Function at 0x1401c1a80
Capabilities:
Create directory

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x798]
sub rsp, 0x880
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rdi, rcx
xor ebx, ebx
mov dword [rbp + 0x7a0], ebx
cmp qword [rcx + 0xb8], rbx
jne 0x1401c1aef
lea ecx, [rbx + 0x10]
call fcn.14018ef40
mov qword [rbp + 0x7a0], rax
test rax, rax
je 0x1401c1ae5
mov rcx, qword [0x14037adb0]
lea rdx, vtable.CQuarantineNotifier.0
mov qword [rax], rdx
mov qword [rax + 8], rcx
jmp 0x1401c1ae8
mov rax, rbx
mov qword [rdi + 0xb8], rax
cmp qword [rdi + 0xc0], rbx
jne 0x1401c1c31
xor edx, edx
mov r8d, 0x410
lea rcx, [rsp + 0x60]
call fcn.140249b10
mov rax, rbx
lea rdx, [0x14034ec34]
nop dword [rax + rax]
movzx ecx, byte [rax + rdx]
mov byte [rsp + rax + 0x60], cl
lea rax, [rax + 1]
test cl, cl
jne 0x1401c1b20
lea rdx, str.Quarantine
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
xor edx, edx
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rdx, str.quarantine.db
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
mov ecx, 0xa8
call fcn.14018ef40
mov rsi, rax
mov qword [rbp + 0x7a8], rax
lea r14, vtable.CSABString.0
test rax, rax
je 0x1401c1bf3
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], rbx
lea rax, [rsp + 0x60]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], 0
jne 0x1401c1b97
mov dword [rsp + 0x50], ecx
inc ecx
call fcn.140247068
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1401c1bca
mov r8d, dword [rsp + 0x50]
inc r8d
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.1402496a0
mov dword [rsp + 0x54], 1
mov ebx, 1
mov dword [rbp + 0x7a0], ebx
mov r8, qword [rdi + 0xb8]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.14006b540
jmp 0x1401c1bf6
mov rax, rbx
mov qword [rdi + 0xc0], rax
mov rcx, rax
test bl, 1
je 0x1401c1c2a
mov qword [rsp + 0x40], r14
add dword [rsp + 0x54], 0xffffffff
jne 0x1401c1c2a
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x1401c1c2a
mov rcx, rax
call fcn.140247060
mov rcx, qword [rdi + 0xc0]
xor edx, edx
call fcn.14006eb70
cmp qword [rdi + 0xc8], 0
jne 0x1401c1d2d
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x370]
call fcn.140249b10
movzx eax, word [rsp + 0x4c]
movzx ecx, word [rsp + 0x4a]
movzx edx, word [rsp + 0x48]
movzx r10d, word [rsp + 0x40]
movzx r9d, word [rsp + 0x46]
movzx r8d, word [rsp + 0x42]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r10d
lea rdx, str.System_Investigator____02d__02d__04d____02d__02d__02d
lea rcx, [rbp + 0x370]
call fcn.140006bc0
xor edx, edx
mov r8d, 0x410
lea rcx, [rsp + 0x60]
call fcn.140249b10
movzx eax, word [rsp + 0x4c]
movzx ecx, word [rsp + 0x4a]
movzx edx, word [rsp + 0x48]
movzx r10d, word [rsp + 0x40]
movzx r9d, word [rsp + 0x46]
movzx r8d, word [rsp + 0x42]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r10d
lea rdx, str.System_Investigator____02d__02d__04d____02d:_02d:_02d
lea rcx, [rsp + 0x60]
call fcn.140006bc0
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0x370]
mov rcx, qword [rdi + 0xc0]
call fcn.14006d8e0
mov qword [rdi + 0xc8], rax
lea rdx, str.Removed_By_User_Action
mov rcx, rax
call fcn.14006c3b0
mov qword [rdi + 0xd0], rax
lea r11, [rsp + 0x880]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret