Function at 0x180004840
Capabilities:
Create directory

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov rax, qword [0x180068020]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov r15, rcx
xorps xmm0, xmm0
movups xmmword [r11 - 0x68], xmm0
xor r13d, r13d
mov qword [r11 - 0x58], r13
mov qword [r11 - 0x50], r13
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], r13b
jne 0x180004890
lea rcx, [rsp + 0x100]
call fcn.1800019d0
nop
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x70], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0xd8], xmm0
mov qword [rsp + 0xe8], 9
mov qword [rsp + socket0], 0xf
movsd xmm0, qword [str._CymArgs_]
movsd qword [rsp + 0xd8], xmm0
movzx eax, byte [0x18005da68]
mov byte [rsp + 0xe0], al
mov byte [rsp + 0xe1], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0xb8], xmm0
mov qword [rsp + 0xc8], r13
mov qword [rsp + 0xd0], r13
lea rsi, [rsp + 0x100]
cmp qword [rsp + 0x118], 0x10
cmovae rsi, qword [rsp + 0x100]
movabs rax, 0x7fffffffffffffff
mov rdi, qword [rsp + 0x110]
cmp rdi, rax
ja 0x1800052b6
mov qword [rsp + 0xd0], socket
mov r12d, reloc.WS2_32.dll_shutdown
cmp rdi, 0x10
jae 0x180004988
mov qword [rsp + 0xc8], rdi
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0xb8], xmm0
movabs r13, 0x8000000000000000
jmp 0x180004a2b
mov rbx, rdi
or rbx, 0xf
cmp rbx, rax
jbe 0x1800049c7
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.180010eb4
mov rcx, rax
test rax, rax
je 0x1800052c0
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1800049f9
cmp rbx, r12
cmovb rbx, r12
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1800049ea
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800052bb
jmp 0x1800049a5
test rcx, rcx
je 0x1800049f6
call fcn.180010eb4
jmp 0x1800049f9
mov rax, r13
movabs r13, 0x8000000000000000
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc8], rdi
mov qword [rsp + 0xd0], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.180022840
nop
lea r8, [rsp + 0xd8]
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x30]
call fcn.180003cd0
nop
xor r9d, r9d
mov r8d, r9d
mov dword [rsp + 0x48], r8d
mov rdx, qword [rsp + 0x38]
mov rax, rdx
mov rcx, qword [rsp + 0x30]
sub rax, rcx
sar rax, 5
mov esi, r8d
cmp rsi, rax
jae 0x180004d50
shl rsi, 5
lea rdi, [rcx + rsi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x98], r9
mov r14, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x180004aa1
mov r14, qword [rdi]
mov rdi, qword [rdi + 0x10]
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
ja 0x1800052c6
mov qword [rsp + 0x98], socket
cmp rdi, 0x10
jae 0x180004ae3
mov qword [rsp + 0x90], rdi
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x80], xmm0
jmp 0x180004b72
mov rbx, rdi
or rbx, 0xf
cmp rbx, rax
jbe 0x180004b18
mov rbx, rax
lea rax, [r13 + 0x27]
mov rcx, rax
call fcn.180010eb4
mov rcx, rax
test rax, rax
je 0x1800052d0
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x180004b4b
cmp rbx, 0x16
cmovb rbx, r12
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x180004b3c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800052cb
jmp 0x180004af6
test rcx, rcx
je 0x180004b48
call fcn.180010eb4
jmp 0x180004b4b
mov rax, r9
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call fcn.180022840
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x50]
call fcn.1800042f0
nop
mov rax, qword [rsp + 0x50]
mov ecx, dword [rax + 0x10]
inc ecx
movsxd rcx, ecx
call fcn.180011270
mov r14, rax
mov rcx, qword [rsp + 0x50]
mov edx, dword [rcx + 0x30]
inc edx
movsxd rcx, edx
call fcn.180011270
mov r12, rax
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x50]
mov edi, dword [rcx + rsi + 0x10]
sub edi, dword [rdx + 0x10]
sub edi, dword [rdx + 0x30]
sub edi, 2
lea eax, [rdi + 1]
movsxd rbx, eax
mov rcx, rbx
call fcn.180011270
mov r13, rax
mov rcx, qword [rsp + 0x50]
mov r8, qword [rcx + 0x10]
inc r8
xor edx, edx
mov rcx, r14
call fcn.180022f00
mov rcx, qword [rsp + 0x50]
mov r8, qword [rcx + 0x30]
inc r8
xor edx, edx
mov rcx, r12
call fcn.180022f00
mov r8, rbx
xor edx, edx
mov rcx, r13
call fcn.180022f00
mov rdx, qword [rsp + 0x50]
mov r8, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x180004c22
mov rdx, qword [rdx]
mov r8, qword [r8 + 0x10]
mov rcx, r14
call fcn.180022840
mov rax, qword [rsp + 0x50]
lea rdx, [rax + 0x20]
cmp qword [rax + 0x38], 0x10
jb 0x180004c42
mov rdx, qword [rax + 0x20]
mov r8, qword [rax + 0x30]
mov rcx, r12
call fcn.180022840
mov rdx, qword [rsp + 0x30]
add rdx, rsi
mov rax, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x180004c63
mov rax, qword [rdx]
movsxd r8, edi
mov rdx, qword [rdx + 0x10]
sub rdx, r8
add rdx, rax
mov rcx, r13
call fcn.180022840
lea rbx, [r15 + 0x48]
mov rsi, qword [rbx]
movabs rax, 0x555555555555555
cmp qword [rbx + 8], rax
je 0x1800052d6
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xb0], 0
mov ecx, gethostbyname
call fcn.180010eb4
mov qword [rax + 0x10], r13
mov dword [rax + 0x18], edi
mov qword [rax + 0x20], r12
mov qword [rax + 0x28], r14
inc qword [rbx + 8]
mov rcx, qword [rsi + 8]
mov qword [rax], rsi
mov qword [rax + 8], rcx
xor r9d, r9d
mov qword [rsp + 0xb0], r9
mov qword [rsi + 8], rax
mov qword [rcx], rax
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x180004d33
mov rdx, qword [rsp + 0x58]
call fcn.180001ae0
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004d2b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800052e3
call fcn.180010c10
xor r9d, r9d
mov r8d, dword [rsp + 0x48]
inc r8d
movabs r13, 0x8000000000000000
mov r12d, reloc.WS2_32.dll_shutdown
jmp 0x180004a4c
test rcx, rcx
je 0x180004da8
call fcn.180001ae0
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004d90
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800052e9
call fcn.180010c10
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
xor r12d, r12d
mov qword [rsp + 0x40], r12
jmp 0x180004dab
xor r12d, r12d
mov r14, qword [rsp + 0x118]
cmp r14, 0x10
jb 0x180004df3
lea rdx, [r14 + 1]
mov rbx, qword [rsp + 0x100]
mov rax, rbx
cmp rdx, 0x1000
jb 0x180004dea
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800052ef
mov rcx, rbx
call fcn.180010c10
nop
mov qword [rsp + 0xa0], r12
mov rsi, qword [r15 + 0x48]
mov rbx, qword [rsi]
cmp rbx, rsi
je 0x180005283
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0xa8], rax
mov rdi, qword [rbx + 0x20]
mov rdx, qword [rbx + 0x28]
lea rcx, str.scenario_id
call fcn.18002c9e4
test eax, eax
jne 0x18000527b
mov rsi, qword [0x18006abf8]
mov rbx, qword [rsi + 8]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x38], r12d
mov r14, rsi
cmp byte [rbx + 0x19], al
jne 0x180004e8b
mov qword [rsp + 0x30], rbx
mov rdx, rdi
mov rcx, qword [rbx + 0x20]
call fcn.18002c9e4
test eax, eax
jne 0x180004e70
mov dword [rsp + 0x38], r12d
mov rbx, qword [rbx + 0x10]
jmp 0x180004e7e
mov dword [rsp + 0x38], 1
mov r14, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x180004e50
mov rsi, qword [0x18006abf8]
cmp byte [r14 + 0x19], 0
jne 0x180004ea9
mov rdx, qword [r14 + 0x20]
mov rcx, rdi
call fcn.18002c9e4
test eax, eax
jne 0x180004ec2
mov rsi, qword [0x18006abf8]
movabs rax, 0x555555555555555
cmp qword [0x18006ac00], rax
je 0x1800052f5
jmp 0x180004ecb
lea r14, [0x18006abf8]
jmp 0x180004f1a
lea r14, [0x18006abf8]
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r12
mov ecx, gethostbyname
call fcn.180010eb4
nop
mov qword [rax + 0x20], rdi
mov dword [rax + 0x28], r12d
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov word [rax + 0x18], 0
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x70], xmm0
mov r8, rax
lea rdx, [rsp + 0x70]
mov rcx, r14
call fcn.180006780
mov rsi, qword [r15 + 0x48]
mov rbx, qword [rsi]
cmp rbx, rsi
je 0x180005283
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x70], rax
mov rdi, qword [rbx + 0x20]
mov rdx, qword [rbx + 0x28]
lea rcx, str.attack_id
call fcn.18002c9e4
test eax, eax
jne 0x180005273
mov rsi, qword [0x18006abf8]
mov rbx, qword [rsi + 8]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x38], r12d
mov r13, rsi
cmp byte [rbx + 0x19], al
jne 0x180004fab
nop dword [rax]
mov qword [rsp + 0x30], rbx
mov rdx, rdi
mov rcx, qword [rbx + 0x20]
call fcn.18002c9e4
test eax, eax
jne 0x180004f90
mov dword [rsp + 0x38], r12d
mov rbx, qword [rbx + 0x10]
jmp 0x180004f9e
mov dword [rsp + 0x38], 1
mov r13, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x180004f70
mov rsi, qword [0x18006abf8]
cmp byte [r13 + 0x19], 0
jne 0x180004fc9
mov rdx, qword [r13 + 0x20]
mov rcx, rdi
call fcn.18002c9e4
test eax, eax
jne 0x180005028
mov rsi, qword [0x18006abf8]
movabs rax, 0x555555555555555
cmp qword [0x18006ac00], rax
je 0x1800052fa
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r12
mov ecx, gethostbyname
call fcn.180010eb4
nop
mov qword [rax + 0x20], rdi
mov dword [rax + 0x28], r12d
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov word [rax + 0x18], 0
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm0
mov r8, rax
lea rdx, [rsp + 0x50]
mov rcx, r14
call fcn.180006780
mov rsi, qword [r15 + 0x48]
mov rbx, qword [rsi]
nop
cmp rbx, rsi
je 0x180005283
mov r12, qword [rbx + 0x10]
mov rdi, qword [rbx + 0x20]
mov rdx, qword [rbx + 0x28]
lea rcx, str.programdata_path
call fcn.18002c9e4
test eax, eax
jne 0x18000526b
mov rsi, qword [0x18006abf8]
mov rbx, qword [rsi + 8]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x38], eax
mov r13, rsi
cmp byte [rbx + 0x19], al
jne 0x1800050ba
nop word [rax + rax]
mov qword [rsp + 0x30], rbx
mov rdx, rdi
mov rcx, qword [rbx + 0x20]
call fcn.18002c9e4
test eax, eax
jne 0x18000509f
mov dword [rsp + 0x38], eax
mov rbx, qword [rbx + 0x10]
jmp 0x1800050ad
mov dword [rsp + 0x38], 1
mov r13, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x180005080
mov rsi, qword [0x18006abf8]
cmp byte [r13 + 0x19], 0
jne 0x1800050d8
mov rdx, qword [r13 + 0x20]
mov rcx, rdi
call fcn.18002c9e4
test eax, eax
jne 0x180005134
mov rsi, qword [0x18006abf8]
movabs rax, 0x555555555555555
cmp qword [0x18006ac00], rax
je 0x1800052ff
mov qword [rsp + 0x50], r14
xor ebx, ebx
mov qword [rsp + 0x58], rbx
lea ecx, [rbx + 0x30]
call fcn.180010eb4
nop
mov qword [rax + 0x20], rdi
mov dword [rax + 0x28], ebx
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov word [rax + 0x18], bx
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm0
mov r8, rax
lea rdx, [rsp + 0x50]
mov rcx, r14
call fcn.180006780
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
lea r8, [rsp + 0xf8]
lea rdx, str.edr_attacks_path
mov rcx, r15
call fcn.180005310
test al, al
je 0x180005283
mov rcx, qword [rsp + 0xa8]
call fcn.18002c930
mov qword [r15 + 0x20], rax
mov rcx, qword [rsp + 0x70]
call fcn.18002c930
mov qword [r15 + 0x28], rax
mov rcx, qword [rsp + 0xa0]
call fcn.18002c930
mov qword [r15 + 0x30], rax
mov rcx, r12
call fcn.18002c930
mov qword [r15 + 0x38], rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rsi, 0xffffffffffffffff
test eax, eax
je 0x180005207
mov rax, qword [r15 + 0x38]
mov rdi, rsi
nop
inc rdi
cmp byte [rax + rdi], 0
jne 0x1800051c0
inc rdi
mov eax, 2
mul rdi
cmovo rax, rsi
mov rcx, rax
call fcn.180011270
mov rbx, rax
mov r8, rdi
mov rdx, qword [r15 + 0x38]
mov rcx, rax
call fcn.18002c7ec
mov rdx, rbx
call fcn.180003b00
mov edx, 2
mov rcx, rbx
call fcn.180010c10
xor edx, edx
mov rcx, qword [r15 + 0x30]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x180005267
mov rax, qword [r15 + 0x30]
mov rdi, rsi
nop
inc rdi
cmp byte [rax + rdi], 0
jne 0x180005220
inc rdi
mov eax, 2
mul rdi
cmovo rax, rsi
mov rcx, rax
call fcn.180011270
mov rbx, rax
mov r8, rdi
mov rdx, qword [r15 + 0x30]
mov rcx, rax
call fcn.18002c7ec
mov rdx, rbx
call fcn.180003b00
mov edx, 2
mov rcx, rbx
call fcn.180010c10
mov al, 1
jmp 0x180005289
mov rbx, qword [rbx]
jmp 0x180005030
mov rbx, qword [rbx]
jmp 0x180004f21
mov rbx, qword [rbx]
jmp 0x180004e02
xor al, al
jmp 0x180005289
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180010bf0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.1800014e0
call fcn.180001440
call fcn.18002c364
nop
call fcn.1800014e0
call fcn.180001440
call fcn.18002c364
nop
lea rcx, str.list_too_long
call fcn.18000fd78
nop
call fcn.18002c364
nop
call fcn.18002c364
nop
call fcn.18002c364
nop
call fcn.180003ae0
call fcn.180003ae0
call fcn.180003ae0
int3