Function at 0x1800c7880
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x14c8
call fcn.1800d92c0
sub rsp, rax
mov rax, qword [0x180284030]
xor rax, rsp
mov qword [rsp + 0x14b8], rax
mov dword [rsp + 0x14a0], 0
xor eax, eax
mov word [rsp + 0x40], ax
lea rax, [rsp + 0x42]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
xor eax, eax
mov word [rsp + 0x250], ax
lea rax, [rsp + 0x252]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
movzx eax, word [0x1802285dc]
mov word [rsp + 0x460], ax
lea rax, [rsp + 0x462]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
lea rax, [rsp + 0x668]
lea rcx, [0x1802287a0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x12
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x67a]
mov rdi, rax
xor eax, eax
mov ecx, 0x1f6
rep stosb byte [rdi], al
lea rax, [rsp + 0x870]
lea rcx, [0x1802287b8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xa
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x87a]
mov rdi, rax
xor eax, eax
mov ecx, 0x1fe
rep stosb byte [rdi], al
lea rax, [rsp + 0xa78]
lea rcx, [0x1802287c8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x14
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xa8c]
mov rdi, rax
xor eax, eax
mov ecx, 0x1f4
rep stosb byte [rdi], al
lea rax, [rsp + 0xc80]
lea rcx, [0x1802287e0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x12
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xc92]
mov rdi, rax
xor eax, eax
mov ecx, 0x1f6
rep stosb byte [rdi], al
lea rax, [rsp + 0xe88]
lea rcx, [0x1802287f8]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.OLEAUT32.dll_SafeArrayCopy
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xea2]
mov rdi, rax
xor eax, eax
mov ecx, 0x1ee
rep stosb byte [rdi], al
lea rax, [rsp + 0x1090]
lea rcx, [0x180228818]
mov rdi, rax
mov rsi, rcx
mov ecx, SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x109e]
mov rdi, rax
xor eax, eax
mov ecx, 0x1fa
rep stosb byte [rdi], al
lea rax, [rsp + 0x1298]
lea rcx, str.Wow64WimMount
mov rdi, rax
mov rsi, rcx
mov ecx, 0x1e
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x12b6]
mov rdi, rax
xor eax, eax
mov ecx, 0x1ea
rep stosb byte [rdi], al
mov qword [rsp + 0x14a8], 0
jmp 0x1800c7a7b
mov rax, qword [rsp + 0x14a8]
inc rax
mov qword [rsp + 0x14a8], rax
cmp qword [rsp + 0x14a8], 8
jae 0x1800c7b05
mov rax, qword [rsp + 0x14a8]
imul rax, rax, 0x208
lea rax, [rsp + rax + 0x460]
mov qword [rsp + 0x14b0], rax
mov rcx, qword [rsp + 0x14e0]
add rcx, 0x78
call fcn.18000122b
mov rcx, qword [rsp + 0x14b0]
mov qword [rsp + 0x20], rcx
mov r9, rax
lea r8, [0x180228848]
mov edx, 0x104
lea rcx, [rsp + 0x250]
call fcn.1800d6e60
xor edx, edx
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1800c7b00
mov dword [rsp + 0x14a0], 0xffffefdd
jmp 0x1800c7b05
jmp 0x1800c7a68
cmp dword [rsp + 0x14a0], 0
je 0x1800c7b11
jmp 0x1800c7b42
mov rax, qword [rsp + 0x14e0]
mov rcx, qword [rax + 0x238]
call fcn.1800cb920
mov dword [rsp + 0x14a0], eax
cmp dword [rsp + 0x14a0], 0
je 0x1800c7b38
jmp 0x1800c7b42
xor eax, eax
test eax, eax
jne 0x1800c7a5a
mov eax, dword [rsp + 0x14a0]
mov rcx, qword [rsp + 0x14b8]
xor rcx, rsp
call fcn.1800d65d0
add rsp, 0x14c8
pop rdi
pop rsi
ret