Function at 0x140002df0
Capabilities:
Create directory
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x2f], rax
lea r9, [rbp - 0x59]
xor r8d, r8d
xor edx, edx
lea rcx, [0x14000a680]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x140002e65
mov rdx, qword [rbp - 0x59]
lea rcx, [rbp - 0x51]
call fcn.140004a30
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
movups xmm0, xmmword [rbp - 0x51]
movups xmmword [rbp + 0xf], xmm0
movups xmm1, xmmword [rbp - 0x41]
movups xmmword [rbp + 0x1f], xmm1
jmp 0x140002e76
lea rdx, [0x14000a7a0]
lea rcx, [rbp + 0xf]
call fcn.140004a30
nop
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
mov r14, qword [rbp + 0x1f]
sub rax, r14
cmp rax, 7
jb 0x1400036cc
lea r12, [rbp + 0xf]
mov r13, qword [rbp + 0xf]
cmp qword [rbp + 0x27], 7
cmova r12, r13
xorps xmm0, xmm0
movups xmmword [rbp - 0x31], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x21], xmm1
lea r15, [r14 + 7]
mov esi, 7
mov ebx, esi
lea rdi, [rbp - 0x31]
movabs rax, 0x7fffffffffffffff
lea edx, [rsi + 3]
cmp r15, rbx
jbe 0x140002f4a
mov rbx, r15
or rbx, rsi
cmp rbx, rcx
jbe 0x140002ee9
mov rbx, rcx
lea rcx, [rax + rax]
jmp 0x140002f09
cmp rbx, rdx
cmovb rbx, rdx
lea rcx, [rbx + 1]
cmp rcx, rax
ja 0x1400036d2
add rcx, rcx
cmp rcx, 0x1000
jb 0x140002f35
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400036d2
mov rcx, rax
call fcn.140008198
test rax, rax
je 0x140003633
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140002f46
test rcx, rcx
je 0x140002f44
call fcn.140008198
mov rdi, rax
jmp 0x140002f46
xor edi, edi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x21], r15
mov qword [rbp - 0x19], rbx
lea rbx, [r14 + r14]
mov r8, rbx
mov rdx, r12
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [0x14000abe0]
movsd qword [rbx + rdi], xmm0
mov eax, dword [0x14000abe8]
mov dword [rbx + rdi + 8], eax
movzx eax, word [0x14000abec]
mov word [rbx + rdi + 0xc], ax
xor r12d, r12d
mov word [rdi + r15*2], r12w
lea rdx, [rbp - 0x31]
cmp qword [rbp - 0x19], 7
cmova rdx, qword [rbp - 0x31]
mov rax, qword [rbp - 0x21]
lea r14, [rdx + rax*2]
lea rdi, [rbp - 0x31]
cmova rdi, qword [rbp - 0x31]
xorps xmm0, xmm0
movups xmmword [rbp - 0x11], xmm0
cmp rdi, r14
jne 0x140002fd0
mov qword [rbp - 1], r12
mov eax, 0xf
mov qword [rbp + 7], rax
mov byte [rbp - 0x11], r12b
jmp 0x1400030d3
mov rax, r14
sub rax, rdi
sar rax, 1
mov rdx, r12
mov qword [rbp - 1], rdx
mov ebx, 0xf
mov qword [rbp + 7], rbx
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
ja 0x1400036d8
cmp rax, rbx
jbe 0x140003090
mov rbx, rax
or rbx, 0xf
cmp rbx, rcx
jbe 0x140003048
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140008198
mov rcx, rax
test rax, rax
je 0x1400035e0
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov rdx, qword [rbp - 1]
jmp 0x140003083
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140003070
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400036c6
jmp 0x140003022
test rcx, rcx
je 0x140003080
call fcn.140008198
mov rdx, qword [rbp - 1]
jmp 0x140003083
mov rax, r12
mov qword [rbp - 0x11], rax
mov qword [rbp + 7], rbx
nop dword [rax + rax]
lea rcx, [rbp - 0x11]
cmp rbx, 0xf
cmova rcx, qword [rbp - 0x11]
movzx eax, byte [rdi]
mov byte [rcx + rdx], al
mov rdx, qword [rbp - 1]
inc rdx
mov qword [rbp - 1], rdx
add rdi, 2
cmp rdi, r14
je 0x1400030bd
mov rbx, qword [rbp + 7]
jmp 0x140003090
lea rax, [rbp - 0x11]
cmp qword [rbp + 7], 0xf
cmova rax, qword [rbp - 0x11]
mov byte [rax + rdx], 0
mov rax, qword [rbp + 7]
lea rcx, [rbp - 0x11]
cmp rax, 0xf
cmova rcx, qword [rbp - 0x11]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1400030fd
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400035ae
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp - 0x59], rax
test rax, rax
je 0x1400035ae
mov r14, qword [rbp - 0x21]
movabs rax, 0x7ffffffffffffffe
mov rcx, rax
sub rcx, r14
cmp rcx, 0xb
jb 0x1400036de
lea r12, [rbp - 0x31]
cmp qword [rbp - 0x19], 7
cmova r12, qword [rbp - 0x31]
xorps xmm0, xmm0
movups xmmword [rbp - 0x51], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x41], xmm1
lea r15, [r14 + 0xb]
mov rbx, rsi
lea rdi, [rbp - 0x51]
cmp r15, rbx
jbe 0x1400031f1
mov rbx, r15
or rbx, 7
cmp rbx, rax
jbe 0x140003180
mov rbx, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x1400031b0
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1400036e4
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400031dc
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400036e4
mov rcx, rax
call fcn.140008198
test rax, rax
je 0x14000328c
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400031ed
test rcx, rcx
je 0x1400031eb
call fcn.140008198
mov rdi, rax
jmp 0x1400031ed
xor edi, edi
mov qword [rbp - 0x51], rdi
mov qword [rbp - 0x41], r15
mov qword [rbp - 0x39], rbx
lea rbx, [r14 + r14]
mov r8, rbx
mov rdx, r12
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movaps xmm0, xmmword [str.Sysmon.exe]
movups xmmword [rbx + rdi], xmm0
mov eax, dword [0x14000ac00]
mov dword [rbx + rdi + 0x10], eax
movzx eax, word [0x14000ac04]
mov word [rbx + rdi + 0x14], ax
xor eax, eax
mov word [rdi + r15*2], ax
lea r9, [rbp - 0x51]
cmp qword [rbp - 0x39], 7
cmova r9, qword [rbp - 0x51]
lea r8, [0x14000ac08]
lea edx, [rax + 0x65]
mov rcx, qword [rbp - 0x59]
call fcn.140002ac0
nop
mov rdx, qword [rbp - 0x39]
cmp rdx, 7
jbe 0x140003298
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x51]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003293
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003293
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008190
mov r14, qword [rbp - 0x21]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, r14
cmp rax, 9
jb 0x1400036ea
lea r12, [rbp - 0x31]
cmp qword [rbp - 0x19], 7
cmova r12, qword [rbp - 0x31]
xorps xmm0, xmm0
movups xmmword [rbp - 0x51], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x41], xmm1
lea r15, [r14 + 9]
mov rbx, rsi
lea rdi, [rbp - 0x51]
cmp r15, rbx
jbe 0x140003377
mov rbx, r15
or rbx, 7
cmp rbx, rcx
jbe 0x140003306
mov rbx, rcx
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x140003336
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1400036f0
add rcx, rcx
cmp rcx, 0x1000
jb 0x140003362
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400036f0
mov rcx, rax
call fcn.140008198
test rax, rax
je 0x14000340b
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140003373
test rcx, rcx
je 0x14000336e
call fcn.140008198
jmp 0x140003370
xor eax, eax
mov rdi, rax
mov qword [rbp - 0x51], rdi
mov qword [rbp - 0x41], r15
mov qword [rbp - 0x39], rbx
lea rbx, [r14 + r14]
mov r8, rbx
mov rdx, r12
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movaps xmm0, xmmword [str.Eula.txt]
movups xmmword [rdi + rbx], xmm0
movzx eax, word [0x14000ac20]
mov word [rdi + rbx + 0x10], ax
xor eax, eax
mov word [rdi + r15*2], ax
lea r9, [rbp - 0x51]
cmp qword [rbp - 0x39], 7
cmova r9, qword [rbp - 0x51]
lea r8, [0x14000ac28]
lea edx, [rax + 0x66]
mov r12, qword [rbp - 0x59]
mov rcx, r12
call fcn.140002ac0
nop
mov rdx, qword [rbp - 0x39]
cmp rdx, 7
jbe 0x140003417
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x51]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003412
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003412
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008190
mov rbx, qword [rbp - 0x21]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, rbx
cmp rax, 0xb
jb 0x1400036f6
lea r15, [rbp - 0x31]
cmp qword [rbp - 0x19], 7
cmova r15, qword [rbp - 0x31]
xorps xmm0, xmm0
movups xmmword [rbp - 0x51], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x41], xmm1
lea r14, [rbx + 0xb]
lea rdi, [rbp - 0x51]
cmp r14, 7
jbe 0x1400034f4
mov rsi, r14
or rsi, 7
cmp rsi, rcx
jbe 0x140003483
mov rsi, rcx
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x1400034b3
cmp rsi, 0xa
mov eax, 0xa
cmovb rsi, rax
lea rcx, [rsi + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1400036c0
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400034df
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400036c0
mov rcx, rax
call fcn.140008198
test rax, rax
je 0x14000358d
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400034f0
test rcx, rcx
je 0x1400034eb
call fcn.140008198
jmp 0x1400034ed
xor eax, eax
mov rdi, rax
mov qword [rbp - 0x51], rdi
mov qword [rbp - 0x41], r14
mov qword [rbp - 0x39], rsi
add rbx, rbx
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movaps xmm0, xmmword [str.Keller.xml]
movups xmmword [rdi + rbx], xmm0
mov eax, dword [0x14000ac50]
mov dword [rdi + rbx + 0x10], eax
movzx eax, word [0x14000ac54]
mov word [rdi + rbx + 0x14], ax
xor eax, eax
mov word [rdi + r14*2], ax
lea r9, [rbp - 0x51]
cmp qword [rbp - 0x39], 7
cmova r9, qword [rbp - 0x51]
lea r8, [0x14000ac58]
lea edx, [rax + 0x67]
mov rcx, r12
call fcn.140002ac0
nop
mov rdx, qword [rbp - 0x39]
cmp rdx, 7
jbe 0x140003599
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x51]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003594
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003594
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008190
lea rcx, [rbp - 0x31]
call fcn.140002680
lea rcx, [rbp - 0x31]
call fcn.140001520
xor r12d, r12d
mov rdx, qword [rbp + 7]
cmp rdx, 0xf
jbe 0x1400035ec
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400035e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400035e7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008190
mov qword [rbp - 1], r12
mov qword [rbp + 7], 0xf
mov byte [rbp - 0x11], 0
mov rdx, qword [rbp - 0x19]
cmp rdx, 7
jbe 0x14000363f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000363a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000363a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008190
movdqa xmm0, xmmword [0x14000b140]
movdqu xmmword [rbp - 0x21], xmm0
mov word [rbp - 0x31], r12w
mov rax, qword [rbp + 0x27]
cmp rax, 7
jbe 0x140003693
lea rdx, [rax*2 + 2]
mov rax, r13
cmp rdx, 0x1000
jb 0x14000368b
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000368b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r13
call fcn.140008190
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140008170
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001110
nop
call fcn.140001110
nop
call fcn.1400011b0
int3
call fcn.140001110
nop
call fcn.1400011b0
nop
call fcn.1400011b0
int3
call fcn.140001110
int3
call fcn.1400011b0
int3
call fcn.140001110
int3
call fcn.1400011b0
int3