Function at 0x140019900
Capabilities:
Create directory
Create thread
Get file size
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x2378
call fcn.140099af4
sub rsp, rax
mov eax, dword [0x1402883f0]
lea ecx, [rax + 1]
mov dword [0x1402883f0], ecx
mov dword [0x1402883f4], eax
call fcn.14006de40
test eax, eax
jne 0x14001a2b3
test byte [0x140288278], 1
je 0x14001994d
mov rcx, qword [0x140288288]
jmp 0x140019954
lea rcx, [0x140288279]
call sub.msvcrt.dll_strlen
cmp rax, 0x14
jne 0x14001a2ca
lea rsi, [0x14002dea0]
mov rdi, qword [sym.imp.KERNEL32.DLL_CreateThread]
nop word cs:[rax + rax]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor ecx, ecx
xor edx, edx
mov r8, rsi
xor r9d, r9d
call rdi
test rax, rax
je 0x140019980
lea rcx, [rsp + 0xa0]
lea rsi, [rsp + 0xe0]
mov rdx, rsi
call fcn.14006d840
movaps xmm0, xmmword [rsp + 0xa0]
movaps xmm1, xmmword [rsp + 0xb0]
movaps xmmword [0x140285310], xmm0
movaps xmmword [0x140285320], xmm1
lea rdi, [rsp + 0xc0]
mov rcx, rdi
call fcn.14005e7e0
lea rbx, [rsp + 0x108]
mov rcx, rbx
xor edx, edx
call fcn.14005f9a0
mov rcx, rbx
mov edx, 0xd03
mov r8d, 0x10f07
mov r9, rdi
call fcn.140061940
lea rdx, [0x140286af0]
mov rcx, rbx
mov r8d, 0x1770
call fcn.14006b5a0
mov dword [0x140286ae4], eax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], 0
mov r9d, dword [0x1402883f4]
lea rax, [0x140288468]
mov qword [rsp + 0x30], rax
lea rax, [0x1402883b0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov rdx, rsi
mov r8, rbx
call fcn.14002cfa0
lea rcx, [rsp + 0x108]
call fcn.14005fa70
movabs r13, 0x7fffffffffffffef
movzx ebx, byte [0x140288308]
mov eax, ebx
and al, 1
je 0x140019aa9
mov rbx, qword [0x140288310]
jmp 0x140019aac
shr rbx, 1
lea rsi, [rbx + 0x13]
cmp rsi, r13
ja 0x14001a301
cmp rsi, 0xa
ja 0x140019adc
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
add sil, sil
mov byte [rsp + 0x40], sil
xor edi, edi
jmp 0x140019b17
mov r14, rsi
or r14, 7
inc r14
js 0x14001a30b
lea rcx, [r14 + r14]
call fcn.14006fb50
mov rdi, rax
or r14, 1
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rsi
movzx eax, byte [0x140288308]
and al, 1
mov esi, r14d
test sil, 1
lea rsi, [rsp + 0x42]
cmove rdi, rsi
test al, al
je 0x140019b31
mov rdx, qword [0x140288318]
jmp 0x140019b38
lea rdx, [0x14028830a]
lea r8, [rbx + rbx]
mov rcx, rdi
call sub.msvcrt.dll_memmove
movabs rax, 0x730065006c0063
mov qword [rdi + rbx*2 + 0x1e], rax
movups xmm0, xmmword [str.programdata_secles]
movups xmmword [rdi + rbx*2], xmm0
movups xmm0, xmmword [0x1401f58ce]
movups xmmword [rdi + rbx*2 + 0x10], xmm0
mov word [rdi + rbx*2 + 0x26], 0
lea rdx, [0x1401fa8ee]
lea rcx, [rsp + 0x40]
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x70], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x60], xmm0
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0x40], 1
je 0x140019bb2
mov rcx, qword [rsp + 0x50]
call fcn.14006fbd0
test byte [rsp + 0x60], 1
je 0x140019bc0
mov rcx, qword [rsp + 0x70]
jmp 0x140019bc5
lea rcx, [rsp + 0x62]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov edx, 0x120089
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140019db6
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_GetFileSize]
mov ebx, eax
lea eax, [rbx - 1]
cmp eax, 0xffffe
ja 0x140019db6
mov r14d, ebx
cmp ebx, 0x17
jae 0x140019c30
lea eax, [rbx + rbx]
mov byte [rsp + 0x40], al
lea r15, [rsp + 0x41]
jmp 0x140019c58
mov r12, r14
or r12, 0xf
inc r12
mov rcx, r12
call fcn.14006fb50
mov r15, rax
mov qword [rsp + 0x50], rax
or r12, 1
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r14
lea r12, [rsp + 0x41]
mov rcx, r15
xor edx, edx
mov r8, r14
call sub.msvcrt.dll_memset
mov byte [r15 + r14], 0
test byte [rsp + 0x40], 1
mov rdx, r12
je 0x140019c7e
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x9c]
mov rcx, rdi
mov r8d, ebx
call qword [sym.imp.KERNEL32.DLL_ReadFile]
movzx r13d, byte [rsp + 0x40]
mov ebx, r13d
and bl, 1
test eax, eax
je 0x140019d9e
test bl, bl
je 0x140019cbf
mov r14, qword [rsp + 0x50]
mov r13, qword [rsp + 0x48]
jmp 0x140019cc5
shr r13, 1
mov r14, r12
lea r15, [r14 + r13]
mov qword [rsp + 0x78], 0xffffffffffffffff
mov rbp, 0xffffffffffffffff
cmp r13, 2
jl 0x140019d41
mov r8, r13
mov rax, r14
nop word cs:[rax + rax]
dec r8
mov rcx, rax
mov edx, 0xd
call sub.msvcrt.dll_memchr
test rax, rax
je 0x140019d1f
movzx ecx, word [rax]
cmp ecx, 0xa0d
je 0x140019d27
inc rax
mov r8, r15
sub r8, rax
cmp r8, 1
jg 0x140019cf0
mov rcx, r15
mov rax, r15
jmp 0x140019d2a
mov rcx, rax
sub rcx, r14
cmp rax, r15
mov rbp, 0xffffffffffffffff
cmovne rbp, rcx
cmp r13, 2
jge 0x140019d50
lea rax, [rbp + 2]
cmp r13, rax
jae 0x14001a1c7
jmp 0x140019d9e
mov r8, r13
mov rcx, r14
nop word cs:[rax + rax]
dec r8
mov edx, 0x47
call sub.msvcrt.dll_memchr
test rax, rax
je 0x140019d8e
mov rcx, rax
movzx eax, word [rax]
cmp eax, 0x4247
je 0x140019d91
inc rcx
mov r8, r15
sub r8, rcx
cmp r8, 1
jg 0x140019d60
mov rcx, r15
lea rax, [rbp + 2]
cmp r13, rax
jae 0x14001a1ae
movabs r13, 0x7fffffffffffffef
test bl, bl
je 0x140019db6
mov rcx, qword [rsp + 0x50]
call fcn.14006fbd0
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
test byte [rsp + 0x60], 1
je 0x140019dd0
mov rcx, qword [rsp + 0x70]
call fcn.14006fbd0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov r9d, dword [0x1402883f4]
lea rcx, [rsp + 0x80]
lea r8, [rsp + 0x60]
mov dl, 0x73
call fcn.14002a690
mov rcx, qword [0x140288400]
call qword [sym.imp.KERNEL32.DLL_SetEvent]
mov rcx, qword [0x140288440]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp byte [0x140227110], 0
jne 0x14001a164
movzx ebx, byte [0x140288308]
mov eax, ebx
and al, 1
je 0x140019e3e
mov rbx, qword [0x140288310]
jmp 0x140019e41
shr rbx, 1
lea r14, [rbx + 0x12]
cmp r14, r13
ja 0x14001a310
cmp r14, 0xa
ja 0x140019e71
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
add r14b, r14b
mov byte [rsp + 0x40], r14b
xor edi, edi
jmp 0x140019eac
mov r15, r14
or r15, 7
inc r15
js 0x14001a32e
lea rcx, [r15 + r15]
call fcn.14006fb50
mov rdi, rax
or r15, 1
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r14
movzx eax, byte [0x140288308]
and al, 1
mov r14d, r15d
test r14b, 1
cmove rdi, rsi
test al, al
je 0x140019ec1
mov rdx, qword [0x140288318]
jmp 0x140019ec8
lea rdx, [0x14028830a]
lea r8, [rbx + rbx]
mov rcx, rdi
call sub.msvcrt.dll_memmove
movups xmm0, xmmword [str.ProgramDataAdobe]
movups xmmword [rdi + rbx*2], xmm0
movups xmm0, xmmword [0x1401fa992]
movups xmmword [rdi + rbx*2 + 0x10], xmm0
mov dword [rdi + rbx*2 + 0x20], 0x650062
mov word [rdi + rbx*2 + 0x24], 0
test byte [rsp + 0x40], 1
je 0x140019f06
mov rsi, qword [rsp + 0x50]
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test byte [rsp + 0x40], 1
je 0x140019f22
mov rcx, qword [rsp + 0x50]
call fcn.14006fbd0
movzx ebx, byte [0x140288308]
mov eax, ebx
and al, 1
je 0x140019f38
mov rbx, qword [0x140288310]
jmp 0x140019f3b
shr rbx, 1
lea rdi, [rbx + 0x27]
cmp rdi, r13
ja 0x14001a31a
cmp rdi, 0xa
ja 0x140019f6b
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
add dil, dil
mov byte [rsp + 0x40], dil
xor esi, esi
jmp 0x140019fa6
mov r14, rdi
or r14, 7
inc r14
js 0x14001a333
lea rcx, [r14 + r14]
call fcn.14006fb50
mov rsi, rax
or r14, 1
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rdi
movzx eax, byte [0x140288308]
and al, 1
mov edi, r14d
test dil, 1
lea rdi, [rsp + 0x42]
cmove rsi, rdi
test al, al
je 0x140019fc0
mov rdx, qword [0x140288318]
jmp 0x140019fc7
lea rdx, [0x14028830a]
lea r8, [rbx + rbx]
mov rcx, rsi
call sub.msvcrt.dll_memmove
movups xmm0, xmmword [str.ProgramDataAdobeExtension_Manager_CC]
movups xmmword [rsi + rbx*2], xmm0
movups xmm0, xmmword [0x1401fa9b8]
movups xmmword [rsi + rbx*2 + 0x10], xmm0
movups xmm0, xmmword [0x1401fa9c8]
movups xmmword [rsi + rbx*2 + 0x20], xmm0
movups xmm0, xmmword [0x1401fa9d8]
movups xmmword [rsi + rbx*2 + 0x30], xmm0
movups xmm0, xmmword [0x1401fa9e6]
movups xmmword [rsi + rbx*2 + 0x3e], xmm0
mov word [rsi + rbx*2 + 0x4e], 0
test byte [rsp + 0x40], 1
je 0x14001a021
mov rdi, qword [rsp + 0x50]
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test byte [rsp + 0x40], 1
je 0x14001a03d
mov rcx, qword [rsp + 0x50]
call fcn.14006fbd0
movzx ebx, byte [0x140288308]
mov eax, ebx
and al, 1
je 0x14001a053
mov rbx, qword [0x140288310]
jmp 0x14001a056
shr rbx, 1
lea rdi, [rbx + 0x2d]
cmp rdi, r13
ja 0x14001a324
cmp rdi, 0xa
ja 0x14001a086
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
add dil, dil
mov byte [rsp + 0x40], dil
xor esi, esi
jmp 0x14001a0c1
mov r14, rdi
or r14, 7
inc r14
js 0x14001a338
lea rcx, [r14 + r14]
call fcn.14006fb50
mov rsi, rax
or r14, 1
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rdi
movzx eax, byte [0x140288308]
and al, 1
mov edi, r14d
test dil, 1
lea rdi, [rsp + 0x42]
cmove rsi, rdi
test al, al
je 0x14001a0db
mov rdx, qword [0x140288318]
jmp 0x14001a0e2
lea rdx, [0x14028830a]
lea r8, [rbx + rbx]
mov rcx, rsi
call sub.msvcrt.dll_memmove
movups xmm0, xmmword [str.ProgramDataAdobeExtension_Manager_CCLogs_]
movups xmmword [rsi + rbx*2], xmm0
movups xmm0, xmmword [0x1401fa7e8]
movups xmmword [rsi + rbx*2 + 0x10], xmm0
movups xmm0, xmmword [0x1401fa7f8]
movups xmmword [rsi + rbx*2 + 0x20], xmm0
movups xmm0, xmmword [0x1401fa808]
movups xmmword [rsi + rbx*2 + 0x30], xmm0
movups xmm0, xmmword [0x1401fa818]
movups xmmword [rsi + rbx*2 + 0x40], xmm0
movups xmm0, xmmword [0x1401fa822]
movups xmmword [rsi + rbx*2 + 0x4a], xmm0
mov word [rsi + rbx*2 + 0x5a], 0
test byte [rsp + 0x40], 1
je 0x14001a148
mov rdi, qword [rsp + 0x50]
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test byte [rsp + 0x40], 1
je 0x14001a164
mov rcx, qword [rsp + 0x50]
call fcn.14006fbd0
lea rcx, [rsp + 0xc0]
call fcn.14005e440
test byte [rsp + 0x60], 1
je 0x14001a182
mov rcx, qword [rsp + 0x70]
call fcn.14006fbd0
test byte [rsp + 0x80], 1
je 0x14001a199
mov rcx, qword [rsp + 0x90]
call fcn.14006fbd0
nop
add rsp, 0x2378
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, rcx
sub rdx, r14
cmp rcx, r15
mov rcx, 0xffffffffffffffff
cmovne rcx, rdx
mov qword [rsp + 0x78], rcx
add rax, r14
mov r8, r15
sub r8, rax
mov rcx, r15
mov rdx, r15
cmp r8, 2
jl 0x14001a21d
nop dword [rax]
dec r8
mov rcx, rax
mov edx, 0x47
call sub.msvcrt.dll_memchr
test rax, rax
je 0x14001a20f
movzx ecx, word [rax]
cmp ecx, 0x4247
je 0x14001a217
inc rax
mov r8, r15
sub r8, rax
cmp r8, 1
jg 0x14001a1e0
mov rcx, r15
mov rdx, r15
jmp 0x14001a21d
mov rcx, rax
mov rdx, rax
sub rcx, r14
cmp rdx, r15
mov r15, 0xffffffffffffffff
cmovne r15, rcx
cmp rbp, 0xffffffffffffffff
movabs r13, 0x7fffffffffffffef
je 0x140019da8
mov rax, qword [rsp + 0x78]
cmp rax, 0xffffffffffffffff
je 0x140019da8
cmp r15, 0xffffffffffffffff
je 0x140019da8
mov byte [r14 + rax], 0
test byte [rsp + 0x40], 1
mov rbx, r12
je 0x14001a26f
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call sub.msvcrt.dll__atoi64
shl rax, 0x1e
mov qword [0x1402897c8], rax
mov byte [rbx + r15], 0
movzx ebx, byte [rsp + 0x40]
and bl, 1
je 0x14001a296
mov r12, qword [rsp + 0x50]
lea rcx, [r12 + rbp]
add rcx, 2
call sub.msvcrt.dll__atoi64
shl rax, 0x1e
mov qword [0x1402897d0], rax
jmp 0x140019da8
xor ecx, ecx
call fcn.14004c360
lea rcx, str.could_not_init_libs
mov dl, 1
call fcn.140012160
jmp 0x14001a2df
lea rcx, str.id_was_not_generated
mov dl, 1
call fcn.140012160
xor ecx, ecx
call fcn.14004c360
mov ecx, 4
call fcn.14006fc20
mov dword [rax], 0x8ae
mov rdx, qword [str.P___]
mov rcx, rax
xor r8d, r8d
call fcn.14006fd10
lea rcx, [rsp + 0x40]
call fcn.140002ec0
call fcn.140002f60
lea rcx, [rsp + 0x40]
call fcn.140002ec0
lea rcx, [rsp + 0x40]
call fcn.140002ec0
lea rcx, [rsp + 0x40]
call fcn.140002ec0
call fcn.140002f60
call fcn.140002f60
call fcn.140002f60
jmp 0x14001a380
mov rsi, rax
test byte [rsp + 0x60], 1
je 0x14001a394
mov rcx, qword [rsp + 0x70]
call fcn.14006fbd0
test byte [rsp + 0x80], 1
je 0x14001a3ab
mov rcx, qword [rsp + 0x90]
call fcn.14006fbd0
mov rcx, rsi
call fcn.14009a110
int3