Function at 0x14008bde0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r13, rcx
xor edx, edx
xor ecx, ecx
call fcn.1400a6dd0
mov r15, rax
test rax, rax
je 0x14008be18
lea rcx, str.settings
call sym.ProcessJacker.exe_PhDuplicateBytesZSafe
mov qword [r15 + 0x30], rax
mov edi, 5
xor eax, eax
lock cmpxchg qword [0x14015b108], rdi
je 0x14008be36
lea rcx, [0x14015b108]
call sym.ProcessJacker.exe_PhfAcquireQueuedLockShared
mov rcx, qword [0x14015e988]
mov r14d, dword [rcx]
mov ebp, dword [rcx + 0x40]
add r14d, 8
mov rbx, qword [rcx + 0x30]
imul rbp, r14
add rbp, rbx
or r12d, 0xffffffff
cmp rbx, rbp
je 0x14008be74
nop dword [rax + rax]
mov rax, rbx
add rbx, r14
cmp dword [rax], 0xffffffff
jne 0x14008bf84
cmp rbx, rbp
jne 0x14008be60
mov rax, qword [0x14015ea40]
xor esi, esi
mov ebx, esi
cmp dword [rax], ebx
jbe 0x14008beaa
mov rax, qword [rax + 8]
mov ecx, ebx
mov rdx, qword [rax + rcx*8]
mov rcx, r15
mov r8, qword [rdx + 0x28]
add rdx, 8
call fcn.14008bcc0
mov rax, qword [0x14015ea40]
inc ebx
cmp ebx, dword [rax]
jb 0x14008be83
mov eax, 5
lock cmpxchg qword [0x14015b108], rsi
je 0x14008bec6
lea rcx, [0x14015b108]
call sym.ProcessJacker.exe_PhfReleaseQueuedLockShared
lea rdx, [rsp + 0x88]
mov rcx, r13
call sym.ProcessJacker.exe_PhGetFullPath
mov rdi, rax
test rax, rax
je 0x14008bf35
mov eax, dword [rsp + 0x88]
cmp eax, 0xffffffff
je 0x14008bf20
mov rcx, qword [rdi + 8]
mov edx, eax
add rdx, rdx
call sym.ProcessJacker.exe_PhCreateStringEx
xor r8d, r8d
xor ecx, ecx
mov rbx, rax
mov rdx, qword [rax + 8]
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea rcx, [rbx - 0x10]
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14008bf20
call fcn.1400ae900
lea rcx, [rdi - 0x10]
lock xadd dword [rcx + 8], r12d
cmp r12d, 1
jne 0x14008bf35
call fcn.1400ae900
mov qword [rsp + 0x38], rsi
lea rcx, [rsp + 0x98]
mov dword [rsp + 0x30], 0x60
xor r9d, r9d
mov dword [rsp + 0x28], 5
mov r8d, 0x120116
mov rdx, r13
mov dword [rsp + 0x20], 1
call sym.ProcessJacker.exe_PhCreateFileWin32Ex
mov ebx, eax
mov rcx, r15
test eax, eax
jns 0x14008c053
call sym.ProcessJacker.exe_mxmlDelete
mov eax, ebx
jmp 0x14008c07f
lea rdi, [rax + 8]
test rdi, rdi
je 0x14008be74
mov ecx, dword [rdi]
test ecx, ecx
je 0x14008c00a
sub ecx, 1
je 0x14008bff6
sub ecx, 1
je 0x14008bfde
cmp ecx, 1
je 0x14008bfb0
call sym.ProcessJacker.exe_PhReferenceEmptyString
mov rsi, rax
jmp 0x14008c025
mov rax, qword [rdi + 0x28]
test rax, rax
jne 0x14008bfc3
call sym.ProcessJacker.exe_PhReferenceEmptyString
mov rsi, rax
jmp 0x14008c025
mov r9d, dword [rax + 4]
lea rcx, str.__u_d__d
mov r8d, dword [rax]
mov edx, dword [rax + 8]
call sym.ProcessJacker.exe_PhFormatString
mov rsi, rax
jmp 0x14008c025
mov r8d, dword [rdi + 0x2c]
lea rcx, str._d__d
mov edx, dword [rdi + 0x28]
call sym.ProcessJacker.exe_PhFormatString
mov rsi, rax
jmp 0x14008c025
mov edx, dword [rdi + 0x28]
lea rcx, [0x1401319c8]
call sym.ProcessJacker.exe_PhFormatString
mov rsi, rax
jmp 0x14008c025
mov rax, qword [rdi + 0x28]
test rax, rax
jne 0x14008c01d
call sym.ProcessJacker.exe_PhReferenceEmptyString
mov rsi, rax
jmp 0x14008c025
lock inc dword [rax - 8]
mov rsi, qword [rdi + 0x28]
lea rdx, [rdi + 8]
mov r8, rsi
mov rcx, r15
call fcn.14008bcc0
lea rcx, [rsi - 0x10]
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14008be56
call fcn.1400ae900
jmp 0x14008be56
mov rdx, qword [rsp + 0x98]
lea r8, [0x14008bc30]
call sym.ProcessJacker.exe_mxmlSaveFd
mov rcx, r15
call sym.ProcessJacker.exe_mxmlDelete
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ntdll.dll_NtClose]
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret