Function at 0x140001230
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xb0
mov r15, qword [rbp + 0x7f]
xor r12d, r12d
mov rdi, rcx
mov qword [r9], r12
mov rax, rdx
mov qword [rbp + 0x77], r12
lea rcx, str.KnownDllPath
mov qword [rbp - 0x51], r12
mov qword [rbp - 0x21], rcx
lea rdx, [rbp - 0x49]
xorps xmm0, xmm0
mov qword [r15], r12
xorps xmm1, xmm1
mov dword [rbp - 0x29], 0x1a0018
mov rcx, rax
mov r14, r9
mov esi, r8d
movups xmmword [rbp - 0x49], xmm0
movups xmmword [rbp - 0x39], xmm1
call fcn.1400015a8
mov ebx, eax
test eax, eax
jns 0x1400012e8
lea ecx, [r12 + 1]
mov qword [rbp - 0x41], r12
mov edx, ecx
lock xadd dword [0x140027960], edx
add edx, ecx
and edx, 0x8000003f
jge 0x1400012c5
sub edx, ecx
or edx, 0xffffffc0
add edx, ecx
movsxd rax, edx
lea rcx, [0x140027960]
add rax, rax
mov dword [rcx + rax*8 + 8], 0xeeb
mov dword [rcx + rax*8 + 0xc], ebx
mov qword [rcx + rax*8 + 0x10], rdi
jmp 0x14000150d
mov rcx, qword [rbp - 0x41]
lea rdx, [rbp - 0x39]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U_WithStatus]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x140001341
mov ecx, 1
mov qword [rbp - 0x31], r12
mov eax, ecx
lock xadd dword [0x140027960], eax
add eax, ecx
and eax, 0x8000003f
jge 0x14000132b
sub eax, ecx
or eax, 0xffffffc0
add eax, ecx
cdqe
lea rcx, [0x140027960]
add rax, rax
mov dword [rcx + rax*8 + 8], 0xf01
jmp 0x1400012da
lea rax, [rbp - 0x39]
mov dword [rsp + 0x28], 0x21
xorps xmm0, xmm0
mov qword [rbp + 7], rax
lea r9, [rbp - 0x19]
mov dword [rbp - 9], 0x30
lea r8, [rbp - 9]
mov qword [rbp - 1], r12
mov edx, 0x100001
mov dword [rbp + 0xf], 0x40
lea rcx, [rbp + 0x7f]
mov dword [rsp + 0x20], 3
movdqu xmmword [rbp + 0x17], xmm0
call qword [sym.imp.ntdll.dll_NtOpenFile]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x1400013e1
mov qword [rbp + 0x7f], r12
cmp eax, 0xc0000034
jne 0x1400013a9
test esi, esi
je 0x14000150a
mov ecx, 1
mov eax, ecx
lock xadd dword [0x140027960], eax
add eax, ecx
and eax, 0x8000003f
jge 0x1400013c8
sub eax, ecx
or eax, 0xffffffc0
add eax, ecx
cdqe
lea rcx, [0x140027960]
add rax, rax
mov dword [rcx + rax*8 + 8], 0xf25
jmp 0x1400012da
mov rax, qword [0x140026f08]
lea r8, [rbp - 9]
mov edx, 0xf000f
mov qword [rbp + 0x17], rax
lea rcx, [rbp + 0x77]
mov dword [rbp - 9], 0x30
mov qword [rbp - 1], r12
mov dword [rbp + 0xf], 0xd0
mov qword [rbp + 7], rdi
mov qword [rbp + 0x1f], r12
call qword [sym.imp.ntdll.dll_NtCreateDirectoryObject]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 0x40000000
je 0x1400014f8
test eax, eax
jns 0x14000146c
mov ecx, 1
mov qword [rbp + 0x77], r12
mov eax, ecx
lock xadd dword [0x140027960], eax
add eax, ecx
and eax, 0x8000003f
jge 0x140001453
sub eax, ecx
or eax, 0xffffffc0
add eax, ecx
cdqe
lea rcx, [0x140027960]
add rax, rax
mov dword [rcx + rax*8 + 8], 0xf4c
jmp 0x1400012da
mov rax, qword [rbp + 0x77]
lea r9, [rbp - 0x49]
mov qword [rbp - 1], rax
lea r8, [rbp - 9]
lea rax, [rbp - 0x29]
mov dword [rbp - 9], 0x30
mov qword [rbp + 7], rax
lea rcx, [rbp - 0x51]
mov rax, qword [0x140026f88]
mov edx, 0xf0001
mov qword [rbp + 0x17], rax
mov dword [rbp + 0xf], 0x50
mov qword [rbp + 0x1f], r12
call qword [sym.imp.ntdll.dll_NtCreateSymbolicLinkObject]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x1400014f8
mov ecx, 1
mov qword [rbp - 0x51], r12
mov eax, ecx
lock xadd dword [0x140027960], eax
add eax, ecx
and eax, 0x8000003f
jge 0x1400014df
sub eax, ecx
or eax, 0xffffffc0
add eax, ecx
cdqe
lea rcx, [0x140027960]
add rax, rax
mov dword [rcx + rax*8 + 8], 0xf67
jmp 0x1400012da
mov rax, qword [rbp + 0x77]
mov qword [r14], rax
mov rax, qword [rbp + 0x7f]
mov qword [r15], rax
mov qword [rbp + 0x77], r12
mov ebx, r12d
cmp qword [rbp - 0x31], r12
je 0x140001532
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp - 0x31]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
cmp qword [rbp - 0x41], r12
je 0x140001557
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp - 0x41]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x14000156c
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x140001581
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
lea r11, [rsp + 0xb0]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret