Function at 0x1000c3d0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009d468
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100cd4bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
test esi, esi
jne 0x1000c413
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.10001ca0
mov ecx, eax
test ecx, ecx
je 0x1000c5e3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
test esi, 0xffff0000
jne 0x1000c44a
movzx eax, si
lea ecx, [ebp + 8]
push eax
call fcn.1000c290
jmp 0x1000c463
mov ecx, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000c450
sub ecx, edx
push ecx
push esi
lea ecx, [ebp + 8]
call fcn.1000cf50
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 1
mov ecx, dword [esi - 0xc]
lea eax, [ecx - 1]
test eax, eax
js 0x1000c5fc
cmp eax, ecx
jg 0x1000c5fc
mov al, byte [eax + esi]
or edi, 0xffffffff
cmp al, 0x5c
je 0x1000c59d
push 0x5c
push esi
call fcn.1007b9ab
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x1000c5df
sub ebx, esi
js 0x1000c5df
cmp ebx, dword [esi - 0xc]
jl 0x1000c4c7
lea ebx, [esi - 0x10]
push ebx
call fcn.1000c230
add esp, 4
lea edi, [eax + 0x10]
mov dword [ebp - 0x14], edi
jmp 0x1000c523
mov ecx, dword [esi - 0x10]
test ecx, ecx
je 0x1000c4d9
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x1000c4ef
call fcn.10001ca0
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x1000c5ed
mov eax, dword [ecx]
push 1
push ebx
call dword [eax]
test eax, eax
je 0x1000c5f7
lea edi, [eax + 0x10]
mov dword [ebp - 0x14], edi
cmp ebx, dword [edi - 8]
jg 0x1000c5fc
push ebx
push esi
push ebx
mov dword [edi - 0xc], ebx
push edi
mov byte [edi + ebx], 0
call fcn.10008170
add esp, 0x10
lea ebx, [esi - 0x10]
lea edx, [edi - 0x10]
mov byte [ebp - 4], 2
mov dword [ebp - 0x10], edx
cmp edx, ebx
je 0x1000c582
cmp dword [ebx + 0xc], 0
lea esi, [ebx + 0xc]
jl 0x1000c570
mov eax, dword [edx]
cmp eax, dword [ebx]
jne 0x1000c570
push edx
call fcn.1000c230
or edi, 0xffffffff
mov dword [ebp - 0x18], eax
add esp, 4
mov ecx, edi
lock xadd dword [esi], ecx
dec ecx
test ecx, ecx
jg 0x1000c565
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
lea esi, [eax + 0x10]
mov dword [ebp + 8], esi
jmp 0x1000c585
push dword [edi - 0xc]
lea ecx, [ebp + 8]
push edi
call fcn.1000cf50
mov esi, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
or edi, 0xffffffff
mov byte [ebp - 4], 1
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1000c59d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
xor ebx, ebx
test eax, eax
sete bl
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x1000c5cb
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
jmp 0x1000c5af
push 0x80004005
call fcn.100015b0
push 0x80004005
call fcn.100015b0
call fcn.10001810
push 0x80070057
call fcn.100015b0
int3