Function at 0x140282b10
Capabilities:
Create directory
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r12
sub rsp, 0x250
mov rax, qword [0x1403710d8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbp, rcx
test rdx, rdx
je 0x140282b99
lea rdi, [rcx + 0x18]
mov ebx, 0x104
mov r8, rdi
sub rdx, rdi
mov r9, rbx
nop dword [rax]
lea rax, [r9 + 0x7ffffefa]
test rax, rax
je 0x140282b84
movzx eax, word [rdx + r8]
test ax, ax
je 0x140282b84
mov word [r8], ax
add r8, 2
sub r9, 1
jne 0x140282b50
sub r8, 2
xor r12d, r12d
mov word [r8], r12w
jmp 0x140282e70
test r9, r9
jne 0x140282b8d
sub r8, 2
xor r12d, r12d
mov word [r8], r12w
jmp 0x140282e70
lea rcx, [rsp + 0x32]
xor r12d, r12d
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x278], rsi
mov esi, 1
mov word [rsp + 0x30], r12w
call sub.MSVCR90.dll_memset
mov ebx, 0x104
lea rcx, [rsp + 0x30]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r11, rbx
lea rax, [rsp + 0x30]
nop dword [rax + rax]
cmp word [rax], r12w
je 0x140282bf1
add rax, 2
sub r11, rsi
jne 0x140282be0
jmp 0x140282c4f
test r11, r11
je 0x140282c4f
mov rdx, rbx
mov rcx, rbx
sub rdx, r11
sub rcx, rdx
lea rax, [rsp + rdx*2 + 0x30]
je 0x140282c47
lea r9, str.SHFolder.dll
lea rdx, [rcx + rdx + 0x7ffffefb]
sub r9, rax
nop dword [rax + rax]
test rdx, rdx
je 0x140282c42
movzx r8d, word [r9 + rax]
test r8w, r8w
je 0x140282c42
mov word [rax], r8w
add rax, 2
dec rdx
sub rcx, rsi
jne 0x140282c20
jmp 0x140282c47
test rcx, rcx
jne 0x140282c4b
sub rax, 2
mov word [rax], r12w
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x140282dcb
lea rdx, [0x140332858]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r11, rax
test rax, rax
je 0x140282c99
lea rax, [rbp + 0x18]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8023
xor ecx, ecx
mov qword [rsp + 0x20], rax
call r11
mov esi, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
jne 0x140282dcb
lea rdi, [rbp + 0x18]
mov rcx, rbx
mov rax, rdi
cmp word [rax], r12w
je 0x140282cc6
add rax, 2
sub rcx, 1
jne 0x140282cb4
jmp 0x140282d20
test rcx, rcx
je 0x140282d20
mov rdx, rbx
sub rdx, rcx
mov rcx, rbx
sub rcx, rdx
lea rax, [rdi + rdx*2]
je 0x140282d18
lea r9, str.AhnLab
lea rdx, [rcx + rdx + 0x7ffffefb]
sub r9, rax
nop
test rdx, rdx
je 0x140282d13
movzx r8d, word [r9 + rax]
test r8w, r8w
je 0x140282d13
mov word [rax], r8w
add rax, 2
dec rdx
sub rcx, 1
jne 0x140282cf0
jmp 0x140282d18
test rcx, rcx
jne 0x140282d1c
sub rax, 2
mov word [rax], r12w
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140282d40
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140282dcb
mov rcx, rbx
mov rax, rdi
cmp word [rax], r12w
je 0x140282d58
add rax, 2
sub rcx, 1
jne 0x140282d46
jmp 0x140282daf
test rcx, rcx
je 0x140282daf
mov rdx, rbx
sub rdx, rcx
mov rcx, rbx
sub rcx, rdx
lea rax, [rdi + rdx*2]
je 0x140282da7
lea r9, str.AIS
lea r8, [rcx + rdx + 0x7ffffefb]
sub r9, rax
test r8, r8
je 0x140282da2
movzx edx, word [r9 + rax]
test dx, dx
je 0x140282da2
mov word [rax], dx
add rax, 2
dec r8
sub rcx, 1
jne 0x140282d81
jmp 0x140282da7
test rcx, rcx
jne 0x140282dab
sub rax, 2
mov word [rax], r12w
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140282dee
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140282dee
lea rdi, [rbp + 0x18]
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x140282dee
dec eax
cmp word [rbp + rax*2 + 0x18], 0x5c
jne 0x140282dee
mov word [rbp + rax*2 + 0x18], r12w
mov rsi, qword [rsp + 0x278]
mov rcx, rbx
mov rax, rdi
nop dword [rax]
cmp word [rax], r12w
je 0x140282e12
add rax, 2
sub rcx, 1
jne 0x140282e00
jmp 0x140282e70
test rcx, rcx
je 0x140282e70
mov rdx, rbx
sub rdx, rcx
mov rcx, rbx
sub rcx, rdx
lea rax, [rdi + rdx*2]
je 0x140282e68
lea r9, str._ai.log
lea rdx, [rcx + rdx + 0x7ffffefb]
sub r9, rax
nop dword [rax + rax]
test rdx, rdx
je 0x140282e63
movzx r8d, word [r9 + rax]
test r8w, r8w
je 0x140282e63
mov word [rax], r8w
add rax, 2
dec rdx
sub rcx, 1
jne 0x140282e40
jmp 0x140282e68
test rcx, rcx
jne 0x140282e6c
sub rax, 2
mov word [rax], r12w
mov edx, 0x2e
mov rcx, rdi
call qword [sym.imp.MSVCR90.dll_wcsrchr]
mov r11, rax
test rax, rax
jne 0x140282f4c
lea r8, [rbp + 0x220]
mov rdx, rbx
mov rcx, r8
sub rdi, r8
nop word [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140282ec4
movzx eax, word [rdi + rcx]
test ax, ax
je 0x140282ec4
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140282ea0
jmp 0x140282ec9
test rdx, rdx
jne 0x140282ecd
sub rcx, 2
mov word [rcx], r12w
mov rax, r8
mov rcx, rbx
cmp word [rax], 0
je 0x140282eec
add rax, 2
sub rcx, 1
jne 0x140282ed7
jmp 0x140283085
test rcx, rcx
je 0x140283085
mov rdx, rbx
sub rdx, rcx
sub rbx, rdx
lea rax, [r8 + rdx*2]
je 0x14028307d
lea r9, [0x14033281c]
lea rcx, [rbx + rdx + 0x7ffffefb]
sub r9, rax
nop word [rax + rax]
test rcx, rcx
je 0x140282f44
movzx edx, word [r9 + rax]
test dx, dx
je 0x140282f44
mov word [rax], dx
add rax, 2
dec rcx
sub rbx, 1
jne 0x140282f20
jmp 0x14028307d
test rbx, rbx
jmp 0x14028307b
mov rcx, rax
lea r10, [rbp + 0x220]
sub rcx, rbp
sub rcx, 0x18
sar rcx, 1
cmp rcx, 0x7ffffffe
jbe 0x140282f6f
mov word [r10], r12w
jmp 0x140282fa8
mov rdx, rbx
mov rax, r10
sub rdi, r10
test rcx, rcx
je 0x140282f9b
movzx r8d, word [rdi + rax]
test r8w, r8w
je 0x140282f9b
mov word [rax], r8w
add rax, 2
dec rcx
sub rdx, 1
jne 0x140282f78
jmp 0x140282fa0
test rdx, rdx
jne 0x140282fa4
sub rax, 2
mov word [rax], r12w
mov rcx, rbx
mov rax, r10
nop
cmp word [rax], 0
je 0x140282fc2
add rax, 2
sub rcx, 1
jne 0x140282fb0
jmp 0x140283020
test rcx, rcx
je 0x140283020
mov rdx, rbx
sub rdx, rcx
mov rcx, rbx
sub rcx, rdx
lea rax, [r10 + rdx*2]
je 0x140283018
lea r9, [0x14033281c]
lea rdx, [rcx + rdx + 0x7ffffefb]
sub r9, rax
nop dword [rax + rax]
test rdx, rdx
je 0x140283013
movzx r8d, word [r9 + rax]
test r8w, r8w
je 0x140283013
mov word [rax], r8w
add rax, 2
dec rdx
sub rcx, 1
jne 0x140282ff0
jmp 0x140283018
test rcx, rcx
jne 0x14028301c
sub rax, 2
mov word [rax], r12w
mov rcx, rbx
mov rax, r10
cmp word [rax], 0
je 0x140283038
add rax, 2
sub rcx, 1
jne 0x140283026
jmp 0x140283085
test rcx, rcx
je 0x140283085
mov rdx, rbx
sub rdx, rcx
sub rbx, rdx
lea rax, [r10 + rdx*2]
je 0x14028307d
lea rcx, [rbx + rdx + 0x7ffffefb]
sub r11, rax
test rcx, rcx
je 0x140283078
movzx edx, word [rax + r11]
test dx, dx
je 0x140283078
mov word [rax], dx
add rax, 2
dec rcx
sub rbx, 1
jne 0x140283057
jmp 0x14028307d
test rbx, rbx
jne 0x140283081
sub rax, 2
mov word [rax], r12w
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14028a900
mov rbx, qword [rsp + 0x280]
add rsp, 0x250
pop r12
pop rdi
pop rbp
ret