Function at 0x18001bc60
Capabilities:
Create directory
Move file

Disassembly:
mov rax, rsp
mov byte [rax + 0x18], r8b
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x98
mov qword [rax - 0x38], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
lea rcx, [0x180066048]
mov rax, qword [0x180066048]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
or rbp, 0xffffffffffffffff
cmp byte [rsp + 0xd0], 0
je 0x18001be52
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsi]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18001bce7
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18001c07e
mov eax, dword [0x180069c80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
cmp ecx, 5
jne 0x18001bd1a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x180069c80], eax
mov edx, 0x5c
mov rcx, qword [rsi]
call fcn.18002ac08
test rax, rax
jne 0x18001bd30
mov eax, ebp
jmp 0x18001bd32
sub eax, dword [rsi]
mov r8d, eax
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.1800098e0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x18001bda4
cmp dword [rbx + 0x10], 0
jl 0x18001bd95
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x18001bd95
call fcn.180002110
mov qword [rsp + 0xd8], rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x18001bd8a
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rVariantCopy + 8]
mov rax, qword [rsp + 0xd8]
add rax, 0x18
mov qword [rsp + 0x50], rax
jmp 0x18001bda4
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x50]
call fcn.180002020
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x18001bdbd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rdx, qword [rsi]
mov rbx, qword [rsp + 0x50]
test rdx, rdx
je 0x18001bde1
cmp dword [rbx - 0x10], 0
jl 0x18001bde1
mov rcx, rbx
call fcn.18002aa38
test rax, rax
je 0x18001bde1
cmp eax, ebx
jns 0x18001be09
lea rcx, [rbx - 0x18]
call fcn.180002110
add rax, 0x18
mov qword [rsp + 0x68], rax
movzx r8d, byte [rsp + 0xd0]
mov rdx, rdi
lea rcx, [rsp + 0x68]
call fcn.18001bc60
xor edi, edi
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsi]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18001c07e
mov ecx, dword [0x180069c80]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x38e38e39
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub r8d, eax
cmp r8d, 7
jne 0x18001beca
lea ecx, [r8 + 0x21]
call fcn.1800289f0
mov rbp, rax
xor edi, edi
call fcn.1800289f8
add eax, dword [0x180069c80]
mov dword [rbp + rdi*4], eax
inc rdi
cmp rdi, 0xa
jl 0x18001be95
mov eax, dword [rbp + 0x24]
mov dword [0x180069c80], eax
mov rcx, rbp
call fcn.180028a24
or rbp, 0xffffffffffffffff
mov rdi, qword [rsp + 0xc8]
mov rcx, qword [rsi]
mov rdx, rcx
call fcn.18002b470
test eax, eax
jns 0x18001c07e
call qword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xfffffffe
cmp eax, 1
ja 0x18001c07e
mov edx, 0x5c
mov rcx, qword [rsi]
call fcn.18002ac08
test rax, rax
jne 0x18001bf05
mov eax, ebp
jmp 0x18001bf07
sub eax, dword [rsi]
mov r8d, eax
lea rdx, [rsp + 0x70]
mov rcx, rsi
call fcn.1800098e0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x18001bf7d
cmp dword [rbx + 0x10], 0
jl 0x18001bf6e
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x18001bf6e
call fcn.180002110
mov qword [rsp + 0xd8], rax
mov ecx, ebp
lock xadd dword [rbx + 0x10], ecx
dec ecx
jg 0x18001bf63
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rVariantCopy + 8]
mov rax, qword [rsp + 0xd8]
add rax, 0x18
mov qword [rsp + 0x50], rax
jmp 0x18001bf7d
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x50]
call fcn.180002020
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x18001bf9a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rdx, qword [rsi]
mov rbx, qword [rsp + 0x50]
test rdx, rdx
je 0x18001bfbe
cmp dword [rbx - 0x10], 0
jl 0x18001bfbe
mov rcx, rbx
call fcn.18002aa38
test rax, rax
je 0x18001bfbe
cmp eax, ebx
jns 0x18001bfe0
lea rcx, [rbx - 0x18]
call fcn.180002110
add rax, 0x18
mov qword [rsp + 0x78], rax
xor r8d, r8d
mov rdx, rdi
lea rcx, [rsp + 0x78]
call fcn.18001bc60
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov r8d, dword [0x180069c80]
mov ecx, r8d
imul ecx, r8d
mov eax, 0x78787879
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
mov eax, ecx
sub eax, edx
cmp eax, 0xa
jne 0x18001c07e
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
mov eax, 0xb94c96c2
cmp ecx, 8
cmove r8d, eax
mov dword [0x180069c80], r8d
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x2f4
movsxd rcx, r8d
mov eax, 4
mul rcx
cmovo rax, rbp
mov rcx, rax
call fcn.1800289f0
mov rcx, rax
call fcn.180028a24
nop
lea rdx, [rbx - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x18001c097
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebp
dec ebp
jg 0x18001c0b0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
add rsp, 0x98
pop rdi
pop rsi
pop rbp
pop rbx
ret