Function at 0x1400a61d0
Capabilities:
Create directory
Set file attributes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1138]
mov eax, 0x1238
call fcn.1401e33b0
sub rsp, rax
mov rax, qword [0x1402a76c0]
xor rax, rsp
mov qword [rbp + 0x1120], rax
mov r14, r9
mov qword [rbp - 0x68], r9
mov rsi, r8
mov qword [rbp - 0x70], r8
mov r12d, edx
mov dword [rsp + 0x50], edx
mov r15, rcx
xor edi, edi
lea rdx, str.OperateTempFolder::CopyDriverToTempSub
lea rcx, [rbp + 0x40]
call fcn.14001abe0
nop
lea rax, [0x1402a8360]
lea rbx, [0x1402bbdb0]
mov rcx, qword [0x1402a8360]
cmp rcx, rax
je 0x1400a6274
test byte [rcx + 0x1c], 1
je 0x1400a6274
mov r9, rbx
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
lea edx, [rdi + 0x28]
lea r8, [0x14025a4c8]
mov rcx, qword [rcx + 0x10]
call fcn.140001ad0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xa0]
call fcn.1401e7e40
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x2b0]
call fcn.1401e7e40
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xd00]
call fcn.1401e7e40
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x4c0]
call fcn.1401e7e40
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1400136d6.0]
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0xb8]
mov rcx, rdx
call qword [case.0x1400136d6.0]
mov r13d, eax
mov dword [rsp + 0x6c], eax
xor ecx, ecx
mov dword [rsp + 0x68], ecx
test r14, r14
je 0x1400a6e61
test rsi, rsi
je 0x1400a6e61
mov r14, 0xffffffffffffffff
mov ebx, r14d
mov dword [rsp + 0x58], ebx
mov rcx, qword [0x1402bbf50]
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x20]
call qword [case.0x1400136d6.0]
cmp dword [rax + 0xa64], 2
jne 0x1400a6370
lea rcx, [rsp + 0x78]
call fcn.1400484a0
nop
xor r8d, r8d
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x78]
call fcn.14004fa10
nop
lea rcx, [rsp + 0x78]
call fcn.140048610
mov ebx, dword [rsp + 0x58]
cmp ebx, 2
jge 0x1400a63d7
nop dword [rax]
mov rax, qword [0x1402bc020]
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], ebx
lea rcx, [rbp + 0xa0]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0xd00]
mov r8d, r12d
mov rdx, rsi
lea rcx, [0x1402bc020]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
mov edi, eax
test r13d, r13d
je 0x1400a63d3
lea rdx, [0x140251dfc]
lea rcx, [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400a63d3
inc ebx
cmp ebx, 2
jl 0x1400a6370
mov dword [rsp + 0x58], ebx
lea rdx, [0x140251dfc]
lea rcx, [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400a64e9
mov esi, 0x8001001b
mov dword [0x1402bbd98], 0x1b
lea r15, [0x1402a8360]
lea rbx, [0x1402bbdb0]
mov al, 1
mov byte [rbp + 0x48], al
mov rcx, qword [0x1402a8360]
cmp rcx, r15
je 0x1400a645d
test byte [rcx + 0x1c], al
je 0x1400a645d
mov r9, rbx
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x2b
mov dword [rsp + 0x20], esi
lea r8, [0x14025a4c8]
mov rcx, qword [rcx + 0x10]
call fcn.140001b40
movzx eax, byte [rbp + 0x48]
mov rcx, qword [0x1402a8360]
lea rdx, vtable.WppTrace.0
mov qword [rbp + 0x40], rdx
test al, al
jne 0x1400a64b2
cmp rcx, r15
je 0x1400a64b2
test byte [rcx + 0x1c], 1
je 0x1400a64b2
lea rax, [rbp + 0x50]
cmp qword [rbp + 0x68], 8
cmovae rax, qword [rbp + 0x50]
cmp qword [0x1402bbdc8], 8
cmovae rbx, qword [0x1402bbdb0]
mov edx, 0xa
mov qword [rsp + 0x20], rax
mov r9, rbx
lea r8, [0x140252818]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
lea rcx, [rbp + 0x70]
call fcn.1400048a0
lea rcx, [rbp + 0x50]
call fcn.1400048a0
mov eax, esi
mov rcx, qword [rbp + 0x1120]
xor rcx, rsp
call fcn.1401e2900
add rsp, 0x1238
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov esi, edi
test edi, edi
jne 0x1400a6402
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x1400a6e87
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
add rax, 0x18
mov qword [rsp + 0x60], rax
lea rdx, [0x140253e18]
cmp rdx, 0x10000
jae 0x1400a6539
movzx edx, dx
lea rcx, [rsp + 0x60]
call fcn.1400041d0
jmp 0x1400a6558
mov rax, r14
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400a6540
mov r8d, eax
lea rcx, [rsp + 0x60]
call fcn.140004e60
nop
test r13d, r13d
je 0x1400a6590
lea rcx, [rbp + 0xa0]
mov rax, r14
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400a6570
mov r8d, eax
lea rdx, [rbp + 0xa0]
lea rcx, [rsp + 0x60]
call fcn.140004e60
jmp 0x1400a65a4
mov r8d, r12d
lea rdx, [0x1402524b4]
lea rcx, [rsp + 0x60]
call fcn.140018e20
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xor eax, eax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov rbx, qword [rsp + 0x60]
mov r8, r14
nop dword [rax]
inc r8
cmp word [rbx + r8*2], ax
jne 0x1400a65c0
mov rdx, rbx
lea rcx, [rbp - 0x28]
call fcn.140005520
lea rax, [r15 + 8]
mov qword [rsp + 0x70], rax
mov rax, qword [rax]
mov r10, qword [rax + 8]
mov r13, rax
mov esi, edi
mov r15, qword [rbp - 0x18]
mov r12, qword [rbp - 0x28]
cmp byte [r10 + 0x19], 0
jne 0x1400a669a
mov rbx, qword [rbp - 0x10]
nop dword [rax]
nop word [rax + rax]
lea rax, [rbp - 0x28]
cmp rbx, 8
cmovae rax, r12
lea r9, [r10 + 0x20]
cmp qword [r10 + 0x38], 8
jb 0x1400a662b
mov r9, qword [r10 + 0x20]
mov r11, qword [r10 + 0x30]
mov rcx, r11
cmp r15, r11
cmovb rcx, r15
test rcx, rcx
je 0x1400a6655
sub r9, rax
movzx edx, word [r9 + rax]
cmp dx, word [rax]
jne 0x1400a665f
add rax, 2
sub rcx, 1
jne 0x1400a6641
cmp r11, r15
jae 0x1400a666a
mov eax, r14d
jmp 0x1400a6675
mov eax, 1
cmovb eax, r14d
jmp 0x1400a6675
jbe 0x1400a6673
mov eax, 1
jmp 0x1400a6675
xor eax, eax
mov esi, edi
shr eax, 0x1f
test al, al
je 0x1400a6684
mov r10, qword [r10 + 0x10]
jmp 0x1400a668a
mov r13, r10
mov r10, qword [r10]
cmp byte [r10 + 0x19], 0
je 0x1400a6610
mov rbx, qword [rsp + 0x60]
cmp byte [r13 + 0x19], 0
jne 0x1400a6718
lea rax, [r13 + 0x20]
cmp qword [r13 + 0x38], 8
jb 0x1400a66b0
mov rax, qword [r13 + 0x20]
lea r9, [rbp - 0x28]
mov r11, qword [rbp - 0x10]
cmp r11, 8
cmovae r9, r12
mov r10, qword [r13 + 0x30]
mov rcx, r15
cmp r10, r15
cmovb rcx, r10
test rcx, rcx
je 0x1400a66ea
sub r9, rax
movzx edx, word [r9 + rax]
cmp dx, word [rax]
jne 0x1400a66f4
add rax, 2
sub rcx, 1
jne 0x1400a66d6
cmp r15, r10
jae 0x1400a66ff
mov eax, r14d
jmp 0x1400a670a
mov eax, 1
cmovb eax, r14d
jmp 0x1400a670a
jbe 0x1400a6708
mov eax, 1
jmp 0x1400a670a
xor eax, eax
shr eax, 0x1f
test al, al
jne 0x1400a671c
mov r15, qword [rsp + 0x70]
jmp 0x1400a6724
mov r11, qword [rbp - 0x10]
mov r15, qword [rsp + 0x70]
mov r13, qword [r15]
cmp r11, 8
jb 0x1400a6760
lea rdx, [r11*2 + 2]
mov rax, r12
cmp rdx, 0x1000
jb 0x1400a6758
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a6e92
mov rcx, r12
call fcn.1400079c0
xor edi, edi
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], di
cmp r13, qword [r15]
jne 0x1400a6a15
mov rax, qword [0x1402bbfe0]
lea r9, [rbp + 0x4c0]
lea r8, [rbp + 0xa0]
mov r12d, dword [rsp + 0x50]
mov edx, r12d
lea rcx, [0x1402bbfe0]
mov rax, qword [rax + 0x58]
call qword [case.0x1400136d6.0]
mov esi, eax
test eax, eax
jne 0x1400a6a35
lea rcx, [rbp - 0x60]
call fcn.1401c8bf0
nop
mov r8, r14
xor edx, edx
lea rcx, [rbp - 0x60]
call fcn.1401c921c
lea rcx, [rsp + 0x70]
call fcn.140091e00
nop
lea r9d, [rdi + 1]
lea r8, [rbp - 0x60]
lea rdx, [rbp + 0x4c0]
lea rcx, [rsp + 0x70]
call fcn.140093c10
mov rax, qword [rbp - 0x50]
movsxd rdi, eax
test eax, eax
jle 0x1400a683b
xor ecx, ecx
mov ebx, ecx
nop
test rbx, rbx
js 0x1400a6e9e
cmp rbx, rax
jge 0x1400a6e9e
lfence
mov edx, 0x20
mov rcx, qword [rbp - 0x58]
mov rcx, qword [rcx + rbx*8]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
inc rbx
cmp rbx, rdi
jge 0x1400a6836
mov rax, qword [rbp - 0x50]
jmp 0x1400a6800
mov rbx, qword [rsp + 0x60]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x8e0]
call fcn.1401e7e40
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xaf0]
call fcn.1401e7e40
mov qword [rsp + 0x40], 0x104
lea rax, [rbp + 0xaf0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0x104
lea rax, [rbp + 0x8e0]
mov qword [rsp + 0x28], rax
xor edi, edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0xa0]
call fcn.1401fded0
lea r8, [rbp + 0xaf0]
mov edx, 0x104
lea rcx, [rbp + 0x8e0]
call fcn.1401ec614
lea rcx, [rbp + 0x4c0]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea r8, [rbp + 0x8e0]
mov edx, 0x104
lea rcx, [rbp + 0x4c0]
call fcn.1401ec614
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x10], xmm1
mov r8, r14
nop word [rax + rax]
inc r8
cmp word [rbx + r8*2], di
jne 0x1400a6900
mov rdx, rbx
lea rcx, [rbp]
call fcn.140005520
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x30], xmm1
lea rax, [rbp + 0x4c0]
mov r8, r14
inc r8
cmp word [rax + r8*2], 0
jne 0x1400a6930
lea rdx, [rbp + 0x4c0]
lea rcx, [rbp + 0x20]
call fcn.140005520
nop
lea r8, [rbp]
lea rdx, [rbp - 0x38]
mov rcx, r15
call fcn.1400059f0
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x1400a699d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a6998
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a6e98
call fcn.1400079c0
movdqa xmm0, xmmword [0x14026f3f0]
movdqa xmmword [rbp + 0x30], xmm0
mov word [rbp + 0x20], di
mov rdx, qword [rbp + 0x18]
cmp rdx, 8
jb 0x1400a69ee
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a69e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a6e98
call fcn.1400079c0
movdqa xmm0, xmmword [0x14026f3f0]
movdqa xmmword [rbp + 0x10], xmm0
mov word [rbp], di
lea rcx, [rsp + 0x70]
call fcn.140091f70
nop
lea rcx, [rbp - 0x60]
call fcn.1401c8c10
jmp 0x1400a6a35
lea rdx, [r13 + 0x40]
cmp qword [rdx + 0x18], 8
jb 0x1400a6a23
mov rdx, qword [rdx]
lea rcx, [rbp + 0x4c0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov r12d, dword [rsp + 0x50]
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400a6a59
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
test esi, esi
jne 0x1400a6402
lea rcx, [rbp - 0x80]
call fcn.140051640
nop
mov dword [rsp + 0x20], 1
lea r9, [rbp + 0xd00]
lea r8, [rbp + 0x2b0]
mov edx, r12d
lea rcx, [rbp - 0x80]
call fcn.140053200
test eax, eax
jne 0x1400a6baf
mov esi, 0x80010041
mov dword [0x1402bbd98], 0x41
lea r15, [0x1402a8360]
lea rcx, [rbp - 0x80]
call fcn.1400517b0
test esi, esi
jne 0x1400a6409
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x6d0]
call fcn.1401e7e40
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xf10]
call fcn.1401e7e40
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0x104
lea r9, [rbp + 0x6d0]
lea r8d, [rsi + 8]
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0xa0]
call fcn.1401fded0
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x6d0]
lea r8, [rbp + 0x90]
mov edx, 0x104
lea rcx, [rbp + 0xf10]
call fcn.1401fdacc
cmp dword [rsp + 0x6c], esi
jbe 0x1400a6d87
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x1400a6e7c
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x6d0]
cmp rax, 0x10000
jae 0x1400a6c27
lea rax, [rbp + 0x6d0]
movzx edx, ax
lea rcx, [rsp + 0x50]
call fcn.1400041d0
jmp 0x1400a6c50
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x1400a6aa4
mov rcx, qword [0x1402a8360]
lea r15, [0x1402a8360]
cmp rcx, r15
je 0x1400a6c13
test byte [rcx + 0x1c], 4
je 0x1400a6c13
lea r9, [0x1402bbdb0]
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
lea edx, [rax + 0x29]
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x20], rax
lea r8, [0x14025a4c8]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
xor edx, edx
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x1400a6aab
lea rcx, [rbp + 0x6d0]
mov rax, r14
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400a6c31
mov r8d, eax
lea rdx, [rbp + 0x6d0]
lea rcx, [rsp + 0x50]
call fcn.140004e60
nop
mov edx, 0x5c
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call fcn.1401e768c
test rax, rax
jne 0x1400a6c6c
mov eax, r14d
jmp 0x1400a6c72
sub rax, rbx
sar rax, 1
mov r8d, 1
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.140064220
mov edx, 0x5c
mov rdi, qword [rsp + 0x50]
mov rcx, rdi
call fcn.1401e768c
test rax, rax
jne 0x1400a6ca0
mov eax, r14d
jmp 0x1400a6ca6
sub rax, rdi
sar rax, 1
mov r9d, dword [rdi - 0x10]
sub r9d, eax
mov r8d, eax
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x50]
call fcn.14002eaa0
nop
mov rbx, qword [rbp - 0x78]
lea rcx, [rbx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x1400a6d2a
cmp dword [rdi + 0x10], 0
jl 0x1400a6d18
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x1400a6d18
call fcn.140004d00
mov rbx, rax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x1400a6d09
lfence
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
mov rax, qword [r8 + 8]
call qword [case.0x1400136d6.0]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x50], rax
mov rbx, qword [rbp - 0x78]
jmp 0x1400a6d2a
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140004e60
nop
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400a6d4e
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
mov rbx, qword [rsp + 0x50]
mov rdx, rbx
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x1400a6d87
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x1400a6def
mov rcx, qword [0x1402a8360]
cmp rcx, r15
je 0x1400a6de0
test byte [rcx + 0x1c], 4
je 0x1400a6de0
lea r9, [0x1402bbdb0]
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
lea edx, [rax + 0x2a]
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x20], rax
lea r8, [0x14025a4c8]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
xor edx, edx
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rcx, qword [0x1402bbf58]
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1400136d6.0]
mov rcx, rax
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x2b0]
mov r8, qword [rbp - 0x70]
lea rdx, [rbp + 0x4c0]
call fcn.14018ff60
lea rbx, [0x1402bbdb0]
test eax, eax
je 0x1400a6e52
mov esi, 0x80010005
mov dword [0x1402bbd98], 5
jmp 0x1400a6410
mov eax, dword [rsp + 0x68]
mov rcx, qword [rbp - 0x68]
mov dword [rcx], eax
jmp 0x1400a6410
mov esi, 0x80010001
mov dword [0x1402bbd98], 1
lea r15, [0x1402a8360]
jmp 0x1400a6410
mov ecx, 0x80004005
call fcn.140001470
int3
mov ecx, 0x80004005
call fcn.140001470
nop
call fcn.1401ec41c
nop
call fcn.1401ec41c
int3
call fcn.1401bb848
int3