x100005890
test bl, 8
je 0x100005720
mov rcx, 0xffffffffffffffff
jmp 0x100005866
test bl, 2
mov qword [rsp + 0x50], r13
jne 0x100005737
test bl, 1
jne 0x100005737
mov r13d, 0x80000000
jmp 0x10000573d
mov r13d, 0x40000000
bt ebx, 8
mov qword [rsp + 0x48], r14
mov r14d, 2
jae 0x10000576a
bt ebx, 0xa
jae 0x10000575a
lea r12d, [r14 - 1]
jmp 0x10000577d
mov r12d, 4
bt ebx, 9
cmovb r12d, r14d
jmp 0x10000577d
mov eax, 5
mov r12d, 3
bt ebx, 9
cmovb r12d, eax
mov qword [rsp + 0x30], r15
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
mov rcx, rbp
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rcx, rax
jne 0x10000585c
cmp r12d, 3
je 0x10000585c
movzx eax, byte [rbp]
test al, al
je 0x100005835
movzx ecx, byte [rbp + 1]
lea rbx, [rbp + 1]
mov edi, r15d
cmp cl, 0x3a
jne 0x1000057dc
cmp byte [rbp + 2], 0x5c
jne 0x1000057dc
lea rbx, [rbp + 3]
jmp 0x1000057eb
cmp al, 0x5c
jne 0x1000057eb
cmp cl, al
jne 0x1000057eb
lea rbx, [rbp + 2]
mov edi, r14d
cmp byte [rbx], r15b
je 0x10000582e
cmp byte [rbx], 0x5c
jne 0x100005814
cmp byte [rbx - 1], 0x3a
je 0x100005814
test edi, edi
je 0x100005803
dec edi
jmp 0x100005814
xor edx, edx
mov rcx, rbp
mov byte [rbx], r15b
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov byte [rbx], 0x5c
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharNextA]
mov rbx, rax
cmp byte [rax], r15b
jne 0x1000057f0
lea rdi, [0x100012be0]
jmp 0x100005835
lea rdi, [0x100012be0]
mov qword [rsp + 0x30], r15
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
mov rcx, rbp
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, rax
mov r14, qword [rsp + 0x48]
mov r13, qword [rsp + 0x50]
movsxd rdx, esi
mov rax, rdx
shl rax, 5
cmp rcx, 0xffffffffffffffff
mov qword [rax + rdi + 0x18], rcx
je 0x100005886
mov dword [rax + rdi], r15d
mov dword [rax + rdi + 4], r15d
jmp 0x10000588d
mov rdx, 0xffffffffffffffff
mov rax, rdx
mov r12, qword [rsp + 0x58]
mov r15, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x98]
add rsp, 0x78
ret