Function at 0x1071ff0
Capabilities:
Create directory
Set file attributes
Write file on windows

Disassembly:
push 0x5b4
mov eax, 0x10d02e6
call fcn.0109887a
push 0
sub esp, 0x58
mov dword [ebp - 0x538], esp
mov dword [ebp - 0x53c], ecx
mov ecx, esp
mov esi, 0xff
push esi
push 1
push 0x7c
push 0x1018c98
mov edi, 0x10189ec
push edi
mov ebx, 0x1018980
push ebx
call fcn.01099386
lea ecx, [ebp - 0x57c]
call fcn.0109a83a
and dword [ebp - 4], 0
and dword [ebp - 0x534], 0
push 2
push 0x80
lea eax, [ebp - 0x52c]
push eax
mov byte [ebp - 0x4ac], 0
mov byte [ebp - 0x4ab], 0
mov byte [ebp - 0x4aa], 0
mov byte [ebp - 0x4a9], 0
mov byte [ebp - 0x4a8], 0
mov byte [ebp - 0x4a7], 5
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
jne 0x10720d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x107209e
and eax, 0xffff
or eax, 0x80070000
push 0x1007014
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x538], esp
push esi
push 1
push 0x91
push 0x1018c98
push edi
push ebx
mov dword [ebp - 0x574], eax
call fcn.01099386
lea eax, [ebp - 0x57c]
push eax
call fcn.01043107
add esp, 0x60
lea eax, [ebp - 0x534]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x12
push 1
lea eax, [ebp - 0x4ac]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x1072149
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1072110
and eax, 0xffff
or eax, 0x80070000
push 0x1018c64
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x538], esp
push esi
push 1
push 0xa5
push 0x1018c98
push edi
push ebx
mov dword [ebp - 0x574], eax
call fcn.01099386
lea eax, [ebp - 0x57c]
push eax
call fcn.01043107
add esp, 0x60
push dword [ebp - 0x534]
lea eax, [ebp - 0x52c]
push 0x101f0000
push 2
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
test eax, eax
jne 0x10721b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x107217f
and eax, 0xffff
or eax, 0x80070000
push 0x1006fec
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x530], esp
push esi
push 1
push 0xb4
push 0x1018c98
push edi
push ebx
mov dword [ebp - 0x574], eax
call fcn.01099386
lea eax, [ebp - 0x57c]
push eax
call fcn.01043107
add esp, 0x60
push dword [ebp - 0x534]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
and dword [ebp - 0x534], 0
push 1
lea eax, [ebp - 0x5c0]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x107222b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10721f2
and eax, 0xffff
or eax, 0x80070000
push 0x1006fb0
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x530], esp
push esi
push 1
push 0xbf
push 0x1018c98
push edi
push ebx
mov dword [ebp - 0x574], eax
call fcn.01099386
lea eax, [ebp - 0x57c]
push eax
call fcn.01043107
add esp, 0x60
push 0
lea eax, [ebp - 0x52c]
push eax
push 1
lea eax, [ebp - 0x5c0]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
jne 0x1072294
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x107225b
and eax, 0xffff
or eax, 0x80070000
push 0x1006f7c
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x530], esp
push esi
push 1
push 0xc5
push 0x1018c98
push edi
push ebx
mov dword [ebp - 0x574], eax
call fcn.01099386
lea eax, [ebp - 0x57c]
push eax
call fcn.01043107
add esp, 0x60
xor eax, eax
lea edi, [ebp - 0x58c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x5c0]
mov dword [ebp - 0x588], eax
lea eax, [ebp - 0x4a4]
push eax
mov dword [ebp - 0x58c], 0xc
mov dword [ebp - 0x584], 1
call fcn.01071bc6
lea eax, [ebp - 0x4a4]
push eax
push 0x1018c2c
lea eax, [ebp - 0x29c]
push 0x144
push eax
call fcn.01047599
add esp, 0x10
mov dword [ebp - 0x574], eax
test eax, eax
jge 0x107232a
push 0x1007040
push eax
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x530], esp
push esi
push 1
push 0xdb
push 0x1018c98
push 0x10189ec
push ebx
call fcn.01099386
lea eax, [ebp - 0x57c]
push eax
call fcn.0109c3bb
mov edi, dword [ebp - 0x53c]
lea eax, [ebp - 0x29c]
push eax
mov ecx, edi
call fcn.01071cf8
test al, al
jne 0x1072416
lea eax, [ebp - 0x58c]
push eax
lea eax, [ebp - 0x29c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10723af
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1072372
and eax, 0xffff
or eax, 0x80070000
push 0x1018c0c
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x530], esp
push esi
push 1
push 0xe4
push 0x1018c98
push 0x10189ec
push ebx
mov dword [ebp - 0x574], eax
call fcn.01099386
lea eax, [ebp - 0x57c]
push eax
call fcn.01043107
add esp, 0x60
push 0x2006
lea eax, [ebp - 0x29c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x1072416
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10723d9
and eax, 0xffff
or eax, 0x80070000
push 0x1018be8
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x530], esp
push esi
push 1
push 0xf2
push 0x1018c98
push 0x10189ec
push ebx
mov dword [ebp - 0x574], eax
call fcn.01099386
lea eax, [ebp - 0x57c]
push eax
call fcn.01043107
add esp, 0x60
cmp byte [ebp + 8], 0
mov eax, dword [0x10e3168]
jne 0x1072426
mov eax, dword [0x10e3164]
push eax
movzx eax, byte [edi + 0xf7]
push eax
movzx eax, byte [edi + 0xf6]
push eax
movzx eax, byte [edi + 0xf5]
push eax
movzx eax, byte [edi + 0xf4]
push eax
movzx eax, byte [edi + 0xf3]
push eax
movzx eax, byte [edi + 0xf2]
push eax
movzx eax, byte [edi + 0xf1]
push eax
movzx eax, byte [edi + 0xf0]
push eax
movzx eax, word [edi + 0xee]
push eax
movzx eax, word [edi + 0xec]
push eax
push dword [edi + 0xe8]
lea eax, [ebp - 0x4a4]
push eax
push dword [0x10e3170]
lea eax, [ebp - 0x29c]
push 0x144
push eax
call fcn.01047599
add esp, 0x40
mov dword [ebp - 0x574], eax
test eax, eax
jge 0x10724c2
push 0x1007040
push eax
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x530], esp
push esi
push 1
push esi
jmp 0x107230e
push 0
push 0x80
push 1
lea eax, [ebp - 0x58c]
push eax
push 3
push 0xc0000000
lea eax, [ebp - 0x29c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x53c], eax
mov dword [ebp - 0x594], 0x10059a0
mov dword [ebp - 0x590], eax
mov byte [ebp - 4], 2
cmp eax, 0xffffffff
jne 0x1072559
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1072519
and eax, 0xffff
or eax, 0x80070000
push 0x1018bd0
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x530], esp
push esi
push 1
push 0x112
mov edi, 0x1018c98
push edi
push 0x10189ec
push ebx
mov dword [ebp - 0x574], eax
call fcn.01099386
lea eax, [ebp - 0x57c]
push eax
call fcn.01043107
add esp, 0x60
jmp 0x107255e
mov edi, 0x1018c98
push 0x2006
lea eax, [ebp - 0x29c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x10725c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1072588
and eax, 0xffff
or eax, 0x80070000
push 0x1018be8
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x530], esp
push esi
push 1
push 0x11f
push edi
push 0x10189ec
push ebx
mov dword [ebp - 0x574], eax
call fcn.01099386
lea eax, [ebp - 0x57c]
push eax
call fcn.01043107
add esp, 0x60
and dword [ebp - 0x598], 0
push 0
lea eax, [ebp - 0x538]
push eax
push 0xc
lea eax, [ebp - 0x5a0]
push eax
push dword [ebp - 0x53c]
mov dword [ebp - 0x5a0], 0x9d4feff5
mov dword [ebp - 0x59c], 1
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1072607
cmp dword [ebp - 0x538], 0xc
je 0x1072654
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x107261b
and eax, 0xffff
or eax, 0x80070000
push 0x1018bbc
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x530], esp
push esi
push 1
push 0x12e
push edi
push 0x10189ec
push ebx
mov dword [ebp - 0x574], eax
call fcn.01099386
lea eax, [ebp - 0x57c]
push eax
call fcn.01043107
add esp, 0x60
lea ecx, [ebp - 0x594]
call fcn.0104a1b7
and dword [ebp - 4], 0
cmp dword [ebp - 0x574], 0
jge 0x107277c
cmp dword [ebp - 0x534], 0
je 0x1072685
push dword [ebp - 0x534]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x574]
mov dword [ebp - 0x580], eax
push 0x10d4844
lea eax, [ebp - 0x580]
push eax
call sub.msvcrt.dll__CxxThrowException
push dword [ebp - 0x564]
lea ecx, [ebp - 0x57c]
push 0x132
push 0x1018c98
push 0x10189ec
push 0x1018980
push dword [ebp - 0x5ac]
call fcn.0109a680
and dword [ebp - 4], 0
mov eax, 0x10726d7
ret
lea ecx, [ebp - 0x57c]
call fcn.0109a8f3
call fcn.010988e5
ret 4