Function at 0x14003d870
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x260
mov rax, qword [0x1400981e8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rsi, rcx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0x104
xor ebx, ebx
mov qword [rsp + 0x40], rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14003d9da
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14003d9da
add eax, 0xfffffffe
cmp eax, 1
ja 0x14003d9d5
lea edx, [rbx + 0x5c]
mov rcx, rsi
call fcn.14004b398
test rax, rax
je 0x14003d9d5
sub rax, rsi
sar rax, 1
mov r8, rax
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.14003c010
test al, al
je 0x14003d9d5
mov rdi, qword [rsp + 0x40]
lea r15, [rdi + 1]
cmp r15, qword [rsp + 0x38]
jbe 0x14003d99c
lfence
movabs rax, 0xfc0fc0fc0fc0fc1
mul r15
shr rdx, 4
inc rdx
imul rax, rdx, 0x104
cmp rax, r15
cmovae r15, rax
lea rdx, [r15 + r15]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x48]
cmp rcx, rax
cmove rcx, rbx
call fcn.14004fe7c
mov r14, rax
test rax, rax
je 0x14003d9d5
mov rdi, qword [rsp + 0x40]
test rdi, rdi
je 0x14003d990
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x30]
cmp rdx, rax
jne 0x14003d990
lea r8, [rdi + rdi]
mov rcx, r14
call fcn.14004f4b0
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
jmp 0x14003d9a1
mov r14, qword [rsp + 0x30]
mov word [r14 + rdi*2], bx
inc qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call fcn.14003d870
test eax, eax
jne 0x14003d9d5
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14003d9da
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14003d9da
mov ebx, 0xffffffff
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rcx, rax
je 0x14003d9f3
test rcx, rcx
je 0x14003d9f3
call fcn.14004fe60
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400498a0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x14003ef30
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x1400981e8]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
test r9, r9
je 0x14003ef6b
mov r8, r9
mov rdx, rbx
mov rcx, rdi
call fcn.140048b10
jmp 0x14003ef7e
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x14003efe7
mov eax, eax
cmp rax, rbx
ja 0x14003efe7
lea r9, [rsp + 0x20]
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x14003efe7
test rbx, rbx
je 0x14003efe3
lea rcx, [rsp + 0x20]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003efb0
lea r8, [rsp + 0x20]
mov rdx, rbx
mov rcx, rdi
cmp rax, rbx
jae 0x14003efd3
call fcn.1400577d8
xor eax, eax
jmp 0x14003efee
lea r9, [rbx - 1]
call fcn.140059e78
xor eax, eax
mov word [rdi + rbx*2 - 2], ax
xor eax, eax
jmp 0x14003efee
mov rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400498a0
add rsp, 0x240
pop rdi
pop rsi
pop rbx
ret