Function at 0x108eb6f
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor edi, edi
push 2
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x20], edi
call dword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
test eax, eax
jne 0x108ebaf
call fcn.010a4804
mov esi, eax
push esi
push 0x9c60197
jmp 0x108ee07
xor eax, eax
inc eax
push eax
push 0x100259c
mov dword [ebp - 0x1c], eax
call fcn.0109322e
mov esi, eax
cmp esi, edi
je 0x108ebd1
push esi
push 0x9cb0197
jmp 0x108ee07
mov eax, dword [ebp + 0x24]
cmp eax, edi
je 0x108ebda
mov dword [eax], edi
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ebx
jmp 0x108ec24
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp - 4]
call fcn.01097db4
mov esi, eax
cmp esi, 0x80070002
jne 0x108ec45
cmp dword [ebp - 8], edi
jne 0x108ec49
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 8]
push eax
push ebx
mov dword [ebp - 4], edi
call fcn.0107b500
mov esi, eax
cmp esi, edi
jne 0x108ec3a
mov ebx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push ebx
call fcn.0107e4f0
mov esi, eax
cmp esi, edi
je 0x108ebe4
push esi
push 0x9d50197
jmp 0x108ee07
push esi
push 0x9e00197
jmp 0x108ee07
cmp esi, edi
je 0x108ec54
push esi
push 0x9e50197
jmp 0x108ee07
push dword [ebp + 0xc]
call fcn.0108cae0
test eax, eax
jne 0x108ec88
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x108ec88
call fcn.010a4804
mov esi, eax
cmp esi, 0x800700b7
je 0x108ec88
push esi
push 0x9f80197
jmp 0x108ee07
mov eax, dword [ebp + 0xc]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x108ec8e
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, dword [ebp - 4]
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
cmp si, di
jne 0x108eca4
sub eax, edx
sar eax, 1
lea esi, [eax + ecx + 6]
lea eax, [esi + esi]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
cmp ebx, edi
mov dword [ebp - 0xc], ebx
jne 0x108ecda
mov esi, 0x8007000e
push esi
push 0xa020197
jmp 0x108ee07
push dword [ebp + 0xc]
push esi
push ebx
call fcn.01028f74
push 0x1008080
push esi
push ebx
call fcn.0102920e
push dword [ebp - 4]
push esi
push ebx
call fcn.0102920e
push 0x1001d54
push esi
push ebx
call fcn.0102920e
mov esi, dword [sym.imp.CRYPT32.dll_CertOpenStore]
push 0x1009170
push 0x2c200
push edi
push 1
push 0xa
call esi
cmp eax, edi
mov dword [ebp - 0x14], eax
jne 0x108ed36
call fcn.010a4804
mov esi, eax
push esi
push 0xa170197
jmp 0x108ee07
push edi
push edi
push edi
push 1
push 2
call esi
cmp eax, edi
mov dword [ebp - 0x10], eax
jne 0x108ed58
call fcn.010a4804
mov esi, eax
push esi
push 0xa230197
jmp 0x108ee07
xor ebx, ebx
cmp dword [ebp - 0x18], edi
mov dword [ebp + 0xc], edi
jbe 0x108ed9c
push dword [ebp + 0x20]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push ebx
push dword [ebp - 4]
call fcn.0108ea6d
mov esi, eax
cmp esi, edi
je 0x108ed85
push esi
push 0xa2f0197
call fcn.0107ae44
cmp esi, 1
je 0x108ed91
cmp esi, edi
jne 0x108eda9
inc dword [ebp + 0xc]
inc ebx
cmp ebx, dword [ebp - 0x18]
jb 0x108ed62
cmp dword [ebp + 0xc], edi
jne 0x108edb1
mov esi, 0x80092004
push esi
push 0xa3a0197
jmp 0x108ee07
push esi
push 0xa320197
jmp 0x108ee07
mov eax, dword [ebp + 0x1c]
neg eax
sbb eax, eax
and eax, 6
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0x24]
push dword [ebp + 0x10]
push eax
push dword [ebp - 0x10]
call fcn.0108d015
mov esi, eax
cmp esi, edi
je 0x108eddc
push esi
push 0xa4a0197
jmp 0x108ee07
mov eax, dword [ebp + 0x18]
mov ebx, dword [ebp - 0xc]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 2
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x20]
push ebx
call sub.certcli.dll_Ordinal_225
mov esi, eax
cmp esi, edi
je 0x108ee0e
push esi
push 0xa510197
call fcn.0107ae44
jmp 0x108ee1a
mov eax, dword [ebp + 0x24]
cmp eax, edi
je 0x108ee1a
mov dword [eax], ebx
mov dword [ebp - 0xc], edi
cmp dword [ebp - 4], edi
je 0x108ee28
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 8], edi
je 0x108ee36
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0xc], edi
je 0x108ee44
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x14], edi
mov ebx, dword [sym.imp.CRYPT32.dll_CertCloseStore]
je 0x108ee56
push 2
push dword [ebp - 0x14]
call ebx
cmp dword [ebp - 0x10], edi
je 0x108ee62
push 2
push dword [ebp - 0x10]
call ebx
cmp dword [ebp - 0x20], edi
je 0x108ee70
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x1c], edi
je 0x108ee86
push edi
push 0x100259c
call fcn.0109322e
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x20