Function at 0x11070720
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x111ddb33
mov eax, dword fs:[0]
push eax
sub esp, 0x16c
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push str.Client
mov ecx, esi
mov dword [ebp - 0x134], esi
call fcn.110bf1d0
mov esi, dword [esi + 0x2c]
push 3
push 9
push str.DisableRemoteCmd
push str.Client
mov ecx, esi
call fcn.110bbd40
push 3
push 9
push str.DisablePowerShell
push str.Client
mov ecx, esi
call fcn.110bbd40
push 3
push 9
push str.DisableInventory
push str.Client
mov ecx, esi
call fcn.110bbd40
push 3
push 9
push 0x1120a0ac
push str.Client
mov ecx, esi
call fcn.110bbd40
push 3
push 9
push str.DisableJoinClass
push str.Client
mov ecx, esi
call fcn.110bbd40
push 3
push 9
push str.DisableReplayMenu
push str.Client
mov ecx, esi
call fcn.110bbd40
push 3
push 9
push str.DisableJournal
push str.Client
mov ecx, esi
call fcn.110bbd40
push 3
push 9
push str.DisableJournalMenu
push str.Client
mov ecx, esi
call fcn.110bbd40
push 3
push 9
push str.DisableAudio
push str.Client
mov ecx, esi
call fcn.110bbd40
push 3
push 9
push str.DisableSounds
push str.Client
mov ecx, esi
call fcn.110bbd40
cmp dword [0x1127aa48], 0x180003
jge 0x11070859
push 3
push 1
push 0x1120a004
push str.Client
mov ecx, esi
call fcn.110bbd40
push 3
push 1
push str.DisableHelp
push str.Client
mov ecx, esi
call fcn.110bbd40
push 1
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x110708b4
push 4
push str.pcigateway
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
je 0x1107089b
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x110708ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jne 0x110708ad
mov ebx, 0xc0d
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 3
push ebx
push str.WebServerPort
push 0x11218828
mov ecx, esi
call fcn.110bbd40
push 3
push 1
push str.WebServer
push 0x11218828
mov ecx, esi
call fcn.110bbd40
cmp dword [0x1127ad00], 0
je 0x110709f0
lea eax, [ebp - 0x12c]
push eax
mov dword [ebp - 0x12c], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x110709f0
cmp byte [ebp - 0x12], 3
jne 0x110709f0
lea ecx, [ebp - 0x148]
call fcn.110701a0
lea ecx, [ebp - 0x148]
push str.Remote_Desktop_Services
push ecx
mov dword [ebp - 4], 0
call fcn.1106e060
add esp, 8
test al, al
jne 0x11070995
lea edx, [ebp - 0x130]
push edx
lea eax, [ebp - 0x138]
push eax
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x130], 0x12
call fcn.111c0db0
mov edi, dword [ebp - 0x144]
cmp dword [eax], edi
jne 0x11070995
mov eax, dword [edi]
mov dword [ebp - 0x130], eax
cmp eax, edi
je 0x110709bd
jmp 0x11070980
lea ecx, [ebp - 0x130]
call fcn.110926b0
cmp dword [ebp - 0x130], edi
jne 0x11070980
jmp 0x110709bd
push str.detected_TS_feature_n
call fcn.111bd7b0
add esp, 4
push 3
push 1
push str.DisableConsoleClient
push 0x11218928
mov ecx, esi
call fcn.110bbd40
mov edi, dword [ebp - 0x144]
mov eax, dword [edi]
push edi
push eax
lea ecx, [ebp - 0x138]
push ecx
lea ecx, [ebp - 0x148]
mov dword [ebp - 4], 1
call fcn.1106e230
mov edx, dword [ebp - 0x144]
push edx
mov dword [ebp - 4], 0xffffffff
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
push 3
push 1
push str.ImpersonateCurrentUser
push str.Client
mov ecx, esi
call fcn.110bbd40
push 3
push str.cic_lock_image.jpg
push str.ImageFile
push str.Client
mov ecx, esi
call fcn.110bbcf0
push 3
push 0x1124b64c
push str.Usernames
push str.Client
mov ecx, esi
call fcn.110bbcf0
push 3
push 1
push str.Silent
push str.Client
mov ecx, esi
call fcn.110bbd40
push 3
push 3
push str.Protocols
push str.Client
mov ecx, esi
call fcn.110bbd40
push 3
push 0x4e20
push str.DisconnectTimeout
push str.General
mov ecx, esi
call fcn.110bbd40
push 3
push 1
push str.UseNCS
push str.TCPIP
mov ecx, esi
call fcn.110bbd40
push 3
push 1
push 0x11209ea0
push 0x11218828
mov ecx, esi
call fcn.110bbd40
push 3
push 1
push str.SSLOnly
push 0x11218828
mov ecx, esi
call fcn.110bbd40
push 3
push 1
push str.WebSocket
push 0x11218828
mov ecx, esi
call fcn.110bbd40
push 3
push 2
push str.WiredNetworkSpeed
push 0x11218828
mov ecx, esi
call fcn.110bbd40
push 0
push 3
push 6
call fcn.111bb9f0
add esp, 0xc
test eax, eax
je 0x11070b07
push 3
push 4
push str.WinHttp
push 0x11218828
mov ecx, esi
call fcn.110bbd40
push 3
push 8
push str.limitcolorbits
push str.View
mov ecx, esi
call fcn.110bbd40
push 3
push 1
push str.ClassCodes
push str.Client
mov ecx, esi
call fcn.110bbd40
push 3
push 1
push str.NoAckWhenInRoom
push str.Client
mov ecx, esi
call fcn.110bbd40
push 3
push 0xa
push 0x111fb8d4
push str._License
mov ecx, esi
call fcn.110bbd40
push 3
push 0x14
push 0x111fb860
push str._License
mov ecx, esi
call fcn.110bbd40
push 3
push 0x2a
push str.tracesend
push 0x11218828
mov ecx, esi
call fcn.110bbd40
push 3
push 0x2a
push str.tracerecv
push 0x11218828
mov ecx, esi
call fcn.110bbd40
push 3
push 2
push str.tracefile
push str._debug
mov ecx, esi
call fcn.110bbd40
push 3
push 0x14
push 0x111fb860
push str._License
mov ecx, esi
call fcn.110bbd40
mov eax, dword [ebp - 0x134]
mov ecx, dword [eax + 0x30]
push 3
push 0x14
push 0x111fb860
push str._License
call fcn.110bbd40
lea ecx, [ebp - 0x158]
call fcn.1113dd30
lea ecx, [ebp - 0x158]
push ecx
mov dword [ebp - 4], 2
call fcn.1106b050
add esp, 4
test al, al
je 0x11070c8e
cmp dword [0x1127ad10], 0
jne 0x11070c8e
push 0
push str.InstalledBy
push str.SoftwareNetSupport_Ltdclassroom.cloud
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.11143c30
add esp, 0x10
test eax, eax
je 0x11070c43
push 3
push eax
push str.shareType
push str.Client
mov ecx, esi
call fcn.110bbd40
mov edx, dword [ebp - 0x158]
mov eax, dword [edx]
lea ecx, [ebp - 0x158]
call eax
test al, al
jne 0x11070c6b
push 0x266
push str.e:_nsmsrc_nsm14101410fctl32NSMString.h
push str.IsA__
call fcn.11067750
mov ecx, dword [ebp - 0x14c]
push 3
push ecx
push str.shareVer
push str.Client
mov ecx, esi
call fcn.110bbcf0
push 3
push 0x11209d98
jmp 0x11070ca5
call fcn.111b8710
cmp eax, 0x14
jge 0x11070cb6
push 3
push 5
call fcn.11068bb0
add esp, 4
push eax
push 0x112071f4
push 0x11218828
mov ecx, esi
call fcn.110bbcf0
mov eax, str.cic_delta.zip
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], 0x11209d60
mov dword [ebp - 0x140], 0x11209d44
mov dword [ebp - 0x13c], 0
lea ebx, [ebp - 0x148]
push 1
push eax
call fcn.111bb700
mov edi, eax
mov dword [ebp - 0x138], edi
push 0
push edi
mov byte [ebp - 4], 3
call fcn.111be4e0
add esp, 0x10
mov byte [ebp - 4], 2
push edi
test eax, eax
jne 0x11070d21
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebx + 4]
add ebx, 4
add esp, 4
test eax, eax
jne 0x11070ce5
jmp 0x11070d43
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
mov ebx, dword [ebx]
add esp, 4
test ebx, ebx
je 0x11070d43
push 3
push ebx
push str.shareFile
push str.Client
mov ecx, esi
call fcn.110bbcf0
push 4
push str.RootCerts
call fcn.111bb700
mov edi, eax
add esp, 8
mov dword [ebp - 0x134], edi
push 0
push edi
mov byte [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
lea ecx, [ebp - 0x178]
call fcn.1113ccd0
push 0x11203288
push eax
lea edx, [ebp - 0x168]
push edx
mov byte [ebp - 4], 5
call fcn.1113dee0
add esp, 0xc
lea ecx, [ebp - 0x178]
mov byte [ebp - 4], 7
call fcn.1113cd80
mov eax, dword [ebp - 0x168]
mov edx, dword [eax]
lea ecx, [ebp - 0x168]
call edx
test al, al
jne 0x11070dc3
push 0x266
push str.e:_nsmsrc_nsm14101410fctl32NSMString.h
push str.IsA__
call fcn.11067750
mov eax, dword [ebp - 0x15c]
push 3
push eax
push str.SSLCertDir
push 0x11218828
mov ecx, esi
call fcn.110bbcf0
push 1
push str.rootcert.pem
call fcn.111bb700
mov edi, eax
mov dword [ebp - 0x138], edi
push 0
push edi
mov byte [ebp - 4], 8
call fcn.111be4e0
add esp, 0x10
test eax, eax
je 0x11070e18
push 3
push edi
push str.SSLDefCert
push 0x11218828
mov ecx, esi
call fcn.110bbcf0
push 1
push str.pcicl32.pdb
call fcn.111bb700
mov ebx, eax
mov dword [ebp - 0x130], ebx
push 0
push ebx
mov byte [ebp - 4], 9
call fcn.111be4e0
add esp, 0x10
test eax, eax
je 0x11070e54
push 3
push 1
push str.EnableStopClient
push str.Client
mov ecx, esi
call fcn.110bbd40
push esi
call fcn.1106bae0
push ebx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
push edi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 0xc
lea ecx, [ebp - 0x168]
mov byte [ebp - 4], 4
call fcn.1113cd80
mov ecx, dword [ebp - 0x134]
push ecx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
lea ecx, [ebp - 0x158]
mov dword [ebp - 4], 0xffffffff
call fcn.1113cd80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret