Function at 0x180004390
Capabilities:
Create directory

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x150
mov rax, qword [0x18004d020]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov r14, rcx
xorps xmm0, xmm0
movups xmmword [r11 - 0x68], xmm0
xor r15d, r15d
mov qword [r11 - 0x58], r15
mov qword [r11 - 0x50], r15
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], r15b
jne 0x1800043e0
lea rcx, [rsp + 0x110]
call fcn.180001b50
nop
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x70], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0xc8], xmm0
mov qword [rsp + 0xd8], 9
mov qword [rsp + 0xe0], socket
movsd xmm0, qword [str._CymArgs_]
movsd qword [rsp + 0xc8], xmm0
movzx eax, byte [0x180045b38]
mov byte [rsp + 0xd0], al
mov byte [rsp + 0xd1], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x98], xmm0
mov qword [rsp + 0xa8], r15
mov qword [rsp + 0xb0], r15
lea rsi, [rsp + 0x110]
cmp qword [rsp + 0x128], 0x10
cmovae rsi, qword [rsp + 0x110]
movabs rbx, 0x7fffffffffffffff
mov rdi, qword [rsp + 0x120]
cmp rdi, rbx
ja 0x180004d26
mov qword [rsp + 0xb0], socket
cmp rdi, 0x10
jae 0x1800044c8
mov qword [rsp + 0xa8], rdi
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x98], xmm0
jmp 0x180004566
mov rax, rdi
or rax, 0xf
cmp rax, rbx
jbe 0x180004504
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.18000ddb4
mov rcx, rax
test rax, rax
je 0x180004d30
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x18000453e
mov rbx, rax
mov ecx, reloc.WS2_32.dll_shutdown
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x18000452f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180004d2b
jmp 0x1800044e2
test rcx, rcx
je 0x18000453b
call fcn.18000ddb4
jmp 0x18000453e
mov rax, r15
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xb0], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.18000fd40
nop
lea r8, [rsp + 0xc8]
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x30]
call fcn.180003bd0
nop
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rsp + 0x38]
mov rax, rdx
mov rcx, qword [rsp + 0x30]
sub rax, rcx
sar rax, 5
mov ebx, r15d
cmp rbx, rax
jae 0x1800047ba
shl rbx, 5
lea rdx, [rcx + rbx]
lea rcx, [rsp + 0xf0]
call fcn.180005960
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.180003ec0
nop
mov rax, qword [rsp + 0x80]
mov ecx, dword [rax + 0x10]
inc ecx
movsxd rcx, ecx
call fcn.18000e170
mov r12, rax
mov rcx, qword [rsp + 0x80]
mov edx, dword [rcx + 0x30]
inc edx
movsxd rcx, edx
call fcn.18000e170
mov r13, rax
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x80]
mov edi, dword [rcx + rbx + 0x10]
sub edi, dword [rdx + 0x10]
sub edi, dword [rdx + 0x30]
sub edi, 2
lea eax, [rdi + 1]
cdqe
mov qword [rsp + 0x60], rax
mov rcx, rax
call fcn.18000e170
mov rsi, rax
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x80]
mov r8, qword [rcx + 0x10]
inc r8
xor edx, edx
mov rcx, r12
call fcn.180010400
mov rcx, qword [rsp + 0x80]
mov r8, qword [rcx + 0x30]
inc r8
xor edx, edx
mov rcx, r13
call fcn.180010400
mov r8, qword [rsp + 0x60]
xor edx, edx
mov rcx, rsi
call fcn.180010400
mov rdx, qword [rsp + 0x80]
mov r8, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x180004690
mov rdx, qword [rdx]
mov r8, qword [r8 + 0x10]
mov rcx, r12
call fcn.18000fd40
mov rax, qword [rsp + 0x80]
lea rdx, [rax + 0x20]
cmp qword [rax + 0x38], 0x10
jb 0x1800046b3
mov rdx, qword [rax + 0x20]
mov r8, qword [rax + 0x30]
mov rcx, r13
call fcn.18000fd40
mov rdx, qword [rsp + 0x30]
add rdx, rbx
mov rax, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x1800046d4
mov rax, qword [rdx]
movsxd r8, edi
mov rdx, qword [rdx + 0x10]
sub rdx, r8
add rdx, rax
mov rcx, rsi
call fcn.18000fd40
lea rbx, [r14 + 0x48]
mov rsi, qword [rbx]
movabs rax, 0x555555555555555
cmp qword [rbx + 8], rax
je 0x180004d36
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0xc0], 0
mov ecx, gethostbyname
call fcn.18000ddb4
mov rcx, qword [rsp + 0x50]
mov qword [rax + 0x10], rcx
mov dword [rax + 0x18], edi
mov qword [rax + 0x20], r13
mov qword [rax + 0x28], r12
inc qword [rbx + 8]
mov rcx, qword [rsi + 8]
mov qword [rax], rsi
mov qword [rax + 8], rcx
xor r12d, r12d
mov qword [rsp + 0xc0], r12
mov qword [rsi + 8], rax
mov qword [rcx], rax
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x1800047b2
mov rdx, qword [rsp + 0x88]
call fcn.180001c60
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x80]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800047ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180004d43
call fcn.18000db10
inc r15d
jmp 0x180004590
test rcx, rcx
je 0x180004812
call fcn.180001c60
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800047fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180004d49
call fcn.18000db10
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
xor r12d, r12d
mov qword [rsp + 0x40], r12
jmp 0x180004815
xor r12d, r12d
mov r13, qword [rsp + 0x128]
cmp r13, 0x10
jb 0x180004860
lea rdx, [r13 + 1]
mov r12, qword [rsp + 0x110]
mov rax, r12
cmp rdx, 0x1000
jb 0x180004855
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180004d4f
mov rcx, r12
call fcn.18000db10
xor r12d, r12d
mov qword [rsp + 0x60], r12
mov rsi, qword [r14 + 0x48]
mov rbx, qword [rsi]
nop dword [rax]
cmp rbx, rsi
je 0x180004cf3
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0xb8], rax
mov rdi, qword [rbx + 0x20]
mov rdx, qword [rbx + 0x28]
lea rcx, str.scenario_id
call fcn.180019c58
test eax, eax
jne 0x180004ceb
mov rsi, qword [0x18004f9a8]
mov rbx, qword [rsi + 8]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x38], r12d
mov r15, rsi
cmp byte [rbx + 0x19], al
jne 0x1800048fb
nop
mov qword [rsp + 0x30], rbx
mov rdx, rdi
mov rcx, qword [rbx + 0x20]
call fcn.180019c58
test eax, eax
jne 0x1800048e0
mov dword [rsp + 0x38], r12d
mov rbx, qword [rbx + 0x10]
jmp 0x1800048ee
mov dword [rsp + 0x38], 1
mov r15, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1800048c0
mov rsi, qword [0x18004f9a8]
cmp byte [r15 + 0x19], 0
jne 0x180004919
mov rdx, qword [r15 + 0x20]
mov rcx, rdi
call fcn.180019c58
test eax, eax
jne 0x180004932
mov rsi, qword [0x18004f9a8]
movabs rax, 0x555555555555555
cmp qword [0x18004f9b0], rax
je 0x180004d55
jmp 0x18000493b
lea r15, [0x18004f9a8]
jmp 0x18000498a
lea r15, [0x18004f9a8]
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r12
mov ecx, gethostbyname
call fcn.18000ddb4
nop
mov qword [rax + 0x20], rdi
mov dword [rax + 0x28], r12d
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov word [rax + 0x18], 0
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x70], xmm0
mov r8, rax
lea rdx, [rsp + 0x70]
mov rcx, r15
call fcn.1800061b0
mov rsi, qword [r14 + 0x48]
mov rbx, qword [rsi]
cmp rbx, rsi
je 0x180004cf3
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x70], rax
mov rdi, qword [rbx + 0x20]
mov rdx, qword [rbx + 0x28]
lea rcx, str.attack_id
call fcn.180019c58
test eax, eax
jne 0x180004ce3
mov rsi, qword [0x18004f9a8]
mov rbx, qword [rsi + 8]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x38], r12d
mov r13, rsi
cmp byte [rbx + 0x19], al
jne 0x180004a1b
nop dword [rax]
mov qword [rsp + 0x30], rbx
mov rdx, rdi
mov rcx, qword [rbx + 0x20]
call fcn.180019c58
test eax, eax
jne 0x180004a00
mov dword [rsp + 0x38], r12d
mov rbx, qword [rbx + 0x10]
jmp 0x180004a0e
mov dword [rsp + 0x38], 1
mov r13, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1800049e0
mov rsi, qword [0x18004f9a8]
cmp byte [r13 + 0x19], 0
jne 0x180004a39
mov rdx, qword [r13 + 0x20]
mov rcx, rdi
call fcn.180019c58
test eax, eax
jne 0x180004a98
mov rsi, qword [0x18004f9a8]
movabs rax, 0x555555555555555
cmp qword [0x18004f9b0], rax
je 0x180004d5a
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r12
mov ecx, gethostbyname
call fcn.18000ddb4
nop
mov qword [rax + 0x20], rdi
mov dword [rax + 0x28], r12d
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov word [rax + 0x18], 0
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm0
mov r8, rax
lea rdx, [rsp + 0x50]
mov rcx, r15
call fcn.1800061b0
mov rsi, qword [r14 + 0x48]
mov rbx, qword [rsi]
nop
cmp rbx, rsi
je 0x180004cf3
mov r12, qword [rbx + 0x10]
mov rdi, qword [rbx + 0x20]
mov rdx, qword [rbx + 0x28]
lea rcx, str.programdata_path
call fcn.180019c58
test eax, eax
jne 0x180004cdb
mov rsi, qword [0x18004f9a8]
mov rbx, qword [rsi + 8]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x38], eax
mov r13, rsi
cmp byte [rbx + 0x19], al
jne 0x180004b2a
nop word [rax + rax]
mov qword [rsp + 0x30], rbx
mov rdx, rdi
mov rcx, qword [rbx + 0x20]
call fcn.180019c58
test eax, eax
jne 0x180004b0f
mov dword [rsp + 0x38], eax
mov rbx, qword [rbx + 0x10]
jmp 0x180004b1d
mov dword [rsp + 0x38], 1
mov r13, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x180004af0
mov rsi, qword [0x18004f9a8]
cmp byte [r13 + 0x19], 0
jne 0x180004b48
mov rdx, qword [r13 + 0x20]
mov rcx, rdi
call fcn.180019c58
test eax, eax
jne 0x180004ba4
mov rsi, qword [0x18004f9a8]
movabs rax, 0x555555555555555
cmp qword [0x18004f9b0], rax
je 0x180004d5f
mov qword [rsp + 0x50], r15
xor ebx, ebx
mov qword [rsp + 0x58], rbx
lea ecx, [rbx + 0x30]
call fcn.18000ddb4
nop
mov qword [rax + 0x20], rdi
mov dword [rax + 0x28], ebx
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov word [rax + 0x18], bx
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm0
mov r8, rax
lea rdx, [rsp + 0x50]
mov rcx, r15
call fcn.1800061b0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xe8]
lea r8, [rsp + 0x50]
lea rdx, str.edr_attacks_path
mov rcx, r14
call fcn.180004d70
test al, al
je 0x180004cf3
mov rcx, qword [rsp + 0xb8]
call fcn.180019ba4
mov qword [r14 + 0x20], rax
mov rcx, qword [rsp + 0x70]
call fcn.180019ba4
mov qword [r14 + 0x28], rax
mov rcx, qword [rsp + 0x60]
call fcn.180019ba4
mov qword [r14 + 0x30], rax
mov rcx, r12
call fcn.180019ba4
mov qword [r14 + 0x38], rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rsi, 0xffffffffffffffff
test eax, eax
je 0x180004c77
mov rax, qword [r14 + 0x38]
mov rdi, rsi
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x180004c30
inc rdi
mov eax, 2
mul rdi
cmovo rax, rsi
mov rcx, rax
call fcn.18000e170
mov rbx, rax
mov r8, rdi
mov rdx, qword [r14 + 0x38]
mov rcx, rax
call fcn.180019a60
mov rdx, rbx
call fcn.180003a00
mov edx, 2
mov rcx, rbx
call fcn.18000db10
xor edx, edx
mov rcx, qword [r14 + 0x30]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x180004cd7
mov rax, qword [r14 + 0x30]
mov rdi, rsi
nop
inc rdi
cmp byte [rax + rdi], 0
jne 0x180004c90
inc rdi
mov eax, 2
mul rdi
cmovo rax, rsi
mov rcx, rax
call fcn.18000e170
mov rbx, rax
mov r8, rdi
mov rdx, qword [r14 + 0x30]
mov rcx, rax
call fcn.180019a60
mov rdx, rbx
call fcn.180003a00
mov edx, 2
mov rcx, rbx
call fcn.18000db10
mov al, 1
jmp 0x180004cf9
mov rbx, qword [rbx]
jmp 0x180004aa0
mov rbx, qword [rbx]
jmp 0x180004991
mov rbx, qword [rbx]
jmp 0x180004870
xor al, al
jmp 0x180004cf9
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18000daf0
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.180001640
call fcn.1800015a0
call fcn.1800195d8
nop
lea rcx, str.list_too_long
call fcn.18000cc78
nop
call fcn.1800195d8
nop
call fcn.1800195d8
nop
call fcn.1800195d8
nop
call fcn.1800039e0
call fcn.1800039e0
call fcn.1800039e0
int3