Function at 0x180015810
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push r12
push r14
sub rsp, 0x70
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x18], 0xfffffffffffffffe
mov qword [rbp + 0x58], rbx
mov qword [rbp + 0x60], rsi
mov qword [rbp + 0x68], rdi
mov rax, qword [0x18003d928]
xor rax, rbp
mov qword [rbp + 0x28], rax
mov rbx, rcx
and dword [rbp], 0
lea rcx, [0x18003d858]
mov rax, qword [0x18003d858]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
mov r12d, 1
mov dword [rbp], r12d
call fcn.180017d10
mov r14d, 0x104
test al, al
je 0x180015958
and qword [rbp + 8], 0
lea r9, [rbp + 8]
xor r8d, r8d
xor edx, edx
lea rcx, [0x18002f7d0]
call fcn.180017e24
mov rdi, qword [rbp + 8]
test rdi, rdi
je 0x18001592f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9d, [r12 + rax]
cmp r9d, 0x3fffffff
jg 0x180015928
movsxd rax, r9d
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1800158d7
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1800193e0
sub rsp, rcx
lea rsi, [rsp + 0x40]
test rsi, rsi
je 0x180015928
mov byte [rsi], 0
lea eax, [r9 + r9]
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
or r9d, 0xffffffff
mov r8, rdi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb rdi, rdi
and rdi, rsi
jmp 0x18001592a
xor edi, edi
test rdi, rdi
jne 0x180015933
xor eax, eax
jmp 0x18001593b
mov rcx, rdi
call fcn.18001b040
mov r8d, eax
mov rdx, rdi
mov rcx, rbx
call fcn.180003dd0
mov rcx, qword [rbp + 8]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x1800159d8
lea rcx, str._APPDATA_
call fcn.18001b040
mov r8d, eax
lea rdx, str._APPDATA_
mov rcx, rbx
call fcn.180003dd0
mov r11, qword [rbx]
mov ecx, r12d
sub ecx, dword [r11 - 8]
mov eax, dword [r11 - 0xc]
sub eax, r14d
or eax, ecx
jge 0x180015996
mov edx, r14d
mov rcx, rbx
call fcn.1800026b0
mov edx, r14d
mov rcx, qword [rbx]
call qword [sym.imp.SHELL32.dll_DoEnvironmentSubstA]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x1800159ae
xor eax, eax
jmp 0x1800159bf
movsxd rdx, dword [rcx - 0xc]
call fcn.180019134
test eax, eax
js 0x180015a95
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x180015a95
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbx]
mov byte [rcx + rax], 0
mov rax, qword [rbx]
sub r12d, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, r14d
or eax, r12d
jge 0x1800159f5
mov edx, r14d
mov rcx, rbx
call fcn.1800026b0
mov rdi, qword [rbx]
lea rdx, str.FNODOMAIN
lea rcx, [rbp + 0x20]
call fcn.180003f80
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.1800153cc
mov rdx, qword [rax]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
mov rdx, qword [rbp + 0x10]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180015a3f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x180015a57
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x180015a63
xor eax, eax
jmp 0x180015a70
movsxd rdx, dword [rcx - 0xc]
call fcn.180019134
test eax, eax
js 0x180015a8a
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x180015a8a
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbx]
mov byte [rcx + rax], 0
mov rax, rbx
jmp 0x180015aa0
mov ecx, 0x80070057
call fcn.1800010d0
int3
mov ecx, 0x80070057
call fcn.1800010d0
nop
mov rcx, qword [rbp + 0x28]
xor rcx, rbp
call fcn.1800193b0
mov rbx, qword [rbp + 0x58]
mov rsi, qword [rbp + 0x60]
mov rdi, qword [rbp + 0x68]
lea rsp, [rbp + 0x30]
pop r14
pop r12
pop rbp
ret