Function at 0x4e2056
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8c
mov eax, dword [0x5184d0]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push esi
push edi
mov dword [esp + 0x14], edx
mov eax, dword [ebp + 8]
lea ecx, [esp + 0x34]
mov dword [esp + 0x64], ecx
lea ecx, [esp + 0x38]
mov dword [esp + 0x6c], ecx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x30], eax
mov eax, dword [0x519974]
mov dword [esp + 0x74], ecx
lea ecx, [esp + 0x4c]
mov esi, dword [ebp + 0xc]
mov dword [esp + 0x24], eax
xor eax, eax
mov dword [esp + 0x7c], ecx
mov ebx, eax
mov dword [esp + 0x48], eax
lea ecx, [esp + 0x44]
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0xc], eax
lea eax, [esp + 0x64]
mov dword [esp + 0x84], ecx
lea ecx, [esp + 0x40]
push eax
push 6
mov dword [esp + 0x94], ecx
lea ecx, [esp + 0x34]
pop edx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x6c], 0x405ffc
mov dword [esp + 0x74], 0x405f80
mov dword [esp + 0x7c], 0x405f5c
mov dword [esp + 0x84], 0x405f48
mov dword [esp + 0x8c], 0x405fac
mov dword [esp + 0x94], 0x42fbb0
call fcn.004e16dc
mov edi, eax
test edi, edi
je 0x4e215f
push edi
push 0x42e0197
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x4e240f
cmp dword [esp + 0x24], ebx
jne 0x4e2174
mov eax, 0x80070057
push eax
mov edi, eax
push 0x4330197
jmp 0x4e2154
test esi, esi
jne 0x4e2180
lea esi, [esp + 0x58]
mov dword [esp + 0x18], esi
mov edi, esi
xor eax, eax
push 2
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
test eax, eax
jne 0x4e21a2
call fcn.004c73cc
mov edi, eax
push edi
push 0x43f0197
jmp 0x4e2154
xor eax, eax
inc eax
push 0x11
mov edx, eax
mov dword [esp + 0x14], eax
pop ecx
call fcn.004e6904
mov edi, eax
test edi, edi
je 0x4e21c1
push edi
push 0x4440197
jmp 0x4e2154
mov esi, dword [esp + 0x30]
test esi, esi
jne 0x4e21d9
mov edi, 0x80004003
push edi
push 0x4490197
jmp 0x4e2154
test dword [esp + 0x14], 0xfffffcfc
je 0x4e21f5
mov eax, 0x80070057
push eax
mov edi, eax
push 0x44e0197
jmp 0x4e2154
mov ecx, esi
call fcn.004e1f43
test eax, eax
jne 0x4e2226
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4e2226
call fcn.004c73cc
mov edi, eax
cmp edi, 0x800700b7
je 0x4e2226
push edi
push 0x4580197
jmp 0x4e2154
lea eax, [esp + 0x20]
mov edx, 0x42f9dc
push eax
push ecx
mov ecx, esi
call fcn.004cc4cd
mov edi, eax
test edi, edi
je 0x4e2253
push edi
push 0x4620197
call dword [sym.imp.certcli.dll_Ordinal_357]
mov ebx, dword [esp + 0x20]
jmp 0x4e240f
mov esi, dword [esp + 0x14]
mov edx, esi
mov ebx, dword [esp + 0x20]
mov ecx, ebx
shr edx, 8
and edx, dword [esp + 0x10]
call fcn.004e1fbf
mov edi, eax
test edi, edi
je 0x4e227c
push edi
push 0x4670197
jmp 0x4e2154
test esi, 0x200
jne 0x4e240f
mov esi, dword [esp + 0x34]
lea eax, [esp + 0x50]
push eax
push dword [esp + 0x28]
mov ecx, esi
call dword [0x51cbac]
call esi
mov edi, eax
test edi, edi
je 0x4e22b0
push edi
push 0x46d0197
jmp 0x4e2154
cmp dword [esp + 0x50], 0
jne 0x4e22c7
mov edi, 0x800706ba
push edi
push 0x4740197
jmp 0x4e2154
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0xc]
and ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x38]
push eax
mov dword [esp + 0x34], ecx
lea eax, [ecx + 1]
push eax
push ecx
push dword [esp + 0x30]
mov ecx, esi
call dword [0x51cbac]
call esi
mov edi, eax
test edi, edi
je 0x4e2300
push edi
push 0x4850197
jmp 0x4e2154
cmp dword [esp + 0x30], 0
mov eax, dword [esp + 0x10]
mov dword [esp + 0x48], eax
jne 0x4e23ac
mov esi, dword [esp + 0x3c]
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x20]
mov ecx, esi
push eax
push dword [esp + 0x14]
call dword [0x51cbac]
call esi
mov edi, eax
test edi, edi
je 0x4e2340
push edi
push 0x48c0197
jmp 0x4e2154
lea eax, [esp + 0x28]
mov edx, 0x42f9f0
push eax
push ecx
mov ecx, ebx
call fcn.004cc4cd
mov edi, eax
test edi, edi
je 0x4e2363
push edi
push 0x4930197
jmp 0x4e2154
push 2
push dword [esp + 0x58]
push dword [esp + 0x24]
push dword [esp + 0x34]
call dword [sym.imp.certcli.dll_Ordinal_225]
mov edi, eax
test edi, edi
je 0x4e2388
push edi
push 0x49a0197
jmp 0x4e2154
mov esi, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push esi
push ebx
call fcn.004e19eb
mov edi, eax
test edi, edi
je 0x4e23b6
push edi
push 0x4a10197
jmp 0x4e2154
mov esi, dword [esp + 0x18]
mov dword [esi], 0x64
mov ecx, dword [esp + 0xc]
lea eax, [esi + 4]
push eax
push ebx
xor edx, edx
call fcn.004e19eb
mov edi, eax
test edi, edi
je 0x4e23d7
push edi
push 0x4ae0197
jmp 0x4e2154
test dword [esp + 0x14], 2
jne 0x4e2404
push dword [esp + 0xc]
mov esi, dword [esp + 0x44]
mov ecx, esi
call dword [0x51cbac]
call esi
mov edi, eax
test edi, edi
je 0x4e2404
push edi
push 0x4b40197
jmp 0x4e2154
mov eax, dword [esp + 0x18]
mov dword [eax + 8], 0x64
cmp dword [esp + 0x1c], 0
je 0x4e2428
push dword [esp + 0x1c]
mov esi, dword [esp + 0x48]
mov ecx, esi
call dword [0x51cbac]
call esi
cmp dword [esp + 0x48], 0
je 0x4e2459
push dword [esp + 0xc]
mov esi, dword [esp + 0x50]
mov ecx, esi
call dword [0x51cbac]
call esi
mov esi, eax
test esi, esi
je 0x4e2453
push esi
push 0x4c20197
call dword [sym.imp.certcli.dll_Ordinal_357]
test edi, edi
jne 0x4e2459
mov edi, esi
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4e2468
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
test ebx, ebx
je 0x4e2473
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [esp + 0x10], 0
je 0x4e248a
push 0x11
xor edx, edx
pop ecx
call fcn.004e6904
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp dword [esp + 0x2c], 0
je 0x4e249b
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x94]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005036b0
mov esp, ebp
pop ebp
ret 8