Function at 0x1800043d0
Capabilities:
Create directory

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x150
mov rax, qword [0x18004e020]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov r14, rcx
xorps xmm0, xmm0
movups xmmword [r11 - 0x68], xmm0
xor r15d, r15d
mov qword [r11 - 0x58], r15
mov qword [r11 - 0x50], r15
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], r15b
jne 0x180004420
lea rcx, [rsp + 0x110]
call fcn.180001b90
nop
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x70], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0xc8], xmm0
mov qword [rsp + 0xd8], 9
mov qword [rsp + 0xe0], socket
movsd xmm0, qword [str._CymArgs_]
movsd qword [rsp + 0xc8], xmm0
movzx eax, byte [0x180046b88]
mov byte [rsp + 0xd0], al
mov byte [rsp + 0xd1], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x98], xmm0
mov qword [rsp + 0xa8], r15
mov qword [rsp + 0xb0], r15
lea rsi, [rsp + 0x110]
cmp qword [rsp + 0x128], 0x10
cmovae rsi, qword [rsp + 0x110]
movabs rbx, 0x7fffffffffffffff
mov rdi, qword [rsp + 0x120]
cmp rdi, rbx
ja 0x180004d66
mov qword [rsp + 0xb0], socket
cmp rdi, 0x10
jae 0x180004508
mov qword [rsp + 0xa8], rdi
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x98], xmm0
jmp 0x1800045a6
mov rax, rdi
or rax, 0xf
cmp rax, rbx
jbe 0x180004544
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.18000eb84
mov rcx, rax
test rax, rax
je 0x180004d70
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x18000457e
mov rbx, rax
mov ecx, reloc.WS2_32.dll_shutdown
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x18000456f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180004d6b
jmp 0x180004522
test rcx, rcx
je 0x18000457b
call fcn.18000eb84
jmp 0x18000457e
mov rax, r15
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xb0], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.180010b10
nop
lea r8, [rsp + 0xc8]
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x30]
call fcn.180003c10
nop
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rsp + 0x38]
mov rax, rdx
mov rcx, qword [rsp + 0x30]
sub rax, rcx
sar rax, 5
mov ebx, r15d
cmp rbx, rax
jae 0x1800047fa
shl rbx, 5
lea rdx, [rcx + rbx]
lea rcx, [rsp + 0xf0]
call fcn.1800059a0
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.180003f00
nop
mov rax, qword [rsp + 0x80]
mov ecx, dword [rax + 0x10]
inc ecx
movsxd rcx, ecx
call fcn.18000ef40
mov r12, rax
mov rcx, qword [rsp + 0x80]
mov edx, dword [rcx + 0x30]
inc edx
movsxd rcx, edx
call fcn.18000ef40
mov r13, rax
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x80]
mov edi, dword [rcx + rbx + 0x10]
sub edi, dword [rdx + 0x10]
sub edi, dword [rdx + 0x30]
sub edi, 2
lea eax, [rdi + 1]
cdqe
mov qword [rsp + 0x60], rax
mov rcx, rax
call fcn.18000ef40
mov rsi, rax
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x80]
mov r8, qword [rcx + 0x10]
inc r8
xor edx, edx
mov rcx, r12
call fcn.1800111d0
mov rcx, qword [rsp + 0x80]
mov r8, qword [rcx + 0x30]
inc r8
xor edx, edx
mov rcx, r13
call fcn.1800111d0
mov r8, qword [rsp + 0x60]
xor edx, edx
mov rcx, rsi
call fcn.1800111d0
mov rdx, qword [rsp + 0x80]
mov r8, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x1800046d0
mov rdx, qword [rdx]
mov r8, qword [r8 + 0x10]
mov rcx, r12
call fcn.180010b10
mov rax, qword [rsp + 0x80]
lea rdx, [rax + 0x20]
cmp qword [rax + 0x38], 0x10
jb 0x1800046f3
mov rdx, qword [rax + 0x20]
mov r8, qword [rax + 0x30]
mov rcx, r13
call fcn.180010b10
mov rdx, qword [rsp + 0x30]
add rdx, rbx
mov rax, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x180004714
mov rax, qword [rdx]
movsxd r8, edi
mov rdx, qword [rdx + 0x10]
sub rdx, r8
add rdx, rax
mov rcx, rsi
call fcn.180010b10
lea rbx, [r14 + 0x48]
mov rsi, qword [rbx]
movabs rax, 0x555555555555555
cmp qword [rbx + 8], rax
je 0x180004d76
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0xc0], 0
mov ecx, gethostbyname
call fcn.18000eb84
mov rcx, qword [rsp + 0x50]
mov qword [rax + 0x10], rcx
mov dword [rax + 0x18], edi
mov qword [rax + 0x20], r13
mov qword [rax + 0x28], r12
inc qword [rbx + 8]
mov rcx, qword [rsi + 8]
mov qword [rax], rsi
mov qword [rax + 8], rcx
xor r12d, r12d
mov qword [rsp + 0xc0], r12
mov qword [rsi + 8], rax
mov qword [rcx], rax
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x1800047f2
mov rdx, qword [rsp + 0x88]
call fcn.180001ca0
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x80]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800047ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180004d83
call fcn.18000e8e0
inc r15d
jmp 0x1800045d0
test rcx, rcx
je 0x180004852
call fcn.180001ca0
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000483a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180004d89
call fcn.18000e8e0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
xor r12d, r12d
mov qword [rsp + 0x40], r12
jmp 0x180004855
xor r12d, r12d
mov r13, qword [rsp + 0x128]
cmp r13, 0x10
jb 0x1800048a0
lea rdx, [r13 + 1]
mov r12, qword [rsp + 0x110]
mov rax, r12
cmp rdx, 0x1000
jb 0x180004895
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180004d8f
mov rcx, r12
call fcn.18000e8e0
xor r12d, r12d
mov qword [rsp + 0x60], r12
mov rsi, qword [r14 + 0x48]
mov rbx, qword [rsi]
nop dword [rax]
cmp rbx, rsi
je 0x180004d33
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0xb8], rax
mov rdi, qword [rbx + 0x20]
mov rdx, qword [rbx + 0x28]
lea rcx, str.scenario_id
call fcn.18001aa28
test eax, eax
jne 0x180004d2b
mov rsi, qword [0x180050a08]
mov rbx, qword [rsi + 8]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x38], r12d
mov r15, rsi
cmp byte [rbx + 0x19], al
jne 0x18000493b
nop
mov qword [rsp + 0x30], rbx
mov rdx, rdi
mov rcx, qword [rbx + 0x20]
call fcn.18001aa28
test eax, eax
jne 0x180004920
mov dword [rsp + 0x38], r12d
mov rbx, qword [rbx + 0x10]
jmp 0x18000492e
mov dword [rsp + 0x38], 1
mov r15, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x180004900
mov rsi, qword [0x180050a08]
cmp byte [r15 + 0x19], 0
jne 0x180004959
mov rdx, qword [r15 + 0x20]
mov rcx, rdi
call fcn.18001aa28
test eax, eax
jne 0x180004972
mov rsi, qword [0x180050a08]
movabs rax, 0x555555555555555
cmp qword [0x180050a10], rax
je 0x180004d95
jmp 0x18000497b
lea r15, [0x180050a08]
jmp 0x1800049ca
lea r15, [0x180050a08]
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r12
mov ecx, gethostbyname
call fcn.18000eb84
nop
mov qword [rax + 0x20], rdi
mov dword [rax + 0x28], r12d
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov word [rax + 0x18], 0
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x70], xmm0
mov r8, rax
lea rdx, [rsp + 0x70]
mov rcx, r15
call fcn.1800061f0
mov rsi, qword [r14 + 0x48]
mov rbx, qword [rsi]
cmp rbx, rsi
je 0x180004d33
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x70], rax
mov rdi, qword [rbx + 0x20]
mov rdx, qword [rbx + 0x28]
lea rcx, str.attack_id
call fcn.18001aa28
test eax, eax
jne 0x180004d23
mov rsi, qword [0x180050a08]
mov rbx, qword [rsi + 8]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x38], r12d
mov r13, rsi
cmp byte [rbx + 0x19], al
jne 0x180004a5b
nop dword [rax]
mov qword [rsp + 0x30], rbx
mov rdx, rdi
mov rcx, qword [rbx + 0x20]
call fcn.18001aa28
test eax, eax
jne 0x180004a40
mov dword [rsp + 0x38], r12d
mov rbx, qword [rbx + 0x10]
jmp 0x180004a4e
mov dword [rsp + 0x38], 1
mov r13, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x180004a20
mov rsi, qword [0x180050a08]
cmp byte [r13 + 0x19], 0
jne 0x180004a79
mov rdx, qword [r13 + 0x20]
mov rcx, rdi
call fcn.18001aa28
test eax, eax
jne 0x180004ad8
mov rsi, qword [0x180050a08]
movabs rax, 0x555555555555555
cmp qword [0x180050a10], rax
je 0x180004d9a
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r12
mov ecx, gethostbyname
call fcn.18000eb84
nop
mov qword [rax + 0x20], rdi
mov dword [rax + 0x28], r12d
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov word [rax + 0x18], 0
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm0
mov r8, rax
lea rdx, [rsp + 0x50]
mov rcx, r15
call fcn.1800061f0
mov rsi, qword [r14 + 0x48]
mov rbx, qword [rsi]
nop
cmp rbx, rsi
je 0x180004d33
mov r12, qword [rbx + 0x10]
mov rdi, qword [rbx + 0x20]
mov rdx, qword [rbx + 0x28]
lea rcx, str.programdata_path
call fcn.18001aa28
test eax, eax
jne 0x180004d1b
mov rsi, qword [0x180050a08]
mov rbx, qword [rsi + 8]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x38], eax
mov r13, rsi
cmp byte [rbx + 0x19], al
jne 0x180004b6a
nop word [rax + rax]
mov qword [rsp + 0x30], rbx
mov rdx, rdi
mov rcx, qword [rbx + 0x20]
call fcn.18001aa28
test eax, eax
jne 0x180004b4f
mov dword [rsp + 0x38], eax
mov rbx, qword [rbx + 0x10]
jmp 0x180004b5d
mov dword [rsp + 0x38], 1
mov r13, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x180004b30
mov rsi, qword [0x180050a08]
cmp byte [r13 + 0x19], 0
jne 0x180004b88
mov rdx, qword [r13 + 0x20]
mov rcx, rdi
call fcn.18001aa28
test eax, eax
jne 0x180004be4
mov rsi, qword [0x180050a08]
movabs rax, 0x555555555555555
cmp qword [0x180050a10], rax
je 0x180004d9f
mov qword [rsp + 0x50], r15
xor ebx, ebx
mov qword [rsp + 0x58], rbx
lea ecx, [rbx + 0x30]
call fcn.18000eb84
nop
mov qword [rax + 0x20], rdi
mov dword [rax + 0x28], ebx
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov word [rax + 0x18], bx
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm0
mov r8, rax
lea rdx, [rsp + 0x50]
mov rcx, r15
call fcn.1800061f0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xe8]
lea r8, [rsp + 0x50]
lea rdx, str.edr_attacks_path
mov rcx, r14
call fcn.180004db0
test al, al
je 0x180004d33
mov rcx, qword [rsp + 0xb8]
call fcn.18001a974
mov qword [r14 + 0x20], rax
mov rcx, qword [rsp + 0x70]
call fcn.18001a974
mov qword [r14 + 0x28], rax
mov rcx, qword [rsp + 0x60]
call fcn.18001a974
mov qword [r14 + 0x30], rax
mov rcx, r12
call fcn.18001a974
mov qword [r14 + 0x38], rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rsi, 0xffffffffffffffff
test eax, eax
je 0x180004cb7
mov rax, qword [r14 + 0x38]
mov rdi, rsi
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x180004c70
inc rdi
mov eax, 2
mul rdi
cmovo rax, rsi
mov rcx, rax
call fcn.18000ef40
mov rbx, rax
mov r8, rdi
mov rdx, qword [r14 + 0x38]
mov rcx, rax
call fcn.18001a830
mov rdx, rbx
call fcn.180003a40
mov edx, 2
mov rcx, rbx
call fcn.18000e8e0
xor edx, edx
mov rcx, qword [r14 + 0x30]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x180004d17
mov rax, qword [r14 + 0x30]
mov rdi, rsi
nop
inc rdi
cmp byte [rax + rdi], 0
jne 0x180004cd0
inc rdi
mov eax, 2
mul rdi
cmovo rax, rsi
mov rcx, rax
call fcn.18000ef40
mov rbx, rax
mov r8, rdi
mov rdx, qword [r14 + 0x30]
mov rcx, rax
call fcn.18001a830
mov rdx, rbx
call fcn.180003a40
mov edx, 2
mov rcx, rbx
call fcn.18000e8e0
mov al, 1
jmp 0x180004d39
mov rbx, qword [rbx]
jmp 0x180004ae0
mov rbx, qword [rbx]
jmp 0x1800049d1
mov rbx, qword [rbx]
jmp 0x1800048b0
xor al, al
jmp 0x180004d39
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18000e8c0
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.180001640
call fcn.1800015a0
call fcn.18001a3a8
nop
lea rcx, str.list_too_long
call fcn.18000da48
nop
call fcn.18001a3a8
nop
call fcn.18001a3a8
nop
call fcn.18001a3a8
nop
call fcn.180003a20
call fcn.180003a20
call fcn.180003a20
int3