Function at 0x1400c4280
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r13, rcx
xor edx, edx
xor ecx, ecx
call fcn.1400e06b0
mov r15, rax
test rax, rax
je 0x1400c42b8
lea rcx, str.settings
call sym.ProcessHacker.exe_PhDuplicateBytesZSafe
mov qword [r15 + 0x30], rax
mov edi, 5
xor eax, eax
lock cmpxchg qword [0x14015bb40], rdi
je 0x1400c42d6
lea rcx, [0x14015bb40]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rcx, qword [0x14015ded8]
mov r14d, dword [rcx]
mov ebp, dword [rcx + 0x40]
add r14d, 8
mov rbx, qword [rcx + 0x30]
imul rbp, r14
add rbp, rbx
or r12d, 0xffffffff
cmp rbx, rbp
je 0x1400c4314
nop dword [rax + rax]
mov rax, rbx
add rbx, r14
cmp dword [rax], 0xffffffff
jne 0x1400c4424
cmp rbx, rbp
jne 0x1400c4300
mov rax, qword [0x14015dec0]
xor esi, esi
mov ebx, esi
cmp dword [rax], ebx
jbe 0x1400c434a
mov rax, qword [rax + 8]
mov ecx, ebx
mov rdx, qword [rax + rcx*8]
mov rcx, r15
mov r8, qword [rdx + 0x28]
add rdx, 8
call fcn.1400c4160
mov rax, qword [0x14015dec0]
inc ebx
cmp ebx, dword [rax]
jb 0x1400c4323
mov eax, 5
lock cmpxchg qword [0x14015bb40], rsi
je 0x1400c4366
lea rcx, [0x14015bb40]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
lea rdx, [rsp + 0x88]
mov rcx, r13
call sym.ProcessHacker.exe_PhGetFullPath
mov rdi, rax
test rax, rax
je 0x1400c43d5
mov eax, dword [rsp + 0x88]
cmp eax, 0xffffffff
je 0x1400c43c0
mov rcx, qword [rdi + 8]
mov edx, eax
add rdx, rdx
call sym.ProcessHacker.exe_PhCreateStringEx
xor r8d, r8d
xor ecx, ecx
mov rbx, rax
mov rdx, qword [rax + 8]
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea rcx, [rbx - 0x10]
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400c43c0
call fcn.1400258b0
lea rcx, [rdi - 0x10]
lock xadd dword [rcx + 8], r12d
cmp r12d, 1
jne 0x1400c43d5
call fcn.1400258b0
mov qword [rsp + 0x38], rsi
lea rcx, [rsp + 0x98]
mov dword [rsp + 0x30], 0x60
xor r9d, r9d
mov dword [rsp + 0x28], 5
mov r8d, 0x120116
mov rdx, r13
mov dword [rsp + 0x20], 1
call sym.ProcessHacker.exe_PhCreateFileWin32Ex
mov ebx, eax
mov rcx, r15
test eax, eax
jns 0x1400c44c0
call sym.ProcessHacker.exe_mxmlDelete
mov eax, ebx
jmp 0x1400c44ec
lea rdi, [rax + 8]
test rdi, rdi
je 0x1400c4314
mov ecx, dword [rdi]
test ecx, ecx
je 0x1400c4477
sub ecx, 1
je 0x1400c4463
cmp ecx, 1
je 0x1400c444b
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov rsi, rax
jmp 0x1400c4492
mov r8d, dword [rdi + 0x2c]
lea rcx, str._u__u
mov edx, dword [rdi + 0x28]
call sym.ProcessHacker.exe_PhFormatString
mov rsi, rax
jmp 0x1400c4492
mov edx, dword [rdi + 0x28]
lea rcx, [0x140134d88]
call sym.ProcessHacker.exe_PhFormatString
mov rsi, rax
jmp 0x1400c4492
mov rax, qword [rdi + 0x28]
test rax, rax
jne 0x1400c448a
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov rsi, rax
jmp 0x1400c4492
lock inc dword [rax - 8]
mov rsi, qword [rdi + 0x28]
lea rdx, [rdi + 8]
mov r8, rsi
mov rcx, r15
call fcn.1400c4160
lea rcx, [rsi - 0x10]
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400c42f6
call fcn.1400258b0
jmp 0x1400c42f6
mov rdx, qword [rsp + 0x98]
lea r8, [0x1400c40d0]
call sym.ProcessHacker.exe_mxmlSaveFd
mov rcx, r15
call sym.ProcessHacker.exe_mxmlDelete
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ntdll.dll_NtClose]
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret