Function at 0x140019c94
Capabilities:
Create directory
Delete file
Delete registry key
Get common file path
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x270]
sub rsp, 0x370
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rbp + 0x260], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersion_
lea rcx, [rsp + 0x50]
call fcn.1400e9240
lea rbx, [rsp + 0x50]
mov edx, 0x47dd2b91
movsxd rcx, eax
mov r8d, 0xa
add rbx, rcx
lea rcx, [0x140168388]
call fcn.140001558
sub rbx, rax
xor edi, edi
mov cl, byte [rax]
mov byte [rbx + rax], cl
inc rax
test cl, cl
jne 0x140019cf7
lea rax, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov r9d, 0x2010e
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140019e4a
mov edx, 0xefd40169
mov ecx, 0x6dd172d4
mov r8d, 0x9ab80a8f
call fcn.1400015d0
lea r8, [0x140128d38]
lea rcx, [rbp + 0x160]
mov rdx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [rsp + 0x40]
lea rdx, [rbp + 0x160]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x50]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x50]
mov edx, 0x5c
call fcn.1400e875c
mov rbx, rax
test rax, rax
je 0x140019e4a
mov edx, 0x8d1e50a9
mov ecx, 0xf1b2324
mov r8d, 0xf8725b45
add rbx, 2
call fcn.1400015d0
mov rdx, rbx
sub rdx, rax
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x140019dc6
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, 0xa567d526
mov ecx, 0x2762a64f
mov r8d, 0xd00bdeca
call fcn.1400015d0
mov rdx, rbx
sub rdx, rax
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x140019dfc
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, 0xa946cd46
mov ecx, 0x2b43be33
mov r8d, 0xdc2ac6aa
call fcn.1400015d0
sub rbx, rax
movzx ecx, word [rax]
mov word [rbx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x140019e2f
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, 1
call fcn.140018fe8
mov rdx, qword [0x140174718]
lea r8, [rsp + 0x40]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140019e81
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001a109
call fcn.140023008
xor r9d, r9d
lea rax, [rsp + 0x50]
lea edx, [r9 + 0x1a]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x140019ef5
mov edx, 0x693bdfa8
mov ecx, 0xeb3eacf9
mov r8d, 0x1c57d459
call fcn.1400015d0
lea rcx, [rsp + 0x50]
mov r8, rax
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x140019ec7
xor edx, edx
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
inc rdx
test ax, ax
jne 0x140019ed2
lea rcx, [rsp + 0x50]
call fcn.14001fc34
cmp al, 1
je 0x14001a05a
xor r9d, r9d
lea rax, [rsp + 0x50]
xor r8d, r8d
lea ebx, [r9 + 0x23]
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov edx, ebx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x140019f68
mov edx, 0xe719c93d
mov ecx, 0x651cba0e
mov r8d, 0x9275c2cc
call fcn.1400015d0
lea rcx, [rsp + 0x50]
mov r9, rax
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x140019f38
xor r8d, r8d
movzx eax, word [r9 + r8*2]
mov word [rcx + r8*2], ax
inc r8
test ax, ax
jne 0x140019f44
lea rcx, [rsp + 0x50]
call fcn.14001fc34
cmp al, 1
je 0x14001a05a
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14001a05a
mov edx, 0x9bbe5ad2
mov ecx, 0x19bb29c7
mov r8d, 0xeed25134
call fcn.1400015d0
lea rcx, [rsp + 0x50]
mov r8, rax
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x140019fab
xor edx, edx
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
inc rdx
test ax, ax
jne 0x140019fb6
lea rcx, [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, 0xd3bfdd77
mov ecx, 0x51baaf92
mov r8d, 0xa6d3d69c
call fcn.1400015d0
lea rcx, [rsp + 0x50]
mov r9, rax
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x140019ff5
xor edx, edx
movzx eax, word [r9 + rdx*2]
mov word [rcx + rdx*2], ax
inc rdx
test ax, ax
jne 0x14001a000
lea rcx, [rsp + 0x50]
call fcn.14001fc34
test al, al
jne 0x14001a05a
xor r9d, r9d
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x50]
lea r8d, [r9 + 2]
mov edx, 0x40000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14001a05a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [0x140174718]
lea r8, [rsp + 0x48]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x14001a0ce
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, 0x7045a3c3
mov ecx, 0xf240d108
mov r8d, 0x529a824
lea ebx, [rax*2 + 2]
call fcn.1400015d0
mov rcx, qword [rsp + 0x48]
mov r9d, 1
mov rdx, rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [0x140168470]
mov edx, 0x1934820e
mov r8d, 0x14
call fcn.140001558
lea r8, [0x140128ee8]
lea rcx, [rsp + 0x50]
mov rdx, rax
mov r9d, 1
call fcn.1400e9240
lea rcx, [rsp + 0x50]
call fcn.140004878
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.1400e7da0
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret