Function at 0x14005cd10
Capabilities:
Create directory
Delete file

Disassembly:
mov rax, rsp
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
push r14
sub rsp, 0x128
mov qword [rax - 0x80], 0xfffffffffffffffe
mov r14, rdx
mov rsi, rcx
lea rcx, [rax - 0x90]
call fcn.140063d20
nop
lea rdx, str.C:WindowsIassist
lea rcx, [rsp + 0x168]
call fcn.14000c6f0
nop
lea rdx, str..log
lea rcx, [rsp + 0x28]
call fcn.14000c6f0
nop
lea rdx, str.helperAdminLog
lea rcx, [rsp + 0x20]
call fcn.14000c6f0
nop
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x50]
call fcn.14000ba30
nop
lea r8, [rsp + 0x28]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14000ba30
mov qword [rsp + 0xd0], rax
mov rcx, qword [rax]
mov qword [rsp + 0xd8], rcx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
mov rcx, qword [rsp + 0x40]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x48], rcx
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x14005cdf1
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x58], rcx
mov eax, ebx
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x14005ce1a
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x20]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x60], rcx
mov eax, ebx
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x14005ce43
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x28]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x68], rcx
mov eax, ebx
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x14005ce6b
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xor r8d, r8d
mov rdx, qword [rsp + 0x168]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x14005ce9a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14005ce9a
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14005d0a7
lea rdx, str..log
lea rcx, [rsp + 0x38]
call fcn.14000c6f0
nop
lea rdx, str.helperAdminLog
lea rcx, [rsp + 0x30]
call fcn.14000c6f0
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x90]
call fcn.14000ba30
nop
lea r8, [rsp + 0x38]
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.14000ba30
mov qword [rsp + 0xe0], rax
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov qword [rsp + 0xe8], rcx
mov rdi, qword [rsp + 0x168]
add rdi, 0xffffffffffffffe8
mov qword [rsp + 0x70], rdi
cmp rcx, rdi
je 0x14005cf82
cmp dword [rdi + 0x10], 0
jl 0x14005cf60
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14005cf60
call fcn.14000d070
mov qword [rsp + 0x78], rax
mov eax, ebx
lock xadd dword [rdi + 0x10], eax
sub eax, 1
jg 0x14005cf4d
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rsp + 0x78]
add rax, 0x18
mov qword [rsp + 0x168], rax
jmp 0x14005cf82
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x160], r8d
mov qword [rsp + 0xf0], rdx
lea rcx, [rsp + 0x168]
call fcn.14000d160
nop
mov rcx, qword [rsp + 0x80]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x88], rcx
mov eax, ebx
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x14005cfb4
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x90]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x98], rcx
mov eax, ebx
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x14005cfe6
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x30]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0xa0], rcx
mov eax, ebx
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x14005d015
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x38]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0xa8], rcx
mov eax, ebx
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x14005d043
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rdx, [0x1400a7368]
mov rcx, qword [rsp + 0x168]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov rdi, rax
mov qword [rsp + 0xf8], rax
test rax, rax
je 0x14005d0a7
mov rdx, qword [rsi]
mov qword [rsp + 0x100], rdx
mov rcx, rax
call fcn.140068f50
mov rdx, qword [r14]
mov qword [rsp + 0x108], rdx
mov rcx, rdi
call fcn.140068f50
lea rdx, [0x140098d50]
mov rcx, rdi
call fcn.140068f00
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
nop
mov rcx, qword [rsp + 0x168]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0xb0], rcx
mov eax, ebx
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x14005d0d9
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0xb8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0xc0], rcx
mov eax, ebx
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x14005d10b
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
jmp 0x14005d122
mov rdx, qword [rsi]
sub rdx, 0x18
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005d13f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [r14]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14005d159
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
add rsp, 0x128
pop r14
pop rdi
pop rsi
pop rbx
ret