Function at 0x140061ba0
Capabilities:
Create directory
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1401b7030]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rcx
mov qword [rsp + 0x38], rcx
lea rax, vtable.VNCOptions.0
mov qword [rcx], rax
lea rbx, [rcx + 0x330]
xor esi, esi
mov qword [rbx], rsi
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], rsi
add rcx, 0xa82
xor edx, edx
mov r8d, 0xff
call fcn.1401216a0
mov qword [rdi + 0x4b3], rsi
mov qword [rdi + 0x4bb], rsi
mov qword [rdi + 0x4c3], rsi
mov dword [rdi + 0x4cb], esi
mov word [rdi + 0x4cf], si
mov word [rdi + 0x4b3], 0x101
mov byte [rdi + 0x4b5], 1
mov dword [rdi + 0x4b7], 0x1010101
mov word [rdi + 0x4bb], 0x101
mov dword [rdi + 0x4c3], 0x1010101
mov byte [rdi + 0x4bd], 1
mov dword [rdi + 0x4cc], 0x10101
mov byte [rdi + 0x4d0], 1
mov word [rdi + 0x31e], si
mov dword [rdi + 0x321], esi
mov word [rdi + 0x326], si
mov dword [rdi + 0x328], esi
mov byte [rdi + 0x325], 1
mov word [rdi + 0x361], si
mov byte [rdi + 0x363], sil
mov byte [rdi + 0x320], sil
mov dword [rsp + 0x30], 0xa
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x140061cb7
mov dword [rdx], 0xa
add qword [rbx + 8], 4
jmp 0x140061cc4
lea r8, [rsp + 0x30]
mov rcx, rbx
call fcn.14002e690
mov dword [rdi + 0x348], 0x10000
mov dword [rdi + 0x34c], WSAAsyncSelect
mov dword [rdi + 0x350], 4
mov dword [rdi + 0x354], 1
mov dword [rdi + 0x358], 1
mov dword [rdi + 0x360], 0
mov dword [rdi + 0x364], WSAAsyncSelect
mov dword [rdi + 0x368], WSAAsyncSelect
mov dword [rdi + 0x380], 1
mov qword [rdi + 0x384], 3
mov qword [rdi + 0x38c], rsi
mov dword [rdi + 0x394], esi
mov dword [rdi + 0x398], 0x100
mov byte [rdi + 0x4d1], 0
mov byte [rdi + 0x5d0], 0
mov dword [rdi + 0x5cc], 0xffffffff
mov dword [rdi + 0x6cc], 0xffffffff
mov byte [rdi + 0x4a9], 0
mov byte [rdi + 0x4b2], 0
mov qword [rdi + 0x6dc], rsi
mov word [rdi + 0x6e4], 0
mov byte [rdi + 0x6e6], 0
mov dword [rdi + 0x7ec], esi
mov word [rdi + 0x10], 0
mov byte [rdi + 0x218], 0
mov byte [rdi + 8], 0
mov dword [rdi + 0xc], 0x157c
mov word [rdi + 0x31c], 0
mov byte [rdi + 0x36c], 1
mov dword [rdi + 0x370], 6
mov byte [rdi + 0x374], 1
mov dword [rdi + 0x378], 8
mov word [rdi + 0x37c], 1
mov byte [rdi + 0x12], 0
mov byte [rdi + 0x112], 0
mov dword [rdi + 0x214], 1
mov byte [rdi + 0x49f], 0
mov dword [rdi + 0x6d0], 0
mov word [rdi + 0x6d4], 0
mov byte [rdi + 0x6d6], 0
mov dword [rdi + 0x6d8], esi
lea rbx, [rdi + 0x809]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 5]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x140061e7b
lea r8, [0x14019c38c]
mov edx, 0x104
mov rcx, rbx
call fcn.1401252ac
lea r8, [0x14019e190]
mov edx, 0x104
mov rcx, rbx
call fcn.1401252ac
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140133774
cmp eax, 0xffffffff
jne 0x140061ea3
mov rcx, rbx
call fcn.140131810
jmp 0x140061ea3
lea rcx, str.TEMP
call fcn.140133bf0
mov edx, 0x104
mov rcx, rbx
test rax, rax
mov r8, rax
jne 0x140061e9e
lea r8, [0x14019945a]
call fcn.14012524c
lea rcx, [rdi + 0x90d]
lea r8, str.vnc_
mov edx, 0x38
call fcn.14012524c
lea rcx, [rdi + 0x945]
lea r8, str..jpeg
mov edx, 0x38
call fcn.14012524c
mov word [rdi + 0x807], 0
mov word [rdi + 0x804], 0
mov byte [rdi + 0x806], 0
mov dword [rdi + 0x4a0], 0x64
mov dword [rdi + 0x4a4], 0x64
mov byte [rdi + 0x4a8], 0
mov dword [rdi + 0x7f0], 3
mov word [rdi + 0x7f4], 0
mov qword [rdi + 0xb88], rsi
mov dword [rdi + 0x7f8], 0x1e
mov qword [rdi + 0x7fc], 5
mov dword [rdi + 0x35c], esi
lea rcx, [rdi + 0x97e]
call fcn.140061fc0
lea rdx, [rdi + 0x97e]
mov rcx, rdi
call fcn.140064960
nop
mov rax, rdi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14011c340
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret