Function at 0x1400484e0
Capabilities:
Create directory
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r12
sub rsp, 0x250
mov rax, qword [0x1400bdbf0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbp, rcx
test rdx, rdx
je 0x140048569
lea rdi, [rcx + 0x18]
mov ebx, 0x104
mov r8, rdi
sub rdx, rdi
mov r9, rbx
nop dword [rax]
lea rax, [r9 + 0x7ffffefa]
test rax, rax
je 0x140048554
movzx eax, word [rdx + r8]
test ax, ax
je 0x140048554
mov word [r8], ax
add r8, 2
sub r9, 1
jne 0x140048520
sub r8, 2
xor r12d, r12d
mov word [r8], r12w
jmp 0x140048840
test r9, r9
jne 0x14004855d
sub r8, 2
xor r12d, r12d
mov word [r8], r12w
jmp 0x140048840
lea rcx, [rsp + 0x32]
xor r12d, r12d
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x278], rsi
mov esi, 1
mov word [rsp + 0x30], r12w
call sub.MSVCR90.dll_memset
mov ebx, 0x104
lea rcx, [rsp + 0x30]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r11, rbx
lea rax, [rsp + 0x30]
nop dword [rax + rax]
cmp word [rax], r12w
je 0x1400485c1
add rax, 2
sub r11, rsi
jne 0x1400485b0
jmp 0x14004861f
test r11, r11
je 0x14004861f
mov rdx, rbx
mov rcx, rbx
sub rdx, r11
sub rcx, rdx
lea rax, [rsp + rdx*2 + 0x30]
je 0x140048617
lea r9, str.SHFolder.dll
lea rdx, [rcx + rdx + 0x7ffffefb]
sub r9, rax
nop dword [rax + rax]
test rdx, rdx
je 0x140048612
movzx r8d, word [r9 + rax]
test r8w, r8w
je 0x140048612
mov word [rax], r8w
add rax, 2
dec rdx
sub rcx, rsi
jne 0x1400485f0
jmp 0x140048617
test rcx, rcx
jne 0x14004861b
sub rax, 2
mov word [rax], r12w
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x14004879b
lea rdx, [0x1400902b0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r11, rax
test rax, rax
je 0x140048669
lea rax, [rbp + 0x18]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8023
xor ecx, ecx
mov qword [rsp + 0x20], rax
call r11
mov esi, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
jne 0x14004879b
lea rdi, [rbp + 0x18]
mov rcx, rbx
mov rax, rdi
cmp word [rax], r12w
je 0x140048696
add rax, 2
sub rcx, 1
jne 0x140048684
jmp 0x1400486f0
test rcx, rcx
je 0x1400486f0
mov rdx, rbx
sub rdx, rcx
mov rcx, rbx
sub rcx, rdx
lea rax, [rdi + rdx*2]
je 0x1400486e8
lea r9, str.AhnLab
lea rdx, [rcx + rdx + 0x7ffffefb]
sub r9, rax
nop
test rdx, rdx
je 0x1400486e3
movzx r8d, word [r9 + rax]
test r8w, r8w
je 0x1400486e3
mov word [rax], r8w
add rax, 2
dec rdx
sub rcx, 1
jne 0x1400486c0
jmp 0x1400486e8
test rcx, rcx
jne 0x1400486ec
sub rax, 2
mov word [rax], r12w
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140048710
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14004879b
mov rcx, rbx
mov rax, rdi
cmp word [rax], r12w
je 0x140048728
add rax, 2
sub rcx, 1
jne 0x140048716
jmp 0x14004877f
test rcx, rcx
je 0x14004877f
mov rdx, rbx
sub rdx, rcx
mov rcx, rbx
sub rcx, rdx
lea rax, [rdi + rdx*2]
je 0x140048777
lea r9, str.AIS
lea r8, [rcx + rdx + 0x7ffffefb]
sub r9, rax
test r8, r8
je 0x140048772
movzx edx, word [r9 + rax]
test dx, dx
je 0x140048772
mov word [rax], dx
add rax, 2
dec r8
sub rcx, 1
jne 0x140048751
jmp 0x140048777
test rcx, rcx
jne 0x14004877b
sub rax, 2
mov word [rax], r12w
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400487be
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1400487be
lea rdi, [rbp + 0x18]
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1400487be
dec eax
cmp word [rbp + rax*2 + 0x18], 0x5c
jne 0x1400487be
mov word [rbp + rax*2 + 0x18], r12w
mov rsi, qword [rsp + 0x278]
mov rcx, rbx
mov rax, rdi
nop dword [rax]
cmp word [rax], r12w
je 0x1400487e2
add rax, 2
sub rcx, 1
jne 0x1400487d0
jmp 0x140048840
test rcx, rcx
je 0x140048840
mov rdx, rbx
sub rdx, rcx
mov rcx, rbx
sub rcx, rdx
lea rax, [rdi + rdx*2]
je 0x140048838
lea r9, str._ai.log
lea rdx, [rcx + rdx + 0x7ffffefb]
sub r9, rax
nop dword [rax + rax]
test rdx, rdx
je 0x140048833
movzx r8d, word [r9 + rax]
test r8w, r8w
je 0x140048833
mov word [rax], r8w
add rax, 2
dec rdx
sub rcx, 1
jne 0x140048810
jmp 0x140048838
test rcx, rcx
jne 0x14004883c
sub rax, 2
mov word [rax], r12w
mov edx, 0x2e
mov rcx, rdi
call qword [sym.imp.MSVCR90.dll_wcsrchr]
mov r11, rax
test rax, rax
jne 0x14004891c
lea r8, [rbp + 0x220]
mov rdx, rbx
mov rcx, r8
sub rdi, r8
nop word [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140048894
movzx eax, word [rdi + rcx]
test ax, ax
je 0x140048894
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140048870
jmp 0x140048899
test rdx, rdx
jne 0x14004889d
sub rcx, 2
mov word [rcx], r12w
mov rax, r8
mov rcx, rbx
cmp word [rax], 0
je 0x1400488bc
add rax, 2
sub rcx, 1
jne 0x1400488a7
jmp 0x140048a55
test rcx, rcx
je 0x140048a55
mov rdx, rbx
sub rdx, rcx
sub rbx, rdx
lea rax, [r8 + rdx*2]
je 0x140048a4d
lea r9, [0x140090274]
lea rcx, [rbx + rdx + 0x7ffffefb]
sub r9, rax
nop word [rax + rax]
test rcx, rcx
je 0x140048914
movzx edx, word [r9 + rax]
test dx, dx
je 0x140048914
mov word [rax], dx
add rax, 2
dec rcx
sub rbx, 1
jne 0x1400488f0
jmp 0x140048a4d
test rbx, rbx
jmp 0x140048a4b
mov rcx, rax
lea r10, [rbp + 0x220]
sub rcx, rbp
sub rcx, 0x18
sar rcx, 1
cmp rcx, 0x7ffffffe
jbe 0x14004893f
mov word [r10], r12w
jmp 0x140048978
mov rdx, rbx
mov rax, r10
sub rdi, r10
test rcx, rcx
je 0x14004896b
movzx r8d, word [rdi + rax]
test r8w, r8w
je 0x14004896b
mov word [rax], r8w
add rax, 2
dec rcx
sub rdx, 1
jne 0x140048948
jmp 0x140048970
test rdx, rdx
jne 0x140048974
sub rax, 2
mov word [rax], r12w
mov rcx, rbx
mov rax, r10
nop
cmp word [rax], 0
je 0x140048992
add rax, 2
sub rcx, 1
jne 0x140048980
jmp 0x1400489f0
test rcx, rcx
je 0x1400489f0
mov rdx, rbx
sub rdx, rcx
mov rcx, rbx
sub rcx, rdx
lea rax, [r10 + rdx*2]
je 0x1400489e8
lea r9, [0x140090274]
lea rdx, [rcx + rdx + 0x7ffffefb]
sub r9, rax
nop dword [rax + rax]
test rdx, rdx
je 0x1400489e3
movzx r8d, word [r9 + rax]
test r8w, r8w
je 0x1400489e3
mov word [rax], r8w
add rax, 2
dec rdx
sub rcx, 1
jne 0x1400489c0
jmp 0x1400489e8
test rcx, rcx
jne 0x1400489ec
sub rax, 2
mov word [rax], r12w
mov rcx, rbx
mov rax, r10
cmp word [rax], 0
je 0x140048a08
add rax, 2
sub rcx, 1
jne 0x1400489f6
jmp 0x140048a55
test rcx, rcx
je 0x140048a55
mov rdx, rbx
sub rdx, rcx
sub rbx, rdx
lea rax, [r10 + rdx*2]
je 0x140048a4d
lea rcx, [rbx + rdx + 0x7ffffefb]
sub r11, rax
test rcx, rcx
je 0x140048a48
movzx edx, word [rax + r11]
test dx, dx
je 0x140048a48
mov word [rax], dx
add rax, 2
dec rcx
sub rbx, 1
jne 0x140048a27
jmp 0x140048a4d
test rbx, rbx
jne 0x140048a51
sub rax, 2
mov word [rax], r12w
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14004d770
mov rbx, qword [rsp + 0x280]
add rsp, 0x250
pop r12
pop rdi
pop rbp
ret