Function at 0x140053d00
Capabilities:
Create directory

Disassembly:
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x830
mov rax, qword [0x1400945f8]
xor rax, rsp
mov qword [rsp + 0x828], rax
mov rax, qword [rsp + 0x848]
mov qword [rsp + 0x268], rax
mov dword [rsp + 0x250], 0x800
mov dword [rsp + 0x40], 0x409
mov dword [rsp + 0x44], 1
lea rax, [rsp + 0x40]
mov qword [rsp + 0x258], rax
mov rcx, qword [rsp + 0x840]
call fcn.1400532a0
mov rdx, qword [rsp + 0x840]
movzx eax, byte [rsp + 0x868]
mov byte [rdx + 0x179], al
mov rcx, qword [rsp + 0x840]
add rcx, 0x384
mov rdx, qword [rsp + 0x848]
call fcn.140026030
mov rcx, qword [rsp + 0x840]
add rcx, 0x17a
mov rdx, qword [rsp + 0x850]
call fcn.140026030
mov rdx, qword [rsp + 0x840]
movzx eax, byte [rsp + 0x858]
mov byte [rdx + 0x178], al
mov rcx, qword [rsp + 0x840]
mov eax, dword [rsp + 0x860]
mov dword [rcx + 0x37c], eax
mov rdx, qword [rsp + 0x848]
mov rcx, qword [rsp + 0x840]
call fcn.1400527b0
movzx eax, al
test eax, eax
jne 0x140053e3e
movsx eax, byte [rsp + 0x858]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x850]
mov r8, qword [rsp + 0x848]
lea rdx, str.load_esent_lib_failed____s___Windir:_s__SamDrive:_c_n
lea rcx, [0x1400a5fd0]
call fcn.140048c60
xor al, al
jmp 0x140054ca6
movsx eax, byte [rsp + 0x858]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x850]
mov r8, qword [rsp + 0x848]
lea rdx, str.load_esent_lib_ok____s___Windir:_s__SamDrive:_c_n
lea rcx, [0x1400a5fd0]
call fcn.140048c60
mov byte [rsp + 0x50], 0
lea rdi, [rsp + 0x51]
xor eax, eax
mov ecx, 0x1ff
rep stosb byte [rdi], al
mov rdx, qword [rsp + 0x848]
lea rcx, [rsp + 0x50]
call fcn.140026030
lea rcx, [rsp + 0x50]
call fcn.140025720
lea rax, [rsp + rax + 0x4f]
mov qword [rsp + 0x470], rax
lea rax, [rsp + 0x50]
cmp qword [rsp + 0x470], rax
jbe 0x140053eeb
mov rax, qword [rsp + 0x470]
movsx eax, byte [rax]
cmp eax, 0x5c
jne 0x140053ed5
mov rax, qword [rsp + 0x470]
mov byte [rax], 0
jmp 0x140053eeb
mov rax, qword [rsp + 0x470]
sub rax, 1
mov qword [rsp + 0x470], rax
jmp 0x140053ea9
mov rax, qword [rsp + 0x840]
cmp dword [rax + 0x380], 0
je 0x140053f1a
lea rdx, str.pcunlocker
lea rcx, [rsp + 0x50]
call fcn.140025f90
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rcx, qword [rsp + 0x840]
add rcx, 0x590
mov qword [rsp + 0x20], 0
mov r9d, 0x2000
mov r8d, 0x40
mov rdx, 0xffffffffffffffff
mov rax, qword [rsp + 0x840]
call qword [rax + 0x5c0]
mov dword [rsp + 0x260], eax
mov rcx, qword [rsp + 0x840]
add rcx, 0x590
mov qword [rsp + 0x20], 0
mov r9d, 1
mov r8d, 0x11
mov rdx, 0xffffffffffffffff
mov rax, qword [rsp + 0x840]
call qword [rax + 0x5c0]
mov dword [rsp + 0x260], eax
mov rcx, qword [rsp + 0x840]
add rcx, 0x590
lea rax, [0x140076dbc]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x22
mov rdx, 0xffffffffffffffff
mov rax, qword [rsp + 0x840]
call qword [rax + 0x5c0]
mov dword [rsp + 0x260], eax
mov rcx, qword [rsp + 0x840]
add rcx, 0x590
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x30
mov rdx, 0xffffffffffffffff
mov rax, qword [rsp + 0x840]
call qword [rax + 0x5c0]
mov dword [rsp + 0x260], eax
mov rcx, qword [rsp + 0x840]
add rcx, 0x590
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x2d
mov rdx, 0xffffffffffffffff
mov rax, qword [rsp + 0x840]
call qword [rax + 0x5c0]
mov dword [rsp + 0x260], eax
mov rcx, qword [rsp + 0x840]
add rcx, 0x590
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, 0xffffffffffffffff
mov rax, qword [rsp + 0x840]
call qword [rax + 0x5c0]
mov dword [rsp + 0x260], eax
mov byte [rsp + 0x270], 0
lea rdi, [rsp + 0x271]
xor eax, eax
mov ecx, 0x1ff
rep stosb byte [rdi], al
lea r8, [rsp + 0x50]
lea rdx, str._s_temp.edb
lea rcx, [rsp + 0x270]
call fcn.140025b64
mov rcx, qword [rsp + 0x840]
add rcx, 0x590
lea rax, [rsp + 0x270]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 1
mov rdx, 0xffffffffffffffff
mov rax, qword [rsp + 0x840]
call qword [rax + 0x5c0]
mov dword [rsp + 0x260], eax
mov rcx, qword [rsp + 0x840]
add rcx, 0x590
mov qword [rsp + 0x20], 0
mov r9d, 1
mov r8d, 0x24
mov rdx, 0xffffffffffffffff
mov rax, qword [rsp + 0x840]
call qword [rax + 0x5c0]
mov dword [rsp + 0x260], eax
mov rcx, qword [rsp + 0x840]
add rcx, 0x590
lea rax, str.NTDS
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8d, 4
mov rdx, 0xffffffffffffffff
mov rax, qword [rsp + 0x840]
call qword [rax + 0x5c0]
mov dword [rsp + 0x260], eax
mov rcx, qword [rsp + 0x840]
add rcx, 0x590
mov qword [rsp + 0x20], 0
mov r9d, 0x2800
mov r8d, VariantTimeToDosDateTime
mov rdx, 0xffffffffffffffff
mov rax, qword [rsp + 0x840]
call qword [rax + 0x5c0]
mov dword [rsp + 0x260], eax
mov rcx, qword [rsp + 0x840]
add rcx, 0x590
mov qword [rsp + 0x20], 0
mov r9d, 0x3e8
mov r8d, 6
mov rdx, 0xffffffffffffffff
mov rax, qword [rsp + 0x840]
call qword [rax + 0x5c0]
mov dword [rsp + 0x260], eax
mov rcx, qword [rsp + 0x840]
add rcx, 0x590
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 2
mov rdx, 0xffffffffffffffff
mov rax, qword [rsp + 0x840]
call qword [rax + 0x5c0]
mov dword [rsp + 0x260], eax
mov rcx, qword [rsp + 0x840]
add rcx, 0x590
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x71
mov rdx, 0xffffffffffffffff
mov rax, qword [rsp + 0x840]
call qword [rax + 0x5c0]
mov dword [rsp + 0x260], eax
lea r9, [rsp + 0x270]
lea r8, [rsp + 0x50]
lea rdx, str.szTempDir:_s__szTempDB:_s_n
lea rcx, [0x1400a5fd0]
call fcn.140048c60
mov rcx, qword [rsp + 0x840]
add rcx, 0x590
mov rax, qword [rsp + 0x840]
call qword [rax + 0x5c8]
mov dword [rsp + 0x260], eax
mov r9, qword [rsp + 0x840]
mov r9, qword [r9 + 0x590]
mov r8d, dword [rsp + 0x260]
lea rdx, str.m_JetInit_error:_d__m_hInstance:_d_n
lea rcx, [0x1400a5fd0]
call fcn.140048c60
mov dword [rsp + 0x478], 0
jmp 0x14005430d
mov eax, dword [rsp + 0x478]
add eax, 1
mov dword [rsp + 0x478], eax
cmp dword [rsp + 0x478], 2
jge 0x1400546a2
mov rdx, qword [rsp + 0x840]
add rdx, 0x598
lea r9, [0x14007fce0]
lea r8, str.admin
mov rcx, qword [rsp + 0x840]
mov rcx, qword [rcx + 0x590]
mov rax, qword [rsp + 0x840]
call qword [rax + 0x5d0]
mov dword [rsp + 0x260], eax
mov r8d, dword [rsp + 0x260]
lea rdx, str.m_JetBeginSession_error:_d_n
lea rcx, [0x1400a5fd0]
call fcn.140048c60
cmp dword [rsp + 0x260], 0
je 0x140054388
xor al, al
jmp 0x140054ca6
mov rax, qword [rsp + 0x840]
cmp dword [rax + 0x380], 0
je 0x1400543a6
mov dword [rsp + 0x818], 1
jmp 0x1400543b1
mov dword [rsp + 0x818], 0x200
mov r8d, dword [rsp + 0x818]
mov rdx, qword [rsp + 0x268]
mov rcx, qword [rsp + 0x840]
mov rcx, qword [rcx + 0x598]
mov rax, qword [rsp + 0x840]
call qword [rax + 0x5d8]
mov dword [rsp + 0x260], eax
mov r8d, dword [rsp + 0x260]
lea rdx, str.m_JetAttachDatabase_error:_d_n
lea rcx, [0x1400a5fd0]
call fcn.140048c60
cmp dword [rsp + 0x260], 0
jge 0x140054480
mov rax, qword [rsp + 0x840]
cmp dword [rax + 0x380], 0
je 0x140054422
xor al, al
jmp 0x140054ca6
mov r8d, 0x400
mov rdx, qword [rsp + 0x268]
mov rcx, qword [rsp + 0x840]
mov rcx, qword [rcx + 0x598]
mov rax, qword [rsp + 0x840]
call qword [rax + 0x5d8]
mov dword [rsp + 0x260], eax
mov r8d, dword [rsp + 0x260]
lea rdx, str.m_JetAttachDatabase_error2:_d_n
lea rcx, [0x1400a5fd0]
call fcn.140048c60
cmp dword [rsp + 0x260], 0
jge 0x140054480
xor al, al
jmp 0x140054ca6
mov rax, qword [rsp + 0x840]
cmp dword [rax + 0x380], 0
je 0x14005449e
mov dword [rsp + 0x81c], 1
jmp 0x1400544a9
mov dword [rsp + 0x81c], 0x200
mov r9, qword [rsp + 0x840]
add r9, 0x5a8
mov eax, dword [rsp + 0x81c]
mov dword [rsp + 0x20], eax
xor r8d, r8d
mov rdx, qword [rsp + 0x268]
mov rcx, qword [rsp + 0x840]
mov rcx, qword [rcx + 0x598]
mov rax, qword [rsp + 0x840]
call qword [rax + 0x5e0]
mov dword [rsp + 0x260], eax
mov r8d, dword [rsp + 0x260]
lea rdx, str.m_JetOpenDatabase_error:_d_n
lea rcx, [0x1400a5fd0]
call fcn.140048c60
cmp dword [rsp + 0x260], 0
je 0x14005451e
xor al, al
jmp 0x140054ca6
mov rax, qword [rsp + 0x840]
cmp dword [rax + 0x380], 0
je 0x14005453c
mov dword [rsp + 0x820], 4
jmp 0x140054547
mov dword [rsp + 0x820], 8
mov rax, qword [rsp + 0x840]
add rax, 0x5a0
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x820]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.datatable
mov rax, qword [rsp + 0x840]
mov edx, dword [rax + 0x5a8]
mov rcx, qword [rsp + 0x840]
mov rcx, qword [rcx + 0x598]
mov rax, qword [rsp + 0x840]
call qword [rax + 0x5e8]
mov dword [rsp + 0x260], eax
mov r8d, dword [rsp + 0x260]
lea rdx, str.m_JetOpenTable_error:_d_n
lea rcx, [0x1400a5fd0]
call fcn.140048c60
cmp dword [rsp + 0x260], 0
je 0x1400545d5
xor al, al
jmp 0x140054ca6
cmp dword [rsp + 0x478], 0
jne 0x14005469d
mov rdx, qword [rsp + 0x840]
mov rdx, qword [rdx + 0x5a0]
mov rcx, qword [rsp + 0x840]
mov rcx, qword [rcx + 0x598]
mov rax, qword [rsp + 0x840]
call qword [rax + 0x608]
mov dword [rsp + 0x260], eax
xor r8d, r8d
mov rax, qword [rsp + 0x840]
mov edx, dword [rax + 0x5a8]
mov rcx, qword [rsp + 0x840]
mov rcx, qword [rcx + 0x598]
mov rax, qword [rsp + 0x840]
call qword [rax + 0x610]
mov dword [rsp + 0x260], eax
mov rdx, qword [rsp + 0x268]
mov rcx, qword [rsp + 0x840]
mov rcx, qword [rcx + 0x598]
mov rax, qword [rsp + 0x840]
call qword [rax + 0x618]
mov dword [rsp + 0x260], eax
xor edx, edx
mov rcx, qword [rsp + 0x840]
mov rcx, qword [rcx + 0x598]
mov rax, qword [rsp + 0x840]
call qword [rax + 0x620]
mov dword [rsp + 0x260], eax
jmp 0x1400542fc
mov r8, qword [rsp + 0x840]
mov r8, qword [r8 + 0x5a0]
mov rdx, qword [rsp + 0x840]
mov rdx, qword [rdx + 0x598]
mov rcx, qword [rsp + 0x840]
call fcn.140051590
lea r8, [0x14007fda8]
mov rdx, qword [rsp + 0x840]
mov rdx, qword [rdx + 0x5a0]
mov rcx, qword [rsp + 0x840]
mov rcx, qword [rcx + 0x598]
mov rax, qword [rsp + 0x840]
call qword [rax + 0x630]
mov dword [rsp + 0x260], eax
mov r8d, dword [rsp + 0x260]
lea rdx, [0x14007fdb8]
lea rcx, [0x1400a5fd0]
call fcn.140048c60
xor r9d, r9d
mov r8d, 0x80000000
mov rdx, qword [rsp + 0x840]
mov rdx, qword [rdx + 0x5a0]
mov rcx, qword [rsp + 0x840]
mov rcx, qword [rcx + 0x598]
mov rax, qword [rsp + 0x840]
call qword [rax + 0x5f8]
mov dword [rsp + 0x260], eax
mov r8d, dword [rsp + 0x260]
lea rdx, [0x14007fdd8]
lea rcx, [0x1400a5fd0]
call fcn.140048c60
mov rax, qword [rsp + 0x840]
mov r9d, dword [rax + 0x5b8]
mov r8, qword [rsp + 0x840]
mov r8, qword [r8 + 0x5b0]
mov rdx, qword [rsp + 0x840]
mov rdx, qword [rdx + 0x5a0]
mov rcx, qword [rsp + 0x840]
mov rcx, qword [rcx + 0x598]
mov rax, qword [rsp + 0x840]
call qword [rax + 0x600]
mov dword [rsp + 0x260], eax
mov rax, qword [rsp + 0x840]
mov rax, qword [rax + 0x5b0]
cmp dword [rax + 0x194], 4
jb 0x140054810
mov rax, qword [rsp + 0x840]
mov rax, qword [rax + 0x5b0]
mov rax, qword [rax + 0x188]
mov eax, dword [rax]
mov dword [rsp + 0x814], eax
cmp dword [rsp + 0x814], 0
jbe 0x140054810
jmp 0x140054c67
mov rax, qword [rsp + 0x840]
mov rax, qword [rax + 0x5b0]
cmp dword [rax + 0x1c4], 0
jbe 0x140054886
mov rax, qword [rsp + 0x840]
mov rax, qword [rax + 0x5b0]
mov rcx, qword [rsp + 0x840]
mov eax, dword [rax + 0x1c4]
mov dword [rcx + 0x130], eax
mov rax, qword [rsp + 0x840]
mov r8d, dword [rax + 0x130]
mov rdx, qword [rsp + 0x840]
mov rdx, qword [rdx + 0x5b0]
mov rcx, qword [rsp + 0x840]
add rcx, 0x30
mov rdx, qword [rdx + 0x1b8]
call fcn.1400252e0
jmp 0x140054c67
mov rax, qword [rsp + 0x840]
mov rax, qword [rax + 0x5b0]
cmp dword [rax + 0x74], 4
je 0x1400548a0
jmp 0x140054c67
mov rax, qword [rsp + 0x840]
mov rax, qword [rax + 0x5b0]
mov rax, qword [rax + 0x68]
mov eax, dword [rax]
mov dword [rsp + 0x810], eax
cmp dword [rsp + 0x810], 0x30000000
je 0x1400548ce
jmp 0x140054c67
mov r8d, 0x368
xor edx, edx
lea rcx, [rsp + 0x4a0]
call fcn.1400258a0
mov rax, qword [rsp + 0x840]
mov rax, qword [rax + 0x5b0]
mov qword [rsp + 0x488], rax
xor edx, edx
mov rax, qword [rsp + 0x488]
mov eax, dword [rax + 0x14]
mov ecx, 2
div ecx
mov r9d, eax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xfe
lea rax, [rsp + 0x4a4]
mov qword [rsp + 0x20], rax
mov r8, qword [rsp + 0x488]
mov r8, qword [r8 + 8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor edx, edx
mov rax, qword [rsp + 0x488]
mov eax, dword [rax + 0x14]
mov ecx, 2
div ecx
mov eax, eax
mov byte [rsp + rax + 0x4a4], 0
mov rax, qword [rsp + 0x840]
mov rax, qword [rax + 0x5b0]
add rax, 0x30
mov qword [rsp + 0x488], rax
xor edx, edx
mov rax, qword [rsp + 0x488]
mov eax, dword [rax + 0x14]
mov ecx, 2
div ecx
mov r9d, eax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x1ff
lea rax, [rsp + 0x5a7]
mov qword [rsp + 0x20], rax
mov r8, qword [rsp + 0x488]
mov r8, qword [r8 + 8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor edx, edx
mov rax, qword [rsp + 0x488]
mov eax, dword [rax + 0x14]
mov ecx, 2
div ecx
mov eax, eax
mov byte [rsp + rax + 0x5a7], 0
mov rax, qword [rsp + 0x840]
mov rax, qword [rax + 0x5b0]
add rax, 0x90
mov qword [rsp + 0x488], rax
mov rax, qword [rsp + 0x488]
mov ecx, dword [rax + 0x14]
mov rax, qword [rsp + 0x488]
mov rax, qword [rax + 8]
lea rax, [rax + rcx - 4]
mov qword [rsp + 0x498], rax
lea rax, [rsp + 0x4a0]
mov qword [rsp + 0x480], rax
mov rcx, qword [rsp + 0x480]
mov rax, qword [rsp + 0x498]
movzx eax, byte [rax + 3]
mov byte [rcx], al
mov rcx, qword [rsp + 0x480]
mov rax, qword [rsp + 0x498]
movzx eax, byte [rax + 2]
mov byte [rcx + 1], al
mov rcx, qword [rsp + 0x480]
mov rax, qword [rsp + 0x498]
movzx eax, byte [rax + 1]
mov byte [rcx + 2], al
mov rcx, qword [rsp + 0x480]
mov rax, qword [rsp + 0x498]
movzx eax, byte [rax]
mov byte [rcx + 3], al
mov rax, qword [rsp + 0x840]
mov rax, qword [rax + 0x5b0]
add rax, 0xf0
mov qword [rsp + 0x488], rax
mov byte [rsp + 0x5a4], 0
mov rax, qword [rsp + 0x488]
cmp dword [rax + 0x14], 0
jbe 0x140054afe
mov byte [rsp + 0x5a4], 1
mov r8d, 0x28
mov rdx, qword [rsp + 0x488]
mov rdx, qword [rdx + 8]
lea rcx, [rsp + 0x7d9]
call fcn.1400252e0
mov byte [rsp + 0x7b0], 0
mov rax, qword [rsp + 0x840]
mov rax, qword [rax + 0x5b0]
add rax, 0x120
mov qword [rsp + 0x488], rax
mov rax, qword [rsp + 0x488]
cmp dword [rax + 0x14], 0
jbe 0x140054b58
mov byte [rsp + 0x7b0], 1
mov r8d, 0x28
mov rdx, qword [rsp + 0x488]
mov rdx, qword [rdx + 8]
lea rcx, [rsp + 0x7b1]
call fcn.1400252e0
mov rax, qword [rsp + 0x840]
mov rax, qword [rax + 0x5b0]
mov rax, qword [rax + 0xc8]
mov eax, dword [rax]
mov dword [rsp + 0x490], eax
mov eax, dword [rsp + 0x490]
and eax, 2
test eax, eax
je 0x140054b8f
mov byte [rsp + 0x824], 1
jmp 0x140054b97
mov byte [rsp + 0x824], 0
movzx eax, byte [rsp + 0x824]
mov byte [rsp + 0x5a5], al
mov eax, dword [rsp + 0x490]
and eax, 0x10
test eax, eax
je 0x140054bbe
mov byte [rsp + 0x825], 1
jmp 0x140054bc6
mov byte [rsp + 0x825], 0
movzx eax, byte [rsp + 0x825]
mov byte [rsp + 0x5a3], al
mov eax, dword [rsp + 0x490]
and eax, 0x10000
test eax, eax
je 0x140054bef
mov byte [rsp + 0x826], 1
jmp 0x140054bf7
mov byte [rsp + 0x826], 0
movzx eax, byte [rsp + 0x826]
mov byte [rsp + 0x5a6], al
mov eax, dword [rsp + 0x490]
mov dword [rsp + 0x7ac], eax
mov rax, qword [rsp + 0x840]
mov rax, qword [rax + 0x5b0]
mov rax, qword [rax + 0x1e8]
mov eax, dword [rax]
mov dword [rsp + 0x7a8], eax
mov rax, qword [rsp + 0x840]
mov rax, qword [rax + 0x5b0]
mov rax, qword [rax + 0x158]
mov eax, dword [rax]
mov dword [rsp + 0x804], eax
lea rdx, [rsp + 0x4a0]
mov rcx, qword [rsp + 0x840]
call fcn.14000bdd0
xor r9d, r9d
mov r8d, 1
mov rdx, qword [rsp + 0x840]
mov rdx, qword [rdx + 0x5a0]
mov rcx, qword [rsp + 0x840]
mov rcx, qword [rcx + 0x598]
mov rax, qword [rsp + 0x840]
call qword [rax + 0x5f8]
test eax, eax
je 0x140054779
mov al, 1
mov rcx, qword [rsp + 0x828]
xor rcx, rsp
call fcn.1400252b0
add rsp, 0x830
pop rdi
ret