Function at 0x14008872b
Capabilities:
Create directory
Get disk information
Query environment variable

Disassembly:
push rax
pushf
mov eax, 0xa201e98c
pushf
not eax
add eax, 0x76dcf2d5
xor eax, 0x638ba5f1
rol eax, 0x20
popf
pushf
not eax
add eax, 0x2c9da557
xor eax, 0x754cf89d
rol eax, 0xd2
popf
cmp eax, 9
jne 0x140088768
popf
pop rax
jmp 0x140088dd1
cmp eax, 7
jne 0x140088777
popf
pop rax
jmp 0x140088cd9
cmp eax, 0
jne 0x140088786
popf
pop rax
jmp 0x140088894
cmp eax, 0x10
jne 0x140088795
popf
pop rax
jmp 0x14008926d
cmp eax, 0xd
jne 0x1400887a4
popf
pop rax
jmp 0x140088fe1
cmp eax, 0xe
jne 0x1400887b3
popf
pop rax
jmp 0x140089032
cmp eax, 2
jne 0x1400887c2
popf
pop rax
jmp 0x1400889f0
cmp eax, 0xc
jne 0x1400887d1
popf
pop rax
jmp 0x140088f1c
cmp eax, 8
jne 0x1400887e0
popf
pop rax
jmp 0x140088d83
cmp eax, 6
jne 0x1400887ef
popf
pop rax
jmp 0x140088c9d
cmp eax, 0x11
jne 0x1400887fe
popf
pop rax
jmp 0x14008931d
cmp eax, 3
jne 0x14008880d
popf
pop rax
jmp 0x140088b0b
cmp eax, 0x12
jne 0x14008881c
popf
pop rax
jmp 0x1400893b7
cmp eax, 0x14
jne 0x14008882b
popf
pop rax
jmp 0x14008949c
cmp eax, 1
jne 0x14008883a
popf
pop rax
jmp 0x14008899f
cmp eax, 0xb
jne 0x140088849
popf
pop rax
jmp 0x140088eda
cmp eax, 0xf
jne 0x140088858
popf
pop rax
jmp 0x1400890ec
cmp eax, 4
jne 0x140088867
popf
pop rax
jmp 0x140088b6f
cmp eax, 0xa
jne 0x140088876
popf
pop rax
jmp 0x140088e5b
cmp eax, 0x13
jne 0x140088885
popf
pop rax
jmp 0x140089453
cmp eax, 5
jne 0x140088894
popf
pop rax
jmp 0x140088c09
push rdi
mov eax, 0xdc4617fd
pushf
not eax
add eax, 0x25c78ba7
xor eax, 0x6c64a499
rol eax, 0x43
popf
pushf
not eax
add eax, 0x6013d6aa
xor eax, 0x20e51d38
rol eax, 0xca
popf
call fcn.14009b7ed
sub rsp, rax
mov rax, qword [0x14003e040]
xor rax, rsp
mov qword [rsp + 0x4030], rax
xor r8d, r8d
xor edx, edx
call fcn.14008fbd5
mov rdi, rax
test rax, rax
jne 0x140088946
push rax
pushf
mov eax, 0xecc1af05
pushf
not eax
add eax, 0x48b49817
xor eax, 0x5716a8c0
rol eax, 0x43
popf
pushf
not eax
add eax, 0x9fca491
xor eax, 0x577c4cff
rol eax, 0x78
popf
pushf
not eax
add eax, 0x1ad05ff0
xor eax, 0x60332dd
rol eax, 0xb1
popf
pushf
not eax
add eax, 0x3be4043f
xor eax, 0x2053ba8b
rol eax, 0x86
popf
jmp 0x140088759
push rax
pushf
mov eax, 0x98809fef
pushf
not eax
add eax, 0x5b31da7d
xor eax, 0x36c21944
rol eax, 0xb1
popf
pushf
not eax
add eax, 0x10b654a2
xor eax, 0x7d475e8d
rol eax, 0xda
popf
pushf
not eax
add eax, 0x66cb7a17
xor eax, 0x7cccdb5f
rol eax, 0x60
popf
pushf
not eax
add eax, 0x2b7a862f
xor eax, 0x34454810
rol eax, 0x21
popf
jmp 0x140088759
lea rcx, [0x191719277]
pushf
sub rcx, 0x516ebd17
popf
call fcn.14006f976
xor eax, eax
jmp 0x1400894a4
mov r8d, 0x9d8d1118
pushf
not r8d
add r8d, 0x3b17f9a5
xor r8d, 0x28ab87c5
rol r8d, 0x2f
popf
pushf
not r8d
add r8d, 0x5b9f3c90
xor r8d, 0x11e41e7c
rol r8d, 0x74
popf
pushf
not r8d
add r8d, 0x7dce2404
xor r8d, 0x20be7e97
rol r8d, 0x33
popf
pushf
not r8d
add r8d, 0x5c3965b8
xor r8d, 0x77dc344c
rol r8d, 0xc1
popf
mov qword [rsp + 0x4058], rbx
lea rdx, [rsp + 0x30]
mov rcx, rdi
jmp 0x140088a6b
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rdi
mov ebx, eax
call fcn.1400e5748
test ebx, ebx
jne 0x140088ac5
push rax
pushf
mov eax, 0x68715e58
pushf
not eax
add eax, 0x29d68581
xor eax, 0x70380489
rol eax, 0x7c
popf
pushf
not eax
add eax, 0x149283eb
xor eax, 0x19ce6816
rol eax, 0x6e
popf
pushf
not eax
add eax, 0x25e420d1
xor eax, 0x6fba68a4
rol eax, 0x2a
popf
jmp 0x140088759
push rax
pushf
mov eax, 0xef9514d6
pushf
not eax
add eax, 0x7df7c9e6
xor eax, 0x1af35fa
rol eax, 0xd0
popf
pushf
not eax
add eax, 0x18376545
xor eax, 0x27b915fe
rol eax, 0xe
popf
pushf
not eax
add eax, 0x49e44cd0
xor eax, 0x19c1e011
rol eax, 0xdb
popf
jmp 0x140088759
lea rcx, [0x1a54b8935]
pushf
sub rcx, 0x6548b355
popf
call fcn.14006f976
xor eax, eax
jmp 0x14008949c
lea rcx, [rsp + 0x30]
call fcn.14008f035
test eax, eax
je 0x140088bd6
push rax
pushf
mov eax, 0xeafcfd7a
pushf
not eax
add eax, 0x54f13767
xor eax, 0x79bf0a39
rol eax, 0xe9
popf
pushf
not eax
add eax, 0x7bdac5c3
xor eax, 0x78bf2e5
rol eax, 0x86
popf
pushf
not eax
add eax, 0x4d6c6c25
xor eax, 0x45858e35
rol eax, 0x77
popf
pushf
not eax
add eax, 0x4d391c11
xor eax, 0x4053c546
rol eax, 0x78
popf
jmp 0x140088759
push rax
pushf
mov eax, 0x9f75eb98
pushf
not eax
add eax, 0x251427d9
xor eax, 0x77ffa4af
rol eax, 0xf7
popf
pushf
not eax
add eax, 0x79429e5c
xor eax, 0x1496e8f
rol eax, 0xda
popf
jmp 0x140088759
cmp word [rsp + 0x34], 0x5c
je 0x140088c57
push rax
pushf
mov eax, 0x873d8c71
pushf
not eax
add eax, 0x269fe17c
xor eax, 0x3e98a792
rol eax, 0x62
popf
pushf
not eax
add eax, 0x5760b79e
xor eax, 0x260f3791
rol eax, 0x50
popf
pushf
not eax
add eax, 0xed4c63c
xor eax, 0x3429dcc3
rol eax, 0x61
popf
jmp 0x140088759
push rax
pushf
mov eax, 0xc23bd2f7
pushf
not eax
add eax, 0x2b9eb722
xor eax, 0x6451ef65
rol eax, 0xf3
popf
pushf
not eax
add eax, 0x2a507f81
xor eax, 0x4ee85f62
rol eax, 0x92
popf
pushf
not eax
add eax, 0x6fc64449
xor eax, 0x45953f87
rol eax, 0x30
popf
jmp 0x140088759
lea rcx, [rsp + 0x30]
sub rcx, 2
push rax
pushf
mov eax, 0x14935332
pushf
not eax
add eax, 0x197f5298
xor eax, 0x42a17afd
rol eax, 0x32
popf
pushf
not eax
add eax, 0x4403dd9e
xor eax, 0x2da2c46f
rol eax, 0x7e
popf
jmp 0x140088759
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140088d3d
push rax
pushf
mov eax, 0xfbfa2fe4
pushf
not eax
add eax, 0x2f3dea76
xor eax, 0x76197e99
rol eax, 0xa5
popf
pushf
not eax
add eax, 0x40b07ae4
xor eax, 0x75ebe7c7
rol eax, 0xb9
popf
pushf
not eax
add eax, 0x4ffcaebf
xor eax, 0x2a154d97
rol eax, 0x92
popf
pushf
not eax
add eax, 0x576ea263
xor eax, 0x6b09b1a9
rol eax, 0xef
popf
jmp 0x140088759
push rax
pushf
mov eax, 0x650527b1
pushf
not eax
add eax, 0x3a1bf99c
xor eax, 0xbc64f87
rol eax, 0xec
popf
pushf
not eax
add eax, 0x66dcbe4a
xor eax, 0x2925e2cf
rol eax, 0xe8
popf
pushf
not eax
add eax, 0x14d7ca88
xor eax, 0x4ad53712
rol eax, 7
popf
jmp 0x140088759
mov eax, dword [0x14002d670]
mov dword [rcx], eax
push rax
pushf
mov eax, 0x2e8d88c8
pushf
not eax
add eax, 0x79ad7ab7
xor eax, 0x3ca282e0
rol eax, 0xe2
popf
pushf
not eax
add eax, 0x7f79f6d2
xor eax, 0x38e3c418
rol eax, 0xb4
popf
pushf
not eax
add eax, 0x1ba66b59
xor eax, 0x339864da
rol eax, 0x11
popf
jmp 0x140088759
lea rcx, [rsp + 0x30]
jmp 0x140088dd7
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jg 0x140088e28
push rax
pushf
mov eax, 0x3899e287
pushf
not eax
add eax, 0xcfa3d11
xor eax, 0x182a91eb
rol eax, 0x52
popf
pushf
not eax
add eax, 0xc7bea5d
xor eax, 0x1ff950b4
rol eax, 0xdd
popf
pushf
not eax
add eax, 0x67742fec
xor eax, 0x2f52f2b9
rol eax, 0xa2
popf
jmp 0x140088759
push rax
pushf
mov eax, 0x3beeb4ac
pushf
not eax
add eax, 0xcf9855
xor eax, 0x3f13372
rol eax, 0xc4
popf
pushf
not eax
add eax, 0x7816dbfa
xor eax, 0x5ef9ce4d
rol eax, 0x25
popf
jmp 0x140088759
mov r8d, eax
lea rdx, [rsp + 0x30]
lea rcx, [0x199f50460]
pushf
sub rcx, 0x59f22de0
popf
call fcn.14006f976
xor eax, eax
jmp 0x14008949c
lea rcx, [rsp + 0x30]
call fcn.1400fdaa5
jmp 0x14008949c
mov r8d, 0xa74ab9d3
pushf
not r8d
add r8d, 0x3d8b3665
xor r8d, 0x4dbbd615
rol r8d, 0x19
popf
pushf
not r8d
add r8d, 0x55c2f60b
xor r8d, 0x4d0afeb5
rol r8d, 0x14
popf
lea rdx, [rsp + 0x30]
xor ecx, ecx
call fcn.14010052b
mov rbx, rax
test rax, rax
jne 0x140088f9b
push rax
pushf
mov eax, 0xa555c86c
pushf
not eax
add eax, 0x7997f8ec
xor eax, 0x44e20c8f
rol eax, 0x59
popf
pushf
not eax
add eax, 0x1c85acba
xor eax, 0x3b0c6c40
rol eax, 0xcd
popf
jmp 0x140088759
push rax
pushf
mov eax, 0x790a9cb3
pushf
not eax
add eax, 0x7a0e475e
xor eax, 0x4d14c76d
rol eax, 0xb8
popf
pushf
not eax
add eax, 0x164ca91b
xor eax, 0x7cd272ed
rol eax, 0xd3
popf
pushf
not eax
add eax, 0x7309c7ad
xor eax, 0x5e082915
rol eax, 0xa9
popf
jmp 0x140088759
lea rcx, [0x1a9df6e1a]
pushf
sub rcx, 0x69dc970a
popf
call fcn.14006f976
xor eax, eax
jmp 0x14008949c
mov edx, 0x80d10b71
pushf
not edx
add edx, 0x2aebf1ae
xor edx, 0x2aa111f3
rol edx, 4
popf
pushf
not edx
add edx, 0x73239d39
xor edx, 0x13c74fd0
rol edx, 0xae
popf
pushf
not edx
add edx, 0x281dacfa
xor edx, 0x4c398fff
rol edx, 0x21
popf
mov rcx, rbx
call fcn.14009f964
mov rdi, rax
test rax, rax
je 0x1400890b9
push rax
pushf
mov eax, 0x4b278cc1
pushf
not eax
add eax, 0x66c527f9
xor eax, 0x329ec4a
rol eax, 0x33
popf
pushf
not eax
add eax, 0x200aaa37
xor eax, 0x63a1e493
rol eax, 0x69
popf
jmp 0x140088759
push rax
pushf
mov eax, 0x70344506
pushf
not eax
add eax, 0x5b4e460d
xor eax, 0x3e6c366
rol eax, 0xd4
popf
pushf
not eax
add eax, 0x654caaff
xor eax, 0x3b3e1b32
rol eax, 0x6a
popf
jmp 0x140088759
mov r9, rdi
mov qword [rsp + 0x20], rbx
push rbx
not rbx
add r9, rbx
pop rbx
add r9, 1
lea r8, [0x1a19a9262]
pushf
sub r8, 0x6197baca
popf
sar r9, 1
lea rcx, [rsp + 0x2030]
mov edx, 0x1cef2767
pushf
not edx
add edx, 0x2d93683b
xor edx, 0x35896cf1
rol edx, 0x4c
popf
pushf
not edx
add edx, 0x335bd122
xor edx, 0x1e2b3338
rol edx, 0xcc
popf
pushf
not edx
add edx, 0x2b78820b
xor edx, 0x1990a5f
rol edx, 0x46
popf
call fcn.14006f552
xor edx, edx
lea rcx, [rsp + 0x2030]
jmp 0x140089171
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, 0x3a39483f
pushf
not edx
add edx, 0x4534cc71
xor edx, 0x2d6cb903
rol edx, 0x18
popf
pushf
not edx
add edx, 0x2026fa3b
xor edx, 0x43fcd664
rol edx, 0x44
popf
pushf
not edx
add edx, 0x316b2fd6
xor edx, 0x10568dec
rol edx, 0x82
popf
pushf
not edx
add edx, 0x2b821e20
xor edx, 0x259c6ed5
rol edx, 0xa2
popf
lea rcx, [rdi + 2]
call fcn.14009f964
mov rdi, rax
test rax, rax
jne 0x14008923a
push rax
pushf
mov eax, 0x16b2b680
pushf
not eax
add eax, 0x5fa6f40b
xor eax, 0x37a8613
rol eax, 0xbb
popf
pushf
not eax
add eax, 0x36ae01ba
xor eax, 0x621b0b46
rol eax, 0x90
popf
pushf
not eax
add eax, 0x6e1e3f5b
xor eax, 0x4a3892cd
rol eax, 0x57
popf
pushf
not eax
add eax, 0x49065e91
xor eax, 0x5a3288bf
rol eax, 0x79
popf
jmp 0x140088759
push rax
pushf
mov eax, 0x861825a8
pushf
not eax
add eax, 0x436c4332
xor eax, 0x13c338db
rol eax, 0xf5
popf
pushf
not eax
add eax, 0x55bed345
xor eax, 0x2b690067
rol eax, 0xc1
popf
jmp 0x140088759
xor edx, edx
mov rcx, rbx
jmp 0x140089273
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400892d6
push rax
pushf
mov eax, 0xc5d4f209
pushf
not eax
add eax, 0x16261201
xor eax, 0x2a813bfa
rol eax, 0xc3
popf
pushf
not eax
add eax, 0x58d375db
xor eax, 0x595ce546
rol eax, 0xb2
popf
pushf
not eax
add eax, 0x1df948cc
xor eax, 0x737643bd
rol eax, 0x95
popf
pushf
not eax
add eax, 0x1ee1c8eb
xor eax, 0x3b7c03f7
rol eax, 0xeb
popf
jmp 0x140088759
push rax
pushf
mov eax, 0xaa080f60
pushf
not eax
add eax, 0x3c58d71f
xor eax, 0x584d3def
rol eax, 0x60
popf
pushf
not eax
add eax, 0xf559344
xor eax, 0x409fa27e
rol eax, 0x9b
popf
pushf
not eax
add eax, 0x7c6366e7
xor eax, 0x1c36bd12
rol eax, 0x15
popf
jmp 0x140088759
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14008935d
push rax
pushf
mov eax, 0x423c3405
pushf
not eax
add eax, 0x7a475911
xor eax, 0x72c911e3
rol eax, 0xa8
popf
pushf
not eax
add eax, 0x335ed6f5
xor eax, 0x7161eeaa
rol eax, 0x6e
popf
jmp 0x140088759
push rax
pushf
mov eax, 0xf41858ae
pushf
not eax
add eax, 0x1dbfddce
xor eax, 0x58d47c11
rol eax, 0x40
popf
pushf
not eax
add eax, 0x4414a296
xor eax, 0x2771cc52
rol eax, 0x64
popf
pushf
not eax
add eax, 0x72f4da17
xor eax, 0x1119c226
rol eax, 0xcd
popf
pushf
not eax
add eax, 0x639f3b9e
xor eax, 0x6bcd1b9d
rol eax, 0xdd
popf
jmp 0x140088759
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9, rbx
lea r8, [0x18c573efd]
pushf
sub r8, 0x4c54674d
popf
mov edx, eax
lea rcx, [0x188892f29]
pushf
sub rcx, 0x48865711
popf
call fcn.14007076a
mov rcx, rbx
call fcn.1400e5748
xor eax, eax
jmp 0x14008949c
mov rax, rbx
push rax
pushf
mov eax, 0x98c6b7a
pushf
not eax
add eax, 0x377c8747
xor eax, 0x207a79
rol eax, 0x59
popf
pushf
not eax
add eax, 0x35763c70
xor eax, 0x5ed00b6d
rol eax, 0xbe
popf
pushf
not eax
add eax, 0x67110ad7
xor eax, 0x19ec6a6
rol eax, 0x95
popf
jmp 0x140088759
mov rbx, qword [rsp + 0x4058]
mov rcx, qword [rsp + 0x4030]
xor rcx, rsp
call fcn.140098ae9
add rsp, 0x4040
pop rdi
ret