Function at 0x14000a410
Capabilities:
Create directory
Delete directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x50
mov r15, 0xffffffffffffffff
mov r12, r8
mov rdi, r15
mov rsi, rdx
mov r13, rcx
nop dword [rax]
inc rdi
cmp word [rdx + rdi*2], 0
jne 0x14000a440
mov ebx, 4
lea rdx, str.__
mov r8d, ebx
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
xor ebp, ebp
test eax, eax
sete bpl
test eax, eax
je 0x14000a4bb
cmp edi, 3
jl 0x14000a4a0
movzx ecx, word [rsi]
lea eax, [rcx - 0x61]
cmp ax, 0x19
jbe 0x14000a489
sub cx, 0x41
cmp cx, 0x19
ja 0x14000a4a0
cmp word [rsi + 2], 0x3a
jne 0x14000a4a0
movzx eax, word [rsi + 4]
cmp ax, 0x5c
je 0x14000a4bb
cmp ax, 0x2f
je 0x14000a4bb
mov qword [r13 + 0x88], 0xfffffffffffff019
mov dword [r13 + 0x14c], gethostname
jmp 0x14000a715
lea eax, [rdi*4]
mov qword [rsp + 0x80], r14
movsxd rcx, eax
add rcx, 0x20
je 0x14000a759
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
test rax, rax
je 0x14000a759
mov r8, rbx
lea rdx, [0x140111638]
lea rcx, [rax + 0x10]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
lea eax, [rbp*4]
xor r8d, r8d
movzx ecx, word [rsi + rax*2]
mov r11d, eax
lea r10, [rsi + rax*2]
lea r9d, [r8 + 0x5c]
test cx, cx
je 0x14000a571
mov r9d, r11d
mov rdx, r10
mov ebp, 0x5c
cmp cx, bp
je 0x14000a554
cmp cx, 0x2f
je 0x14000a554
test r8d, r8d
je 0x14000a547
movsxd rax, ebx
inc ebx
xor r8d, r8d
mov word [r14 + rax*2 + 0x10], bp
movzx ecx, word [rdx]
movsxd rax, ebx
inc ebx
mov word [r14 + rax*2 + 0x10], cx
jmp 0x14000a55a
mov r8d, 1
inc r9
movzx ecx, word [rsi + r9*2]
lea rdx, [rsi + r9*2]
test cx, cx
jne 0x14000a526
mov r9d, 0x5c
movsxd rax, ebx
xor ebp, ebp
inc ebx
mov edx, ebp
mov word [r14 + rax*2 + 0x10], r9w
movzx eax, bx
add ax, ax
mov word [r14 + 8], bp
mov word [r14 + 0xa], ax
movsxd rax, ebx
inc ebx
mov r8d, ebx
mov word [r14 + rax*2 + 0x10], bp
movzx ecx, word [r10]
test cx, cx
je 0x14000a5eb
cmp cx, 0x5c
je 0x14000a5d5
cmp cx, 0x2f
je 0x14000a5d5
test edx, edx
je 0x14000a5c8
movsxd rax, ebx
mov edx, ebp
inc ebx
mov word [r14 + rax*2 + 0x10], r9w
movzx ecx, word [r10]
movsxd rax, ebx
inc ebx
mov word [r14 + rax*2 + 0x10], cx
jmp 0x14000a5da
mov edx, 1
inc r11
movzx ecx, word [rsi + r11*2]
lea r10, [rsi + r11*2]
test cx, cx
jne 0x14000a5a7
mov eax, ebx
sub eax, r8d
cmp eax, 2
jne 0x14000a605
movsxd rax, ebx
inc ebx
mov word [r14 + rax*2 + 0x10], r9w
mov eax, 3
add ax, ax
add r8w, r8w
mov word [r14 + 0xe], ax
xor edx, edx
movsxd rax, ebx
mov rcx, r12
mov word [r14 + 0xc], r8w
lea ebx, [rbx*2 + 0x12]
mov word [r14 + rax*2 + 0x10], bp
lea eax, [rbx - 8]
mov word [r14 + 4], ax
mov dword [r14], 0xa0000003
mov word [r14 + 6], bp
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000a653
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, ebp
jmp 0x14000a6c0
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], 0x2200000
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 3
mov rcx, r12
mov edi, 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x14000a6ba
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov r9d, ebx
mov dword [rsp + 0x28], ebp
mov r8, r14
mov edx, 0x900a4
mov qword [rsp + 0x20], rbp
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14000a72e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov dword [r13 + 0x14c], eax
call fcn.140016510
movsxd rcx, eax
mov qword [r13 + 0x88], rcx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, r14
mov ebx, dword [rax]
call qword [0x14012a640]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], ebx
cmp r15, 0xffffffffffffffff
je 0x14000a700
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x14000a70d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov r14, qword [rsp + 0x80]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, r14
mov ebx, dword [rax]
call qword [0x14012a640]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], ebx
mov qword [r13 + 0x88], rbp
jmp 0x14000a70d
lea rdx, str.uv__malloc
mov ecx, ntohs
call fcn.140016450
int3
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, qword [rcx + 0x150]
mov rbx, rcx
mov rcx, qword [rcx + 0x160]
mov r8d, dword [rbx + 0x168]
test r8b, 2
jne 0x14000a7ed
mov edi, dword [reloc.WS2_32.dll_bind]
nop
mov eax, edi
or eax, 1
test r8b, 1
cmovne edi, eax
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_CreateSymbolicLinkW]
test al, al
jne 0x14000a824
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x14000a802
test dil, 2
je 0x14000a802
mov r8d, dword [rbx + 0x168]
xor edi, edi
mov rdx, qword [rbx + 0x150]
mov rcx, qword [rbx + 0x160]
mov dword [reloc.WS2_32.dll_bind], edi
test r8b, 2
je 0x14000a7a0
mov r8, rcx
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14000a410
mov ecx, eax
mov dword [rbx + 0x14c], eax
call fcn.140016510
movsxd rcx, eax
mov qword [rbx + 0x88], rcx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov qword [rbx + 0x88], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret