Function at 0x4e79cb
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x350
mov eax, dword [0x5836e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
or ebx, 0xffffffff
push edi
mov edi, dword [ebp + 8]
test esi, esi
je 0x4e7d7a
mov eax, dword [esi + 0x10]
xor ecx, ecx
test eax, eax
je 0x4e7a08
cmp eax, ebx
je 0x4e7a08
push eax
mov dword [esi + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x4e7a26
mov ecx, esi
call fcn.004e796f
push dword [ebp + 0xc]
mov ecx, esi
push edi
call fcn.004e7da5
test eax, eax
js 0x4e7d7a
mov eax, dword [esi + 8]
test eax, eax
je 0x4e7d7a
xor ecx, ecx
cmp word [eax], cx
je 0x4e7d7a
push 8
xor eax, eax
mov dword [ebp - 0x348], ebx
lea edi, [ebp - 0x34]
pop ecx
rep stosd dword es:[edi], eax
cmp dword [ebp + 0x10], eax
jbe 0x4e7a65
push dword [ebp + 0x10]
lea eax, [ebp - 0x34]
push 0x557c54
push eax
call fcn.00409b1f
add esp, 0xc
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
push 8
push 0x514870
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea edi, [esi + 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
cmp word [ebp - 0x14], 0
je 0x4e7a9c
cmp word [ebp - 0x12], 0
mov eax, 0x521b6c
jne 0x4e7aa1
mov eax, 0x514870
lea ecx, [ebp - 0x34]
push ecx
push 0x514870
push 0x52b38c
lea ecx, [ebp - 0x14]
push ecx
push eax
movzx eax, word [esi + 0x22]
push 0x1c
push 5
push 0x12
push eax
movzx eax, word [esi + 0x20]
push eax
movzx eax, word [esi + 0x1e]
push eax
movzx eax, word [esi + 0x1c]
push eax
movzx eax, word [esi + 0x1a]
push eax
movzx eax, word [esi + 0x16]
push eax
movzx eax, word [edi]
push eax
lea eax, [ebp - 0x340]
push str._i__02i__02i__i:_02i:_02i._03i_ConEmu__u_02u_02u_s_s__s_s__log_s
push eax
call fcn.00401133
mov eax, dword [esi + 4]
add esp, 0x44
test eax, eax
jne 0x4e7d1a
push dword [esi + 8]
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
xor ecx, ecx
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x344], edi
test eax, eax
je 0x4e7bc5
cmp word [eax], cx
je 0x4e7bc5
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 3
add edi, eax
push 2
push edi
call fcn.004e1c42
mov dword [esi + 4], eax
pop ecx
pop ecx
test eax, eax
je 0x4e7d7a
push dword [esi + 0xc]
push edi
push eax
call fcn.00401a0b
mov eax, dword [esi + 0xc]
push 0x5c
pop ecx
cmp word [eax + edi*2 - 2], cx
je 0x4e7b6b
push 0x524e5c
push edi
push dword [esi + 4]
call fcn.004019cd
push dword [esi + 8]
push edi
push dword [esi + 4]
call fcn.004019cd
xor edi, edi
push edi
push 0x80
push 2
push edi
push 1
push 0x40000000
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x10], eax
test eax, eax
je 0x4e7b9d
cmp eax, ebx
jne 0x4e7bbd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x348], eax
mov dword [esi + 0x10], edi
cmp dword [esi + 4], edi
je 0x4e7bbd
push dword [esi + 4]
call fcn.004e1bea
pop ecx
mov dword [esi + 4], edi
mov edi, dword [ebp - 0x344]
xor ecx, ecx
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x4e7d10
push 0x20a
push ecx
lea eax, [ebp - 0x240]
push eax
call fcn.004f5a90
add esp, 0xc
lea ecx, [ebp - 0x350]
push str.Shell32.dll
call fcn.004e3fe7
lea eax, [ebp - 0x344]
push eax
push 0x5683fc
lea ecx, [ebp - 0x350]
call fcn.00401080
cmp dword [ebp - 0x344], 0
je 0x4e7d02
lea eax, [ebp - 0x240]
push eax
xor eax, eax
push eax
push eax
push 0x8010
push eax
call dword [ebp - 0x344]
test eax, eax
jne 0x4e7d02
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x344], eax
add eax, 0x20
add edi, eax
push 2
push edi
call fcn.004e1c42
mov dword [esi + 4], eax
pop ecx
pop ecx
test eax, eax
jne 0x4e7c71
lea ecx, [ebp - 0x350]
call fcn.004e400d
jmp 0x4e7d7a
lea ecx, [ebp - 0x240]
push ecx
push edi
push eax
call fcn.00401a0b
mov ecx, dword [ebp - 0x344]
mov eax, 0x568410
push 0x5c
pop edx
cmp word [ebp + ecx*2 - 0x242], dx
mov edx, str.ConEmuLogs
cmove eax, edx
push eax
push edi
push dword [esi + 4]
call fcn.004019cd
xor eax, eax
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x524e5c
push edi
push dword [esi + 4]
call fcn.004019cd
push dword [esi + 8]
push edi
push dword [esi + 4]
call fcn.004019cd
xor edi, edi
push edi
push 0x80
push 2
push edi
push 1
push 0x40000000
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x10], eax
test eax, eax
je 0x4e7cf3
cmp eax, ebx
jne 0x4e7d02
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x348], eax
mov dword [esi + 0x10], edi
lea ecx, [ebp - 0x350]
call fcn.004e400d
mov eax, dword [esi + 0x10]
mov ecx, dword [ebp - 0x348]
xor edi, edi
jmp 0x4e7d54
xor edi, edi
cmp word [eax], di
je 0x4e7d7a
push edi
push 0x80
push 4
push edi
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x10], eax
test eax, eax
je 0x4e7d43
cmp eax, ebx
jne 0x4e7d52
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov dword [esi + 0x10], edi
mov eax, edi
jmp 0x4e7d54
mov ecx, ebx
test eax, eax
je 0x4e7d72
cmp eax, ebx
je 0x4e7d72
push 1
push edi
push edi
lea eax, [ebp - 0x340]
mov ecx, esi
push eax
call fcn.004e7f0a
xor eax, eax
jmp 0x4e7d7c
test ecx, ecx
mov dword [esi + 0x10], edi
cmovne ebx, ecx
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f4166
leave
ret 0xc