Function at 0x14014e968
Capabilities:
Create directory

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
xor r14d, r14d
mov r12, r8
mov r13, rdx
mov r15, rcx
lea rbx, [0x1400154a0]
mov qword [rbp + 0x50], r14
mov edi, r14d
mov qword [rbp + 0x58], r14
mov qword [rbp + 0x60], r14
test rcx, rcx
jne 0x14014e9b7
lea r8, [0x1400154f8]
mov edx, 0x239
mov rcx, rbx
call fcn.1400a8be8
test r13, r13
jne 0x14014e9d0
lea r8, [0x140015560]
mov edx, 0x23a
mov rcx, rbx
call fcn.1400a8be8
test r12, r12
jne 0x14014e9e9
lea r8, [0x140015540]
mov edx, 0x23b
mov rcx, rbx
call fcn.1400a8be8
lea r8, [rbp + 0x58]
mov rdx, r13
mov rcx, r15
mov qword [r12], r14
call fcn.14012e938
mov rsi, qword [rbp + 0x58]
mov ebx, eax
test eax, eax
js 0x14014edba
lea rcx, [rbp - 0x20]
call fcn.1400b5dbc
mov ebx, eax
test eax, eax
js 0x14014edba
lea rdx, [rbp - 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rcx, qword [rbp - 0x18]
mov ebx, eax
test rcx, rcx
je 0x14014ea3f
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbp - 0x18], r14
test ebx, ebx
jne 0x14014ea9a
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
cmp ebx, 0x800700b7
jne 0x14014eb57
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14014ea9a
test byte [rcx + 0x1c], 1
je 0x14014ea9a
cmp byte [rcx + 0x19], 3
jb 0x14014ea9a
mov rcx, qword [rcx + 0x10]
lea r8, [0x140015578]
mov edx, 0x1e
mov r9, rsi
call fcn.14001ec40
lea r8, [rbp + 0x50]
lea rdx, [0x140001800]
mov rcx, r15
call fcn.1400a9ab8
mov ebx, eax
test eax, eax
js 0x14014ed9f
mov rax, qword [rbp + 0x50]
or rcx, 0xffffffffffffffff
mov rbx, rcx
inc rbx
cmp word [rax + rbx*2], r14w
jne 0x14014eac2
mov qword [rsp + 0x30], rcx
mov eax, 3
xor r9d, r9d
mov edx, 0xc0000000
mov rcx, rsi
mov r8d, eax
mov dword [rsp + 0x28], reloc.ADVAPI32.dll_TraceEvent
add bx, bx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp - 0x28], rax
cmp rax, 0xffffffffffffffff
jne 0x14014eba6
mov rcx, qword [0x14017d3a8]
lea r12, [0x14017d3a8]
cmp rcx, r12
je 0x14014eb3e
test byte [rcx + 0x1c], 1
je 0x14014eb3e
lea edx, [rax + 3]
cmp byte [rcx + 0x19], dl
jb 0x14014eb3e
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x21]
lea r8, [0x140015578]
mov r9, rsi
call fcn.14001ec40
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x14014eda6
mov rcx, qword [0x14017d3a8]
lea r12, [0x14017d3a8]
mov edi, 2
cmp rcx, r12
je 0x14014edcd
test byte [rcx + 0x1c], 1
je 0x14014edcd
cmp byte [rcx + 0x19], dil
jb 0x14014edcd
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0x1d]
lea r8, [0x140015578]
mov r9, rsi
mov dword [rsp + 0x20], ebx
call fcn.14001ecbc
jmp 0x14014edc6
mov ecx, 0x4000
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
xor ecx, ecx
mov r14, rax
test rax, rax
jne 0x14014ebc5
mov ebx, 0x8007000e
jmp 0x14014ed87
mov rdx, qword [rbp + 0x50]
mov dword [rax], reloc.ADVAPI32.dll_TraceEvent
lea eax, [rbx + 0xc]
mov word [r14 + 4], ax
mov eax, 2
mov word [r14 + 0xa], bx
add eax, ebx
mov dword [r14 + 6], ecx
mov word [r14 + 0xe], cx
movzx ebx, bx
lea rcx, [r14 + 0x10]
mov word [r14 + 0xc], ax
mov r8d, ebx
call sub.msvcrt.dll_memcpy
xor ecx, ecx
mov r11d, 0x3f
mov qword [rsp + 0x38], rcx
lea rax, [rbp + 0x48]
mov word [r14 + 0x12], r11w
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rcx
shr rbx, 1
mov r8, r14
mov edx, 0x900a4
mov dword [r14 + rbx*2 + 0x10], ecx
movzx r9d, word [r14 + 4]
mov rcx, qword [rbp - 0x28]
add r9d, 8
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
xor ebx, ebx
test eax, eax
jne 0x14014ecab
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14014ed7e
test byte [rcx + 0x1c], 1
je 0x14014ed7e
mov eax, 2
cmp byte [rcx + 0x19], al
jb 0x14014ed7e
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x1f]
lea r8, [0x140015578]
mov r9d, ebx
call fcn.14001de24
jmp 0x14014ed7e
mov ecx, 0x208
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rdi, rax
test rax, rax
jne 0x14014ecc8
mov ebx, 0x8007000e
jmp 0x14014ed7e
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call sub.msvcrt.dll_memset
xor r9d, r9d
lea r8, [0x140005998]
mov r10d, 0x104
mov rcx, rdi
sub r8, rdi
mov edx, r10d
lea esi, [r9 + 2]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x14014ed16
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14014ed16
mov word [rcx], ax
add rcx, rsi
dec rdx
jne 0x14014ecf5
mov rsi, qword [rbp + 0x58]
test rdx, rdx
jne 0x14014ed28
sub rcx, 2
mov ebx, 0x8007007a
mov word [rcx], r9w
test ebx, ebx
js 0x14014ed7e
lea r8, [0x140001800]
mov rdx, r10
mov rcx, rdi
call fcn.14006892c
mov ebx, eax
test eax, eax
js 0x14014ed7e
lea r8, [rbp + 0x60]
mov rdx, r13
mov rcx, r15
call fcn.14012e664
xor r13d, r13d
mov ebx, eax
test eax, eax
js 0x14014ed7e
mov r8, qword [rbp + 0x60]
mov edx, 0x104
mov rcx, rdi
call fcn.14006892c
mov ebx, eax
test eax, eax
js 0x14014ed7e
mov qword [r12], rdi
mov edi, r13d
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x14014ed9f
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea r12, [0x14017d3a8]
mov rax, qword [rbp + 0x50]
test rax, rax
je 0x14014edba
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x14014edc1
lea r12, [0x14017d3a8]
mov edi, 2
mov rcx, qword [0x14017d3a8]
test rsi, rsi
je 0x14014ede2
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x14017d3a8]
mov rax, qword [rbp + 0x60]
test rax, rax
je 0x14014edfb
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x14017d3a8]
test ebx, ebx
jns 0x14014ee2c
cmp rcx, r12
je 0x14014ee2c
test byte [rcx + 0x1c], 1
je 0x14014ee2c
cmp byte [rcx + 0x19], dil
jb 0x14014ee2c
mov rcx, qword [rcx + 0x10]
lea r8, [0x140015578]
mov edx, 0x22
mov r9, r15
mov dword [rsp + 0x20], ebx
call fcn.14001ecbc
mov eax, ebx
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret