Function at 0x14005be90
Capabilities:
Create directory
Query environment variable

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x6c0
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov qword [rsp + 0x718], rbx
mov rax, qword [0x14007e3c0]
xor rax, rsp
mov qword [rsp + 0x6b0], rax
mov rsi, r8
mov qword [rsp + 0x70], r8
mov rdi, rdx
mov qword [rsp + 0x68], rdx
mov r15, rcx
mov qword [rsp + 0x78], rcx
xor eax, eax
mov r13d, eax
mov dword [rsp + 0x40], eax
mov qword [rcx], rax
mov dword [rsp + 0x40], 0x1a
mov dword [rsp + 0x44], 5
xor bpl, bpl
mov r14d, eax
lea r12, [rsp + 0x40]
nop
nop
test bpl, bpl
jne 0x14005c2b5
mov eax, dword [0x140081880]
test al, 1
jne 0x14005bf5c
or eax, 1
mov dword [0x140081880], eax
xor r9d, r9d
lea r8, str.SHGetFolderPathW
lea rdx, str.Shell32
lea rcx, [0x140081870]
call fcn.14001a920
lea rcx, [0x14005fc60]
call fcn.140036380
nop
mov eax, dword [0x140081880]
test al, 2
jne 0x14005bf99
or eax, 2
mov dword [0x140081880], eax
xor r9d, r9d
lea r8, str.SHGetFolderPathW
lea rdx, str.SHFolder
lea rcx, [0x140081860]
call fcn.14001a920
lea rcx, [0x14005fc50]
call fcn.140036380
nop
mov eax, dword [0x140081880]
test al, 4
jne 0x14005bfd0
or eax, 4
mov dword [0x140081880], eax
xor r9d, r9d
lea r8, str.SHGetSpecialFolderPathW
lea rdx, str.Shell32
lea rcx, [0x140081850]
call fcn.14001a920
lea rcx, [0x14005fc40]
call fcn.140036380
nop
mov ebx, 0x80070057
mov rax, qword [0x140081870]
test rax, rax
je 0x14005c004
lea rcx, [rsp + 0x4a0]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, dword [r12]
mov rcx, rdi
call rax
mov ebx, eax
jmp 0x14005c09b
mov rax, qword [0x140081860]
test rax, rax
je 0x14005c030
lea rcx, [rsp + 0x4a0]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, dword [r12]
mov rcx, rdi
call rax
mov ebx, eax
jmp 0x14005c09b
mov rax, qword [0x140081850]
test rax, rax
je 0x14005c05c
mov r9d, 1
mov r8d, dword [r12]
lea rdx, [rsp + 0x4a0]
xor ecx, ecx
call rax
test eax, eax
je 0x14005c09b
xor eax, eax
mov ebx, eax
jmp 0x14005c09b
mov r8d, 0x104
lea rdx, [rsp + 0x4a0]
lea rcx, str._userprofile_Application_Data
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rsi, [rsp + 0x4a0]
lea rdi, str._userprofile_Application_Data
mov ecx, 0x1f
repe cmpsw word [rsi], word [rdi]
mov eax, 0
cmovne ebx, eax
mov rsi, qword [rsp + 0x70]
cmp ebx, 0x80004005
je 0x14005c0b0
test ebx, ebx
je 0x14005c0d5
cmp ebx, 1
jne 0x14005c1c1
xor edx, edx
lea rcx, [rsp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14005c0d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14005c1dd
xor ebx, ebx
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
or r9d, 0xffffffff
mov r8d, 0xfde9
lea rdx, [rsp + 0x4a0]
lea rcx, [rsp + 0x60]
call fcn.140012c10
or r8d, 0xffffffff
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.1400134b0
mov rcx, qword [rsp + 0x60]
call fcn.140034ee0
cmp dword [r12], 0x1a
jne 0x14005c1a6
mov r8, rsi
lea rdx, [0x14006b250]
lea rcx, [rsp + 0x48]
call fcn.140013810
mov dword [rsp + 0x20], ebx
or r9d, 0xffffffff
mov r8d, 0xfde9
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x58]
call fcn.140012a60
or r13d, 1
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14005c186
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14005c186
mov dil, 1
jmp 0x14005c189
xor dil, dil
test r13b, 1
je 0x14005c19d
and r13d, 0xfffffffe
mov rcx, qword [rsp + 0x58]
call fcn.140034ee0
test dil, dil
jne 0x14005c249
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], ebx
mov qword [r15], rax
mov bpl, 1
xor ecx, ecx
call fcn.140034ee0
add r14d, 1
add r12, 4
cmp r14d, 2
jae 0x14005c2b5
mov rdi, qword [rsp + 0x68]
jmp 0x14005bf10
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov byte [rsp + 0x18c], 0
or r9d, 0xffffffff
lea r8, str.CreateDirectory
mov edx, 0x100
lea rcx, [rsp + 0x18c]
call fcn.14001a500
mov edx, edi
lea rcx, [rsp + 0x18c]
call fcn.14001ac20
lea rcx, [rsp + 0x290]
lea rdx, [rsp + 0x18c]
mov r8d, 0x104
call fcn.1400374a0
lea rdx, [0x14007a800]
lea rcx, [rsp + 0x290]
call fcn.140035840
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov byte [rsp + 0x88], 0
or r9d, 0xffffffff
lea r8, str.CreateDirectory
mov edx, 0x100
lea rcx, [rsp + 0x88]
call fcn.14001a500
mov edx, edi
lea rcx, [rsp + 0x88]
call fcn.14001ac20
lea rcx, [rsp + 0x394]
lea rdx, [rsp + 0x88]
mov r8d, 0x104
call fcn.1400374a0
lea rdx, [0x14007a800]
lea rcx, [rsp + 0x394]
call fcn.140035840
nop
mov rax, r15
mov rcx, qword [rsp + 0x6b0]
xor rcx, rsp
call fcn.1400353d0
mov rbx, qword [rsp + 0x718]
add rsp, 0x6c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret