Function at 0x7ff662985380
Capabilities:
Create directory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x40
xor r14d, r14d
lea r13, [0x7ff66298d040]
mov ebx, edx
mov rsi, rcx
mov rax, r13
lea edi, [r14 + 1]
cmp dword [rax], edi
je 0x7ff6629853ca
add r14d, edi
lea rcx, [0x7ff66298d540]
add rax, 0x20
cmp rax, rcx
jl 0x7ff6629853b3
cmp r14d, 0x28
jne 0x7ff6629853fd
and dword [rsp + 0x28], 0
xor r9d, r9d
mov rcx, qword [0x7ff66298c828]
xor r8d, r8d
mov edx, 0x4bb
mov dword [rsp + 0x20], 0x10
call fcn.7ff662984dcc
or rax, 0xffffffffffffffff
jmp 0x7ff6629855b6
lea rdx, str.MEMCAB
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
nop dword [rax + rax]
test eax, eax
jne 0x7ff662985454
test ebx, 0x10b
jne 0x7ff6629853f4
movsxd rdx, r14d
mov rcx, rdx
shl rcx, 5
and dword [rcx + r13], eax
mov rax, qword [0x7ff66298d560]
and dword [rcx + r13 + 0x10], 0
mov qword [rcx + r13 + 8], rax
mov eax, dword [0x7ff66298d568]
mov dword [rcx + r13 + 0x14], eax
mov dword [rcx + r13 + 4], edi
jmp 0x7ff6629855b3
test bl, 8
je 0x7ff662985462
or rcx, 0xffffffffffffffff
jmp 0x7ff66298558d
mov eax, ebx
and al, 3
neg al
sbb ebp, ebp
and ebp, 0xc0000000
add ebp, 0x80000000
bt ebx, 8
jae 0x7ff662985498
bt ebx, 0xa
jae 0x7ff662985486
mov ebx, edi
jmp 0x7ff6629854a8
and ebx, 0x200
neg ebx
sbb ebx, ebx
and ebx, 0xfffffffe
add ebx, 4
jmp 0x7ff6629854a8
and ebx, 0x200
neg ebx
sbb ebx, ebx
and ebx, 2
add ebx, 3
and qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, ebp
mov dword [rsp + 0x20], ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
nop dword [rax + rax]
mov rcx, rax
cmp rax, 0xffffffffffffffff
jne 0x7ff66298558d
cmp ebx, 3
je 0x7ff66298558d
cmp byte [rsi], 0
je 0x7ff662985561
mov al, byte [rsi + 1]
lea rdi, [rsi + 2]
xor r15d, r15d
cmp al, 0x3a
jne 0x7ff662985505
cmp byte [rdi], 0x5c
jne 0x7ff662985505
lea rdi, [rsi + 3]
jmp 0x7ff662985514
cmp byte [rsi], 0x5c
jne 0x7ff662985518
cmp al, 0x5c
jne 0x7ff662985518
mov r15d, 2
mov al, byte [rdi]
jmp 0x7ff66298555d
lea rdi, [rsi + 1]
jmp 0x7ff66298555d
cmp al, 0x5c
jne 0x7ff662985549
cmp byte [rdi - 1], 0x3a
je 0x7ff662985549
test r15d, r15d
je 0x7ff662985532
dec r15d
jmp 0x7ff662985549
xor edx, edx
mov byte [rdi], 0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
nop dword [rax + rax]
mov byte [rdi], 0x5c
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextA]
nop dword [rax + rax]
mov rdi, rax
mov al, byte [rax]
test al, al
jne 0x7ff66298551e
and qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, ebp
mov dword [rsp + 0x20], ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
nop dword [rax + rax]
mov rcx, rax
movsxd rdx, r14d
mov rax, rdx
shl rax, 5
mov qword [rax + r13 + 0x18], rcx
cmp rcx, 0xffffffffffffffff
je 0x7ff6629855af
and dword [rax + r13], 0
and dword [rax + r13 + 4], 0
jmp 0x7ff6629855b3
or rdx, 0xffffffffffffffff
mov rax, rdx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
ret