Function at 0x10004cb0
Capabilities:
Create directory
Map section object

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x534
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp dword [edi + 8], 0
lea ebx, [edi + 8]
je 0x10004cdf
call fcn.10006880
test eax, eax
jns 0x10004cdf
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
mov ecx, 0
test al, 7
mov byte [ebp - 0x58], 0
setne cl
shr eax, 3
add ecx, eax
shl ecx, 3
mov dword [ebp + 0xc], ecx
test esi, esi
je 0x10004d1c
mov edx, 0x30
xor eax, eax
mov cl, byte [esi + eax]
test cl, cl
je 0x10004d17
mov byte [ebp + eax - 0x58], cl
inc eax
sub edx, 1
jne 0x10004d06
mov byte [ebp + eax - 0x58], 0
or edx, 0xffffffff
xor eax, eax
mov cl, byte [ebp + eax - 0x58]
test cl, cl
je 0x10004d36
mov byte [ebp + eax - 0xb4], cl
inc eax
sub edx, 1
jne 0x10004d21
mov byte [ebp + eax - 0xb4], 0
mov eax, 0x5c
push 0x3fe
mov word [ebp - 0x534], ax
lea eax, [ebp - 0x532]
push 0
push eax
call fcn.100034a0
lea eax, [ebp - 0xc]
mov dword [ebp - 0x74], 0x40001
mov dword [ebp - 0x28], eax
add esp, 0xc
lea eax, [ebp - 0x74]
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x20], eax
xorps xmm0, xmm0
mov al, byte [0x100142bc]
mov ecx, 1
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x24], 0xc0
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x70], xmm0
test al, al
je 0x10004db9
cbw
mov word [ebp + ecx*2 - 0x534], ax
inc ecx
mov al, byte [ecx + 0x100142bb]
test al, al
jne 0x10004da4
lea eax, [ebp - 0x534]
mov dword [ebp - 8], eax
lea eax, [ecx + ecx]
mov word [ebp - 0xc], ax
add eax, 2
mov word [ebp - 0xa], ax
lea eax, [ebp - 0x30]
push eax
push 0xf000f
lea eax, [edi + 0xc]
push eax
call dword [sym.imp.ntdll.dll_NtCreateDirectoryObject]
test eax, eax
jns 0x10004df5
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0xc]
mov dword [ebp - 0x60], eax
lea ecx, [ebp - 0x30]
push 0x100142bc
lea eax, [ebp - 0xb4]
mov dword [ebp - 0x5c], 0
push eax
xorps xmm0, xmm0
lea eax, [ebp - 0x334]
push eax
movups xmmword [ebp - 0x30], xmm0
movq qword [ebp - 0x20], xmm0
call fcn.10009510
or dword [ebp - 0x24], 0x80
lea eax, [ebp - 0x60]
push 0
push 0x8000000
push 4
push eax
lea eax, [ebp - 0x30]
push eax
push 0xf001f
push ebx
call dword [sym.imp.ntdll.dll_NtCreateSection]
mov dword [ebp - 8], eax
test eax, eax
jns 0x10004e65
pop edi
pop esi
mov eax, 0xfffffffd
pop ebx
mov esp, ebp
pop ebp
ret 8
push 4
push 0
push 1
lea eax, [ebp + 0xc]
mov dword [ebp - 0x18], 0
push eax
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push 0
push eax
push 0xffffffffffffffff
push dword [ebx]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
je 0x10004eb6
mov ecx, dword [edi + 8]
lea eax, [ecx + 1]
cmp eax, 1
jbe 0x10004ea1
push ecx
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [edi + 8], 0
mov eax, 0xfffffffc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebp - 8], 0x40000000
lea esi, [edi + 0x10]
mov ecx, dword [ebp - 0x18]
mov dword [esi], ecx
je 0x1000519b
mov eax, dword [ebp + 0xc]
mov edx, 0x5f
mov dword [ecx + 0x14], eax
mov ebx, 0x10012bb4
mov eax, dword [esi]
mov ecx, dword [edi + 8]
add eax, 0x58
mov dword [ebp + 8], eax
lea esi, [edx - 0x2f]
xor al, al
mov dword [ebp - 0x10], ecx
test ecx, ecx
movzx eax, al
cmovne eax, edx
mov byte [ebp - 0xb4], al
xor eax, eax
test ecx, ecx
lea ecx, [ebp - 0xb4]
setne al
xor edx, edx
add ecx, eax
mov dword [ebp - 4], ecx
mov eax, ecx
sub ebx, ecx
mov cl, byte [ebx + eax]
test cl, cl
je 0x10004f24
mov byte [eax], cl
inc edx
inc eax
sub esi, 1
jne 0x10004f14
mov eax, dword [ebp - 4]
movups xmm0, xmmword [str.0123456789ABCDEF0123456789abcdefFailed_to_open_process:__08X__u_]
movups xmm1, xmmword [0x100121b0]
mov byte [edx + eax], 0
xor edx, edx
cmp dword [ebp - 0x10], edx
je 0x10005009
mov eax, dword [0x7ffe0000]
mov dword [ebp - 4], eax
test eax, eax
je 0x10004f54
xor eax, eax
jmp 0x10004f61
mov eax, dword [0x7ffe0320]
mov dword [ebp - 4], eax
mov eax, dword [0x7ffe0324]
mov ecx, dword fs:[0x18]
mov edx, dword fs:[0x18]
movups xmmword [ebp - 0x38], xmm0
mov ebx, dword [ecx + 0x24]
imul ebx, dword [edx + 0x20]
mov ecx, dword [0x7ffe0004]
mul ecx
movups xmmword [ebp - 0x28], xmm1
mov esi, eax
mov eax, dword [ebp - 4]
mul ecx
add esi, edx
shrd eax, esi, 0x18
imul ebx, eax
xor ebx, dword [ebp - 0x10]
je 0x10004fc8
lea ecx, [ebp - 0xed]
xor edx, edx
cmp edx, 8
jge 0x10004fb7
mov eax, ebx
shr ebx, 4
and eax, 0xf
inc edx
mov al, byte [ebp + eax - 0x38]
jmp 0x10004fb9
mov al, 0x30
mov byte [ecx], al
dec ecx
lea eax, [ebp - 0xf4]
cmp ecx, eax
jae 0x10004fa3
jmp 0x10004fdc
mov dword [ebp - 0xf4], 0x30303030
mov dword [ebp - 0xf0], 0x30303030
mov eax, dword [ebp + 8]
lea ebx, [ebp - 0xf4]
xor edx, edx
mov esi, 8
sub ebx, eax
nop
mov cl, byte [ebx + eax]
test cl, cl
je 0x10005000
mov byte [eax], cl
inc edx
inc eax
sub esi, 1
jne 0x10004ff0
mov eax, dword [ebp + 8]
mov byte [edx + eax], 0
jmp 0x1000500c
mov eax, dword [ebp + 8]
lea ecx, [edx + eax]
or esi, 0xffffffff
lea ebx, [ebp - 0xb4]
mov dword [ebp + 8], ecx
xor edx, edx
mov eax, ecx
sub ebx, ecx
mov cl, byte [ebx + eax]
test cl, cl
je 0x10005031
mov byte [eax], cl
inc edx
inc eax
sub esi, 1
jne 0x10005021
mov eax, dword [ebp + 8]
mov ebx, 0x10012bb8
mov byte [edx + eax], 0
mov edx, 0x5f
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 8]
add eax, 0x18
mov dword [ebp + 8], eax
xor al, al
test ecx, ecx
movzx eax, al
mov dword [ebp - 4], ecx
lea esi, [edx - 0x2f]
cmovne eax, edx
mov byte [ebp - 0xb4], al
xor eax, eax
test ecx, ecx
lea ecx, [ebp - 0xb4]
setne al
xor edx, edx
add ecx, eax
mov dword [ebp - 0x10], ecx
mov eax, ecx
sub ebx, ecx
nop dword [eax]
mov cl, byte [ebx + eax]
test cl, cl
je 0x10005090
mov byte [eax], cl
inc edx
inc eax
sub esi, 1
jne 0x10005080
mov eax, dword [ebp - 0x10]
mov byte [edx + eax], 0
xor edx, edx
cmp dword [ebp - 4], edx
je 0x10005169
mov eax, dword [0x7ffe0000]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x100050b2
xor eax, eax
jmp 0x100050bf
mov eax, dword [0x7ffe0320]
mov dword [ebp - 0x10], eax
mov eax, dword [0x7ffe0324]
mov ecx, dword fs:[0x18]
mov edx, dword fs:[0x18]
movups xmmword [ebp - 0x38], xmm0
mov ebx, dword [ecx + 0x24]
imul ebx, dword [edx + 0x20]
mov ecx, dword [0x7ffe0004]
mul ecx
movups xmmword [ebp - 0x28], xmm1
mov esi, eax
mov eax, dword [ebp - 0x10]
mul ecx
add esi, edx
shrd eax, esi, 0x18
imul ebx, eax
xor ebx, dword [ebp - 4]
je 0x10005126
lea ecx, [ebp - 0x12d]
xor edx, edx
cmp edx, 8
jge 0x10005115
mov eax, ebx
shr ebx, 4
and eax, 0xf
inc edx
mov al, byte [ebp + eax - 0x38]
jmp 0x10005117
mov al, 0x30
mov byte [ecx], al
dec ecx
lea eax, [ebp - 0x134]
cmp ecx, eax
jae 0x10005101
jmp 0x1000513a
mov dword [ebp - 0x134], 0x30303030
mov dword [ebp - 0x130], 0x30303030
mov eax, dword [ebp + 8]
lea ebx, [ebp - 0x134]
xor edx, edx
mov esi, 8
sub ebx, eax
nop dword [eax]
mov cl, byte [ebx + eax]
test cl, cl
je 0x10005160
mov byte [eax], cl
inc edx
inc eax
sub esi, 1
jne 0x10005150
mov eax, dword [ebp + 8]
mov byte [edx + eax], 0
jmp 0x1000516c
mov eax, dword [ebp + 8]
lea ecx, [edx + eax]
or esi, 0xffffffff
lea ebx, [ebp - 0xb4]
mov dword [ebp + 8], ecx
xor edx, edx
mov eax, ecx
sub ebx, ecx
mov cl, byte [ebx + eax]
test cl, cl
je 0x10005191
mov byte [eax], cl
inc edx
inc eax
sub esi, 1
jne 0x10005181
mov eax, dword [ebp + 8]
lea esi, [edi + 0x10]
mov byte [edx + eax], 0
mov eax, dword [esi]
lea edx, [ebp - 0x14]
push 0x100142bc
add eax, 0x58
lea ecx, [ebp - 0x30]
push eax
xorps xmm0, xmm0
lea eax, [ebp - 0x334]
push eax
movups xmmword [ebp - 0x30], xmm0
movq qword [ebp - 0x20], xmm0
call fcn.10009510
or dword [ebp - 0x24], 0x80
lea eax, [ebp - 0x30]
push 0
push eax
push 0x1f0001
lea ebx, [edi + 4]
push ebx
call dword [sym.imp.ntdll.dll_NtCreateMutant]
mov eax, dword [esi]
lea edx, [ebp - 0x14]
push 0x100142bc
add eax, 0x18
lea ecx, [ebp - 0x30]
push eax
xorps xmm0, xmm0
lea eax, [ebp - 0x334]
push eax
movups xmmword [ebp - 0x30], xmm0
movq qword [ebp - 0x20], xmm0
call fcn.10009510
or dword [ebp - 0x24], 0x80
lea eax, [ebp - 0x30]
push 0
push 0
push eax
push 0x1f0003
push edi
call dword [sym.imp.ntdll.dll_NtCreateEvent]
mov eax, dword [ebx]
test eax, eax
je 0x10005244
cmp dword [edi], 0
je 0x10005244
xor eax, eax
cmp dword [ebp - 8], 0x40000000
pop edi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0
je 0x10005309
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0xfaa2b580
push ecx
push 0
push eax
mov dword [ebp - 8], 0xffffffff
call dword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov ebx, esi
test eax, eax
js 0x10005279
cmp eax, 0x102
je 0x1000528c
lea ebx, [edi + 0x10]
cmp dword [edi + 8], 0
jne 0x1000528c
push 0
push dword [edi + 4]
call dword [sym.imp.ntdll.dll_NtReleaseMutant]
mov esi, ebx
mov eax, dword [esi]
mov ebx, dword [edi + 8]
mov dword [edi + 8], 0
test eax, eax
je 0x10005309
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
test eax, eax
jne 0x10005309
mov dword [esi], eax
lea eax, [ebx + 1]
mov esi, dword [sym.imp.ntdll.dll_NtClose]
cmp eax, 1
jbe 0x100052bc
push ebx
call esi
mov ecx, dword [edi]
test ecx, ecx
je 0x100052cd
lea eax, [ecx + 1]
cmp eax, 1
jbe 0x100052cd
push ecx
call esi
push 0
push dword [edi + 4]
mov dword [edi], 0
call dword [sym.imp.ntdll.dll_NtReleaseMutant]
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x100052f0
lea eax, [ecx + 1]
cmp eax, 1
jbe 0x100052f0
push ecx
call esi
mov ecx, dword [edi + 0xc]
mov dword [edi + 4], 0
test ecx, ecx
je 0x10005309
lea eax, [ecx + 1]
cmp eax, 1
jbe 0x10005309
push ecx
call esi
pop edi
pop esi
mov eax, 0xfffffff9
pop ebx
mov esp, ebp
pop ebp
ret 8