Function at 0x1400147b0
Capabilities:
Check if file exists
Create directory
Query environment variable

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x700
mov rax, qword [0x140035cc8]
xor rax, rsp
mov qword [rsp + 0x6f8], rax
mov dword [rsp + 0x6d0], 0
mov r8, qword [rsp + 0x710]
add r8, 0x58
mov rcx, qword [rsp + 0x710]
add rcx, 8
mov edx, 0x3ed
call fcn.140016360
mov rcx, qword [rsp + 0x710]
add rcx, 0x58
call fcn.14000a000
movzx eax, al
test eax, eax
je 0x140014827
jmp 0x140014e0e
mov rcx, qword [rsp + 0x710]
add rcx, 0x58
call fcn.14000afd0
mov rdx, rax
lea rcx, [rsp + 0x450]
call fcn.14000be00
mov rcx, qword [rsp + 0x710]
add rcx, 8
mov r8d, 0x3f8
lea rdx, [rsp + 0x6b0]
call fcn.140002e80
mov rcx, rax
call fcn.14000afd0
mov rdx, rax
lea rcx, [rsp + 0x6a8]
call fcn.140018470
mov rcx, rax
call fcn.140016250
test eax, eax
jne 0x140014904
mov r8d, 7
lea rdx, [rsp + 0x6b8]
lea rcx, [rsp + 0x450]
call fcn.1400165d0
or dword [rsp + 0x6d0], 1
lea rdx, str.http:__
mov rcx, rax
call fcn.14000bf30
test eax, eax
je 0x1400148f7
mov r8d, 6
lea rdx, [rsp + 0x6c0]
lea rcx, [rsp + 0x450]
call fcn.1400165d0
or dword [rsp + 0x6d0], 2
lea rdx, str.ftp:__
mov rcx, rax
call fcn.14000bf30
test eax, eax
jne 0x140014904
mov dword [rsp + 0x6d4], 0
jmp 0x14001490f
mov dword [rsp + 0x6d4], 1
movzx eax, byte [rsp + 0x6d4]
mov byte [rsp + 0x6a0], al
mov eax, dword [rsp + 0x6d0]
and eax, 2
test eax, eax
je 0x140014941
and dword [rsp + 0x6d0], 0xfffffffd
lea rcx, [rsp + 0x6c0]
call fcn.1400040f0
mov eax, dword [rsp + 0x6d0]
and eax, 1
test eax, eax
je 0x140014964
and dword [rsp + 0x6d0], 0xfffffffe
lea rcx, [rsp + 0x6b8]
call fcn.1400040f0
movzx eax, byte [rsp + 0x6a0]
test eax, eax
je 0x140014a9b
mov rcx, qword [rsp + 0x710]
add rcx, 0x58
call fcn.14000afd0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140014a9b
lea rcx, [rsp + 0x460]
call fcn.140013970
lea rcx, [rsp + 0x468]
call fcn.140013970
mov rcx, qword [rsp + 0x710]
add rcx, 0x48
call fcn.14000afd0
mov qword [rsp + 0x6d8], rax
lea rcx, [rsp + 0x460]
call fcn.1400046c0
mov r8, rax
mov rax, qword [rsp + 0x6d8]
mov rax, qword [rax]
mov edx, 0xba
mov rcx, qword [rsp + 0x6d8]
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x710]
add rcx, 0x48
call fcn.14000afd0
mov qword [rsp + 0x6e0], rax
lea rcx, [rsp + 0x468]
call fcn.1400046c0
mov r8, rax
mov rax, qword [rsp + 0x6e0]
mov rax, qword [rax]
mov edx, 0xbb
mov rcx, qword [rsp + 0x6e0]
call qword [rax + 0x28]
lea rcx, [rsp + 0x460]
call fcn.14000afd0
mov rdi, rax
lea rcx, [rsp + 0x468]
call fcn.14000afd0
mov rcx, qword [rsp + 0x710]
add rcx, 8
xor r9d, r9d
mov r8, rdi
mov rdx, rax
call fcn.140002ec0
lea rcx, [rsp + 0x468]
call fcn.140002d80
lea rcx, [rsp + 0x460]
call fcn.140002d80
lea rcx, [rsp + 0x450]
call fcn.1400040f0
jmp 0x140014e0e
mov rcx, qword [rsp + 0x710]
add rcx, 8
mov edx, 0x401
call fcn.140002e50
test eax, eax
je 0x140014ad7
mov rdx, qword [rsp + 0x710]
add rdx, 0x58
mov rcx, qword [rsp + 0x710]
add rcx, 0x60
call fcn.1400162b0
jmp 0x140014cfa
mov rcx, qword [rsp + 0x710]
add rcx, 8
mov r8d, 0x3f0
lea rdx, [rsp + 0x6c8]
call fcn.140002e80
mov rcx, rax
call fcn.14000afd0
mov rdx, rax
lea rcx, [rsp + 0x680]
call fcn.140016180
xor eax, eax
mov word [rsp + 0x470], ax
lea rdi, [rsp + 0x472]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
lea rcx, [rsp + 0x680]
call fcn.1400160b0
lea r8, [rsp + 0x470]
mov edx, eax
lea rcx, [rsp + 0x680]
call fcn.140016110
mov rcx, qword [rsp + 0x710]
add rcx, 0x60
lea rdx, [rsp + 0x470]
call fcn.140009ed0
mov rcx, qword [rsp + 0x710]
add rcx, 0x60
call fcn.140009f50
cmp eax, 3
jbe 0x140014cfa
mov rcx, qword [rsp + 0x710]
add rcx, 0x60
call fcn.14000afd0
mov rdx, rax
add rdx, 6
lea rcx, [rsp + 0x688]
call fcn.14000be00
lea rdx, str._:____
lea rcx, [rsp + 0x688]
call fcn.140016670
cmp eax, 0xffffffff
jne 0x140014bdb
lea rdx, [0x14002cb9c]
lea rcx, [rsp + 0x688]
call fcn.1400166d0
cmp eax, 0xffffffff
je 0x140014ced
lea rcx, [rsp + 0x698]
call fcn.140013970
lea rcx, [rsp + 0x690]
call fcn.140013970
mov rcx, qword [rsp + 0x710]
add rcx, 0x48
call fcn.14000afd0
mov qword [rsp + 0x6e8], rax
lea rcx, [rsp + 0x698]
call fcn.1400046c0
mov r8, rax
mov rax, qword [rsp + 0x6e8]
mov rax, qword [rax]
mov edx, 0xb5
mov rcx, qword [rsp + 0x6e8]
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x710]
add rcx, 0x48
call fcn.14000afd0
mov qword [rsp + 0x6f0], rax
lea rcx, [rsp + 0x690]
call fcn.1400046c0
mov r8, rax
mov rax, qword [rsp + 0x6f0]
mov rax, qword [rax]
mov edx, 0xb6
mov rcx, qword [rsp + 0x6f0]
call qword [rax + 0x28]
lea rcx, [rsp + 0x698]
call fcn.14000afd0
mov rdi, rax
lea rcx, [rsp + 0x690]
call fcn.14000afd0
mov rcx, qword [rsp + 0x710]
add rcx, 8
xor r9d, r9d
mov r8, rdi
mov rdx, rax
call fcn.140002ec0
lea rcx, [rsp + 0x690]
call fcn.140002d80
lea rcx, [rsp + 0x698]
call fcn.140002d80
lea rcx, [rsp + 0x688]
call fcn.1400040f0
lea rcx, [rsp + 0x450]
call fcn.1400040f0
jmp 0x140014e0e
lea rcx, [rsp + 0x688]
call fcn.1400040f0
xor eax, eax
mov word [rsp + 0x30], ax
lea rdi, [rsp + 0x32]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov r8d, 0x104
lea rdx, [rsp + 0x30]
lea rcx, [0x14002cba8]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor edx, edx
mov word [rsp + 0x240], dx
lea rdi, [rsp + 0x242]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
lea r8, [rsp + 0x30]
mov edx, 0x104
lea rcx, [rsp + 0x240]
call fcn.14001d2b4
lea rdx, [0x14002cbd0]
lea rcx, [rsp + 0x240]
call fcn.140002ac0
lea rcx, [rsp + 0x458]
call fcn.140002ff0
mov rcx, qword [rsp + 0x710]
add rcx, 8
mov edx, 0x3fb
call fcn.140002e50
mov r8d, eax
lea rdx, [0x14002cbec]
lea rcx, [rsp + 0x458]
call fcn.140003010
lea rcx, [rsp + 0x458]
call fcn.14000afd0
lea r9, [rsp + 0x240]
mov r8, rax
lea rdx, [0x14002cbf8]
lea rcx, [0x14002cc10]
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov edx, dword [rsp + 0x720]
mov rcx, qword [rsp + 0x710]
call fcn.140002380
lea rcx, [rsp + 0x458]
call fcn.1400040f0
lea rcx, [rsp + 0x450]
call fcn.1400040f0
mov rcx, qword [rsp + 0x6f8]
xor rcx, rsp
call fcn.14001d350
add rsp, 0x700
pop rdi
ret