Function at 0x10001719c
Capabilities:
Create thread
Get common file path
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x280
mov rax, qword [0x100028110]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor r14d, r14d
mov r13, r8
mov rbp, rdx
mov edi, ecx
mov ebx, 0xe
mov r12d, r14d
mov dword [rsp + 0x44], r14d
mov word [rsp + 0x60], r14w
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea edx, [rbx - 6]
lea r8d, [rbx + 0xa]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
cmp rax, r14
je 0x10001746b
mov r8d, edi
xor edx, edx
mov ecx, 0x410
mov dword [rax], edi
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsi + 8], rax
cmp rax, r14
je 0x100017424
lea r8, [rsp + 0x44]
mov rdx, rbp
mov ecx, edi
call fcn.100016734
cmp eax, r14d
jl 0x10001741d
cmp dword [rsp + 0x44], r14d
je 0x10001741d
mov edi, 0x104
lea rdx, [rsp + 0x60]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, r14d
je 0x100017431
lea rcx, [rsp + 0x60]
mov rdx, r13
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp eax, r14d
je 0x100017431
mov rcx, qword [rsi + 8]
lea rdx, [rsp + 0x44]
mov dword [rsp + 0x44], r14d
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp eax, r14d
je 0x1000172b6
cmp dword [rsp + 0x44], r14d
je 0x1000172b6
lea rdx, [0x100006ab8]
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_StrStrW]
cmp rax, r14
je 0x1000172b6
mov word [rax], r14w
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea rdx, [0x100006b10]
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathAddExtensionW]
cmp eax, r14d
jne 0x1000172ec
lea r8, [0x100006b10]
lea rcx, [rsp + 0x60]
mov rdx, rdi
call fcn.10000ada8
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.SHELL32.dll_PathYetAnotherMakeUniqueName]
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0x60]
mov r13d, 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40010000
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x100017413
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], r13d
lea r9, [rsi + 0x10]
mov r8, rbx
mov rdx, rbp
mov rcx, rax
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp eax, r14d
je 0x100017400
lea rax, [rsp + 0x48]
lea r8, [0x100016fc0]
mov r9, rsi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
cmp rax, r14
je 0x100017400
mov r8, qword [0x10002a358]
mov rcx, qword [0x10002a370]
lea r9, [0x100017058]
mov edx, 0x1bb
lea r12d, [r13 - 1]
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov rbx, rax
cmp eax, 0x4c7
jne 0x1000173f5
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov r9d, r12d
mov rcx, rbp
mov byte [rsp + 0x40], r12b
mov dword [rsp + 0x20], 0xd
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100017408
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10001742c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x100017431
mov ebx, 6
jmp 0x10001742c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp r12d, r14d
jne 0x1000174ad
mov rcx, qword [rsi + 8]
cmp rcx, r14
je 0x100017440
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsi + 0x10]
cmp rcx, r14
je 0x10001744f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebx, 0x4c7
je 0x10001747f
mov rcx, qword [0x10002a358]
mov r8d, ebx
mov edx, 0x9cc1
call fcn.10000ac38
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.100022bc0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
cmp ebx, r14d
jne 0x100017463
mov r8, qword [0x10002a358]
mov rcx, qword [0x10002a370]
lea rax, [rsp + 0x60]
lea r9, [0x100017144]
mov edx, 0x1bc
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x10001747f