Function at 0x140018bc0
Capabilities:
Check if file exists
Create directory
Query environment variable

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x730
mov qword [rsp + 0x6d8], 0xfffffffffffffffe
mov rax, qword [0x140042dd0]
xor rax, rsp
mov qword [rsp + 0x728], rax
mov dword [rsp + 0x6d0], 0
mov r8, qword [rsp + 0x740]
add r8, 0x58
mov rcx, qword [rsp + 0x740]
add rcx, 8
mov edx, 0x3ed
call fcn.14001a800
mov rcx, qword [rsp + 0x740]
add rcx, 0x58
call fcn.14000a180
movzx eax, al
test eax, eax
je 0x140018c43
jmp 0x14001928b
mov rcx, qword [rsp + 0x740]
add rcx, 0x58
call fcn.14000a6a0
mov rdx, rax
lea rcx, [rsp + 0x450]
call fcn.14000c070
nop
mov rcx, qword [rsp + 0x740]
add rcx, 8
mov r8d, 0x3f8
lea rdx, [rsp + 0x6b0]
call fcn.140002e80
mov rcx, rax
call fcn.14000a6a0
mov rdx, rax
lea rcx, [rsp + 0x6a8]
call fcn.14001a720
mov rcx, rax
call fcn.14001a6c0
test eax, eax
jne 0x140018d71
mov r8d, 7
lea rdx, [rsp + 0x6b8]
lea rcx, [rsp + 0x450]
call fcn.14001aa80
mov qword [rsp + 0x6e0], rax
mov rax, qword [rsp + 0x6e0]
mov qword [rsp + 0x6e8], rax
mov eax, dword [rsp + 0x6d0]
or eax, 1
mov dword [rsp + 0x6d0], eax
lea rdx, str.http:__
mov rcx, qword [rsp + 0x6e8]
call fcn.14000c1a0
test eax, eax
je 0x140018d64
mov r8d, 6
lea rdx, [rsp + 0x6c0]
lea rcx, [rsp + 0x450]
call fcn.14001aa80
mov qword [rsp + 0x6f0], rax
mov rax, qword [rsp + 0x6f0]
mov qword [rsp + 0x6f8], rax
mov eax, dword [rsp + 0x6d0]
or eax, 2
mov dword [rsp + 0x6d0], eax
lea rdx, str.ftp:__
mov rcx, qword [rsp + 0x6f8]
call fcn.14000c1a0
test eax, eax
jne 0x140018d71
mov dword [rsp + 0x700], 0
jmp 0x140018d7c
mov dword [rsp + 0x700], 1
movzx eax, byte [rsp + 0x700]
mov byte [rsp + 0x6a0], al
mov eax, dword [rsp + 0x6d0]
and eax, 2
test eax, eax
je 0x140018daf
and dword [rsp + 0x6d0], 0xfffffffd
lea rcx, [rsp + 0x6c0]
call fcn.1400040d0
nop
mov eax, dword [rsp + 0x6d0]
and eax, 1
test eax, eax
je 0x140018dd2
and dword [rsp + 0x6d0], 0xfffffffe
lea rcx, [rsp + 0x6b8]
call fcn.1400040d0
movzx eax, byte [rsp + 0x6a0]
test eax, eax
je 0x140018f0e
mov rcx, qword [rsp + 0x740]
add rcx, 0x58
call fcn.14000a6a0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140018f0e
lea rcx, [rsp + 0x460]
call fcn.14001ad70
nop
lea rcx, [rsp + 0x468]
call fcn.14001ad70
nop
mov rcx, qword [rsp + 0x740]
add rcx, 0x48
call fcn.14000a6a0
mov qword [rsp + 0x708], rax
lea rcx, [rsp + 0x460]
call fcn.14000a0e0
mov r8, rax
mov rax, qword [rsp + 0x708]
mov rax, qword [rax]
mov edx, 0xba
mov rcx, qword [rsp + 0x708]
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x740]
add rcx, 0x48
call fcn.14000a6a0
mov qword [rsp + 0x710], rax
lea rcx, [rsp + 0x468]
call fcn.14000a0e0
mov r8, rax
mov rax, qword [rsp + 0x710]
mov rax, qword [rax]
mov edx, 0xbb
mov rcx, qword [rsp + 0x710]
call qword [rax + 0x28]
lea rcx, [rsp + 0x460]
call fcn.14000a6a0
mov rdi, rax
lea rcx, [rsp + 0x468]
call fcn.14000a6a0
mov rcx, qword [rsp + 0x740]
add rcx, 8
xor r9d, r9d
mov r8, rdi
mov rdx, rax
call fcn.140002ec0
nop
lea rcx, [rsp + 0x468]
call fcn.140002d80
nop
lea rcx, [rsp + 0x460]
call fcn.140002d80
nop
lea rcx, [rsp + 0x450]
call fcn.1400040d0
jmp 0x14001928b
mov rcx, qword [rsp + 0x740]
add rcx, 8
mov edx, 0x401
call fcn.140002e50
test eax, eax
je 0x140018f4a
mov rdx, qword [rsp + 0x740]
add rdx, 0x58
mov rcx, qword [rsp + 0x740]
add rcx, 0x60
call fcn.14001a750
jmp 0x140019174
mov rcx, qword [rsp + 0x740]
add rcx, 8
mov r8d, 0x3f0
lea rdx, [rsp + 0x6c8]
call fcn.140002e80
mov rcx, rax
call fcn.14000a6a0
mov rdx, rax
lea rcx, [rsp + 0x680]
call fcn.14001a5f0
xor eax, eax
mov word [rsp + 0x470], ax
lea rdi, [rsp + 0x472]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
lea rcx, [rsp + 0x680]
call fcn.14001a530
lea r8, [rsp + 0x470]
mov edx, eax
lea rcx, [rsp + 0x680]
call fcn.14001a590
mov rcx, qword [rsp + 0x740]
add rcx, 0x60
lea rdx, [rsp + 0x470]
call fcn.14000a040
mov rcx, qword [rsp + 0x740]
add rcx, 0x60
call fcn.14000a0c0
cmp eax, 3
jbe 0x140019174
mov rcx, qword [rsp + 0x740]
add rcx, 0x60
call fcn.14000a6a0
mov rdx, rax
add rdx, 6
lea rcx, [rsp + 0x688]
call fcn.14000c070
nop
lea rdx, str._:____
lea rcx, [rsp + 0x688]
call fcn.14001ab40
cmp eax, 0xffffffff
jne 0x14001904f
lea rdx, [0x140036ab4]
lea rcx, [rsp + 0x688]
call fcn.14001aba0
cmp eax, 0xffffffff
je 0x140019167
lea rcx, [rsp + 0x698]
call fcn.14001ad70
nop
lea rcx, [rsp + 0x690]
call fcn.14001ad70
nop
mov rcx, qword [rsp + 0x740]
add rcx, 0x48
call fcn.14000a6a0
mov qword [rsp + 0x718], rax
lea rcx, [rsp + 0x698]
call fcn.14000a0e0
mov r8, rax
mov rax, qword [rsp + 0x718]
mov rax, qword [rax]
mov edx, 0xb5
mov rcx, qword [rsp + 0x718]
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x740]
add rcx, 0x48
call fcn.14000a6a0
mov qword [rsp + 0x720], rax
lea rcx, [rsp + 0x690]
call fcn.14000a0e0
mov r8, rax
mov rax, qword [rsp + 0x720]
mov rax, qword [rax]
mov edx, 0xb6
mov rcx, qword [rsp + 0x720]
call qword [rax + 0x28]
lea rcx, [rsp + 0x698]
call fcn.14000a6a0
mov rdi, rax
lea rcx, [rsp + 0x690]
call fcn.14000a6a0
mov rcx, qword [rsp + 0x740]
add rcx, 8
xor r9d, r9d
mov r8, rdi
mov rdx, rax
call fcn.140002ec0
nop
lea rcx, [rsp + 0x690]
call fcn.140002d80
nop
lea rcx, [rsp + 0x698]
call fcn.140002d80
nop
lea rcx, [rsp + 0x688]
call fcn.1400040d0
nop
lea rcx, [rsp + 0x450]
call fcn.1400040d0
jmp 0x14001928b
lea rcx, [rsp + 0x688]
call fcn.1400040d0
xor eax, eax
mov word [rsp + 0x30], ax
lea rdi, [rsp + 0x32]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov r8d, 0x104
lea rdx, [rsp + 0x30]
lea rcx, [0x140036ac0]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor edx, edx
mov word [rsp + 0x240], dx
lea rdi, [rsp + 0x242]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
lea r8, [rsp + 0x30]
mov edx, 0x104
lea rcx, [rsp + 0x240]
call fcn.140022658
lea rdx, [0x140036ae8]
lea rcx, [rsp + 0x240]
call fcn.140002ac0
lea rcx, [rsp + 0x458]
call fcn.140002ff0
nop
mov rcx, qword [rsp + 0x740]
add rcx, 8
mov edx, 0x3fb
call fcn.140002e50
mov r8d, eax
lea rdx, [0x140036b04]
lea rcx, [rsp + 0x458]
call fcn.140003010
lea rcx, [rsp + 0x458]
call fcn.14000a6a0
lea r9, [rsp + 0x240]
mov r8, rax
lea rdx, [0x140036b10]
lea rcx, [0x140036b28]
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov edx, dword [rsp + 0x750]
mov rcx, qword [rsp + 0x740]
call fcn.140002380
nop
lea rcx, [rsp + 0x458]
call fcn.1400040d0
nop
lea rcx, [rsp + 0x450]
call fcn.1400040d0
mov rcx, qword [rsp + 0x728]
xor rcx, rsp
call fcn.1400226f0
add rsp, 0x730
pop rdi
ret