Function at 0x140018030
Capabilities:
Create directory
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r12
sub rsp, 0x250
mov rax, qword [0x140172b58]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbp, rcx
test rdx, rdx
je 0x1400180b9
lea rdi, [rcx + 0x18]
mov ebx, 0x104
mov r8, rdi
sub rdx, rdi
mov r9, rbx
nop dword [rax]
lea rax, [r9 + 0x7ffffefa]
test rax, rax
je 0x1400180a4
movzx eax, word [rdx + r8]
test ax, ax
je 0x1400180a4
mov word [r8], ax
add r8, 2
sub r9, 1
jne 0x140018070
sub r8, 2
xor r12d, r12d
mov word [r8], r12w
jmp 0x140018390
test r9, r9
jne 0x1400180ad
sub r8, 2
xor r12d, r12d
mov word [r8], r12w
jmp 0x140018390
lea rcx, [rsp + 0x32]
xor r12d, r12d
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x278], rsi
mov esi, 1
mov word [rsp + 0x30], r12w
call sub.MSVCR90.dll_memset
mov ebx, 0x104
lea rcx, [rsp + 0x30]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r11, rbx
lea rax, [rsp + 0x30]
nop dword [rax + rax]
cmp word [rax], r12w
je 0x140018111
add rax, 2
sub r11, rsi
jne 0x140018100
jmp 0x14001816f
test r11, r11
je 0x14001816f
mov rdx, rbx
mov rcx, rbx
sub rdx, r11
sub rcx, rdx
lea rax, [rsp + rdx*2 + 0x30]
je 0x140018167
lea r9, str.SHFolder.dll
lea rdx, [rcx + rdx + 0x7ffffefb]
sub r9, rax
nop dword [rax + rax]
test rdx, rdx
je 0x140018162
movzx r8d, word [r9 + rax]
test r8w, r8w
je 0x140018162
mov word [rax], r8w
add rax, 2
dec rdx
sub rcx, rsi
jne 0x140018140
jmp 0x140018167
test rcx, rcx
jne 0x14001816b
sub rax, 2
mov word [rax], r12w
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x1400182eb
lea rdx, str.SHGetFolderPathW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r11, rax
test rax, rax
je 0x1400181b9
lea rax, [rbp + 0x18]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8023
xor ecx, ecx
mov qword [rsp + 0x20], rax
call r11
mov esi, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
jne 0x1400182eb
lea rdi, [rbp + 0x18]
mov rcx, rbx
mov rax, rdi
cmp word [rax], r12w
je 0x1400181e6
add rax, 2
sub rcx, 1
jne 0x1400181d4
jmp 0x140018240
test rcx, rcx
je 0x140018240
mov rdx, rbx
sub rdx, rcx
mov rcx, rbx
sub rcx, rdx
lea rax, [rdi + rdx*2]
je 0x140018238
lea r9, str.AhnLab
lea rdx, [rcx + rdx + 0x7ffffefb]
sub r9, rax
nop
test rdx, rdx
je 0x140018233
movzx r8d, word [r9 + rax]
test r8w, r8w
je 0x140018233
mov word [rax], r8w
add rax, 2
dec rdx
sub rcx, 1
jne 0x140018210
jmp 0x140018238
test rcx, rcx
jne 0x14001823c
sub rax, 2
mov word [rax], r12w
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140018260
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400182eb
mov rcx, rbx
mov rax, rdi
cmp word [rax], r12w
je 0x140018278
add rax, 2
sub rcx, 1
jne 0x140018266
jmp 0x1400182cf
test rcx, rcx
je 0x1400182cf
mov rdx, rbx
sub rdx, rcx
mov rcx, rbx
sub rcx, rdx
lea rax, [rdi + rdx*2]
je 0x1400182c7
lea r9, str.AIS
lea r8, [rcx + rdx + 0x7ffffefb]
sub r9, rax
test r8, r8
je 0x1400182c2
movzx edx, word [r9 + rax]
test dx, dx
je 0x1400182c2
mov word [rax], dx
add rax, 2
dec r8
sub rcx, 1
jne 0x1400182a1
jmp 0x1400182c7
test rcx, rcx
jne 0x1400182cb
sub rax, 2
mov word [rax], r12w
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14001830e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14001830e
lea rdi, [rbp + 0x18]
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x14001830e
dec eax
cmp word [rbp + rax*2 + 0x18], 0x5c
jne 0x14001830e
mov word [rbp + rax*2 + 0x18], r12w
mov rsi, qword [rsp + 0x278]
mov rcx, rbx
mov rax, rdi
nop dword [rax]
cmp word [rax], r12w
je 0x140018332
add rax, 2
sub rcx, 1
jne 0x140018320
jmp 0x140018390
test rcx, rcx
je 0x140018390
mov rdx, rbx
sub rdx, rcx
mov rcx, rbx
sub rcx, rdx
lea rax, [rdi + rdx*2]
je 0x140018388
lea r9, str._ai.log
lea rdx, [rcx + rdx + 0x7ffffefb]
sub r9, rax
nop dword [rax + rax]
test rdx, rdx
je 0x140018383
movzx r8d, word [r9 + rax]
test r8w, r8w
je 0x140018383
mov word [rax], r8w
add rax, 2
dec rdx
sub rcx, 1
jne 0x140018360
jmp 0x140018388
test rcx, rcx
jne 0x14001838c
sub rax, 2
mov word [rax], r12w
mov edx, 0x2e
mov rcx, rdi
call qword [sym.imp.MSVCR90.dll_wcsrchr]
mov r11, rax
test rax, rax
jne 0x14001846c
lea r8, [rbp + 0x220]
mov rdx, rbx
mov rcx, r8
sub rdi, r8
nop word [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x1400183e4
movzx eax, word [rdi + rcx]
test ax, ax
je 0x1400183e4
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400183c0
jmp 0x1400183e9
test rdx, rdx
jne 0x1400183ed
sub rcx, 2
mov word [rcx], r12w
mov rax, r8
mov rcx, rbx
cmp word [rax], 0
je 0x14001840c
add rax, 2
sub rcx, 1
jne 0x1400183f7
jmp 0x1400185a5
test rcx, rcx
je 0x1400185a5
mov rdx, rbx
sub rdx, rcx
sub rbx, rdx
lea rax, [r8 + rdx*2]
je 0x14001859d
lea r9, [0x140108558]
lea rcx, [rbx + rdx + 0x7ffffefb]
sub r9, rax
nop word [rax + rax]
test rcx, rcx
je 0x140018464
movzx edx, word [r9 + rax]
test dx, dx
je 0x140018464
mov word [rax], dx
add rax, 2
dec rcx
sub rbx, 1
jne 0x140018440
jmp 0x14001859d
test rbx, rbx
jmp 0x14001859b
mov rcx, rax
lea r10, [rbp + 0x220]
sub rcx, rbp
sub rcx, 0x18
sar rcx, 1
cmp rcx, 0x7ffffffe
jbe 0x14001848f
mov word [r10], r12w
jmp 0x1400184c8
mov rdx, rbx
mov rax, r10
sub rdi, r10
test rcx, rcx
je 0x1400184bb
movzx r8d, word [rdi + rax]
test r8w, r8w
je 0x1400184bb
mov word [rax], r8w
add rax, 2
dec rcx
sub rdx, 1
jne 0x140018498
jmp 0x1400184c0
test rdx, rdx
jne 0x1400184c4
sub rax, 2
mov word [rax], r12w
mov rcx, rbx
mov rax, r10
nop
cmp word [rax], 0
je 0x1400184e2
add rax, 2
sub rcx, 1
jne 0x1400184d0
jmp 0x140018540
test rcx, rcx
je 0x140018540
mov rdx, rbx
sub rdx, rcx
mov rcx, rbx
sub rcx, rdx
lea rax, [r10 + rdx*2]
je 0x140018538
lea r9, [0x140108558]
lea rdx, [rcx + rdx + 0x7ffffefb]
sub r9, rax
nop dword [rax + rax]
test rdx, rdx
je 0x140018533
movzx r8d, word [r9 + rax]
test r8w, r8w
je 0x140018533
mov word [rax], r8w
add rax, 2
dec rdx
sub rcx, 1
jne 0x140018510
jmp 0x140018538
test rcx, rcx
jne 0x14001853c
sub rax, 2
mov word [rax], r12w
mov rcx, rbx
mov rax, r10
cmp word [rax], 0
je 0x140018558
add rax, 2
sub rcx, 1
jne 0x140018546
jmp 0x1400185a5
test rcx, rcx
je 0x1400185a5
mov rdx, rbx
sub rdx, rcx
sub rbx, rdx
lea rax, [r10 + rdx*2]
je 0x14001859d
lea rcx, [rbx + rdx + 0x7ffffefb]
sub r11, rax
test rcx, rcx
je 0x140018598
movzx edx, word [rax + r11]
test dx, dx
je 0x140018598
mov word [rax], dx
add rax, 2
dec rcx
sub rbx, 1
jne 0x140018577
jmp 0x14001859d
test rbx, rbx
jne 0x1400185a1
sub rax, 2
mov word [rax], r12w
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140103060
mov rbx, qword [rsp + 0x280]
add rsp, 0x250
pop r12
pop rdi
pop rbp
ret