Function at 0x1000ccc28
Capabilities:
Create directory

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], r9
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x130
mov r15, qword [0x10011bd48]
xor ecx, ecx
lea rax, [rsp + 0x68]
mov qword [r11 - 0xc8], rax
lea rax, [0x10000d738]
mov esi, edx
mov qword [r11 - 0xc0], rax
lea rax, [rsp + 0x58]
mov r13, r8
mov qword [r11 - 0xb8], rax
lea rax, [0x10000d720]
mov edi, ecx
mov qword [r11 - 0xb0], rax
lea rax, [r11 - 0xd0]
mov r12, rcx
mov qword [r11 - 0xa8], rax
lea rax, [0x10000d670]
mov qword [rsp + 0x30], rcx
mov qword [r11 - 0xa0], rax
lea rax, [rsp + 0x60]
mov r14, rcx
mov qword [r11 - 0x98], rax
lea rax, [0x10000d6e0]
mov qword [rsp + 0x40], rcx
mov qword [r11 - 0x90], rax
lea rax, [r11 - 0xd8]
mov qword [rsp + 0x50], rcx
mov qword [r11 - 0x88], rax
lea rax, [0x10000d6c8]
mov ebp, ecx
mov qword [r11 - 0x80], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rcx
mov qword [r11 - 0x78], rax
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rcx
lea rax, [0x10002ab40]
mov qword [r11 - 0xd0], rcx
mov qword [rsp + 0x60], rcx
mov qword [r11 - 0xd8], rcx
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x28], rcx
lea edx, [rcx + 6]
lea r8, [r11 - 0xc8]
lea rcx, [rsp + 0x70]
mov qword [r11 - 0x70], rax
call fcn.1000cc0e8
mov ebx, eax
test eax, eax
je 0x1000ccd59
mov r8d, eax
mov edx, 0x42b0197
jmp 0x1000ccd6c
test r15, r15
jne 0x1000ccd7b
mov r8d, 0x80070057
mov edx, 0x4300197
mov ebx, r8d
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000ccea4
mov rax, qword [rsp + 0x178]
lea rdi, [rsp + 0xf0]
test rax, rax
cmovne rdi, rax
xor eax, eax
mov dword [rdi], eax
mov dword [rdi + 4], eax
lea ecx, [rax + 2]
mov dword [rdi + 8], eax
call qword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
test eax, eax
jne 0x1000ccdc1
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x43c0197
mov ebx, eax
jmp 0x1000cd0d3
mov ebp, 1
lea rcx, [0x10000d750]
mov edx, ebp
call fcn.1000d39c4
mov ebx, eax
test eax, eax
je 0x1000ccde1
mov edx, 0x4410197
jmp 0x1000cce57
test r13, r13
jne 0x1000ccdf5
mov ebx, 0x80004003
mov edx, 0x4460197
mov r8d, ebx
jmp 0x1000cce5a
test esi, 0xfffffcfc
je 0x1000cce0d
mov r8d, 0x80070057
mov edx, 0x44b0197
mov ebx, r8d
jmp 0x1000cce5a
lea r8, [rsp + reloc.certcli.dll_Ordinal_256]
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x1000cce2e
test byte [rsp + reloc.certcli.dll_Ordinal_256], 0x10
jne 0x1000cce69
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1000cce69
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov ebx, eax
cmp eax, 0x800700b7
je 0x1000cce69
mov edx, 0x4550197
mov r8d, eax
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
mov edi, r12d
jmp 0x1000ccea4
lea r9, [rsp + 0x30]
lea rdx, [0x10002ac38]
xor r8d, r8d
mov rcx, r13
call fcn.1000b2490
mov ebx, eax
test eax, eax
je 0x1000ccf45
xor r9d, r9d
mov r8d, eax
mov edx, 0x45f0197
xor ecx, ecx
call fcn.1000b51b8
mov r12, qword [rsp + 0x30]
mov edi, r14d
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1000cceb5
call qword [rsp + 0x80]
test edi, edi
je 0x1000ccedf
mov rcx, qword [rsp + 0x28]
call qword [rsp + 0x60]
mov edi, eax
test eax, eax
je 0x1000cceda
xor r9d, r9d
mov r8d, eax
mov edx, 0x4bf0197
xor ecx, ecx
call fcn.1000b51b8
test ebx, ebx
cmove ebx, edi
test r14, r14
je 0x1000cceed
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r12, r12
je 0x1000ccefb
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
test ebp, ebp
je 0x1000ccf13
lea rcx, [0x10000d750]
xor edx, edx
call fcn.1000d39c4
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1000ccf22
call sub.KERNEL32.dll_FreeLibrary
lea r11, [rsp + 0x130]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov r12, qword [rsp + 0x30]
mov edx, esi
shr edx, 8
mov rcx, r12
and edx, ebp
call fcn.1000ccb54
mov ebx, eax
test eax, eax
je 0x1000ccf76
mov edx, 0x4640197
mov r8d, eax
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000ccea1
bt esi, 9
jb 0x1000ccea1
lea rdx, [rsp + 0x48]
mov rcx, r15
call qword [rsp + 0x68]
mov ebx, eax
test eax, eax
je 0x1000ccf99
mov edx, 0x46a0197
jmp 0x1000ccf64
cmp dword [rsp + 0x48], r14d
jne 0x1000ccfaf
mov ebx, 0x800706ba
mov edx, 0x4710197
mov r8d, ebx
jmp 0x1000ccf67
mov r13d, esi
xor edx, edx
mov r8d, ebp
and r13d, ebp
je 0x1000ccfc4
mov edx, ebp
mov r8d, 2
lea r9, [rsp + 0x28]
mov rcx, r15
call qword [rsp + 0x58]
mov ebx, eax
test eax, eax
je 0x1000ccfdd
mov edx, 0x4820197
jmp 0x1000ccf64
mov r15d, 0x64
test r13d, r13d
jne 0x1000cd094
mov rcx, qword [rsp + 0x28]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x50]
call qword [rsp + Ordinal_140]
mov ebx, eax
test eax, eax
je 0x1000cd012
mov edx, 0x4890197
jmp 0x1000cd0d3
lea r9, [rsp + 0x40]
lea rdx, [0x10002ac50]
xor r8d, r8d
mov rcx, r12
call fcn.1000b2490
mov ebx, eax
test eax, eax
je 0x1000cd04b
xor r9d, r9d
mov r8d, eax
mov edx, 0x4900197
xor ecx, ecx
call fcn.1000b51b8
mov r14, qword [rsp + 0x40]
jmp 0x1000cd0e0
mov r14, qword [rsp + 0x40]
mov r8d, dword [rsp + 0x38]
mov rdx, qword [rsp + 0x50]
mov rcx, r14
mov r9d, 2
call sub.certcli.dll_Ordinal_225
mov ebx, eax
test eax, eax
je 0x1000cd075
mov edx, 0x4970197
jmp 0x1000cd0d3
mov rcx, qword [rsp + 0x28]
mov r9, rdi
mov r8, r12
mov edx, ebp
call fcn.1000cc4f0
mov ebx, eax
test eax, eax
je 0x1000cd097
mov edx, 0x49e0197
jmp 0x1000cd0d3
mov dword [rdi], r15d
mov rcx, qword [rsp + 0x28]
lea r9, [rdi + 4]
mov r8, r12
xor edx, edx
call fcn.1000cc4f0
mov ebx, eax
test eax, eax
je 0x1000cd0b7
mov edx, 0x4ab0197
jmp 0x1000cd0d3
and esi, 2
test sil, sil
jne 0x1000cd0e7
mov rcx, qword [rsp + 0x28]
call qword [rsp + 0x78]
mov ebx, eax
test eax, eax
je 0x1000cd0e7
mov edx, 0x4b10197
mov r8d, eax
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
mov edi, ebp
jmp 0x1000ccea4
mov dword [rdi + 8], r15d
jmp 0x1000cd0e0