Function at 0x44ed90
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65f452
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x717dac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
push 0x400
mov dword [ebp - 0x42c], esi
push eax
mov dword [ebp - 0x428], eax
lea eax, [ebp - 0x410]
push eax
mov dword [ebp - 4], 0
call fcn.006319e0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
lea ecx, [ebp - 0x424]
push ecx
push eax
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
lea eax, [ebp - 0x410]
push eax
push 0
je 0x44ee2b
push dword [ebp - 0x424]
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
push dword [ebp - 0x424]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x44ee39
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov edi, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
test edi, edi
js 0x44ee6a
lea ecx, [ebp - 0x410]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44ee57
sub ecx, edx
lea eax, [ebp - 0x410]
push ecx
push eax
jmp 0x44ee71
push 0
push 0x6660c0
mov ecx, esi
call fcn.00449a80
push 1
push 0x6676c4
mov ecx, esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], 3
call fcn.00449920
mov byte [ebp - 0x41c], 0x68
mov al, 0x18
xor al, byte [ebp - 0x41c]
mov cl, 7
mov byte [ebp - 0x41b], al
mov dl, 0x1c
mov al, byte [ebp - 0x41c]
mov ch, 9
mov dh, 0x11
mov byte [ebp - 0x41d], 0x1a
xor cl, al
mov byte [ebp - 0x412], 0
xor dl, al
mov byte [ebp - 0x41a], cl
xor ch, al
mov byte [ebp - 0x419], dl
xor dh, al
mov byte [ebp - 0x416], ch
mov bl, 0x38
mov byte [ebp - 0x415], dh
mov ah, 4
mov byte [ebp - 0x412], 0
mov bh, 0xd
lea ecx, [ebp - 0x41b]
xor bl, al
lea edx, [ecx + 1]
xor ah, al
mov byte [ebp - 0x418], bl
xor bh, al
mov byte [ebp - 0x417], ah
mov al, byte [ebp - 0x41d]
xor al, byte [ebp - 0x41c]
mov byte [ebp - 0x414], bh
mov byte [ebp - 0x413], al
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44ef28
sub ecx, edx
lea eax, [ebp - 0x41b]
push ecx
push eax
mov ecx, esi
call fcn.00449920
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x44ef4a
mov eax, dword [esi]
push 0
push eax
call fcn.0063e845
add esp, 8
test eax, eax
je 0x44ef97
mov eax, dword fs:[0x2c]
mov ecx, dword [0x71ee68]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x71b438]
cmp eax, dword [ecx + 0x10]
jg 0x44efb5
cmp dword [esi + 0x14], 0x10
mov edi, esi
jb 0x44ef7f
mov edi, dword [esi]
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x44ef97
push 0x714040
push edi
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0062f00e
mov esp, ebp
pop ebp
ret
push 0x71b438
call fcn.0062ec6c
add esp, 4
cmp dword [0x71b438], 0xffffffff
jne 0x44ef75
push 0
lea eax, [ebp - 0x424]
push eax
push 1
push str.D:_A_OICI_GA___AU_
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
neg eax
mov dword [0x714048], 0
push 0x71b438
sbb eax, eax
and eax, dword [ebp - 0x424]
mov dword [0x714044], eax
call fcn.0062ec22
add esp, 4
jmp 0x44ef75