Function at 0x10011850
Capabilities:
Access peb ldr_data
Create directory

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003361f
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x10
push esi
push edi
mov eax, dword [0x10045014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], edx
mov esi, ecx
mov edi, dword [ebx + 0x10]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [esi]
test eax, eax
jne 0x100118ce
push dword [ebx + 0x18]
mov edx, dword [ebx + 8]
push dword [ebx + 0x14]
mov ecx, dword [ebp - 0x14]
push edi
push dword [ebx + 0xc]
call fcn.1000f900
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
cmp eax, 1
jne 0x100119cc
push 0x50
call fcn.1001937a
mov edi, eax
add esp, 4
mov dword [ebp - 0x1c], edi
mov esi, dword [ebx + 0x10]
lea ecx, [edi + 0xc]
mov dword [ebp - 4], 0
mov edx, esi
mov dword [edi], vtable.logging::streams::detail::CModulesStream.0
xor eax, eax
mov dword [edi + 4], vtable.CRefCounted.0
mov dword [edi + 8], 1
mov dword [ecx], 0
mov word [ecx], ax
lea eax, [edx + 2]
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov dword [ebp - 0x18], eax
nop dword [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10011930
sub edx, dword [ebp - 0x18]
sar edx, 1
push edx
push esi
call fcn.10002cf0
mov eax, dword [ebp - 0x14]
lea esi, [edi + 0x40]
mov byte [ebp - 4], 1
push 0x34
mov dword [ebp - 0x18], esi
mov eax, dword [eax]
mov dword [edi + 0x24], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0x28], eax
mov eax, dword [ebx + 0x14]
mov dword [edi + 0x2c], eax
mov eax, dword [ebx + 8]
movups xmm0, xmmword [eax]
movups xmmword [edi + 0x30], xmm0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.1001937a
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov byte [ebp - 4], 2
push 0x2000
mov dword [edi + 0x48], 0x1000
call fcn.1001933b
mov dword [edi + 0x4c], eax
add esp, 4
mov eax, dword [ebx + 0x18]
mov dword [eax], edi
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
cmp eax, 2
jne 0x10011ac2
push 0x50
call fcn.1001937a
mov edi, eax
add esp, 4
mov dword [ebp - 0x1c], edi
mov esi, dword [ebx + 0x10]
lea ecx, [edi + 0xc]
mov dword [ebp - 4], 3
mov edx, esi
mov dword [edi], vtable.logging::streams::detail::CThreadsStream.0
xor eax, eax
mov dword [edi + 4], vtable.CRefCounted.0
mov dword [edi + 8], 1
mov dword [ecx], 0
mov word [ecx], ax
lea eax, [edx + 2]
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov dword [ebp - 0x18], eax
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10011a26
sub edx, dword [ebp - 0x18]
sar edx, 1
push edx
push esi
call fcn.10002cf0
mov eax, dword [ebp - 0x14]
lea esi, [edi + 0x40]
mov byte [ebp - 4], 4
push 0x20
mov dword [ebp - 0x18], esi
mov eax, dword [eax]
mov dword [edi + 0x24], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0x28], eax
mov eax, dword [ebx + 0x14]
mov dword [edi + 0x2c], eax
mov eax, dword [ebx + 8]
movups xmm0, xmmword [eax]
movups xmmword [edi + 0x30], xmm0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.1001937a
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov byte [ebp - 4], 5
push 0x2000
mov dword [edi + 0x48], 0x1000
call fcn.1001933b
mov dword [edi + 0x4c], eax
add esp, 4
mov eax, dword [ebx + 0x18]
mov dword [eax], edi
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov eax, 0x80004001
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret