Function at 0x140003500
Capabilities:
Create directory
Get common file path

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x220]
sub rsp, 0x320
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x370], rbx
mov rax, qword [0x14002f070]
xor rax, rsp
mov qword [rbp + 0x210], rax
movzx r15d, r9b
movzx r12d, r8b
mov r13d, edx
mov r14, rcx
xor ebx, ebx
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x38], rbx
mov r8, qword [rcx + 8]
mov rdx, qword [rcx]
lea rcx, [rbp - 0x40]
call fcn.140003f20
xor edx, edx
lea rcx, [rbp - 0x40]
call fcn.140002300
mov qword [rsp + 0x50], rax
call fcn.140009b90
call fcn.140009b74
mov esi, ebx
mov rbx, qword [rbp - 0x40]
movabs rdi, 0x112e0be826d694b3
mov rdx, qword [r14]
lea r8, [rdx + 0x19000]
mov qword [rbp - 0x38], rbx
lea rcx, [rbp - 0x40]
call fcn.140004080
call fcn.140009b90
mov rbx, rax
call fcn.140009b74
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
lea rbx, [rax + rcx]
call fcn.140009c78
imul rcx, rax, 0x64
add rcx, 0x5f5e100
mov rax, rdi
imul rcx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rsp + 0x30], rdx
imul rax, rdx, 0x3b9aca00
sub rcx, rax
mov dword [rsp + 0x38], ecx
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp - 0x60], xmm0
lea rcx, [rbp - 0x60]
call fcn.140009d00
call fcn.140009b90
mov rdi, rax
call fcn.140009b74
cqo
idiv rdi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
lea rdx, [rax + rcx]
sub rdx, rbx
movabs rax, 0x431bde82d7b634db
imul rdx
mov rbx, rdx
sar rbx, 0x12
mov rax, rbx
shr rax, 0x3f
add rbx, rax
call fcn.140010be8
mov r8d, eax
mov eax, 0x51eb851f
imul r8d
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x32
sub r8d, ecx
mov edi, r13d
sub edi, r8d
add edi, ebx
mov r9, qword [rsp + 0x50]
mov r8d, 0xc800
lea edx, [rdi + 0x21]
lea rcx, [rbp - 0x40]
call fcn.1400031a0
mov rbx, qword [rbp - 0x40]
movzx eax, byte [rbp + 0x280]
cmp byte [rbx], al
jne 0x1400036c1
cmp byte [rbx + 1], r15b
jne 0x1400036c1
cmp byte [rbx + 2], r12b
je 0x1400036d4
inc esi
cmp esi, 0x258
jae 0x1400039e4
jmp 0x140003589
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 0x21]
mov rcx, r14
call fcn.1400031a0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp]
call fcn.14000cde0
xor r9d, r9d
lea r8d, [r9 + 0x1c]
lea rdx, [rbp]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rcx, [rbp]
or rdi, 0xffffffffffffffff
mov rax, rdi
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x140003714
mov esi, 0x5c
mov word [rbp + rax*2], si
lea r8, [0x140419700]
mov edx, 0x104
lea rcx, [rbp]
call fcn.140010dd4
lea rcx, [rbp]
mov rax, rdi
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x140003745
mov word [rbp + rax*2], si
xor edx, edx
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rax, [0x14002b700]
mov qword [rsp + 0x20], rax
lea r9, [0x140419700]
lea r8, [rbp]
lea rdx, str._s_sed.ex_s
lea r12, [0x140419910]
mov rcx, r12
call fcn.140003ec0
mov qword [rbp - 0x10], 0xf
xor r15d, r15d
mov qword [rbp - 0x18], r15
mov byte [rbp - 0x28], r15b
mov r8, qword [r14 + 8]
mov rdx, qword [r14]
mov qword [rbp - 0x48], 0xf
mov qword [rbp - 0x50], r15
mov byte [rbp - 0x60], r15b
cmp rdx, r8
je 0x1400037ca
sub r8, rdx
lea rcx, [rbp - 0x60]
call fcn.140001220
nop
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x60]
call fcn.140002190
movzx esi, al
mov rcx, qword [rbp - 0x48]
cmp rcx, 0x10
jb 0x140003834
inc rcx
mov rdx, qword [rbp - 0x60]
cmp rcx, 0x1000
jb 0x14000382c
test dl, 0x1f
je 0x1400037ff
call fcn.140010b70
int3
mov rax, qword [rdx - 8]
cmp rax, rdx
jb 0x14000380e
call fcn.140010b70
int3
sub rdx, rax
cmp rdx, 8
jae 0x14000381d
call fcn.140010b70
int3
cmp rdx, 0x27
jbe 0x140003829
call fcn.140010b70
int3
mov rdx, rax
mov rcx, rdx
call fcn.14000a400
test sil, sil
je 0x14000398e
lea r8, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae r8, qword [rbp - 0x28]
add r8, qword [rbp - 0x18]
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rdx, qword [rbp - 0x28]
mov rcx, qword [r14]
mov qword [r14 + 8], rcx
mov rcx, r14
call fcn.140003f20
mov rdx, r14
call fcn.1400010a0
call fcn.140009c78
imul rcx, rax, 0x64
add rcx, 0x3b9aca00
movabs rax, 0x112e0be826d694b3
imul rcx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rsp + 0x30], rdx
imul rax, rdx, 0x3b9aca00
sub rcx, rax
mov dword [rsp + 0x38], ecx
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp - 0x60], xmm0
lea rcx, [rbp - 0x60]
call fcn.140009d00
mov qword [rsp + 0x78], 0xf
mov qword [rsp + 0x70], r15
mov byte [rsp + 0x60], 0
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], r15
mov word [rsp + 0x30], r15w
mov qword [rbp - 0x68], 7
mov qword [rbp - 0x70], r15
mov word [rbp - 0x80], r15w
mov qword [rbp - 0x48], 7
mov qword [rbp - 0x50], r15
mov word [rbp - 0x60], r15w
cmp word [0x140419910], 0
jne 0x140003920
mov rdi, r15
jmp 0x14000392b
inc rdi
cmp word [r12 + rdi*2], 0
jne 0x140003920
mov r8, rdi
lea rcx, [rbp - 0x60]
call fcn.140001460
lea r8, [rsp + 0x30]
lea rcx, [rbp - 0x60]
call fcn.1400033f0
mov r8, qword [rbp - 0x48]
cmp r8, 8
jb 0x14000395f
inc r8
mov rdx, qword [rbp - 0x60]
lea rcx, [rbp - 0x60]
call fcn.140001a80
mov qword [rbp - 0x48], 7
mov qword [rbp - 0x50], r15
mov word [rbp - 0x60], r15w
mov r8, qword [rsp + 0x48]
cmp r8, 8
jb 0x14000398e
inc r8
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.140001a80
nop
mov rax, qword [rbp - 0x10]
cmp rax, 0x10
jb 0x1400039e4
inc rax
mov rcx, qword [rbp - 0x28]
cmp rax, 0x1000
jb 0x1400039df
test cl, 0x1f
je 0x1400039b2
call fcn.140010b70
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400039c1
call fcn.140010b70
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400039d0
call fcn.140010b70
int3
cmp rcx, 0x27
jbe 0x1400039dc
call fcn.140010b70
int3
mov rcx, rax
call fcn.14000a400
call fcn.140009b90
call fcn.140009b74
nop
mov rax, qword [rbp - 0x30]
sub rax, rbx
cmp rax, 0x1000
jb 0x140003a36
test bl, 0x1f
je 0x140003a09
call fcn.140010b70
int3
mov rax, qword [rbx - 8]
cmp rax, rbx
jb 0x140003a18
call fcn.140010b70
int3
sub rbx, rax
cmp rbx, 8
jae 0x140003a27
call fcn.140010b70
int3
cmp rbx, 0x27
jbe 0x140003a33
call fcn.140010b70
int3
mov rbx, rax
mov rcx, rbx
call fcn.14000a400
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.14000a3a0
mov rbx, qword [rsp + 0x370]
add rsp, 0x320
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret