Function at 0x10a1e5e
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor edi, edi
push 2
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x20], edi
call dword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
test eax, eax
jne 0x10a1e9e
call fcn.01091f43
mov esi, eax
push esi
push 0xa170197
jmp 0x10a20f6
xor eax, eax
inc eax
push eax
push 0x10027f4
mov dword [ebp - 0x1c], eax
call fcn.010a7263
mov esi, eax
cmp esi, edi
je 0x10a1ec0
push esi
push 0xa1c0197
jmp 0x10a20f6
mov eax, dword [ebp + 0x24]
cmp eax, edi
je 0x10a1ec9
mov dword [eax], edi
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ebx
jmp 0x10a1f13
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp - 4]
call fcn.010aecd7
mov esi, eax
cmp esi, 0x80070002
jne 0x10a1f34
cmp dword [ebp - 8], edi
jne 0x10a1f38
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 8]
push eax
push ebx
mov dword [ebp - 4], edi
call fcn.0108d0a9
mov esi, eax
cmp esi, edi
jne 0x10a1f29
mov ebx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push ebx
call fcn.010909c2
mov esi, eax
cmp esi, edi
je 0x10a1ed3
push esi
push 0xa260197
jmp 0x10a20f6
push esi
push 0xa310197
jmp 0x10a20f6
cmp esi, edi
je 0x10a1f43
push esi
push 0xa360197
jmp 0x10a20f6
push dword [ebp + 0xc]
call fcn.010a070c
test eax, eax
jne 0x10a1f77
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10a1f77
call fcn.01091f43
mov esi, eax
cmp esi, 0x800700b7
je 0x10a1f77
push esi
push 0xa490197
jmp 0x10a20f6
mov eax, dword [ebp + 0xc]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x10a1f7d
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, dword [ebp - 4]
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
cmp si, di
jne 0x10a1f93
sub eax, edx
sar eax, 1
lea esi, [eax + ecx + 6]
lea eax, [esi + esi]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
mov dword [ebp - 0xc], ebx
cmp ebx, edi
jne 0x10a1fc9
mov esi, 0x8007000e
push esi
push 0xa530197
jmp 0x10a20f6
push dword [ebp + 0xc]
push esi
push ebx
call fcn.0102e082
push 0x1008ba8
push esi
push ebx
call fcn.0102e0bc
push dword [ebp - 4]
push esi
push ebx
call fcn.0102e0bc
push 0x1001f1c
push esi
push ebx
call fcn.0102e0bc
mov esi, dword [sym.imp.CRYPT32.dll_CertOpenStore]
push 0x1009cbc
push 0x2c200
push edi
push 1
push 0xa
call esi
mov dword [ebp - 0x14], eax
cmp eax, edi
jne 0x10a2025
call fcn.01091f43
mov esi, eax
push esi
push 0xa680197
jmp 0x10a20f6
push edi
push edi
push edi
push 1
push 2
call esi
mov dword [ebp - 0x10], eax
cmp eax, edi
jne 0x10a2047
call fcn.01091f43
mov esi, eax
push esi
push 0xa740197
jmp 0x10a20f6
xor ebx, ebx
mov dword [ebp + 0xc], edi
cmp dword [ebp - 0x18], edi
jbe 0x10a208b
push dword [ebp + 0x20]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push ebx
push dword [ebp - 4]
call fcn.010a1d5a
mov esi, eax
cmp esi, edi
je 0x10a2074
push esi
push 0xa800197
call fcn.0108c55a
cmp esi, 1
je 0x10a2080
cmp esi, edi
jne 0x10a2098
inc dword [ebp + 0xc]
inc ebx
cmp ebx, dword [ebp - 0x18]
jb 0x10a2051
cmp dword [ebp + 0xc], edi
jne 0x10a20a0
mov esi, 0x80092004
push esi
push 0xa8b0197
jmp 0x10a20f6
push esi
push 0xa830197
jmp 0x10a20f6
mov eax, dword [ebp + 0x1c]
neg eax
sbb eax, eax
and eax, 6
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0x24]
push dword [ebp + 0x10]
push eax
push dword [ebp - 0x10]
call fcn.010a0c42
mov esi, eax
cmp esi, edi
je 0x10a20cb
push esi
push 0xa9b0197
jmp 0x10a20f6
mov eax, dword [ebp + 0x18]
mov ebx, dword [ebp - 0xc]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 2
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x20]
push ebx
call sub.certcli.dll_Ordinal_225
mov esi, eax
cmp esi, edi
je 0x10a20fd
push esi
push 0xaa20197
call fcn.0108c55a
jmp 0x10a2109
mov eax, dword [ebp + 0x24]
cmp eax, edi
je 0x10a2109
mov dword [eax], ebx
mov dword [ebp - 0xc], edi
cmp dword [ebp - 4], edi
je 0x10a2117
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 8], edi
je 0x10a2125
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0xc], edi
je 0x10a2133
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, dword [sym.imp.CRYPT32.dll_CertCloseStore]
cmp dword [ebp - 0x14], edi
je 0x10a2145
push 2
push dword [ebp - 0x14]
call ebx
cmp dword [ebp - 0x10], edi
je 0x10a2151
push 2
push dword [ebp - 0x10]
call ebx
cmp dword [ebp - 0x20], edi
je 0x10a215f
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x1c], edi
je 0x10a2175
push edi
push 0x10027f4
call fcn.010a7263
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x20