Function at 0x1000cee50
Capabilities:
Create directory

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov dword [r11 + 0x20], r9d
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov eax, dword [0x10011bd40]
and qword [rsp + 0x48], 0
xor ebp, ebp
and qword [rsp + 0x30], rbp
mov dword [rsp + 0x50], eax
mov eax, dword [0x10011bd00]
mov r12, rcx
xor ebx, ebx
lea ecx, [rbp + 2]
and qword [r11 - 0x68], rbx
mov dword [rsp + 0x38], eax
xor r14d, r14d
xor r13d, r13d
mov qword [rsp + 0x40], rbx
call qword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
test eax, eax
jne 0x1000ceedc
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0xa170197
mov edi, eax
mov r8d, eax
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000cefe7
mov ebp, 1
lea rcx, [0x10000d750]
mov edx, ebp
call fcn.1000d39c4
mov edi, eax
test eax, eax
je 0x1000ceefc
mov edx, 0xa1c0197
jmp 0x1000ceeca
mov r15, qword [rsp + 0x108]
test r15, r15
je 0x1000cef0c
and qword [r15], rbx
mov rcx, r12
jmp 0x1000cef6b
mov rsi, qword [rsp + 0x30]
lea r8, [rsp + 0x3c]
xor edx, edx
mov rcx, rsi
call fcn.1000dcdbc
mov edi, eax
cmp eax, 0x80070002
jne 0x1000cf048
test rbx, rbx
jne 0x1000cf04c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
and qword [rsp + 0x30], r13
lea rdx, [rsp + 0x40]
mov rcx, r12
call fcn.1000b0d88
mov edi, eax
test eax, eax
jne 0x1000cf02c
mov rbx, qword [rsp + 0x40]
mov r12, rbx
mov rcx, rbx
lea rdx, [rsp + 0x30]
call fcn.1000b0bd4
mov edi, eax
test eax, eax
je 0x1000cef11
xor r9d, r9d
mov r8d, eax
mov edx, 0xa260197
xor ecx, ecx
call fcn.1000b51b8
mov rsi, qword [rsp + 0x30]
test rsi, rsi
je 0x1000cefa0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rbx, rbx
je 0x1000cefae
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r13, r13
je 0x1000cefbc
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x1000cefd4
mov edx, 2
mov rcx, rax
call qword [sym.imp.CRYPT32.dll_CertCloseStore]
test r14, r14
je 0x1000cefe7
mov edx, 2
mov rcx, r14
call qword [sym.imp.CRYPT32.dll_CertCloseStore]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1000ceff7
call qword [sym.imp.KERNEL32.dll_LocalFree]
test ebp, ebp
je 0x1000cf00f
lea rcx, [0x10000d750]
xor edx, edx
call fcn.1000d39c4
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, edi
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor r9d, r9d
mov r8d, eax
mov edx, 0xa310197
xor ecx, ecx
call fcn.1000b51b8
mov rbx, qword [rsp + 0x40]
jmp 0x1000cefa0
test eax, eax
je 0x1000cf056
mov edx, 0xa360197
jmp 0x1000cf294
mov r12, qword [rsp + 0xd8]
lea r8, [rsp + 0x68]
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x1000cf079
test byte [rsp + 0x68], 0x10
jne 0x1000cf0a7
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1000cf0a7
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edi, eax
cmp eax, 0x800700b7
je 0x1000cf0a7
mov edx, 0xa490197
jmp 0x1000cf294
or r8, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
mov rcx, r8
repne scasw ax, word [rdi]
mov rdi, r12
not rcx
sub rcx, rbp
mov rdx, rcx
mov rcx, r8
repne scasw ax, word [rdi]
not rcx
sub rcx, rbp
lea rdi, [rdx + rcx + 6]
xor ecx, ecx
lea rdx, [rdi + rdi]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r13, rax
test rax, rax
jne 0x1000cf0f9
mov edi, 0x8007000e
mov edx, 0xa530197
mov r8d, edi
jmp 0x1000cf297
mov r8, r12
mov rdx, rdi
mov rcx, rax
call fcn.100038b1c
lea r8, [0x100014f4c]
mov rdx, rdi
mov rcx, r13
call fcn.100038a50
mov r8, rsi
mov rdx, rdi
mov rcx, r13
call fcn.100038a50
lea r8, [0x100004d50]
mov rdx, rdi
mov rcx, r13
call fcn.100038a50
lea rdx, [0x100014c30]
xor r8d, r8d
mov qword [rsp + 0x20], rdx
lea ecx, [r8 + 0xa]
mov edx, ebp
mov r9d, 0x2c200
call qword [sym.imp.CRYPT32.dll_CertOpenStore]
mov rdi, rax
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x1000cf17f
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0xa680197
mov edi, eax
jmp 0x1000cf294
and qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
lea ecx, [r9 + 2]
mov edx, ebp
call qword [sym.imp.CRYPT32.dll_CertOpenStore]
mov r14, rax
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x1000cf1bb
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0xa740197
mov edi, eax
jmp 0x1000cf294
xor r12d, r12d
xor r14d, r14d
cmp dword [rsp + 0x3c], r12d
jbe 0x1000cf2ba
mov eax, dword [rsp + 0x50]
mov r9, qword [rsp + 0x30]
mov r8, rdi
mov edx, r12d
mov rcx, rsi
mov dword [rsp + 0x20], eax
call fcn.1000cece8
mov edi, eax
test eax, eax
je 0x1000cf1ff
xor r9d, r9d
mov r8d, eax
mov edx, 0xa800197
xor ecx, ecx
call fcn.1000b51b8
cmp edi, ebp
je 0x1000cf20a
test edi, edi
jne 0x1000cf21b
add r14d, ebp
add r12d, ebp
cmp r12d, dword [rsp + 0x3c]
jae 0x1000cf225
mov rdi, qword [rsp + 0x48]
jmp 0x1000cf1cc
mov edx, 0xa830197
jmp 0x1000cf2c4
test r14d, r14d
je 0x1000cf2ba
mov r14, qword [rsp + 0x30]
mov r9d, dword [rsp + 0xe8]
mov r8, qword [rsp + 0xe0]
lea rdx, [rsp + 0x58]
mov rcx, r14
mov dword [rsp + 0x20], 6
call fcn.1000cea5c
mov edi, eax
test eax, eax
je 0x1000cf265
mov edx, 0xa9b0197
jmp 0x1000cf294
neg dword [rsp + 0x38]
mov r8d, dword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
sbb r9d, r9d
mov rcx, r13
and r9d, reloc.certcli.dll_Ordinal_256
or r9d, 2
call sub.certcli.dll_Ordinal_225
mov edi, eax
test eax, eax
je 0x1000cf2a6
mov edx, 0xaa20197
mov r8d, eax
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000cef92
test r15, r15
je 0x1000cef92
mov qword [r15], r13
xor r13d, r13d
jmp 0x1000cef92
mov edi, 0x80092004
mov edx, 0xa8b0197
mov r8d, edi
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
mov r14, qword [rsp + 0x30]
jmp 0x1000cef92