Function at 0x14009e520
Capabilities:
Create directory
Get session user name

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x268]
sub rsp, 0x340
mov qword [rbp - 0x60], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x14017c430]
xor rax, rsp
mov qword [rbp + 0x220], rax
mov r14, rcx
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea rsi, [0x14012f710]
mov rdi, rsi
shr rdi, 0x10
test rdi, rdi
jne 0x14009e5b4
movzx ebx, si
mov ecx, ebx
call fcn.140002830
test rax, rax
je 0x14009e5c5
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400029f0
jmp 0x14009e5c5
xor r8d, r8d
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140002120
nop
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
test rdi, rdi
jne 0x14009e605
movzx edi, si
mov ecx, edi
call fcn.140002830
test rax, rax
je 0x14009e616
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400029f0
jmp 0x14009e616
xor r8d, r8d
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.140002120
nop
lea rcx, [rbp - 0x78]
call fcn.1400853d0
nop
lea r8, [0x140129b40]
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400162e0
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
or rsi, 0xffffffffffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14009e657
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
xor r12d, r12d
mov qword [rbp - 0x48], r12
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp - 0x20], xmm0
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x20]
call qword [sym.imp.OLEAUT32.dll_VariantTimeToSystemTime]
movsd xmm6, qword [rsp + 0x70]
test eax, eax
je 0x14009e6d2
movzx eax, word [rbp - 0x12]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm0, qword [0x140132ba8]
addsd xmm6, xmm0
movsd qword [rsp + 0x70], xmm6
lea rdx, [rbp]
movapd xmm0, xmm6
call qword [sym.imp.OLEAUT32.dll_UnRegisterTypeLib]
test eax, eax
je 0x14009e6f4
mov r8d, eax
lea rdx, [rbp]
movapd xmm0, xmm6
call fcn.140016470
lea rdx, [rsp + 0x60]
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov r8d, 0xa
lea rdx, [rbp + 0x10]
mov ecx, dword [rsp + 0x60]
call fcn.1400da6c8
xor eax, eax
mov rcx, rsi
lea rdi, [rbp + 0x10]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
lea r13d, [rax + 1]
test ecx, ecx
jne 0x14009e78f
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14009e80d
cmp dword [rdx + 0x10], eax
jge 0x14009e765
cmp dword [rbx - 0xc], eax
jge 0x14009e758
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov dword [rbx - 0x10], r12d
mov word [rbx], r12w
jmp 0x14009e80d
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14009e77b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
jmp 0x14009e80d
mov r15d, dword [rbx - 0x10]
lea r12, [rbp + 0x10]
sub r12, rbx
sar r12, 1
test ecx, ecx
jns 0x14009e7ac
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov ecx, r13d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14009e7cc
mov edx, edi
lea rcx, [rsp + 0x48]
call fcn.1400020c0
mov rbx, qword [rsp + 0x48]
movsxd rax, edi
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
add rdx, rdx
cmp r12, r15
lea r15, [rax + rax]
mov r9, r15
ja 0x14009e7f0
lea r8, [rbx + r12*2]
call fcn.1400d4ebc
jmp 0x14009e7f9
lea r8, [rbp + 0x10]
call fcn.1400d4e34
cmp edi, dword [rbx - 0xc]
jg 0x14009ed36
mov dword [rbx - 0x10], edi
xor r12d, r12d
mov word [r15 + rbx], r12w
mov r8d, r13d
lea rdx, [0x14012ffcc]
lea rcx, [rsp + 0x48]
call fcn.14003bd50
mov r8d, 0xa
lea rdx, [rbp + 0x10]
mov ecx, dword [rsp + 0x64]
call fcn.1400da6c8
xor eax, eax
mov rcx, rsi
lea rdi, [rbp + 0x10]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x48]
call fcn.14003bd50
mov r8d, r13d
lea rdx, reloc.msi.dll_MsiGetActiveDatabase
lea rcx, [rsp + 0x48]
call fcn.14003bd50
mov eax, 0x3b
mov dword [rbp - 0x48], 0x3b0017
mov word [rbp - 0x44], ax
mov eax, 0x3e7
mov word [rbp - 0x42], ax
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp - 0x30], xmm0
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x30]
call qword [sym.imp.OLEAUT32.dll_VariantTimeToSystemTime]
movsd xmm6, qword [rsp + 0x78]
test eax, eax
je 0x14009e8c2
movzx eax, word [rbp - 0x22]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm0, qword [0x140132ba8]
addsd xmm6, xmm0
movsd qword [rsp + 0x78], xmm6
lea rdx, [rbp - 0x10]
movapd xmm0, xmm6
call qword [sym.imp.OLEAUT32.dll_UnRegisterTypeLib]
test eax, eax
je 0x14009e8e4
mov r8d, eax
lea rdx, [rbp - 0x10]
movapd xmm0, xmm6
call fcn.140016470
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov rcx, qword [rbp - 0x80]
mov qword [rsp + 0x60], rcx
mov r8d, 0xa
lea rdx, [rbp + 0x10]
call fcn.1400da6c8
xor eax, eax
mov rcx, rsi
lea rdi, [rbp + 0x10]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x48]
call fcn.14003bd50
mov r8d, r13d
lea rdx, [0x14012ffcc]
lea rcx, [rsp + 0x48]
call fcn.14003bd50
mov r8d, 0xa
lea rdx, [rbp + 0x10]
mov ecx, dword [rsp + 0x64]
call fcn.1400da6c8
xor eax, eax
mov rcx, rsi
lea rdi, [rbp + 0x10]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x48]
call fcn.14003bd50
mov r8d, r13d
lea rdx, [0x14012ffcc]
lea rcx, [rsp + 0x48]
call fcn.14003bd50
mov r8d, 6
lea rdx, [0x140129b48]
lea rcx, [rsp + 0x48]
call fcn.14003bd50
mov rdi, qword [rsp + 0x48]
mov r8, rdi
lea rdx, [0x14012f530]
lea rcx, [rsp + 0x58]
call fcn.140045040
mov edx, 0x8109
mov r8d, 0x180
mov rcx, qword [rsp + 0x58]
call fcn.1400dcc84
mov r15d, eax
cmp eax, 0xffffffff
je 0x14009ecbc
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
mov dword [rsp + 0x68], 0x100
mov rdi, qword [rsp + 0x50]
sub r13d, dword [rdi - 8]
mov ecx, dword [rdi - 0xc]
sub ecx, 0x100
or r13d, ecx
jge 0x14009ea15
mov edx, 0x100
lea rcx, [rsp + 0x50]
call fcn.1400020c0
mov rdi, qword [rsp + 0x50]
lea rdx, [rsp + 0x68]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x14009ea53
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call fcn.1400d4f10
test eax, eax
js 0x14009ea48
cmp eax, dword [rdi - 0xc]
jg 0x14009ea48
mov dword [rdi - 0x10], eax
cdqe
mov word [rdi + rax*2], r12w
jmp 0x14009ea53
mov ecx, 0x80070057
call fcn.1400022b0
int3
movzx eax, word [rbp - 0x34]
movzx ecx, word [rbp - 0x36]
movzx edx, word [rbp - 0x38]
movzx edi, word [rbp - 0x40]
movzx r9d, word [rbp - 0x3e]
movzx r8d, word [rbp - 0x3a]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], edi
lea rdx, str._d._d._d__d:_d:_d_
lea rcx, [rsp + 0x40]
call fcn.140016060
mov rbx, qword [r14 + 0x48]
sub rbx, qword [r14 + 0x40]
sar rbx, 1
mov r12, qword [r14 + 0x40]
test r12, r12
jne 0x14009eab1
test ebx, ebx
je 0x14009eab1
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov r8d, 2
mov edx, ebx
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax]
test rax, rax
jne 0x14009ead4
call fcn.140002060
int3
lea rdi, [rax + 0x18]
mov qword [rbp - 0x70], rdi
test ebx, ebx
js 0x14009ecb1
cmp ebx, dword [rdi - 0xc]
jg 0x14009ecb1
mov dword [rdi - 0x10], ebx
movsxd rax, ebx
lea rdx, [rax + rax]
xor r13d, r13d
mov word [rdx + rdi], r13w
mov r9, rdx
mov r8, r12
mov rcx, rdi
call fcn.1400d4e34
nop
mov r8, rdi
lea rdx, str._s__
lea rcx, [rsp + 0x40]
call fcn.140045040
nop
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14009eb3d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rbx, qword [r14 + 0x28]
sub rbx, qword [r14 + 0x20]
sar rbx, 1
mov r12, qword [r14 + 0x20]
test r12, r12
jne 0x14009eb60
test ebx, ebx
je 0x14009eb60
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov r8d, 2
mov edx, ebx
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax]
test rax, rax
jne 0x14009eb83
call fcn.140002060
int3
lea rdi, [rax + 0x18]
mov qword [rbp - 0x68], rdi
test ebx, ebx
js 0x14009eca6
cmp ebx, dword [rdi - 0xc]
jg 0x14009eca6
mov dword [rdi - 0x10], ebx
movsxd rax, ebx
lea rdx, [rax + rax]
mov word [rdx + rdi], r13w
mov r9, rdx
mov r8, r12
mov rcx, rdi
call fcn.1400d4e34
nop
mov r8, rdi
lea rdx, [0x140132848]
lea rcx, [rsp + 0x40]
call fcn.140045040
nop
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14009ebe9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov r8, qword [rsp + 0x50]
lea rdx, [0x140132848]
lea rcx, [rsp + 0x40]
call fcn.140045040
lea r8, [r14 + 0xc0]
cmp qword [r8 + 0x18], 8
jb 0x14009ec10
mov r8, qword [r8]
lea rdx, [0x140132850]
lea rcx, [rsp + 0x40]
call fcn.140045040
mov rdx, qword [rsp + 0x40]
mov eax, dword [rdx - 0x10]
lea ebx, [rax + rax]
cmp dword [rdx - 8], 1
jle 0x14009ec43
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140001fb0
mov rdx, qword [rsp + 0x40]
mov rcx, rsi
test ebx, ebx
je 0x14009ec74
mov rdi, rdx
mov r8d, ebx
lea r9, [0x14017e9a4]
cmp rcx, 4
jl 0x14009ec62
mov rcx, r13
jmp 0x14009ec65
inc rcx
movzx eax, byte [rcx + r9]
xor byte [rdi], al
inc rdi
dec r8
jne 0x14009ec57
cmp dword [rdx - 8], 1
jle 0x14009ec8c
mov edx, dword [rdx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.140001fb0
mov rdx, qword [rsp + 0x40]
mov r8d, ebx
mov ecx, r15d
call fcn.1400dd5c4
mov ecx, r15d
call fcn.1400dd760
mov rdi, qword [rsp + 0x48]
jmp 0x14009ecbc
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov ecx, 0x80070057
call fcn.1400022b0
nop
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14009ecd7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14009ecf7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14009ed17
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x14009ed41
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
jmp 0x14009ed41
mov ecx, 0x80070057
call fcn.1400022b0
nop
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.1400d4d90
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret