Function at 0x140003d38
Capabilities:
Create directory

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x130
mov rax, qword [0x14003a020]
xor rax, rsp
mov qword [rsp + 0x128], rax
mov rdi, rcx
xorps xmm0, xmm0
movups xmmword [r11 - 0x60], xmm0
xor r12d, r12d
mov qword [r11 - 0x50], r12
mov qword [r11 - 0x48], r12
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r12b
jne 0x140003d7f
lea rcx, [rsp + 0xf8]
call fcn.1400016c4
nop
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0xb8], xmm0
mov qword [rsp + 0xc8], 9
mov ecx, 0xf
mov qword [rsp + 0xd0], rcx
movsd xmm0, qword [0x1400344d0]
movsd qword [rsp + 0xb8], xmm0
mov al, byte [0x1400344d8]
mov byte [rsp + 0xc0], al
mov byte [rsp + 0xc1], r12b
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], r12
mov qword [rsp + 0x98], r12
lea r14, [rsp + 0xf8]
mov r15, qword [rsp + 0xf8]
cmp qword [rsp + 0x110], 0x10
cmovae r14, r15
movabs rbx, 0x7fffffffffffffff
mov rsi, qword [rsp + 0x108]
cmp rsi, rbx
ja 0x14000433a
mov qword [rsp + 0x98], rcx
cmp rsi, 0x10
jae 0x140003e65
mov qword [rsp + 0x90], rsi
movups xmm0, xmmword [r14]
movdqu xmmword [rsp + 0x80], xmm0
jmp 0x140003ed6
mov rax, rsi
or rax, rcx
cmp rax, rbx
jbe 0x140003e7c
movabs rcx, 0x8000000000000000
jmp 0x140003e98
mov rbx, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140003e9f
call fcn.140001b64
jmp 0x140003eae
test rcx, rcx
je 0x140003eab
call fcn.140008b94
jmp 0x140003e9d
mov rax, r12
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], rbx
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rax
call fcn.14000ab90
nop
lea r8, [rsp + 0xb8]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0xa0]
call fcn.1400034c4
nop
xor r14d, r14d
mov r12d, r14d
mov rax, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0xa0]
sub rax, rcx
sar rax, 5
mov ebx, r12d
cmp rbx, rax
jae 0x1400040f8
shl rbx, 5
lea r8, [rcx + rbx]
xorps xmm0, xmm0
movups xmmword [rsp + 0xd8], xmm0
mov qword [rsp + 0xe8], r14
mov qword [rsp + 0xf0], r14
mov rdx, r8
cmp qword [r8 + 0x18], 0x10
jb 0x140003f4d
mov rdx, qword [r8]
mov r8, qword [r8 + 0x10]
lea rcx, [rsp + 0xd8]
call fcn.140005648
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x68]
call fcn.140003934
nop
mov rax, qword [rsp + 0x68]
mov ecx, dword [rax + 0x10]
inc ecx
movsxd rcx, ecx
call fcn.140008e20
mov r13, rax
mov rax, qword [rsp + 0x68]
mov ecx, dword [rax + 0x30]
inc ecx
movsxd rcx, ecx
call fcn.140008e20
mov r14, rax
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x68]
mov esi, dword [rax + rbx + 0x10]
sub esi, dword [rcx + 0x10]
sub esi, dword [rcx + 0x30]
sub esi, 2
lea eax, [rsi + 1]
cdqe
mov qword [rsp + 0x40], rax
mov rcx, rax
call fcn.140008e20
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x68]
mov r8, qword [rax + 0x10]
inc r8
xor edx, edx
mov rcx, r13
call fcn.14000b250
mov rax, qword [rsp + 0x68]
mov r8, qword [rax + 0x30]
inc r8
xor edx, edx
mov rcx, r14
call fcn.14000b250
mov r8, qword [rsp + 0x40]
xor edx, edx
mov rcx, qword [rsp + 0x38]
call fcn.14000b250
mov rdx, qword [rsp + 0x68]
mov r8, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x140004020
mov rdx, qword [rdx]
mov r8, qword [r8 + 0x10]
mov rcx, r13
call fcn.14000ab90
mov rax, qword [rsp + 0x68]
lea rdx, [rax + 0x20]
cmp qword [rax + 0x38], 0x10
jb 0x140004040
mov rdx, qword [rax + 0x20]
mov r8, qword [rax + 0x30]
mov rcx, r14
call fcn.14000ab90
mov rdx, qword [rsp + 0xa0]
add rdx, rbx
mov rax, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x140004064
mov rax, qword [rdx]
movsxd r8, esi
mov rdx, qword [rdx + 0x10]
sub rdx, r8
add rdx, rax
mov rcx, qword [rsp + 0x38]
call fcn.14000ab90
lea rbx, [rdi + 0x48]
mov r14, qword [rbx]
movabs rax, 0x555555555555555
cmp qword [rbx + 8], rax
je 0x140004340
mov qword [rsp + 0x58], rbx
and qword [rsp + 0x60], 0
mov ecx, 0x30
call fcn.140008b94
mov rcx, rax
mov rax, qword [rsp + 0x38]
mov qword [rcx + 0x10], rax
mov dword [rcx + 0x18], esi
mov rax, qword [rsp + 0x48]
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], r13
inc qword [rbx + 8]
mov rax, qword [r14 + 8]
mov qword [rcx], r14
mov qword [rcx + 8], rax
and qword [rsp + 0x60], 0
mov qword [r14 + 8], rcx
mov qword [rax], rcx
lea rcx, [rsp + 0x68]
call fcn.140001478
inc r12d
xor r14d, r14d
jmp 0x140003efa
lea rcx, [rsp + 0xa0]
call fcn.140001478
nop
mov r13, qword [rsp + 0x110]
cmp r13, 0x10
jb 0x140004146
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x14000413d
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000434d
mov rcx, r15
call fcn.1400088f0
nop
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [0x1400344e0]
mov rcx, rdi
call fcn.140004354
test al, al
je 0x140004307
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x30]
lea rdx, [0x1400344f0]
mov rcx, rdi
call fcn.140004354
test al, al
je 0x140004307
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x30]
lea rdx, [0x140034500]
mov rcx, rdi
call fcn.140004354
test al, al
je 0x140004307
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x30]
lea rdx, str.edr_attacks_path
mov rcx, rdi
call fcn.140004354
test al, al
je 0x140004307
mov rcx, qword [rsp + 0x50]
call fcn.1400151c8
mov qword [rdi + 0x20], rax
mov rcx, qword [rsp + 0x58]
call fcn.1400151c8
mov qword [rdi + 0x28], rax
mov rcx, qword [rsp + 0x48]
call fcn.1400151c8
mov qword [rdi + 0x30], rax
mov rcx, qword [rsp + 0x40]
call fcn.1400151c8
mov qword [rdi + 0x38], rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
or r15, 0xffffffffffffffff
test eax, eax
je 0x1400042a3
mov rax, qword [rdi + 0x38]
mov rsi, r15
inc rsi
cmp byte [rax + rsi], r14b
jne 0x140004258
inc rsi
mov r12d, 2
mov eax, r12d
mul rsi
cmovo rax, r15
mov rcx, rax
call fcn.140008e20
mov rbx, rax
mov r8, rsi
mov rdx, qword [rdi + 0x38]
mov rcx, rax
call fcn.140015084
mov rdx, rbx
call fcn.140001d10
mov edx, r12d
mov rcx, rbx
call fcn.1400088f0
jmp 0x1400042a9
mov r12d, 2
xor edx, edx
mov rcx, qword [rdi + 0x30]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x140004303
mov rax, qword [rdi + 0x30]
mov rsi, r15
inc rsi
cmp byte [rax + rsi], r14b
jne 0x1400042c0
inc rsi
mov rax, r12
mul rsi
cmovo rax, r15
mov rcx, rax
call fcn.140008e20
mov rbx, rax
mov r8, rsi
mov rdx, qword [rdi + 0x30]
mov rcx, rax
call fcn.140015084
mov rdx, rbx
call fcn.140001d10
mov rdx, r12
mov rcx, rbx
call fcn.1400088f0
mov al, 1
jmp 0x14000430d
xor al, al
jmp 0x14000430d
mov rcx, qword [rsp + 0x128]
xor rcx, rsp
call fcn.1400088d0
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.1400013b0
nop
lea rcx, str.list_too_long
call fcn.140007a50
nop
call fcn.140014bfc
int3