Function at 0x412d40
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46065b
mov eax, dword fs:[0]
push eax
sub esp, 0x338
mov eax, dword [0x476018]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [0x4feb94]
sub edi, dword [0x4feb90]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2e8], eax
mov dword [ebp - 0x2f0], ecx
mov dword [ebp - 0x2dc], edx
je 0x4131ff
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [0x4feb90]
push edi
push ecx
push eax
call sub.MSVCR100.dll_memcpy
add esp, 0xc
lea edx, [ebp - 0x2d8]
push edx
push ebx
push esi
mov dword [ebp - 0x2d8], ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
or eax, 0xffffffff
push 0x47a5f0
mov dword [ebp - method.ATL::CImage.virtual_0], vtable.ATL::CImage.0
mov dword [ebp - 0x328], ebx
mov dword [ebp - 0x324], ebx
mov dword [ebp - 0x320], ebx
mov dword [ebp - 0x31c], ebx
mov dword [ebp - 0x318], ebx
mov dword [ebp - 0x314], ebx
mov word [ebp - 0x310], bx
mov dword [ebp - 0x30c], eax
mov dword [ebp - 0x308], eax
mov dword [ebp - 0x304], ebx
mov dword [ebp - 0x300], ebx
mov dword [ebp - 0x2fc], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [0x47a608]
push 0x47a5f0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2d8]
push eax
lea ecx, [ebp - 0x32c]
push ecx
call fcn.00414f60
mov eax, dword [ebp - 0x2d8]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 0x2e8]
push ecx
push str.Account:__hs
lea edx, [ebp - 0x1e4]
call fcn.00414560
mov edx, dword [ebp - 0x2f0]
push edx
push str.Name:__hs
lea edx, [ebp - 0x24c]
call fcn.00414560
mov esi, dword [ebp - 0x2dc]
mov eax, esi
call fcn.00417e00
push eax
push str.IP_Address:__hs
lea edx, [ebp - 0x2b4]
call fcn.00414560
mov eax, esi
call fcn.00417e60
push eax
push str.Hwid:__hs
lea edx, [ebp - 0x17c]
call fcn.00414560
add esp, 0x20
lea ebx, [ebp - 0x32c]
call fcn.00414950
xor esi, esi
lea ecx, [ebp - 0x2e0]
push ecx
push eax
mov dword [ebp - 0x2e0], esi
call dword [sym.imp.gdiplus.dll_GdipCreateFromHDC]
mov edi, dword [ebp - 0x2e0]
lea edx, [ebp - 0x2f8]
push edx
push esi
push 0x46fa48
mov dword [ebp - 0x2f8], esi
call dword [sym.imp.gdiplus.dll_GdipCreateFontFamilyFromName]
fld dword [0x47052c]
mov dword [ebp - 0x2f4], eax
lea eax, [ebp - 0x2e4]
push eax
push 3
push esi
push ecx
mov ecx, dword [ebp - 0x2f8]
fstp dword [esp]
push ecx
mov dword [ebp - 0x2e4], esi
call dword [sym.imp.gdiplus.dll_GdipCreateFont]
mov edx, dword [ebp - 0x2f8]
mov ebx, dword [ebp - 0x2e4]
push edx
mov dword [ebp - 0x340], ebx
call dword [sym.imp.gdiplus.dll_GdipDeleteFontFamily]
lea eax, [ebp - 0x2ec]
push eax
push 0xffbd19ff
mov dword [ebp - 0x2ec], esi
call dword [sym.imp.gdiplus.dll_GdipCreateSolidFill]
fldz
mov eax, dword [ebp - 0x2ec]
fst dword [ebp - 0x2d4]
push eax
fst dword [ebp - 0x2d0]
push esi
fst dword [ebp - 0x2cc]
mov esi, dword [sym.imp.gdiplus.dll_GdipDrawString]
fstp dword [ebp - 0x2c8]
lea ecx, [ebp - 0x2d4]
push ecx
mov edx, ebx
push edx
mov dword [ebp - 0x334], eax
push 0xffffffffffffffff
lea eax, [ebp - 0x1e4]
push eax
mov ecx, edi
push ecx
call esi
fldz
mov edx, dword [ebp - 0x334]
fst dword [ebp - 0x2d4]
fld dword [0x470528]
push edx
push 0
fstp dword [ebp - 0x2d0]
lea eax, [ebp - 0x2d4]
push eax
push ebx
fst dword [ebp - 0x2cc]
push 0xffffffffffffffff
fstp dword [ebp - 0x2c8]
lea ecx, [ebp - 0x24c]
push ecx
push edi
call esi
fldz
mov edx, dword [ebp - 0x334]
fst dword [ebp - 0x2d4]
fld dword [0x470524]
push edx
fstp dword [ebp - 0x2d0]
push 0
lea eax, [ebp - 0x2d4]
fst dword [ebp - 0x2cc]
fstp dword [ebp - 0x2c8]
push eax
push ebx
push 0xffffffffffffffff
lea ecx, [ebp - 0x2b4]
push ecx
push edi
call esi
fldz
mov edx, dword [ebp - 0x334]
fst dword [ebp - 0x2d4]
fld dword [0x470520]
push edx
push 0
fstp dword [ebp - 0x2d0]
lea eax, [ebp - 0x2d4]
push eax
push ebx
fst dword [ebp - 0x2cc]
push 0xffffffffffffffff
fstp dword [ebp - 0x2c8]
lea ecx, [ebp - 0x17c]
push ecx
push edi
call esi
lea ebx, [ebp - 0x32c]
call fcn.004149a0
lea edx, [ebp - 0x2c4]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x2be]
movzx ecx, word [ebp - 0x2c2]
movzx edx, word [ebp - 0x2c4]
mov esi, dword [sym.imp.MSVCR100.dll_sprintf]
push eax
push ecx
push edx
lea eax, [ebp - 0x94]
push str.ScreenShots_04d__02d__02d
push eax
call esi
add esp, 0x14
push 0
lea ecx, [ebp - 0x94]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp - 0x2e8]
mov eax, ecx
lea edx, [eax + 1]
mov bl, byte [eax]
inc eax
test bl, bl
jne 0x4130d5
sub eax, edx
je 0x41311a
mov edx, dword [ebp - 0x2f0]
movzx eax, word [ebp - 0x2b8]
push edx
movzx edx, word [ebp - 0x2bc]
push ecx
movzx ecx, word [ebp - 0x2ba]
push eax
push ecx
push edx
lea eax, [ebp - 0x94]
push eax
lea ecx, [ebp - 0x114]
push str._s_02d__02d__02d__s__s_.jpg
push ecx
call esi
add esp, 0x20
jmp 0x413156
mov eax, dword [ebp - 0x2dc]
call fcn.00417e00
movzx edx, word [ebp - 0x2b8]
movzx ecx, word [ebp - 0x2bc]
push eax
movzx eax, word [ebp - 0x2ba]
push edx
push eax
push ecx
lea edx, [ebp - 0x94]
push edx
lea eax, [ebp - 0x114]
push str._s_02d__02d__02d_IP__hs_.jpg
push eax
call esi
add esp, 0x1c
lea ecx, [ebp - 0x32c]
push ecx
lea ebx, [ebp - 0x114]
call fcn.00414160
mov esi, dword [ebp - 0x2dc]
mov eax, esi
call fcn.00417e00
push eax
push esi
push 0x46fab4
push 1
call fcn.00417be0
mov ecx, dword [ebp - 0x328]
xor eax, eax
add esp, 0x10
cmp ecx, eax
je 0x4131d3
or edx, 0xffffffff
push ecx
mov dword [ebp - 0x328], eax
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x320], eax
mov dword [ebp - 0x31c], eax
mov dword [ebp - 0x314], eax
mov dword [ebp - 0x318], eax
mov dword [ebp - 0x30c], edx
mov dword [ebp - 0x308], edx
mov word [ebp - 0x310], ax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [ebp - 0x334]
push edx
call dword [sym.imp.gdiplus.dll_GdipDeleteBrush]
mov eax, dword [ebp - 0x340]
push eax
call dword [sym.imp.gdiplus.dll_GdipDeleteFont]
push edi
call dword [sym.imp.gdiplus.dll_GdipDeleteGraphics]
lea ecx, [ebp - 0x32c]
call fcn.00415040
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00418a8f
mov esp, ebp
pop ebp
ret 4