Function at 0x14005a1c0
Capabilities:
Create directory
Get common file path
Get session user name
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x2a0]
sub rsp, 0x3a0
mov rax, qword [0x1400e8180]
xor rax, rsp
mov qword [rbp + 0x290], rax
mov dword [rbp - 0x78], 0x101
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x180]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xor esi, esi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], sil
lea rax, [rbp + 0x180]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], sil
jne 0x14005a233
lea rdx, [rbp + 0x180]
lea rcx, [rsp + 0x48]
call fcn.1400218a0
nop
lea rdx, [rbp + 0x70]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x14005a519
mov byte [0x1400e8e20], 1
lea rax, [rbp + 0x70]
mov rcx, rbx
inc rcx
cmp byte [rax + rcx], 0
jne 0x14005a273
movabs rdi, 0x7fffffffffffffff
mov rax, rdi
mov rdx, qword [rsp + 0x58]
sub rax, rdx
cmp rax, rcx
jb 0x14005a930
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x70]
lea r8, [rsp + 0x48]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp - 0x10]
call fcn.14002d660
nop
lea rax, [rbp + 0x70]
mov rcx, rbx
nop dword [rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x14005a2e0
mov rdx, qword [rsp + 0x58]
sub rdi, rdx
cmp rdi, rcx
jb 0x14005a936
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x70]
lea r8, [rsp + 0x48]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp - 0x50]
call fcn.14002d660
nop
mov r8d, 0xc
lea rdx, str._System_Info
lea rcx, [rbp - 0x50]
call fcn.140021a00
mov qword [rbp + 0x10], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rax]
movaps xmmword [rbp + 0x10], xmm1
movups xmm0, xmmword [rax + 0x10]
movaps xmmword [rbp + 0x20], xmm0
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x14005a3ae
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005a3a8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005a93c
call fcn.140080f50
nop
lea rax, [rbp + 0x70]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14005a3b2
mov r8, rbx
lea rdx, [rbp + 0x70]
lea rcx, [0x1400e9280]
call fcn.1400218a0
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rdx, qword [rbp - 0x10]
lea rcx, [0x1400ec910]
call fcn.14005bc30
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x70]
call fcn.14002f5c0
nop
lea rcx, [rbp - 0x70]
call fcn.1400044e0
test al, al
je 0x14005a41e
lea rdx, str.already_run_before
lea rcx, [0x1400ec5f0]
call fcn.140026050
mov rcx, rax
call fcn.1400262c0
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x68]
call fcn.14005a100
lea rbx, [rbp - 0x10]
mov edi, 2
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14005a442
mov rcx, qword [rbx]
call fcn.14009939c
add rbx, 0x20
sub rdi, 1
jne 0x14005a435
lea rcx, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rcx, qword [rsp + 0x68]
lea edx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ebx, eax
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14005a4ad
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005a4a8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005a942
call fcn.140080f50
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], si
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x14005a4ff
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005a4fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005a948
call fcn.140080f50
movdqa xmm0, xmmword [0x1400d4aa0]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x70], si
lea rcx, [rbp - 0x10]
jmp 0x14005a8b0
mov byte [0x1400e8e20], 0
movabs rdi, 0x7fffffffffffffff
mov rax, rdi
mov rcx, qword [rsp + 0x58]
sub rax, rcx
cmp rax, 9
jb 0x14005a94e
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.C:_Users_
lea r8, [rsp + 0x48]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp - 0x70]
call fcn.14002d660
nop
lea rbx, [0x1400e9220]
mov rdx, rbx
cmp qword [0x1400e9238], 0x10
cmovae rdx, qword [0x1400e9220]
mov r8, qword [0x1400e9230]
lea rcx, [rbp - 0x70]
call fcn.140021a00
mov qword [rbp + 0x30], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x40], xmm0
movups xmm1, xmmword [rax]
movaps xmmword [rbp + 0x30], xmm1
movups xmm0, xmmword [rax + 0x10]
movaps xmmword [rbp + 0x40], xmm0
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x14005a60d
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005a608
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005a954
call fcn.140080f50
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], 0
mov rcx, qword [rsp + 0x58]
sub rdi, rcx
cmp rdi, 9
jb 0x14005a95a
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.C:_Users_
lea r8, [rsp + 0x48]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp - 0x10]
call fcn.14002d660
nop
cmp qword [0x1400e9238], 0x10
cmovae rbx, qword [0x1400e9220]
mov r8, qword [0x1400e9230]
mov rdx, rbx
lea rcx, [rbp - 0x10]
call fcn.140021a00
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 0xc
lea rdx, str._System_Info
lea rcx, [rsp + 0x68]
call fcn.140021a00
mov qword [rbp + 0x50], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x60], xmm0
movups xmm1, xmmword [rax]
movaps xmmword [rbp + 0x50], xmm1
movups xmm0, xmmword [rax + 0x10]
movaps xmmword [rbp + 0x60], xmm0
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x14005a73c
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005a737
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005a960
call fcn.140080f50
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], 0xf
mov byte [rsp + 0x68], 0
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x14005a78a
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005a784
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005a966
call fcn.140080f50
nop
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x50]
call fcn.14002f5c0
nop
lea rcx, [rbp - 0x50]
call fcn.1400044e0
test al, al
je 0x14005a7c0
lea rdx, str.already_run_before
lea rcx, [0x1400ec5f0]
call fcn.140026050
mov rcx, rax
call fcn.1400262c0
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x30]
call fcn.14005a100
lea rbx, [rbp + 0x30]
mov edi, 2
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14005a7e3
mov rcx, qword [rbx]
call fcn.14009939c
add rbx, 0x20
sub rdi, 1
jne 0x14005a7d6
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
lea edx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ebx, eax
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14005a84b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005a846
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005a96c
call fcn.140080f50
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], si
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x14005a89b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005a896
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005a972
call fcn.140080f50
movdqa xmm0, xmmword [0x1400d4aa0]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], si
lea rcx, [rbp + 0x30]
lea r9, [fcn.14001efc0]
mov r8d, 2
lea edx, [r8 + 0x1e]
call fcn.140080f94
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x14005a900
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005a8fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005a92a
call fcn.140080f50
mov eax, ebx
mov rcx, qword [rbp + 0x290]
xor rcx, rsp
call fcn.140080f30
lea r11, [rsp + 0x3a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.1400996b0
nop
call fcn.140002cb0
nop
call fcn.140002cb0
int3
call fcn.1400996b0
nop
call fcn.1400996b0
nop
call fcn.1400996b0
nop
call fcn.140002cb0
nop
call fcn.1400996b0
int3
call fcn.140002cb0
nop
call fcn.1400996b0
nop
call fcn.1400996b0
nop
call fcn.1400996b0
nop
call fcn.1400996b0
int3