Function at 0x1400097d0
Capabilities:
Check mutex on windows
Create directory
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x438]
sub rsp, 0x500
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rbx, r9
mov rsi, r8
mov r14, rdx
mov r15, rcx
xor r12d, r12d
mov dword [rsp + 0x50], r12d
xor edx, edx
mov r8d, 0x208
add rcx, 0x18
call fcn.1401d5b10
mov r8, rbx
mov rdx, rsi
mov rcx, r15
call fcn.14000ad80
mov dword [r15 + 0x220], eax
lea eax, [rax + rax*4]
lea eax, [rax*2 + 1]
mov dword [r15 + 0x224], eax
lea r13d, [r12 + 1]
cmp byte [r15 + 0x240], r12b
jne 0x140009aa5
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x20]
call fcn.1401d5b10
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x801a
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov r13d, eax
test eax, eax
js 0x140009b7b
mov edx, 0x104
lea rcx, [rbp - 0x20]
nop
cmp word [rcx], r12w
je 0x1400098b0
add rcx, 2
sub rdx, 1
jne 0x1400098a0
mov ebx, 0x80070057
mov ecx, ebx
test rdx, rdx
cmovne ecx, r12d
je 0x1400098ca
mov eax, 0x104
sub rax, rdx
jmp 0x1400098cd
mov rax, r12
test ecx, ecx
js 0x140009926
mov edx, 0x104
sub rdx, rax
lea rcx, [rbp - 0x20]
lea rcx, [rcx + rax*2]
je 0x140009917
add rax, 0x7ffffefa
add rax, rdx
lea r9, str.hpqLog
sub r9, rcx
test rax, rax
je 0x140009917
movzx r8d, word [r9 + rcx]
test r8w, r8w
je 0x140009917
mov word [rcx], r8w
add rcx, 2
dec rax
sub rdx, 1
jne 0x1400098f6
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r12w
xor edx, edx
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140009957
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140009957
test eax, eax
jg 0x14000994c
mov r13d, eax
jmp 0x140009957
movzx r13d, ax
or r13d, 0x80070000
test r13d, r13d
js 0x140009b7b
mov ecx, 0x104
lea rax, [rbp - 0x20]
nop dword [rax]
cmp word [rax], r12w
je 0x140009980
add rax, 2
sub rcx, 1
jne 0x140009970
mov edx, ebx
test rcx, rcx
cmovne edx, r12d
je 0x140009995
mov eax, 0x104
sub rax, rcx
jmp 0x140009998
mov rax, r12
test edx, edx
js 0x1400099f1
mov edx, 0x104
sub rdx, rax
lea rcx, [rbp - 0x20]
lea rcx, [rcx + rax*2]
je 0x1400099e2
add rax, 0x7ffffefa
add rax, rdx
lea r9, [0x140277938]
sub r9, rcx
test rax, rax
je 0x1400099e2
movzx r8d, word [r9 + rcx]
test r8w, r8w
je 0x1400099e2
mov word [rcx], r8w
add rcx, 2
dec rax
sub rdx, 1
jne 0x1400099c1
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r12w
mov rcx, r14
call fcn.140006920
mov r9, rax
cmp qword [rax + 0x18], 8
jb 0x140009a06
mov r9, qword [rax]
mov ecx, 0x104
lea rax, [rbp - 0x20]
nop
cmp word [rax], r12w
je 0x140009a20
add rax, 2
sub rcx, 1
jne 0x140009a10
test rcx, rcx
cmovne ebx, r12d
je 0x140009a33
mov eax, 0x104
sub rax, rcx
jmp 0x140009a36
mov rax, r12
test ebx, ebx
js 0x140009a8e
mov r8d, 0x104
sub r8, rax
lea rcx, [rbp - 0x20]
lea rcx, [rcx + rax*2]
je 0x140009a7f
add rax, 0x7ffffefa
add rax, r8
sub r9, rcx
nop dword [rax]
test rax, rax
je 0x140009a7f
movzx edx, word [rcx + r9]
test dx, dx
je 0x140009a7f
mov word [rcx], dx
add rcx, 2
dec rax
sub r8, 1
jne 0x140009a60
lea rax, [rcx - 2]
test r8, r8
cmovne rax, rcx
mov word [rax], r12w
lea r8, [rbp - 0x20]
mov edx, 0x104
lea rcx, [r15 + 0x18]
call fcn.1401dbd68
jmp 0x140009b80
mov rcx, r14
call fcn.140006920
cmp qword [rax + 0x18], 8
jb 0x140009ab7
mov rax, qword [rax]
mov r8, rax
mov edx, 0x104
lea rcx, [r15 + 0x18]
call fcn.1401dbd68
lea rdx, [r15 + 0x18]
lea rcx, [rbp - 0x68]
call fcn.1400065b0
nop
lea rcx, [rbp - 0x68]
call fcn.140006920
cmp qword [rax + 0x18], 8
jb 0x140009ae9
mov rax, qword [rax]
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], 0x100
lea r9, [rbp - 0x20]
mov r8d, 3
lea rdx, [rbp + 0x440]
mov rcx, rax
call fcn.1401dbd04
mov ebx, eax
test eax, eax
jne 0x140009b6e
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x20]
lea r8, [rbp + 0x440]
mov edx, 0x104
lea rcx, [rbp + 0x1f0]
call fcn.1401de698
mov ebx, eax
test eax, eax
jne 0x140009b6e
xor r8d, r8d
lea rdx, [rbp + 0x1f0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov ebx, eax
cmp eax, 0xb7
cmove ebx, r12d
lea rcx, [rbp - 0x68]
call fcn.140006560
test ebx, ebx
je 0x140009b80
mov word [r15 + 0x18], r12w
lea rcx, [rsp + 0x78]
call fcn.140006930
lea rcx, [rsp + 0x78]
call fcn.140006c00
mov r12, rax
mov qword [rax], 7
lea rcx, [rsp + 0x78]
call fcn.140006920
mov rsi, rax
xor ebx, ebx
mov word [rbp + 0x440], bx
mov qword [rax + 0x10], rbx
cmp qword [rax + 0x18], 8
jb 0x140009bc4
mov rcx, qword [rax]
jmp 0x140009bc7
mov rcx, rsi
lea rdx, [rbp + 0x440]
call fcn.1400044f0
nop
cmp word [r15 + 0x18], 0
je 0x140009bf3
lea rdx, [r15 + 0x18]
lea rcx, [rbp - 0x40]
call fcn.1400065b0
mov r14, rax
mov edi, 1
jmp 0x140009c55
lea rcx, [rbp - 0x68]
call fcn.140006930
lea rcx, [rbp - 0x68]
call fcn.140006c00
mov qword [rax], 7
lea rcx, [rbp - 0x68]
call fcn.140006920
mov word [rbp + 0x440], bx
mov qword [rax + 0x10], rbx
cmp qword [rax + 0x18], 8
jb 0x140009c2a
mov rax, qword [rax]
lea rdx, [rbp + 0x440]
mov rcx, rax
call fcn.1400044f0
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, r14
lea rcx, [rbp - 0x68]
call fcn.140006c10
lea r14, [rbp - 0x68]
mov edi, 2
mov dword [rsp + 0x50], edi
lea rcx, [rsp + 0x58]
call fcn.140006930
lea rcx, [rsp + 0x58]
call fcn.140006c00
mov qword [rax], 7
lea rcx, [rsp + 0x58]
call fcn.140006920
mov rbx, rax
xor eax, eax
mov word [rbp + 0x440], ax
mov qword [rbx + 0x10], rax
cmp qword [rbx + 0x18], 8
jb 0x140009c9a
mov rcx, qword [rbx]
jmp 0x140009c9d
mov rcx, rbx
lea rdx, [rbp + 0x440]
call fcn.1400044f0
mov rdx, r14
lea rcx, [rsp + 0x58]
call fcn.14000fa80
nop
test dil, 2
je 0x140009cce
and edi, 0xfffffffd
mov dword [rsp + 0x50], edi
lea rcx, [rbp - 0x68]
call fcn.140006560
nop
test dil, 1
je 0x140009ce4
and edi, 0xfffffffe
mov dword [rsp + 0x50], edi
lea rcx, [rbp - 0x40]
call fcn.140006560
mov r9d, 1
xor r8d, r8d
lea rdx, [0x140277c60]
lea rcx, [rsp + 0x58]
call fcn.14000c810
test eax, eax
jle 0x140009d96
inc eax
movsxd r14, eax
lea rcx, [rsp + 0x58]
call fcn.140006d50
mov rdi, qword [rax]
cmp rdi, r14
ja 0x140009d45
xor eax, eax
mov word [rbp + 0x440], ax
mov qword [rbx + 0x10], rax
cmp qword [rbx + 0x18], 8
jb 0x140009d34
mov rbx, qword [rbx]
lea rdx, [rbp + 0x440]
mov rcx, rbx
call fcn.1400044f0
jmp 0x140009d96
test r14, r14
je 0x140009d96
cmp qword [rbx + 0x18], 8
jb 0x140009d56
mov rcx, qword [rbx]
jmp 0x140009d59
mov rcx, rbx
sub rdi, r14
je 0x140009d6b
lea r8, [rdi + rdi]
lea rdx, [rcx + r14*2]
call fcn.1401d5430
xor r14d, r14d
mov word [rbp + 0x440], r14w
mov qword [rbx + 0x10], rdi
cmp qword [rbx + 0x18], 8
jb 0x140009d84
mov rbx, qword [rbx]
lea rcx, [rbx + rdi*2]
lea rdx, [rbp + 0x440]
call fcn.1400044f0
jmp 0x140009d99
xor r14d, r14d
mov ebx, r14d
nop dword [rax]
movsxd r8, ebx
mov r9d, 1
lea rdx, [0x140277938]
lea rcx, [rsp + 0x58]
call fcn.14000c810
mov rbx, rax
test eax, eax
js 0x140009dd0
movsxd rdx, eax
lea rcx, [rsp + 0x58]
call fcn.14000c4d0
jmp 0x140009da0
lea r8, [rsp + 0x58]
lea rcx, [rbp - 0x40]
call fcn.14000d650
mov r14, rax
lea rax, [rsp + 0x78]
cmp rax, r14
je 0x140009e5a
mov rbx, qword [r12]
cmp rbx, 8
jb 0x140009e1b
lea rcx, [rsp + 0x78]
call fcn.140006920
mov rdi, qword [rax]
lea rcx, [rsp + 0x78]
call fcn.140006920
mov rcx, rax
lea r8, [rbx + 1]
mov rdx, rdi
call fcn.140006b90
mov qword [r12], 7
xor r12d, r12d
mov word [rbp + 0x440], r12w
mov qword [rsi + 0x10], r12
cmp qword [rsi + 0x18], 8
jb 0x140009e3c
mov rsi, qword [rsi]
lea rdx, [rbp + 0x440]
mov rcx, rsi
call fcn.1400044f0
mov rdx, r14
lea rcx, [rsp + 0x78]
call fcn.14000fa80
jmp 0x140009e5d
xor r12d, r12d
lea rcx, [rbp - 0x40]
call fcn.140006560
lea rcx, [rsp + 0x78]
call fcn.140006920
cmp qword [rax + 0x18], 8
jb 0x140009e7a
mov rax, qword [rax]
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [r15 + 0x238], rax
test r13d, r13d
js 0x140009f69
mov rcx, r15
call fcn.14000a020
test eax, eax
je 0x140009f69
mov rcx, r15
call fcn.14000a2b0
test al, al
jne 0x140009ebd
mov dl, 1
mov rcx, r15
call fcn.14000a380
mov r8, qword [rbp + 0x458]
mov rdx, qword [rbp + 0x450]
mov rcx, r15
call fcn.14000aed0
cmp byte [r15 + 0x228], 0
je 0x140009f2d
mov ecx, 0x50
call fcn.1400103f8
mov rbx, rax
mov qword [rbp + 0x440], rax
test rax, rax
je 0x140009f23
mov qword [rax], r12
mov qword [rax + 8], r12
xor r8d, r8d
xor edx, edx
call fcn.14000d520
mov qword [rbx], rax
mov qword [rbx + 0x10], r15
mov byte [rbx + 0x18], 0
mov qword [rbx + 0x20], r12
lea rcx, [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
jmp 0x140009f26
mov rbx, r12
mov qword [r15 + 0x248], rbx
mov rcx, qword [r15 + 0x230]
test rcx, rcx
je 0x140009f69
cmp qword [r15 + 0x238], 0
je 0x140009f69
call fcn.1401dced0
mov rcx, qword [r15 + 0x230]
call fcn.1401dc5fc
mov qword [r15 + 0x230], r12
mov rcx, qword [r15 + 0x238]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
nop
lea rcx, [rsp + 0x58]
call fcn.140006560
nop
lea rcx, [rsp + 0x78]
call fcn.140006560
mov rbx, qword [rsp + 0x548]
add rsp, 0x500
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret