Function at 0x14008a1d0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r13, rcx
xor edx, edx
xor ecx, ecx
call fcn.1400a6bb0
mov r15, rax
test rax, rax
je 0x14008a208
lea rcx, str.settings
call sym.ProcessHacker.exe_PhDuplicateBytesZSafe
mov qword [r15 + 0x30], rax
mov edi, 5
xor eax, eax
lock cmpxchg qword [0x14015c288], rdi
je 0x14008a226
lea rcx, [0x14015c288]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rcx, qword [0x14015fb10]
mov r14d, dword [rcx]
mov ebp, dword [rcx + 0x40]
add r14d, 8
mov rbx, qword [rcx + 0x30]
imul rbp, r14
add rbp, rbx
or r12d, 0xffffffff
cmp rbx, rbp
je 0x14008a264
nop dword [rax + rax]
mov rax, rbx
add rbx, r14
cmp dword [rax], 0xffffffff
jne 0x14008a374
cmp rbx, rbp
jne 0x14008a250
mov rax, qword [0x14015faf8]
xor esi, esi
mov ebx, esi
cmp dword [rax], ebx
jbe 0x14008a29a
mov rax, qword [rax + 8]
mov ecx, ebx
mov rdx, qword [rax + rcx*8]
mov rcx, r15
mov r8, qword [rdx + 0x28]
add rdx, 8
call fcn.14008a0b0
mov rax, qword [0x14015faf8]
inc ebx
cmp ebx, dword [rax]
jb 0x14008a273
mov eax, 5
lock cmpxchg qword [0x14015c288], rsi
je 0x14008a2b6
lea rcx, [0x14015c288]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
lea rdx, [rsp + 0x88]
mov rcx, r13
call sym.ProcessHacker.exe_PhGetFullPath
mov rdi, rax
test rax, rax
je 0x14008a325
mov eax, dword [rsp + 0x88]
cmp eax, 0xffffffff
je 0x14008a310
mov rcx, qword [rdi + 8]
mov edx, eax
add rdx, rdx
call sym.ProcessHacker.exe_PhCreateStringEx
xor r8d, r8d
xor ecx, ecx
mov rbx, rax
mov rdx, qword [rax + 8]
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea rcx, [rbx - 0x10]
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14008a310
call fcn.1400ae580
lea rcx, [rdi - 0x10]
lock xadd dword [rcx + 8], r12d
cmp r12d, 1
jne 0x14008a325
call fcn.1400ae580
mov qword [rsp + 0x38], rsi
lea rcx, [rsp + 0x98]
mov dword [rsp + 0x30], 0x60
xor r9d, r9d
mov dword [rsp + 0x28], 5
mov r8d, 0x120116
mov rdx, r13
mov dword [rsp + 0x20], 1
call sym.ProcessHacker.exe_PhCreateFileWin32Ex
mov ebx, eax
mov rcx, r15
test eax, eax
jns 0x14008a443
call sym.ProcessHacker.exe_mxmlDelete
mov eax, ebx
jmp 0x14008a46f
lea rdi, [rax + 8]
test rdi, rdi
je 0x14008a264
mov ecx, dword [rdi]
test ecx, ecx
je 0x14008a3fa
sub ecx, 1
je 0x14008a3e6
sub ecx, 1
je 0x14008a3ce
cmp ecx, 1
je 0x14008a3a0
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov rsi, rax
jmp 0x14008a415
mov rax, qword [rdi + 0x28]
test rax, rax
jne 0x14008a3b3
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov rsi, rax
jmp 0x14008a415
mov r9d, dword [rax + 4]
lea rcx, str.__u_d__d
mov r8d, dword [rax]
mov edx, dword [rax + 8]
call sym.ProcessHacker.exe_PhFormatString
mov rsi, rax
jmp 0x14008a415
mov r8d, dword [rdi + 0x2c]
lea rcx, str._d__d
mov edx, dword [rdi + 0x28]
call sym.ProcessHacker.exe_PhFormatString
mov rsi, rax
jmp 0x14008a415
mov edx, dword [rdi + 0x28]
lea rcx, [0x1401319f8]
call sym.ProcessHacker.exe_PhFormatString
mov rsi, rax
jmp 0x14008a415
mov rax, qword [rdi + 0x28]
test rax, rax
jne 0x14008a40d
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov rsi, rax
jmp 0x14008a415
lock inc dword [rax - 8]
mov rsi, qword [rdi + 0x28]
lea rdx, [rdi + 8]
mov r8, rsi
mov rcx, r15
call fcn.14008a0b0
lea rcx, [rsi - 0x10]
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14008a246
call fcn.1400ae580
jmp 0x14008a246
mov rdx, qword [rsp + 0x98]
lea r8, [0x14008a020]
call sym.ProcessHacker.exe_mxmlSaveFd
mov rcx, r15
call sym.ProcessHacker.exe_mxmlDelete
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ntdll.dll_NtClose]
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret