Function at 0x1400a7980
Capabilities:
Create directory

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x818]
sub rsp, 0x918
mov rax, qword [0x1402a76c0]
xor rax, rsp
mov qword [rbp + 0x800], rax
mov r13, r9
mov r15, r8
mov ebx, edx
mov rdi, rcx
xor esi, esi
lea rdx, str.OperateTempFolder::CopytempDriverSet
lea rcx, [rsp + 0x70]
call fcn.14001abe0
nop
lea r12, [0x1402a8360]
lea r14, [0x1402bbdb0]
mov rcx, qword [0x1402a8360]
cmp rcx, r12
je 0x1400a7a55
test byte [rcx + 0x1c], 1
je 0x1400a7a19
mov r9, r14
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
lea edx, [rsi + 0x34]
lea r8, [0x14025a4c8]
mov rcx, qword [rcx + 0x10]
call fcn.140001ad0
mov rcx, qword [0x1402a8360]
cmp rcx, r12
je 0x1400a7a55
test byte [rcx + 0x1c], 1
je 0x1400a7a55
mov r9, r14
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x35
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], ebx
lea r8, [0x14025a4c8]
mov rcx, qword [rcx + 0x10]
call fcn.14001d1d0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x40]
call fcn.1401e7e40
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1400136d6.0]
mov rcx, rax
mov rax, qword [rax]
mov rax, qword [rax + 0xb8]
call qword [case.0x1400136d6.0]
mov r12d, eax
test r15, r15
je 0x1400a7e00
test r13, r13
je 0x1400a7e00
mov rax, qword [rdi]
lea r8, [rbp - 0x40]
mov edx, ebx
mov rcx, rdi
mov rax, qword [rax + 0x60]
call qword [case.0x1400136d6.0]
cmp eax, 1
jne 0x1400a7e0f
lea rcx, [rbp - 0x40]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x1400a7b48
xor edx, edx
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
mov r10, qword [0x1402a8360]
lea rax, [0x1402a8360]
cmp r10, rax
je 0x1400a7b2f
test byte [r10 + 0x1c], 4
je 0x1400a7b2f
mov r9, r14
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x36
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
lea r8, [0x14025a4c8]
mov rcx, qword [r10 + 0x10]
call fcn.140006c90
mov r10, qword [0x1402a8360]
cmp ebx, 1
je 0x1400a7b48
mov esi, 0x80010009
mov dword [0x1402bbd98], 9
jmp 0x1400a7e16
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x3e0]
call fcn.1401e7e40
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1d0]
call fcn.1401e7e40
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x5f0]
call fcn.1401e7e40
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], 0x104
lea r9, [rbp + 0x1d0]
mov r8d, 0x104
lea rdx, [rbp + 0x3e0]
mov rcx, r15
call fcn.1401fded0
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x1d0]
lea r8, [rbp + 0x3e0]
mov edx, 0x104
lea rcx, [rbp + 0x5f0]
call fcn.1401fdacc
test r12d, r12d
je 0x1400a7d49
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x1400a7efb
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x1d0]
mov rdi, 0xffffffffffffffff
cmp rax, 0x10000
jae 0x1400a7c42
lea rax, [rbp + 0x1d0]
movzx edx, ax
lea rcx, [rsp + 0x50]
call fcn.1400041d0
jmp 0x1400a7c6f
lea rcx, [rbp + 0x1d0]
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400a7c50
mov r8d, eax
lea rdx, [rbp + 0x1d0]
lea rcx, [rsp + 0x50]
call fcn.140004e60
nop
mov edx, 0x5c
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call fcn.1401e768c
test rax, rax
jne 0x1400a7c8a
mov eax, edi
jmp 0x1400a7c90
sub rax, rbx
sar rax, 1
mov r8d, 1
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.140064220
mov edx, 0x5c
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call fcn.1401e768c
test rax, rax
jne 0x1400a7cbd
mov eax, edi
jmp 0x1400a7cc3
sub rax, rbx
sar rax, 1
mov r9d, dword [rbx - 0x10]
sub r9d, eax
mov r8d, eax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.14002eaa0
nop
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.140004620
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400a7d15
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
mov rbx, qword [rsp + 0x50]
mov rdx, rbx
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400a7d49
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
lea rcx, [rbp - 0x40]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x1400a7dad
mov rcx, qword [0x1402a8360]
lea rax, [0x1402a8360]
cmp rcx, rax
je 0x1400a7da1
test byte [rcx + 0x1c], 4
je 0x1400a7da1
mov r9, r14
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x37
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
lea r8, [0x14025a4c8]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
xor edx, edx
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [rsp + 0x60]
call fcn.140091e00
nop
xor r9d, r9d
lea r8, [rbp - 0x40]
lea rdx, [rbp + 0x5f0]
lea rcx, [rsp + 0x60]
call fcn.140096a40
cmp eax, 1
je 0x1400a7de6
mov esi, 0x8001000c
mov dword [0x1402bbd98], 0xc
jmp 0x1400a7df4
lea rdx, [rbp - 0x40]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
nop
lea rcx, [rsp + 0x60]
call fcn.140091f70
jmp 0x1400a7e0f
mov esi, 0x80010001
mov dword [0x1402bbd98], 1
mov r10, qword [0x1402a8360]
mov al, 1
mov byte [rsp + 0x78], al
lea rdx, [0x1402a8360]
cmp r10, rdx
je 0x1400a7e6d
test byte [r10 + 0x1c], al
je 0x1400a7e6d
mov r9, r14
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x38
mov dword [rsp + 0x20], esi
lea r8, [0x14025a4c8]
mov rcx, qword [r10 + 0x10]
call fcn.140001b40
movzx eax, byte [rsp + 0x78]
mov r10, qword [0x1402a8360]
lea rdx, [0x1402a8360]
lea rcx, vtable.WppTrace.0
mov qword [rsp + 0x70], rcx
test al, al
jne 0x1400a7ec4
cmp r10, rdx
je 0x1400a7ec4
test byte [r10 + 0x1c], 1
je 0x1400a7ec4
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rcx, qword [rbp - 0x80]
cmp qword [0x1402bbdc8], 8
cmovae r14, qword [0x1402bbdb0]
mov edx, 0xa
mov qword [rsp + 0x20], rcx
mov r9, r14
lea r8, [0x140252818]
mov rcx, qword [r10 + 0x10]
call fcn.140006c90
lea rcx, [rbp - 0x60]
call fcn.1400048a0
lea rcx, [rbp - 0x80]
call fcn.1400048a0
mov eax, esi
mov rcx, qword [rbp + 0x800]
xor rcx, rsp
call fcn.1401e2900
add rsp, 0x918
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.140001470
int3