Function at 0x10a1e50
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor edi, edi
push 2
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x20], edi
call dword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
test eax, eax
jne 0x10a1e90
call fcn.01091f1e
mov esi, eax
push esi
push 0xa170197
jmp 0x10a20e8
xor eax, eax
inc eax
push eax
push 0x10027dc
mov dword [ebp - 0x1c], eax
call fcn.010a72b9
mov esi, eax
cmp esi, edi
je 0x10a1eb2
push esi
push 0xa1c0197
jmp 0x10a20e8
mov eax, dword [ebp + 0x24]
cmp eax, edi
je 0x10a1ebb
mov dword [eax], edi
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ebx
jmp 0x10a1f05
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp - 4]
call fcn.010aed42
mov esi, eax
cmp esi, 0x80070002
jne 0x10a1f26
cmp dword [ebp - 8], edi
jne 0x10a1f2a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 8]
push eax
push ebx
mov dword [ebp - 4], edi
call fcn.0108d084
mov esi, eax
cmp esi, edi
jne 0x10a1f1b
mov ebx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push ebx
call fcn.0109099d
mov esi, eax
cmp esi, edi
je 0x10a1ec5
push esi
push 0xa260197
jmp 0x10a20e8
push esi
push 0xa310197
jmp 0x10a20e8
cmp esi, edi
je 0x10a1f35
push esi
push 0xa360197
jmp 0x10a20e8
push dword [ebp + 0xc]
call fcn.010a06fe
test eax, eax
jne 0x10a1f69
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10a1f69
call fcn.01091f1e
mov esi, eax
cmp esi, 0x800700b7
je 0x10a1f69
push esi
push 0xa490197
jmp 0x10a20e8
mov eax, dword [ebp + 0xc]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x10a1f6f
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, dword [ebp - 4]
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
cmp si, di
jne 0x10a1f85
sub eax, edx
sar eax, 1
lea esi, [eax + ecx + 6]
lea eax, [esi + esi]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
mov dword [ebp - 0xc], ebx
cmp ebx, edi
jne 0x10a1fbb
mov esi, 0x8007000e
push esi
push 0xa530197
jmp 0x10a20e8
push dword [ebp + 0xc]
push esi
push ebx
call fcn.0102dff2
push 0x1008b90
push esi
push ebx
call fcn.0102e02c
push dword [ebp - 4]
push esi
push ebx
call fcn.0102e02c
push 0x1001f14
push esi
push ebx
call fcn.0102e02c
mov esi, dword [sym.imp.CRYPT32.dll_CertOpenStore]
push 0x1009ca4
push 0x2c200
push edi
push 1
push 0xa
call esi
mov dword [ebp - 0x14], eax
cmp eax, edi
jne 0x10a2017
call fcn.01091f1e
mov esi, eax
push esi
push 0xa680197
jmp 0x10a20e8
push edi
push edi
push edi
push 1
push 2
call esi
mov dword [ebp - 0x10], eax
cmp eax, edi
jne 0x10a2039
call fcn.01091f1e
mov esi, eax
push esi
push 0xa740197
jmp 0x10a20e8
xor ebx, ebx
mov dword [ebp + 0xc], edi
cmp dword [ebp - 0x18], edi
jbe 0x10a207d
push dword [ebp + 0x20]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push ebx
push dword [ebp - 4]
call fcn.010a1d4c
mov esi, eax
cmp esi, edi
je 0x10a2066
push esi
push 0xa800197
call fcn.0108c503
cmp esi, 1
je 0x10a2072
cmp esi, edi
jne 0x10a208a
inc dword [ebp + 0xc]
inc ebx
cmp ebx, dword [ebp - 0x18]
jb 0x10a2043
cmp dword [ebp + 0xc], edi
jne 0x10a2092
mov esi, 0x80092004
push esi
push 0xa8b0197
jmp 0x10a20e8
push esi
push 0xa830197
jmp 0x10a20e8
mov eax, dword [ebp + 0x1c]
neg eax
sbb eax, eax
and eax, 6
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0x24]
push dword [ebp + 0x10]
push eax
push dword [ebp - 0x10]
call fcn.010a0c34
mov esi, eax
cmp esi, edi
je 0x10a20bd
push esi
push 0xa9b0197
jmp 0x10a20e8
mov eax, dword [ebp + 0x18]
mov ebx, dword [ebp - 0xc]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 2
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x20]
push ebx
call sub.certcli.dll_Ordinal_225
mov esi, eax
cmp esi, edi
je 0x10a20ef
push esi
push 0xaa20197
call fcn.0108c503
jmp 0x10a20fb
mov eax, dword [ebp + 0x24]
cmp eax, edi
je 0x10a20fb
mov dword [eax], ebx
mov dword [ebp - 0xc], edi
cmp dword [ebp - 4], edi
je 0x10a2109
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 8], edi
je 0x10a2117
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0xc], edi
je 0x10a2125
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, dword [sym.imp.CRYPT32.dll_CertCloseStore]
cmp dword [ebp - 0x14], edi
je 0x10a2137
push 2
push dword [ebp - 0x14]
call ebx
cmp dword [ebp - 0x10], edi
je 0x10a2143
push 2
push dword [ebp - 0x10]
call ebx
cmp dword [ebp - 0x20], edi
je 0x10a2151
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x1c], edi
je 0x10a2167
push edi
push 0x10027dc
call fcn.010a72b9
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x20