Function at 0x140018080
Capabilities:
Create directory
Create thread
Get file size
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x2378
call fcn.14009cd54
sub rsp, rax
mov eax, dword [0x1402da468]
lea ecx, [rax + 1]
mov dword [0x1402da468], ecx
mov dword [0x1402da46c], eax
call fcn.14006bdd0
test eax, eax
jne 0x140018a03
lea rsi, [0x14002c300]
mov rdi, qword [sym.imp.KERNEL32.DLL_CreateThread]
nop dword [rax]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor ecx, ecx
xor edx, edx
mov r8, rsi
xor r9d, r9d
call rdi
test rax, rax
je 0x1400180d0
lea rcx, [rsp + 0xa0]
lea rsi, [rsp + 0xe0]
mov rdx, rsi
call fcn.14006b7d0
movaps xmm0, xmmword [rsp + 0xa0]
movaps xmm1, xmmword [rsp + 0xb0]
movaps xmmword [0x1402d7390], xmm0
movaps xmmword [0x1402d73a0], xmm1
lea rdi, [rsp + 0xc0]
mov rcx, rdi
call fcn.14005c770
lea rbx, [rsp + 0x108]
mov rcx, rbx
xor edx, edx
call fcn.14005d930
mov rcx, rbx
mov edx, 0xd03
mov r8d, 0x10f07
mov r9, rdi
call fcn.14005f8d0
lea rdx, [0x1402d8b70]
mov rcx, rbx
mov r8d, 0x1770
call fcn.140069530
mov dword [0x1402d8b64], eax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], 0
mov r9d, dword [0x1402da46c]
lea rax, [0x1402da4e0]
mov qword [rsp + 0x30], rax
lea rax, [0x1402da428]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov rdx, rsi
mov r8, rbx
call fcn.14002b420
lea rcx, [rsp + 0x108]
call fcn.14005da00
movabs r13, 0x7fffffffffffffef
movzx ebx, byte [0x1402da388]
mov eax, ebx
and al, 1
je 0x1400181f9
mov rbx, qword [0x1402da390]
jmp 0x1400181fc
shr rbx, 1
lea rsi, [rbx + 0x13]
cmp rsi, r13
ja 0x140018a25
cmp rsi, 0xa
ja 0x14001822c
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
add sil, sil
mov byte [rsp + 0x40], sil
xor edi, edi
jmp 0x140018267
mov r14, rsi
or r14, 7
inc r14
js 0x140018a2f
lea rcx, [r14 + r14]
call fcn.1400731c0
mov rdi, rax
or r14, 1
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rsi
movzx eax, byte [0x1402da388]
and al, 1
mov esi, r14d
test sil, 1
lea rsi, [rsp + 0x42]
cmove rdi, rsi
test al, al
je 0x140018281
mov rdx, qword [0x1402da398]
jmp 0x140018288
lea rdx, [0x1402da38a]
lea r8, [rbx + rbx]
mov rcx, rdi
call sub.msvcrt.dll_memmove
movabs rax, 0x730065006c0063
mov qword [rdi + rbx*2 + 0x1e], rax
movups xmm0, xmmword [str.programdata_secles]
movups xmmword [rdi + rbx*2], xmm0
movups xmm0, xmmword [0x140259960]
movups xmmword [rdi + rbx*2 + 0x10], xmm0
mov word [rdi + rbx*2 + 0x26], 0
lea rdx, [0x14025da1c]
lea rcx, [rsp + 0x40]
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x70], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x60], xmm0
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0x40], 1
je 0x140018302
mov rcx, qword [rsp + 0x50]
call fcn.140073240
test byte [rsp + 0x60], 1
je 0x140018310
mov rcx, qword [rsp + 0x70]
jmp 0x140018315
lea rcx, [rsp + 0x62]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov edx, 0x120089
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140018506
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_GetFileSize]
mov ebx, eax
lea eax, [rbx - 1]
cmp eax, 0xffffe
ja 0x140018506
mov r14d, ebx
cmp ebx, 0x17
jae 0x140018380
lea eax, [rbx + rbx]
mov byte [rsp + 0x40], al
lea r15, [rsp + 0x41]
jmp 0x1400183a8
mov r12, r14
or r12, 0xf
inc r12
mov rcx, r12
call fcn.1400731c0
mov r15, rax
mov qword [rsp + 0x50], rax
or r12, 1
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r14
lea r12, [rsp + 0x41]
mov rcx, r15
xor edx, edx
mov r8, r14
call sub.msvcrt.dll_memset
mov byte [r15 + r14], 0
test byte [rsp + 0x40], 1
mov rdx, r12
je 0x1400183ce
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x9c]
mov rcx, rdi
mov r8d, ebx
call qword [sym.imp.KERNEL32.DLL_ReadFile]
movzx r13d, byte [rsp + 0x40]
mov ebx, r13d
and bl, 1
test eax, eax
je 0x1400184ee
test bl, bl
je 0x14001840f
mov r14, qword [rsp + 0x50]
mov r13, qword [rsp + 0x48]
jmp 0x140018415
shr r13, 1
mov r14, r12
lea r15, [r14 + r13]
mov qword [rsp + 0x78], 0xffffffffffffffff
mov rbp, 0xffffffffffffffff
cmp r13, 2
jl 0x140018491
mov r8, r13
mov rax, r14
nop word cs:[rax + rax]
dec r8
mov rcx, rax
mov edx, 0xd
call sub.msvcrt.dll_memchr
test rax, rax
je 0x14001846f
movzx ecx, word [rax]
cmp ecx, 0xa0d
je 0x140018477
inc rax
mov r8, r15
sub r8, rax
cmp r8, 1
jg 0x140018440
mov rcx, r15
mov rax, r15
jmp 0x14001847a
mov rcx, rax
sub rcx, r14
cmp rax, r15
mov rbp, 0xffffffffffffffff
cmovne rbp, rcx
cmp r13, 2
jge 0x1400184a0
lea rax, [rbp + 2]
cmp r13, rax
jae 0x140018917
jmp 0x1400184ee
mov r8, r13
mov rcx, r14
nop word cs:[rax + rax]
dec r8
mov edx, 0x47
call sub.msvcrt.dll_memchr
test rax, rax
je 0x1400184de
mov rcx, rax
movzx eax, word [rax]
cmp eax, 0x4247
je 0x1400184e1
inc rcx
mov r8, r15
sub r8, rcx
cmp r8, 1
jg 0x1400184b0
mov rcx, r15
lea rax, [rbp + 2]
cmp r13, rax
jae 0x1400188fe
movabs r13, 0x7fffffffffffffef
test bl, bl
je 0x140018506
mov rcx, qword [rsp + 0x50]
call fcn.140073240
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
test byte [rsp + 0x60], 1
je 0x140018520
mov rcx, qword [rsp + 0x70]
call fcn.140073240
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov r9d, dword [0x1402da46c]
lea rcx, [rsp + 0x80]
lea r8, [rsp + 0x60]
mov dl, 0x73
call fcn.140028b10
mov rcx, qword [0x1402da478]
call qword [sym.imp.KERNEL32.DLL_SetEvent]
mov rcx, qword [0x1402da4b8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp byte [0x14029c040], 0
jne 0x1400188b4
movzx ebx, byte [0x1402da388]
mov eax, ebx
and al, 1
je 0x14001858e
mov rbx, qword [0x1402da390]
jmp 0x140018591
shr rbx, 1
lea r14, [rbx + 0x12]
cmp r14, r13
ja 0x140018a34
cmp r14, 0xa
ja 0x1400185c1
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
add r14b, r14b
mov byte [rsp + 0x40], r14b
xor edi, edi
jmp 0x1400185fc
mov r15, r14
or r15, 7
inc r15
js 0x140018a52
lea rcx, [r15 + r15]
call fcn.1400731c0
mov rdi, rax
or r15, 1
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r14
movzx eax, byte [0x1402da388]
and al, 1
mov r14d, r15d
test r14b, 1
cmove rdi, rsi
test al, al
je 0x140018611
mov rdx, qword [0x1402da398]
jmp 0x140018618
lea rdx, [0x1402da38a]
lea r8, [rbx + rbx]
mov rcx, rdi
call sub.msvcrt.dll_memmove
movups xmm0, xmmword [str.ProgramDataAdobe]
movups xmmword [rdi + rbx*2], xmm0
movups xmm0, xmmword [0x14025da6e]
movups xmmword [rdi + rbx*2 + 0x10], xmm0
mov dword [rdi + rbx*2 + 0x20], 0x650062
mov word [rdi + rbx*2 + 0x24], 0
test byte [rsp + 0x40], 1
je 0x140018656
mov rsi, qword [rsp + 0x50]
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test byte [rsp + 0x40], 1
je 0x140018672
mov rcx, qword [rsp + 0x50]
call fcn.140073240
movzx ebx, byte [0x1402da388]
mov eax, ebx
and al, 1
je 0x140018688
mov rbx, qword [0x1402da390]
jmp 0x14001868b
shr rbx, 1
lea rdi, [rbx + 0x27]
cmp rdi, r13
ja 0x140018a3e
cmp rdi, 0xa
ja 0x1400186bb
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
add dil, dil
mov byte [rsp + 0x40], dil
xor esi, esi
jmp 0x1400186f6
mov r14, rdi
or r14, 7
inc r14
js 0x140018a57
lea rcx, [r14 + r14]
call fcn.1400731c0
mov rsi, rax
or r14, 1
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rdi
movzx eax, byte [0x1402da388]
and al, 1
mov edi, r14d
test dil, 1
lea rdi, [rsp + 0x42]
cmove rsi, rdi
test al, al
je 0x140018710
mov rdx, qword [0x1402da398]
jmp 0x140018717
lea rdx, [0x1402da38a]
lea r8, [rbx + rbx]
mov rcx, rsi
call sub.msvcrt.dll_memmove
movups xmm0, xmmword [str.ProgramDataAdobeExtension_Manager_CC]
movups xmmword [rsi + rbx*2], xmm0
movups xmm0, xmmword [0x14025da94]
movups xmmword [rsi + rbx*2 + 0x10], xmm0
movups xmm0, xmmword [0x14025daa4]
movups xmmword [rsi + rbx*2 + 0x20], xmm0
movups xmm0, xmmword [0x14025dab4]
movups xmmword [rsi + rbx*2 + 0x30], xmm0
movups xmm0, xmmword [0x14025dac2]
movups xmmword [rsi + rbx*2 + 0x3e], xmm0
mov word [rsi + rbx*2 + 0x4e], 0
test byte [rsp + 0x40], 1
je 0x140018771
mov rdi, qword [rsp + 0x50]
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test byte [rsp + 0x40], 1
je 0x14001878d
mov rcx, qword [rsp + 0x50]
call fcn.140073240
movzx ebx, byte [0x1402da388]
mov eax, ebx
and al, 1
je 0x1400187a3
mov rbx, qword [0x1402da390]
jmp 0x1400187a6
shr rbx, 1
lea rdi, [rbx + 0x2d]
cmp rdi, r13
ja 0x140018a48
cmp rdi, 0xa
ja 0x1400187d6
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
add dil, dil
mov byte [rsp + 0x40], dil
xor esi, esi
jmp 0x140018811
mov r14, rdi
or r14, 7
inc r14
js 0x140018a5c
lea rcx, [r14 + r14]
call fcn.1400731c0
mov rsi, rax
or r14, 1
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rdi
movzx eax, byte [0x1402da388]
and al, 1
mov edi, r14d
test dil, 1
lea rdi, [rsp + 0x42]
cmove rsi, rdi
test al, al
je 0x14001882b
mov rdx, qword [0x1402da398]
jmp 0x140018832
lea rdx, [0x1402da38a]
lea r8, [rbx + rbx]
mov rcx, rsi
call sub.msvcrt.dll_memmove
movups xmm0, xmmword [str.ProgramDataAdobeExtension_Manager_CCLogs_]
movups xmmword [rsi + rbx*2], xmm0
movups xmm0, xmmword [0x14025d916]
movups xmmword [rsi + rbx*2 + 0x10], xmm0
movups xmm0, xmmword [0x14025d926]
movups xmmword [rsi + rbx*2 + 0x20], xmm0
movups xmm0, xmmword [0x14025d936]
movups xmmword [rsi + rbx*2 + 0x30], xmm0
movups xmm0, xmmword [0x14025d946]
movups xmmword [rsi + rbx*2 + 0x40], xmm0
movups xmm0, xmmword [0x14025d950]
movups xmmword [rsi + rbx*2 + 0x4a], xmm0
mov word [rsi + rbx*2 + 0x5a], 0
test byte [rsp + 0x40], 1
je 0x140018898
mov rdi, qword [rsp + 0x50]
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test byte [rsp + 0x40], 1
je 0x1400188b4
mov rcx, qword [rsp + 0x50]
call fcn.140073240
lea rcx, [rsp + 0xc0]
call fcn.14005c3d0
test byte [rsp + 0x60], 1
je 0x1400188d2
mov rcx, qword [rsp + 0x70]
call fcn.140073240
test byte [rsp + 0x80], 1
je 0x1400188e9
mov rcx, qword [rsp + 0x90]
call fcn.140073240
nop
add rsp, 0x2378
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, rcx
sub rdx, r14
cmp rcx, r15
mov rcx, 0xffffffffffffffff
cmovne rcx, rdx
mov qword [rsp + 0x78], rcx
add rax, r14
mov r8, r15
sub r8, rax
mov rcx, r15
mov rdx, r15
cmp r8, 2
jl 0x14001896d
nop dword [rax]
dec r8
mov rcx, rax
mov edx, 0x47
call sub.msvcrt.dll_memchr
test rax, rax
je 0x14001895f
movzx ecx, word [rax]
cmp ecx, 0x4247
je 0x140018967
inc rax
mov r8, r15
sub r8, rax
cmp r8, 1
jg 0x140018930
mov rcx, r15
mov rdx, r15
jmp 0x14001896d
mov rcx, rax
mov rdx, rax
sub rcx, r14
cmp rdx, r15
mov r15, 0xffffffffffffffff
cmovne r15, rcx
cmp rbp, 0xffffffffffffffff
movabs r13, 0x7fffffffffffffef
je 0x1400184f8
mov rax, qword [rsp + 0x78]
cmp rax, 0xffffffffffffffff
je 0x1400184f8
cmp r15, 0xffffffffffffffff
je 0x1400184f8
mov byte [r14 + rax], 0
test byte [rsp + 0x40], 1
mov rbx, r12
je 0x1400189bf
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call sub.msvcrt.dll__atoi64
shl rax, 0x1e
mov qword [0x1402db938], rax
mov byte [rbx + r15], 0
movzx ebx, byte [rsp + 0x40]
and bl, 1
je 0x1400189e6
mov r12, qword [rsp + 0x50]
lea rcx, [r12 + rbp]
add rcx, 2
call sub.msvcrt.dll__atoi64
shl rax, 0x1e
mov qword [0x1402db940], rax
jmp 0x1400184f8
mov ecx, 4
call fcn.140073290
mov dword [rax], 0x8ae
mov rdx, qword [str.HZ_]
mov rcx, rax
xor r8d, r8d
call fcn.140073380
lea rcx, [rsp + 0x40]
call fcn.140002b00
call fcn.140002ba0
lea rcx, [rsp + 0x40]
call fcn.140002b00
lea rcx, [rsp + 0x40]
call fcn.140002b00
lea rcx, [rsp + 0x40]
call fcn.140002b00
call fcn.140002ba0
call fcn.140002ba0
call fcn.140002ba0
jmp 0x140018aa4
mov rsi, rax
test byte [rsp + 0x60], 1
je 0x140018ab8
mov rcx, qword [rsp + 0x70]
call fcn.140073240
test byte [rsp + 0x80], 1
je 0x140018acf
mov rcx, qword [rsp + 0x90]
call fcn.140073240
mov rcx, rsi
call fcn.14009d370
int3