Function at 0x18009ebe0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1800f6768]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov edx, 0x1c
lea rcx, [rbp - 0x30]
call fcn.18008f510
nop
mov r14, qword [rbp - 0x20]
movabs r13, 0x7fffffffffffffff
mov rax, r13
sub rax, r14
cmp rax, 0x16
jb 0x18009ef7c
lea r12, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae r12, qword [rbp - 0x30]
mov qword [rbp - 0x50], 0
lea r15, [r14 + 0x16]
mov edi, 0xf
mov ebx, edi
lea rsi, [rbp - 0x50]
lea eax, [rdi + 7]
lea rdx, [rdi - 0x10]
cmp r15, rbx
jbe 0x18009ecd7
mov rbx, r15
or rbx, rdi
cmp rbx, r13
jbe 0x18009ec7b
mov rbx, r13
jmp 0x18009ec82
cmp rbx, rax
cmovb rbx, rax
mov rcx, rbx
add rcx, 1
cmovb rcx, rdx
cmp rcx, 0x1000
jb 0x18009ecc2
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18009ef82
mov rcx, rax
call fcn.1800cc224
test rax, rax
je 0x18009ed58
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x18009ecd3
test rcx, rcx
je 0x18009ecd1
call fcn.1800cc224
mov rsi, rax
jmp 0x18009ecd3
xor esi, esi
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], rbx
mov r8, r14
mov rdx, r12
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [str._immunity_logs_log.txt]
movups xmmword [rsi + r14], xmm0
mov eax, dword [0x1800dff80]
mov dword [rsi + r14 + 0x10], eax
movzx eax, word [0x1800dff84]
mov word [rsi + r14 + 0x14], ax
mov byte [rsi + r15], 0
lea rdx, [rbp - 0x50]
lea rcx, [0x1800f66a0]
call fcn.18008ba40
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x18009ed64
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009ed5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18009ed5f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800cb8d4
lea rdx, str.____appdata
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.18007cce0
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
mov rcx, rax
call fcn.180081360
lea rdx, [0x180082d80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r15, qword [rbp - 0x20]
mov rax, r13
sub rax, r15
cmp rax, rdi
jb 0x18009ef88
lea r14, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae r14, qword [rbp - 0x30]
xor eax, eax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
lea rsi, [r15 + 0xf]
lea rbx, [rbp - 0x50]
cmp rsi, rdi
jbe 0x18009ee53
mov rdi, rsi
or rdi, 0xf
cmp rdi, r13
jbe 0x18009edee
mov rdi, r13
jmp 0x18009edfb
cmp rdi, 0x16
mov ecx, 0x16
cmovb rdi, rcx
mov rcx, rdi
add rcx, 1
mov rdx, 0xffffffffffffffff
cmovb rcx, rdx
cmp rcx, 0x1000
jb 0x18009ee42
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18009ef76
mov rcx, rax
call fcn.1800cc224
test rax, rax
je 0x18009eefe
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x18009ee4f
test rcx, rcx
je 0x18009ee4c
call fcn.1800cc224
mov rbx, rax
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], rdi
mov r8, r15
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [str._immunity_logs_]
movsd qword [rbx + r15], xmm0
mov eax, dword [0x1800dffa0]
mov dword [rbx + r15 + 8], eax
movzx eax, word [0x1800dffa4]
mov word [rbx + r15 + 0xc], ax
movzx eax, byte [0x1800dffa6]
mov byte [rbx + r15 + 0xe], al
mov byte [rbx + rsi], 0
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rcx, qword [rbp - 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x18009eeca
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x18009eeca
xor bl, bl
jmp 0x18009eecc
mov bl, 1
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x18009ef0b
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009ef05
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18009ef05
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800cb8d4
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x18009ef49
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009ef44
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18009ef44
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800cb8d4
movzx eax, bl
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1800cc000
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.18007c110
nop
call fcn.18007c130
int3
call fcn.18007c110
int3
call fcn.18007c130
int3