Function at 0x1002db60
Capabilities:
Create directory
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x48c
mov eax, dword [0x10086084]
xor eax, esp
mov dword [esp + 0x488], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [esp + 0x280]
push esi
xor ecx, ecx
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push 0x208
push ecx
push eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x38], ecx
call sub.msvcrt.dll_memset
add esp, 0xc
xor eax, eax
mov dword [esp + 0x38], eax
push 0x208
push eax
lea eax, [esp + 0x88]
push eax
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [esp + 0x74], 0x11
add esp, 0xc
mov dword [esp + 0x1c], eax
mov byte [esp + 0x6c], al
mov dword [esp + 0x70], 0x12
mov byte [esp + 0x74], al
mov dword [esp + 0x78], 8
mov byte [esp + 0x7c], al
mov dword [esp + 0x34], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x28], eax
test ebx, ebx
je 0x1002e102
test edi, edi
je 0x1002e102
cmp word [edi], ax
je 0x1002e102
cmp dword [ebx], 0xfeedf002
jne 0x1002e102
test dword [ebp + 0x10], 0xfffdefff
jne 0x1002e102
mov ecx, edi
call fcn.10080e5a
test eax, eax
je 0x1002e10a
push esi
xor edx, edx
mov ecx, edi
call fcn.1003670e
mov ecx, eax
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x1002e10a
mov eax, dword [ebp + 0x10]
test eax, 0x20000
jne 0x1002dce0
push esi
lea edx, [esp + 0x20]
mov ecx, ebx
call fcn.10030a2b
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x68]
push 3
call fcn.10039af9
mov esi, eax
test esi, esi
jns 0x1002dcd1
push esi
push 0x82
mov ecx, 0x10006414
call fcn.1003a254
test esi, 0x10000000
je 0x1002dcba
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
cmp eax, 0x13d
je 0x1002dccb
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov esi, eax
jmp 0x1002dccb
mov eax, esi
and eax, 0x1fff0000
cmp eax, 0x70000
jne 0x1002dccb
movzx esi, si
push esi
jmp 0x1002e104
mov eax, dword [ebp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x34], 1
test eax, 0x1000
je 0x1002dcfd
movzx eax, word [ecx]
lea edx, [ebp + 0x10]
push eax
mov ecx, ebx
call fcn.10035c4d
test eax, eax
je 0x1002e10a
mov ecx, dword [esp + 0x14]
mov edx, 0x10003c78
call fcn.10080125
mov dword [esp + 0x3c], eax
test eax, eax
jne 0x1002dd20
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1002de5e
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x28]
push eax
call fcn.1003ab83
test eax, eax
je 0x1002de5e
mov edx, dword [esp + 0x28]
mov ecx, ebx
call fcn.100314aa
lea eax, [esp + 0x20]
push eax
push 1
push 0
call fcn.10030b0c
mov edx, eax
mov ecx, edi
call fcn.10060ba6
mov esi, eax
test esi, esi
jns 0x1002dda6
push esi
push 0xaa
mov ecx, 0x10006414
call fcn.1003a254
test esi, 0x10000000
je 0x1002dd8d
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
cmp eax, 0x13d
je 0x1002dd9e
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
jmp 0x1002dda0
mov eax, esi
and eax, 0x1fff0000
cmp eax, 0x70000
movzx eax, si
je 0x1002dda0
mov eax, esi
push eax
jmp 0x1002dd15
push dword [esp + 0x24]
mov ecx, ebx
mov dword [esp + 0x34], 1
push dword [esp + 0x24]
call fcn.10030997
test eax, eax
jne 0x1002ddf5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1002ddd6
movzx esi, si
or esi, 0x80070000
push 0xba
push 0x10006414
push esi
push 0x10003cf8
xor edi, edi
mov edx, ebx
push edi
push 2
pop ecx
call fcn.1002fae3
jmp 0x1002ddf7
xor edi, edi
test esi, esi
js 0x1002de0f
mov ecx, ebx
call fcn.100310f1
mov dword [esp + 0x2c], eax
test eax, eax
jne 0x1002de0f
mov esi, 0x80070006
push ecx
push edi
push edi
mov edx, 0x9478
mov ecx, ebx
call fcn.1002894a
test dword [ebp + 0x10], 0x1000
je 0x1002e03a
push 0xa
pop ecx
xor eax, eax
lea edi, [esp + 0x40]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x14]
mov edx, 0x10006440
call fcn.10080125
mov edi, eax
mov dword [esp + 0x38], edi
test edi, edi
jne 0x1002df2d
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [esp + 0x10]
test dword [ebp + 0x10], 0x1000
je 0x1002de97
cmp dword [esp + 0x18], 0
je 0x1002de97
lea eax, [esp + 0x288]
push eax
push ecx
push ecx
lea ecx, [esp + 0x8c]
call fcn.100825dc
xor eax, eax
lea ecx, [esp + 0x80]
push eax
push eax
push 5
pop edx
call fcn.1008291e
test esi, esi
jns 0x1002dec1
cmp dword [esp + 0x30], 0
je 0x1002dec1
push dword [esp + 0x24]
mov ecx, ebx
push dword [esp + 0x24]
call fcn.10030b0c
mov ecx, eax
call fcn.10060e76
push 0
push edi
push ebx
call sym.WIMGAPI.DLL_WIMApplyImage
cmp dword [esp + 0x34], 0
je 0x1002dede
test dword [esp + 0x1c], 0x20000
jne 0x1002dede
push 3
pop edx
lea ecx, [esp + 0x68]
call fcn.10039c22
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x1002def6
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esp + 0x14]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x38]
test eax, eax
je 0x1002df21
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
not esi
shr esi, 0x1f
mov eax, esi
jmp 0x1002e10c
mov ecx, edi
call fcn.10080e5a
test eax, eax
jne 0x1002df3f
push 0x32
jmp 0x1002de54
lea ecx, [esp + 0x288]
call fcn.10036069
mov esi, eax
test esi, esi
jns 0x1002df89
test esi, 0x10000000
je 0x1002df70
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
cmp eax, 0x13d
je 0x1002df81
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
jmp 0x1002df83
mov eax, esi
and eax, 0x1fff0000
cmp eax, 0x70000
movzx eax, si
je 0x1002df83
mov eax, esi
push eax
jmp 0x1002de54
lea ecx, [esp + 0x288]
call fcn.10080e5a
test eax, eax
je 0x1002df38
mov ecx, ebx
call fcn.10030ae2
push eax
mov edx, 0x104
lea ecx, [esp + 0x84]
call fcn.10015ac7
mov esi, eax
test esi, esi
js 0x1002de5a
mov edx, 0x104
lea ecx, [esp + 0x80]
call fcn.10036ede
mov esi, eax
test esi, esi
js 0x1002de5a
push 0
lea eax, [esp + 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1002de5a
lea eax, [esp + 0x80]
push eax
push ecx
push ecx
lea ecx, [esp + 0x294]
call fcn.100825dc
test eax, eax
je 0x1002de5a
and dword [esp + 0x48], 0
lea eax, [esp + 0x288]
lea ecx, [esp + 0x40]
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], eax
call fcn.10082d99
test eax, eax
je 0x1002de5a
mov dword [esp + 0x18], 1
test esi, esi
js 0x1002de5a
mov ecx, ebx
call fcn.1003a5ed
call fcn.1003a815
mov edx, eax
mov ecx, ebx
call fcn.1003105f
mov edi, dword [esp + 0x2c]
cmp dword [edi], 0
je 0x1002e078
push dword [edi]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x1002e078
and dword [edi], 0
mov esi, dword [esp + 0x10]
mov ecx, esi
call fcn.10036a6b
push edi
push edi
push esi
mov edx, esi
mov dword [edi], eax
mov ecx, ebx
call fcn.1002e123
mov esi, eax
test esi, esi
jns 0x1002e0ac
push esi
push 0x11a
mov ecx, 0x10006414
call fcn.1003a254
jmp 0x1002de5a
push ecx
push 0
push 0x1e
mov edx, 0x9478
mov ecx, ebx
call fcn.1002894a
push dword [esp + 0x18]
mov ecx, ebx
push edi
push edi
mov edi, dword [esp + 0x1c]
mov edx, edi
push edi
call fcn.1002e30d
mov esi, eax
test esi, esi
jns 0x1002e0ec
push esi
push 0x126
mov ecx, 0x10006414
call fcn.1003a254
jmp 0x1002de5e
push ecx
push 0
push 0x64
mov edx, 0x9478
mov ecx, ebx
call fcn.1002894a
jmp 0x1002de5e
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [esp + 0x494]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10083b20
mov esp, ebp
pop ebp
ret 0xc