Function at 0x140012708
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x14007b108]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
xor eax, eax
mov qword [rsp + 0x78], rdx
lea rdx, [rsp + 0x68]
mov dword [rsp + 0x30], eax
lea r8, [rsp + 0x38]
mov qword [rsp + 0x60], rax
mov r13d, eax
mov qword [rsp + 0x58], rax
mov edi, eax
mov qword [rsp + 0x40], rax
mov r12d, eax
mov dword [rsp + 0x38], eax
mov r15d, eax
mov qword [rsp + 0x68], rax
mov ebx, eax
mov qword [rsp + 0x70], rax
mov qword [rbp - 0x78], rcx
call fcn.14001135c
mov r14, qword [rsp + 0x68]
xor edx, edx
test eax, eax
je 0x1400128ba
mov esi, dword [rsp + 0x38]
test r14, r14
je 0x14001282d
test rsi, rsi
je 0x14001282d
lea ecx, [rbx + 0x20]
call fcn.140068f94
xor edx, edx
mov rdi, rax
test rax, rax
je 0x1400127c3
mov qword [rax], rdx
mov dword [rax + 0x10], edx
mov qword [rax + 0x18], rdx
jmp 0x1400127c6
mov rdi, rdx
test rdi, rdi
je 0x140012823
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call fcn.14004d5b8
xor edx, edx
mov esi, eax
test eax, eax
js 0x1400127ed
mov rbx, rdi
mov esi, edx
mov qword [rsp + 0x40], rbx
jmp 0x140012828
cmp dword [rdi + 0x10], edx
je 0x140012800
mov rcx, qword [rdi + 8]
call fcn.140053264
xor edx, edx
mov dword [rdi + 0x10], edx
mov rcx, qword [rdi]
test rcx, rcx
je 0x140012817
mov qword [rdi], rdx
mov rax, qword [rcx]
mov rax, qword [rax]
call qword [0x14006c9d0]
mov rcx, rdi
call fcn.140068fd4
xor edx, edx
jmp 0x140012828
mov esi, 0x8007000e
mov rdi, r12
jmp 0x140012832
mov esi, 0x80070057
test esi, esi
js 0x14001286d
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x70]
lea rdx, str.IMAGEWIMBOOTENTRIES
xor r8d, r8d
lea rcx, [rsp + 0x40]
call fcn.140049a78
mov rbx, qword [rsp + 0x40]
xor edx, edx
test eax, eax
js 0x14001286d
mov rdi, qword [rsp + 0x70]
lea r15d, [rdx + 1]
mov qword [rsp + 0x60], rdi
test rbx, rbx
je 0x1400128ba
mov eax, dword [rbx + 0x10]
test eax, eax
je 0x14001289b
mov rcx, qword [rbx + 8]
call fcn.140053264
xor edx, edx
mov eax, edx
mov dword [rbx + 0x10], edx
test eax, eax
je 0x14001289b
mov rcx, qword [rbx + 8]
call fcn.140053264
xor edx, edx
mov dword [rbx + 0x10], edx
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400128b2
mov qword [rbx], rdx
mov rax, qword [rcx]
mov rax, qword [rax]
call qword [0x14006c9d0]
mov rcx, rbx
call fcn.140068fd4
test r14, r14
je 0x1400128ce
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
test r15d, r15d
je 0x140012d92
xor r15d, r15d
test rdi, rdi
je 0x140012911
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], r15w
jne 0x1400128e3
test rax, rax
je 0x140012911
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.14002514c
test eax, eax
je 0x140012d92
mov r13, qword [rsp + 0x58]
test r13, r13
jne 0x14001291c
mov r13d, 1
jmp 0x140012d92
mov edi, 0x5c
mov rbx, qword [rsp + 0x78]
mov rdx, r13
mov rcx, rbx
call fcn.140048584
mov r12, rax
test rax, rax
je 0x140012d8d
mov r8, rax
lea rcx, [rbp - 0x60]
mov edx, 0x104
call fcn.1400035ec
test eax, eax
js 0x140012d8d
mov edx, edi
lea rcx, [rbp - 0x60]
call qword [sym.imp.msvcrt.dll_wcsrchr]
nop dword [rax + rax]
test rax, rax
je 0x140012d8d
mov word [rax], r15w
mov esi, 1
mov edi, r15d
mov dword [rsp + 0x34], esi
mov dword [rsp + 0x3c], r15d
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x54], r15d
cmp r15w, word [rbp - 0x60]
je 0x140012cbf
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x60]
call fcn.1400472a8
mov r14, rax
test rax, rax
je 0x140012c9c
or rax, 0xffffffffffffffff
mov qword [rbp - 0x80], r15
xor ebx, ebx
mov dword [rsp + 0x50], r15d
mov rdi, r15
inc rax
cmp word [r14 + rax*2], bx
jne 0x1400129c7
cmp rax, 2
mov ecx, ebx
setae cl
jb 0x1400129ff
mov r8d, 2
lea rdx, [0x140073f18]
mov rcx, r14
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
mov ecx, ebx
sete cl
test ecx, ecx
je 0x140012b2a
mov edx, 0x5c
lea rcx, [r14 + 4]
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
test rax, rax
jne 0x140012a4a
mov ebx, 0x8007000d
xor r15d, r15d
movzx ecx, bx
mov esi, r15d
mov dword [rsp + 0x34], r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x48]
jmp 0x140012bb1
mov rsi, rbx
or rbx, 0xffffffffffffffff
xor ecx, ecx
inc rbx
cmp word [r14 + rbx*2], cx
jne 0x140012a53
mov edx, 0x5c
lea rcx, [rax + 2]
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
xor edx, edx
test rax, rax
jne 0x140012a7d
mov eax, ebx
jmp 0x140012a83
sub rax, r14
sar rax, 1
mov ebx, 0x8007000e
or rcx, 0xffffffffffffffff
inc rcx
cmp word [r14 + rcx*2], dx
jne 0x140012a8c
cmp rax, rcx
ja 0x140012aec
mov rcx, qword gs:[0x60]
lea rdi, [rax + 1]
lea r8, [rdi + rdi]
mov edx, 8
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
xor edx, edx
mov rsi, rax
test rax, rax
je 0x140012ae1
lea r9, [rdi - 1]
mov r8, r14
mov rdx, rdi
mov rcx, rax
call fcn.140003678
mov ebx, eax
xor edx, edx
mov rdi, qword [rbp - 0x80]
mov r15d, dword [rsp + 0x50]
jmp 0x140012af1
mov ebx, 0x80070057
test ebx, ebx
js 0x140012b01
mov rdi, rsi
mov r15d, 1
mov rsi, rdx
test rsi, rsi
je 0x140012b26
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov esi, dword [rsp + 0x34]
test ebx, ebx
js 0x140012a26
cmp r15d, 1
jne 0x140012b79
or rcx, 0xffffffffffffffff
xor r15d, r15d
inc rcx
cmp word [rdi + rcx*2], r15w
jne 0x140012b3f
mov rax, qword [rsp + 0x48]
lea rbx, [rax + rcx*2]
test rdi, rdi
je 0x140012bb1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
jmp 0x140012bb1
mov rbx, qword [rsp + 0x48]
movzx ecx, word [rbx]
lea eax, [rcx - 0x61]
cmp ax, 0x19
jbe 0x140012b94
sub cx, 0x41
cmp cx, 0x19
ja 0x140012bae
mov eax, 0x3a
cmp ax, word [rbx + 2]
jne 0x140012bae
mov eax, 0x5c
cmp ax, word [rbx + 4]
jne 0x140012bae
add rbx, 8
xor r15d, r15d
mov edi, 1
cmp esi, edi
jne 0x140012c48
lea esi, [rdi + 0x5b]
mov edx, esi
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x140012c04
mov rcx, r14
mov word [rax], r15w
call fcn.140046da0
test eax, eax
jne 0x140012bfb
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop dword [rax + rax]
mov word [rbx], si
add rbx, 2
jmp 0x140012bc1
mov esi, dword [rsp + 0x34]
cmp esi, edi
jne 0x140012c48
mov rcx, r14
call fcn.140046da0
cmp eax, edi
je 0x140012c42
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop dword [rax + rax]
cmp eax, edi
je 0x140012c42
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
lea r8, str.CreatePath:_Unable_to_create___s___GLE__0x_x
jmp 0x140012c5b
mov ebx, dword [rsp + 0x54]
jmp 0x140012c7a
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
lea r8, str.CreatePath:_Unable_to_create_parent_directory_for___s___GLE__0x_x
lea r9, [rbp - 0x60]
mov dword [rsp + 0x20], eax
mov edx, 0x3000000
lea rcx, [0x14007ba68]
mov ebx, eax
call fcn.140046248
mov edi, dword [rsp + 0x3c]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
jmp 0x140012caa
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x78]
jmp 0x140012cd0
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
test edi, edi
je 0x140012d8d
mov rsi, qword [rbp - 0x78]
xor r9d, r9d
mov rcx, rsi
mov qword [rsp + 0x20], r15
mov r8, r12
mov rdx, r13
call fcn.14002e3a4
test eax, eax
je 0x140012d8d
mov r8d, r15d
test r13, r13
je 0x140012d09
mov r8d, dword [r13 + 0x208]
lea r9, [rbp - 0x70]
mov rdx, r12
mov rcx, rbx
call fcn.14002bef8
test eax, eax
je 0x140012d8d
test r13, r13
je 0x140012d8d
mov rax, qword [rbp - 0x70]
mov rbx, qword [r13 + 0x220]
mov qword [r13 + 0x218], rax
mov r13, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test eax, eax
mov edi, 0x5c
cmovne r12, r15
test rbx, rbx
jne 0x140012921
test rsi, rsi
je 0x140012d88
cmp dword [rsi], 0xfeedf002
jne 0x140012d88
mov rax, qword [rsp + 0x58]
mov qword [rsi + 0x148], rax
jmp 0x140012911
mov r13d, r15d
jmp 0x140012d92
mov r13d, dword [rsp + 0x30]
mov rbx, qword [rsp + 0x60]
test rbx, rbx
je 0x140012dbc
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test r12, r12
je 0x140012de1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov eax, r13d
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.140068870
mov rbx, qword [rsp + 0x310]
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret