Function at 0x1400011c0
Capabilities:
Create thread
Get common file path
Inject thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x140006008]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov r9d, 1
xor r8d, r8d
lea rbp, [0x1400067e0]
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x140001480
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xor r15d, r15d
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov rdi, 0xffffffffffffffff
mov rbx, rdi
nop
inc rbx
cmp byte [rbx + rbp], r15b
jne 0x140001230
movabs rsi, 0x7fffffffffffffff
cmp rbx, rsi
ja 0x1400014ad
mov qword [rsp + 0x58], 0xf
cmp rbx, 0x10
jae 0x14000127a
mov qword [rsp + 0x50], rbx
mov r8, rbx
mov rdx, rbp
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x40], r15b
jmp 0x140001311
mov rax, rbx
or rax, 0xf
cmp rax, rsi
jbe 0x1400012b3
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140002190
test rax, rax
je 0x14000135d
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x1400012f0
mov rsi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x1400012de
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400014b3
jmp 0x140001294
test rcx, rcx
je 0x1400012ed
call fcn.140002190
mov r14, rax
jmp 0x1400012f0
mov r14, r15
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov r8, rbx
mov rdx, rbp
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rbx], r15b
lea rcx, [rsp + 0x40]
call fcn.140001b90
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140001c70
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140001369
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001364
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001364
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400021cc
lea rbx, [rsp + 0x68]
cmp qword [rsp + 0x80], 0x10
cmovae rbx, qword [rsp + 0x68]
xor edx, edx
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x14000143d
cmp rax, 0xffffffffffffffff
je 0x140001434
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbp, rax
lea rdi, [rdi + 1]
cmp byte [rbx + rdi], 0
jne 0x1400013e0
lea r9, [rdi + 1]
mov qword [rsp + 0x20], r15
mov r8, rbx
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rbp
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x140001434
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x80]
cmp rdx, 0x10
jb 0x140001480
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000147b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000147b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400021cc
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140002170
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
call fcn.1400011a0
int3
call fcn.140001100
int3