Function at 0x1060eea
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor edi, edi
push 2
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x20], edi
call dword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
test eax, eax
jne 0x1060f2f
call fcn.0106d6ff
mov esi, eax
push esi
push 0x8960197
call fcn.01053610
jmp 0x106118b
xor eax, eax
inc eax
push eax
push 0x10022c8
mov dword [ebp - 0x1c], eax
call fcn.01061da6
mov esi, eax
cmp esi, edi
je 0x1060f4e
push esi
push 0x89b0197
jmp 0x1060f25
mov eax, dword [ebp + 0x24]
cmp eax, edi
je 0x1060f57
mov dword [eax], edi
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ebx
jmp 0x1060fa1
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp - 4]
call fcn.01069832
mov esi, eax
cmp esi, 0x80070002
jne 0x1060fc2
cmp dword [ebp - 8], edi
jne 0x1060fc6
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 8]
push eax
push ebx
mov dword [ebp - 4], edi
call fcn.01053ee6
mov esi, eax
cmp esi, edi
jne 0x1060fb7
mov ebx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push ebx
call fcn.01053e0b
mov esi, eax
cmp esi, edi
je 0x1060f61
push esi
push 0x8a50197
jmp 0x1060f25
push esi
push 0x8b00197
jmp 0x1060f25
cmp esi, edi
je 0x1060fd1
push esi
push 0x8b50197
jmp 0x1060f25
mov ebx, dword [ebp + 0xc]
push ebx
call fcn.0105e3aa
test eax, eax
jne 0x1061004
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1061004
call fcn.0106d6ff
mov esi, eax
cmp esi, 0x800700b7
je 0x1061004
push esi
push 0x8c80197
jmp 0x1060f25
push dword [ebp - 4]
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
call esi
push ebx
mov dword [ebp + 8], eax
call esi
pop ecx
pop ecx
mov ecx, dword [ebp + 8]
add ecx, eax
lea eax, [ecx + ecx + 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
cmp esi, edi
mov dword [ebp - 0xc], esi
jne 0x1061041
mov esi, 0x8007000e
push esi
push 0x8d70197
jmp 0x1060f25
push ebx
push esi
call dword [sym.imp.msvcrt.dll_wcscpy]
push 0x1006b9c
push esi
mov esi, dword [sym.imp.msvcrt.dll_wcscat]
call esi
push dword [ebp - 4]
mov ebx, dword [ebp - 0xc]
push ebx
call esi
push 0x1001e98
push ebx
call esi
mov esi, dword [sym.imp.CRYPT32.dll_CertOpenStore]
add esp, 0x20
push 0x100741c
push 0x2c200
push edi
push 1
push 0xa
call esi
cmp eax, edi
mov dword [ebp - 0x14], eax
jne 0x106109b
call fcn.0106d6ff
mov esi, eax
push esi
push 0x8ec0197
jmp 0x1060f25
push edi
push edi
push edi
push 1
push 2
call esi
cmp eax, edi
mov dword [ebp - 0x10], eax
jne 0x10610bd
call fcn.0106d6ff
mov esi, eax
push esi
push 0x8f80197
jmp 0x1060f25
cmp dword [ebp - 0x18], edi
mov dword [ebp + 0xc], edi
mov dword [ebp + 8], edi
jbe 0x1061109
push dword [ebp + 0x20]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.01060de8
mov esi, eax
cmp esi, edi
je 0x10610ed
push esi
push 0x9040197
call fcn.01053610
cmp esi, 1
je 0x10610f9
cmp esi, edi
jne 0x1061119
inc dword [ebp + 0xc]
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x18]
jb 0x10610c8
cmp dword [ebp + 0xc], edi
jne 0x1061124
mov esi, 0x80092004
push esi
push 0x90f0197
jmp 0x1060f25
push esi
push 0x9070197
jmp 0x1060f25
mov eax, dword [ebp + 0x1c]
neg eax
sbb eax, eax
and eax, 6
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0x24]
push dword [ebp + 0x10]
push eax
push dword [ebp - 0x10]
call fcn.0105f431
mov esi, eax
cmp esi, edi
je 0x1061152
push esi
push 0x91f0197
jmp 0x1060f25
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 2
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x20]
push ebx
call sub.certcli.dll_Ordinal_225
mov esi, eax
cmp esi, edi
je 0x106117f
push esi
push 0x9260197
jmp 0x1060f25
mov eax, dword [ebp + 0x24]
cmp eax, edi
je 0x106118b
mov dword [eax], ebx
mov dword [ebp - 0xc], edi
cmp dword [ebp - 4], edi
je 0x1061199
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 8], edi
je 0x10611a7
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0xc], edi
je 0x10611b5
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x14], edi
mov ebx, dword [sym.imp.CRYPT32.dll_CertCloseStore]
je 0x10611c7
push 2
push dword [ebp - 0x14]
call ebx
cmp dword [ebp - 0x10], edi
je 0x10611d3
push 2
push dword [ebp - 0x10]
call ebx
cmp dword [ebp - 0x20], edi
je 0x10611e1
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x1c], edi
je 0x10611f7
push edi
push 0x10022c8
call fcn.01061da6
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x20