Function at 0x14000e870
Capabilities:
Create directory

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
lea rbp, [rax - 0x2a8]
sub rsp, 0x390
mov qword [rbp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x140634590]
xor rax, rsp
mov qword [rbp + 0x280], rax
call fcn.1400286c0
mov rbx, rax
lea rdx, [0x1405369f8]
lea rcx, [rbp + 0x40]
call fcn.1400041f0
mov r9, qword [rbx]
mov r8b, 1
mov rdx, rax
mov rcx, rbx
call qword [r9]
lea r11, [rbp - 0x18]
mov qword [rbp - 0x70], r11
lea rdx, str._SystemDrive_ReiSupportInfoTool.log
lea rcx, [rbp - 0x18]
call fcn.1400041f0
mov rbx, rax
call fcn.1400256b0
mov rcx, rax
mov r8, rbx
lea rdx, [rbp - 0x20]
call fcn.14001ca30
nop
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 1
mov r9b, 1
mov r8, qword [rax]
movzx edx, r9b
lea rcx, [0x140636e50]
call fcn.140018a80
nop
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
or esi, 0xffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000e944
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor edx, edx
lea rcx, [0x140636e50]
call fcn.140016930
lea r11, [rbp + 0x28]
mov qword [rbp - 0x70], r11
lea rdx, str._SystemDrive_ReiSupportInfoTool.ini
lea rcx, [rbp + 0x28]
call fcn.1400041f0
mov rbx, rax
call fcn.1400256b0
mov rcx, rax
mov r8, rbx
lea rdx, [rbp - 0x68]
call fcn.14001ca30
nop
mov byte [rsp + 0x20], 0
xor r9d, r9d
mov r8b, 1
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x80]
call fcn.14001bde0
nop
lea rcx, [rbp + 0x60]
call fcn.1400258f0
nop
xor r13d, r13d
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], r13
call fcn.1402255b4
mov r11, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x14000e9e5
mov ecx, 0x80004005
call fcn.1400042e0
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x70], rax
call fcn.1402255b4
mov r11, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x14000ea16
mov ecx, 0x80004005
call fcn.1400042e0
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
call fcn.1402255b4
mov r11, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x14000ea48
mov ecx, 0x80004005
call fcn.1400042e0
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
lea rax, [rbp + 0x38]
mov qword [rbp + 0x18], rax
lea rdx, str._CSIDL_COMMON_DESKTOPDIRECTORY_Support_Info.zip
lea rcx, [rbp + 0x38]
call fcn.1400041f0
mov rdi, rax
call fcn.1400256b0
mov rcx, rax
mov r8, rdi
lea rdx, [rbp - 0x10]
call fcn.14001ca30
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14000eae4
cmp dword [rbx + 0x10], 0
jl 0x14000ead5
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14000ead5
call fcn.140003c60
mov rdi, rax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14000eaca
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x48], rax
jmp 0x14000eae4
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.140004100
nop
mov rdx, qword [rbp - 0x10]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000eb02
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp + 0x30]
call fcn.14000b440
nop
lea r8, str.SupportInfoPackage
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.1400045a0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x40]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14000eb7f
cmp dword [rbx + 0x10], 0
jl 0x14000eb70
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14000eb70
call fcn.140003c60
mov rdi, rax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14000eb65
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x40], rax
jmp 0x14000eb7f
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.140004100
nop
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000eb9e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000ebbc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edx, 1
lea rcx, [rbp - 0x60]
call fcn.140002600
mov rbx, qword [rbp - 0x58]
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x48], rbx
test rbx, rbx
je 0x14000ebf0
mov rcx, qword [rsp + 0x40]
add rcx, 0xffffffffffffffe8
call fcn.140003c60
add rax, 0x18
mov qword [rbx], rax
add rbx, 8
mov qword [rbp - 0x58], rbx
lea rcx, [rsp + 0x40]
call fcn.14000f490
test al, al
jne 0x14000ec52
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000ec3a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov r8, qword [rsp + 0x40]
lea rdx, str.Failed_to_create_directory__s_with_error__u_n
lea rcx, [0x140636e50]
call fcn.140019030
jmp 0x14000ec52
mov r8, qword [rsp + 0x40]
lea rdx, str.Created_directory__s_n
lea rcx, [0x140636e50]
call fcn.140019030
call fcn.14000c5a0
test al, al
jne 0x14000ec6e
lea rdx, str.No_malware_was_added_to_package._n
lea rcx, [0x140636e50]
call fcn.140019030
call fcn.1402255b4
mov r11, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x14000ec8e
mov ecx, 0x80004005
call fcn.1400042e0
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
lea rdx, str.Registry
test rdx, 0xffffffffffff0000
jne 0x14000ecd1
movzx ebx, dx
mov ecx, ebx
call fcn.1402253fc
test rax, rax
je 0x14000ece2
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140003e00
jmp 0x14000ece2
mov r8d, 8
lea rcx, [rsp + 0x60]
call fcn.140004100
nop
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x80]
call fcn.140019800
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000ed13
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, [0x1403d1fe0]
lea rcx, [rbp + 0x50]
call fcn.1400041f0
mov r8, rax
lea rdx, [rbp - 8]
lea rcx, [rbp + 0x80]
call fcn.14001aa50
nop
lea rcx, [rbp - 0x40]
call fcn.14000b440
nop
mov r8, rax
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 8]
call fcn.140027e30
test al, al
sete bl
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000ed75
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
je 0x14000edcb
lea rcx, [rbp + 0x20]
call fcn.140027a50
nop
mov r8, qword [rax]
lea rdx, str.Error_exporting_registry:__s_n
lea rcx, [0x140636e50]
call fcn.140019030
nop
mov rdx, qword [rbp + 0x20]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000edb8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.no_reg_dump_will_be_added._n
lea rcx, [0x140636e50]
call fcn.140019030
lea rcx, [rsp + 0x70]
call fcn.14000da90
test al, al
jne 0x14000edec
lea rdx, str.Error_adding_logs_and_dumps._n
lea rcx, [0x140636e50]
call fcn.140019030
lea rcx, [rsp + 0x70]
call fcn.14000c0b0
test al, al
jne 0x14000ee0d
lea rdx, str.Error_Extending_directories_into_files._n
lea rcx, [0x140636e50]
call fcn.140019030
lea rcx, [rsp + 0x70]
call fcn.14000d1e0
test al, al
jne 0x14000ee2e
lea rdx, str.Error_filtering_directories._n
lea rcx, [0x140636e50]
call fcn.140019030
lea rcx, [rbp + 0x120]
call fcn.140063f60
nop
lea rdx, str.REIMAGZIP_D4UKUFTr1VoZ
lea rcx, [rbp + 0x120]
call fcn.1400641d0
call fcn.1402255b4
mov r11, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x14000ee6e
mov ecx, 0x80004005
call fcn.1400042e0
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x14000eeb4
test rdx, 0xffffffffffff0000
jne 0x14000eeb4
movzx edi, dx
mov ecx, edi
call fcn.1402253fc
test rax, rax
je 0x14000eec3
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140002e80
jmp 0x14000eebe
lea rcx, [rsp + 0x58]
call fcn.140002060
mov rbx, qword [rsp + 0x58]
mov rdx, rbx
lea rcx, [rbp + 0x120]
call fcn.140064150
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000eeed
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp - 0x30]
call fcn.14000b120
nop
lea r8, [0x1403d1e80]
mov rdx, rax
lea rcx, [rbp - 0x38]
call fcn.1400045a0
nop
mov rdi, qword [rax]
call fcn.1402255b4
mov r11, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x14000ef2e
mov ecx, 0x80004005
call fcn.1400042e0
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
test rdi, rdi
je 0x14000ef6f
test rdi, 0xffffffffffff0000
jne 0x14000ef6f
movzx edi, di
mov ecx, edi
call fcn.1402253fc
test rax, rax
je 0x14000ef81
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140002e80
jmp 0x14000ef7c
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.140002060
mov rbx, qword [rsp + 0x50]
mov rdx, rbx
lea rcx, [rbp + 0x120]
call fcn.140064070
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000efac
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000efcb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000efe9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov dl, 1
lea rcx, [rbp + 0x120]
call fcn.140064060
lea rdx, str.repxhxnt
lea rcx, [rbp + 0x120]
call fcn.1400640e0
mov rdi, qword [rsp + 0x70]
cmp rdi, qword [rsp + 0x78]
je 0x14000f0e9
nop word [rax + rax]
mov r12, qword [rdi]
call fcn.1402255b4
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
je 0x14000f0de
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x68], rbx
test r12, r12
je 0x14000f07c
test r12, 0xffffffffffff0000
jne 0x14000f07c
movzx r12d, r12w
mov ecx, r12d
call fcn.1402253fc
test rax, rax
je 0x14000f08e
mov r8d, r12d
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140002e80
jmp 0x14000f089
mov rdx, r12
lea rcx, [rsp + 0x68]
call fcn.140002060
mov rbx, qword [rsp + 0x68]
mov byte [rsp + 0x30], 1
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
mov r9b, 1
xor r8d, r8d
mov rdx, rbx
lea rcx, [rbp + 0x120]
call fcn.1400642f0
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000f0cd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rdi, 8
cmp rdi, qword [rsp + 0x78]
jne 0x14000f020
jmp 0x14000f0e9
mov ecx, 0x80004005
call fcn.1400042e0
int3
lea rcx, [rbp + 0x120]
call fcn.1400642d0
mov rbx, qword [rsp + 0x48]
lea rcx, [0x140636e50]
test al, al
jne 0x14000f113
lea rdx, str.Error_compressing_directories._n
call fcn.140019030
jmp 0x14000f123
mov r8, rbx
lea rdx, str.Finished_creating__s_n
call fcn.140019030
nop
lea rcx, [rbp + 0x120]
call fcn.140063ff0
nop
mov rdi, qword [rbp - 8]
test rdi, rdi
je 0x14000f187
mov r12, qword [rbp]
cmp rdi, r12
je 0x14000f17f
nop word [rax + rax]
mov rdx, qword [rdi]
sub rdx, 0x18
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000f16d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rdi, 8
cmp rdi, r12
jne 0x14000f150
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rbp - 8]
mov rcx, rdi
call fcn.140224608
mov qword [rbp - 8], r13
mov qword [rbp], r13
mov qword [rbp + 8], r13
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000f1ae
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000f1ce
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000f1ed
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rbx, qword [rbp - 0x60]
test rbx, rbx
je 0x14000f234
cmp rbx, qword [rbp - 0x58]
je 0x14000f22b
nop dword [rax]
mov rdx, qword [rbx]
sub rdx, 0x18
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000f21d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rbx, 8
cmp rbx, qword [rbp - 0x58]
jne 0x14000f200
mov rbx, qword [rbp - 0x60]
mov rcx, rbx
call fcn.140224608
nop
mov rbx, qword [rsp + 0x70]
test rbx, rbx
je 0x14000f283
mov rdi, qword [rsp + 0x78]
cmp rbx, rdi
je 0x14000f27b
nop dword [rax + rax]
mov rdx, qword [rbx]
sub rdx, 0x18
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000f26d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rbx, 8
cmp rbx, rdi
jne 0x14000f250
mov rbx, qword [rsp + 0x70]
mov rcx, rbx
call fcn.140224608
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], r13
lea rcx, [rbp + 0x60]
call fcn.140037dd0
nop
lea rcx, [rbp + 0x98]
call fcn.140005ce0
nop
mov rdx, qword [rbp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000f2ca
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000f2ec
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x68]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x14000f308
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rcx, qword [rbp + 0x280]
xor rcx, rsp
call fcn.140360fe0
lea r11, [rsp + 0x390]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rbp
ret