Function at 0x71cf3e00
Capabilities:
Create directory

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x71d11bb9
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x298
mov eax, dword [0x71d5a008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [0x71d7aab8]
xor edi, edi
test esi, esi
je 0x71cf3e57
cmp dword [esi + 0x14], 8
jb 0x71cf3e5c
mov esi, dword [esi]
jmp 0x71cf3e5c
mov esi, 0x71d54520
mov eax, dword [0x71d7aae4]
cmp dword [eax + 0x10], edi
jne 0x71cf4220
xorps xmm0, xmm0
mov dword [ebp - 0x268], edi
movups xmmword [ebp - 0x280], xmm0
movq qword [ebp - 0x270], xmm0
mov dword [ebp - 4], 2
movups xmmword [ebp - 0x280], xmm0
mov dword [ebp - 0x270], 0
mov dword [ebp - 0x26c], 0
mov byte [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x270], 0
mov dword [ebp - 0x26c], 7
mov word [ebp - 0x280], ax
mov dword [ebp - 4], 3
mov dword [ebp - 0x268], eax
mov dword [ebp - 4], 4
movlpd qword [ebp - 0x254], xmm0
mov dword [ebp - 0x24c], eax
mov byte [ebp - 4], 7
movups xmmword [ebp - 0x264], xmm0
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x250], eax
mov byte [ebp - 4], 5
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x250], 7
mov word [ebp - 0x264], ax
mov byte [ebp - 4], 8
mov dword [ebp - 0x24c], eax
mov byte [ebp - 4], 9
mov eax, dword [0x71d7aaf4]
cmp dword [eax + 0x10], 0
je 0x71cf3f70
cmp dword [eax + 0x14], 8
jb 0x71cf3f3a
mov eax, dword [eax]
push eax
push esi
push str._sOem_s
lea eax, [ebp - 0x240]
push 0x104
push eax
call fcn.71ce5af0
add esp, 0x14
xor eax, eax
mov word [ebp - 0x3a], ax
push eax
push 0xffffffffffffffff
push eax
push eax
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x240]
push eax
jmp 0x71cf3f80
push 0
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x264]
push eax
push esi
mov edx, str.TempFolder
lea ecx, [ebp - 0x280]
call fcn.71cf3a40
add esp, 0x18
cmp dword [ebp - 0x270], 0
jne 0x71cf4048
cmp word [str.avast], 0
mov ecx, 0x71d54564
mov eax, str.avast
cmove eax, ecx
push eax
push 0x71d5661c
lea eax, [ebp - 0x34]
push 0x10
push eax
call fcn.71ce5af0
xor eax, eax
add esp, 0x10
mov word [ebp - 0x16], ax
mov eax, dword [0x71d7aaf0]
cmp dword [eax + 0x10], 0
jne 0x71cf4026
lea edx, [ebp - 0x280]
mov ecx, str.TEMP
call fcn.71cebef0
test eax, eax
je 0x71cf400d
lea edx, [ebp - 0x280]
mov ecx, 0x71d54ab0
call fcn.71cebef0
test eax, eax
je 0x71cf400d
lea ecx, [ebp - 0x280]
call fcn.71ceb530
cmp word [ebp - 0x34], 0
je 0x71cf4048
push ecx
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x280]
call fcn.71cf5050
jmp 0x71cf4048
lea ecx, [ebp - 0x280]
cmp ecx, eax
je 0x71cf4048
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x71cf403b
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x280]
call fcn.71ce7500
cmp dword [ebp - 0x26c], 8
lea ecx, [ebp - 0x280]
cmovae ecx, dword [ebp - 0x280]
xor edx, edx
call fcn.71ceb070
test eax, eax
js 0x71cf40ef
cmp dword [ebp - 0x26c], 8
lea eax, [ebp - 0x280]
mov ecx, dword [0x71d7a964]
cmovae eax, dword [ebp - 0x280]
mov dword [ebp - 0x2a0], eax
mov dword [ebp - 0x2a4], 1
mov dword [ebp - 0x244], ecx
test ecx, ecx
je 0x71cf40b9
push 0
call dword [0x71d122ac]
call dword [ebp - 0x244]
mov dword [ebp - 0x2a4], eax
mov eax, dword [ebp - 0x2a0]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x71cf40cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [0x71d7a964]
mov dword [ebp - 0x2a0], eax
test eax, eax
je 0x71cf40ef
push dword [ebp - 0x2a4]
mov ecx, eax
call dword [0x71d122ac]
call dword [ebp - 0x2a0]
lea ecx, [ebp - 0x280]
call fcn.71cf36b0
mov ecx, dword [0x71d7aae4]
lea eax, [ebp - 0x280]
cmp ecx, eax
je 0x71cf4124
cmp dword [ebp - 0x26c], 8
push dword [ebp - 0x270]
cmovae eax, dword [ebp - 0x280]
push eax
call fcn.71ce7500
mov ecx, dword [0x71d7aaf0]
lea eax, [ebp - 0x280]
cmp ecx, eax
je 0x71cf414e
cmp dword [ebp - 0x26c], 8
push dword [ebp - 0x270]
cmovae eax, dword [ebp - 0x280]
push eax
call fcn.71ce7500
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x24c]
test eax, eax
je 0x71cf4165
push eax
call fcn.71cf5a25
add esp, 4
mov byte [ebp - 4], 0xb
cmp dword [ebp - 0x250], 8
jb 0x71cf4190
cmp dword [ebp - 0x264], 0
je 0x71cf4190
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push dword [ebp - 0x264]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x250], 7
mov word [ebp - 0x264], ax
mov dword [ebp - 4], 0xc
mov eax, dword [ebp - 0x268]
test eax, eax
je 0x71cf41c7
push eax
call fcn.71cf5a25
add esp, 4
mov dword [ebp - 4], 0xd
cmp dword [ebp - 0x26c], 8
jb 0x71cf41fc
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x2a0], eax
test eax, eax
je 0x71cf41fc
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push dword [ebp - 0x2a0]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [ebp - 0x270], 0
mov dword [ebp - 0x26c], 7
mov word [ebp - 0x280], ax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [0x71d7aae8]
cmp dword [ecx + 0x10], 0
jne 0x71cf466a
xorps xmm0, xmm0
mov dword [ebp - 0x24c], 0
movups xmmword [ebp - 0x264], xmm0
movq qword [ebp - 0x254], xmm0
mov dword [ebp - 4], 0x10
movups xmmword [ebp - 0x264], xmm0
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x250], 0
mov byte [ebp - 4], 0xe
xor eax, eax
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x250], 7
mov word [ebp - 0x264], ax
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x24c], eax
mov dword [ebp - 4], 0x12
lea edx, [ebp - 0x264]
push 1
xor ecx, ecx
call fcn.71ce6c60
add esp, 4
test eax, eax
je 0x71cf42de
cmp dword [ebp - 0x250], 8
lea eax, [ebp - 0x264]
mov dword [ebp - 0x254], 0
cmovae eax, dword [ebp - 0x264]
xor ecx, ecx
mov word [eax], cx
jmp 0x71cf42ea
push ecx
lea ecx, [ebp - 0x264]
call fcn.71cf50f0
mov eax, dword [0x71d7aaf4]
cmp dword [eax + 0x10], 0
je 0x71cf437f
cmp dword [eax + 0x14], 8
jb 0x71cf4301
mov eax, dword [eax]
push eax
push esi
push str._sOem_s
lea eax, [ebp - 0x240]
push 0x104
push eax
call fcn.71ce5af0
mov ecx, dword [0x71d7aaec]
xor eax, eax
add esp, 0x14
mov word [ebp - 0x3a], ax
cmp dword [ecx + 0x10], eax
jne 0x71cf4636
push eax
push 1
push 0x71d568c8
push 0x71d1ac20
lea eax, [ebp - 0x264]
mov edx, str.ProgramFolder
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.71cf3a40
mov edi, eax
add esp, 0x18
test edi, edi
je 0x71cf4636
mov ecx, dword [0x71d7aaf4]
mov edx, ecx
cmp dword [ecx + 0x14], 8
jb 0x71cf4373
mov edx, dword [ecx]
xor eax, eax
mov dword [ecx + 0x10], 0
mov word [edx], ax
mov ecx, dword [0x71d7aaec]
cmp dword [ecx + 0x10], 0
jne 0x71cf43b0
push 0
push 1
push 0x71d568c8
push 0x71d1ac20
lea eax, [ebp - 0x264]
mov edx, str.ProgramFolder
push eax
push esi
call fcn.71cf3a40
add esp, 0x18
mov edi, eax
test edi, edi
jne 0x71cf44e9
cmp word [str.avast5.ini], di
mov eax, 0x71d54570
mov ecx, str.avast5.ini
mov dword [ebp - 0x244], edi
cmovne eax, ecx
mov dword [ebp - 0x248], eax
mov eax, dword [0x71d7aae8]
cmp dword [eax + 0x10], edi
jne 0x71cf44e9
xorps xmm0, xmm0
mov dword [ebp - 0x284], edi
movups xmmword [ebp - 0x29c], xmm0
movq qword [ebp - 0x28c], xmm0
mov byte [ebp - 4], 0x15
movups xmmword [ebp - 0x29c], xmm0
mov dword [ebp - 0x28c], edi
mov dword [ebp - 0x288], edi
mov byte [ebp - 4], 0x13
xor eax, eax
mov dword [ebp - 0x28c], edi
mov dword [ebp - 0x288], 7
mov word [ebp - 0x29c], ax
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x284], eax
mov byte [ebp - 4], 0x17
push ecx
lea ecx, [ebp - 0x29c]
call fcn.71cf25d0
add esp, 4
mov dword [ebp - 0x2a0], eax
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x284]
test ecx, ecx
je 0x71cf446c
push ecx
call fcn.71cf5a25
add esp, 4
mov byte [ebp - 4], 0x19
cmp dword [ebp - 0x288], 8
jb 0x71cf4493
mov edi, dword [ebp - 0x29c]
test edi, edi
je 0x71cf4493
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [ebp - 0x28c], 0
mov dword [ebp - 0x288], 7
mov word [ebp - 0x29c], ax
mov byte [ebp - 4], 0x12
cmp dword [ebp - 0x2a0], eax
mov ecx, dword [0x71d7aae8]
push 0
sete al
push eax
lea eax, [ebp - 0x248]
push eax
push str.data
lea eax, [ebp - 0x264]
push eax
push esi
mov edx, str.DataFolder
call fcn.71cf3a40
mov edi, eax
add esp, 0x18
mov dword [ebp - 4], 0x1a
mov eax, dword [ebp - 0x24c]
test eax, eax
je 0x71cf4503
push eax
call fcn.71cf5a25
add esp, 4
mov dword [ebp - 4], 0x1b
cmp dword [ebp - 0x250], 8
jb 0x71cf452d
mov esi, dword [ebp - 0x264]
test esi, esi
je 0x71cf452d
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x250], 7
mov word [ebp - 0x264], ax
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x71cf4664
mov word [ebp - 0x240], ax
lea eax, [ebp - 0x240]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x240]
push 0x5c
push eax
call fcn.71cf6e2b
add esp, 8
test eax, eax
je 0x71cf4664
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [0x71d7aaec]
cmp dword [ecx + 0x10], 0
jne 0x71cf45c3
lea edx, [ebp - 0x240]
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x71cf45a7
sub edx, esi
lea eax, [ebp - 0x240]
sar edx, 1
push edx
push eax
call fcn.71ce7500
lea ecx, [ebp - 0x240]
add ecx, 0xfffffffe
nop dword [eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x71cf45d0
mov eax, dword [str.DATA]
mov dword [ecx], eax
mov eax, dword [0x71d56638]
mov dword [ecx + 4], eax
mov eax, dword [0x71d5663c]
mov dword [ecx + 8], eax
mov ecx, dword [0x71d7aae8]
cmp dword [ecx + 0x10], 0
jne 0x71cf4632
lea edx, [ebp - 0x240]
lea esi, [edx + 2]
nop dword [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x71cf4610
sub edx, esi
lea eax, [ebp - 0x240]
sar edx, 1
push edx
push eax
call fcn.71ce7500
mov ecx, dword [0x71d7aae8]
xor edi, edi
jmp 0x71cf466a
mov ecx, dword [0x71d7aae8]
cmp dword [ecx + 0x10], 0
jne 0x71cf44e9
push 0
push 0xffffffffffffffff
push 0
push str.data
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x240]
push eax
jmp 0x71cf44da
mov ecx, dword [0x71d7aae8]
mov eax, dword [0x71d7aab4]
cmp dword [eax + 0x10], 0
jne 0x71cf46b6
cmp dword [ecx + 0x10], 0
je 0x71cf46b6
cmp eax, ecx
je 0x71cf4698
cmp dword [ecx + 0x14], 8
mov edx, dword [ecx + 0x10]
jb 0x71cf468a
mov ecx, dword [ecx]
push edx
push ecx
mov ecx, eax
call fcn.71ce7500
mov eax, dword [0x71d7aab4]
cmp word [str.avast5.ini], 0
mov edx, str.avast5.ini
mov ecx, 0x71d54570
cmovne ecx, edx
push ecx
push ecx
mov ecx, eax
call fcn.71cf5050
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.71cf548b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret