Function at 0x140038074
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x580]
sub rsp, 0x680
mov rax, qword [0x1400592a0]
xor rax, rsp
mov qword [rbp + 0x570], rax
xor r12d, r12d
mov r15d, edx
mov qword [rsp + 0x38], r12
mov r14, rcx
mov ebx, 0x80004005
test rcx, rcx
jne 0x1400380c6
lea eax, [rbx - 2]
jmp 0x14003851b
lea rax, [rsp + 0x38]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140038519
mov ecx, 0x208
mov dword [rsp + 0x30], 1
cmp r15d, ecx
lea r9, [rsp + 0x30]
mov eax, r15d
lea rdx, [0x140050c08]
cmova eax, ecx
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x34], eax
xor r8d, r8d
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x150]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
or rdi, 0xffffffffffffffff
or ebx, 0xffffffff
mov esi, 0x104
test eax, eax
jne 0x140038347
mov ecx, dword [rsp + 0x30]
lea eax, [rcx - 1]
cmp eax, 1
ja 0x140038347
cmp ecx, 2
jne 0x1400381e6
mov r8d, esi
lea rdx, [rbp + 0x360]
lea rcx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
test eax, eax
je 0x140038347
lea r8, [rbp + 0x360]
lea rax, [rbp + 0x150]
sub r8, rax
lea edx, [rsi - 1]
lea rcx, [rbp + 0x150]
lea rax, [rdx + 0x7ffffefb]
test rax, rax
je 0x1400381d7
movzx eax, word [r8 + rcx]
test ax, ax
je 0x1400381d7
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400381b4
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r12w
lea r8, [rbp + 0x150]
mov rdx, rsi
lea rax, [rsp + 0x40]
sub r8, rax
lea rcx, [rsp + 0x40]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140038220
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140038220
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400381fd
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r12w
je 0x14003828c
lea rcx, [rsp + 0x40]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], r12w
jne 0x140038239
test rax, rax
je 0x14003826f
cmp word [rsp + rax*2 + 0x3e], 0x5c
jne 0x14003826f
lea rcx, [rsp + 0x40]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], r12w
jne 0x140038258
test rax, rax
je 0x14003826f
mov word [rsp + rax*2 + 0x3e], r12w
jmp 0x140038231
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, ebx
je 0x14003828c
test al, 0x10
jne 0x1400384bf
xor edx, edx
lea rcx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop dword [rax + rax]
lea r8, [rbp + 0x150]
mov rdx, rsi
lea rax, [rsp + 0x40]
sub r8, rax
lea rcx, [rsp + 0x40]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x1400382db
movzx eax, word [r8 + rcx]
test ax, ax
je 0x1400382db
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400382b8
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r12w
je 0x140038347
lea rcx, [rsp + 0x40]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], r12w
jne 0x1400382f4
test rax, rax
je 0x14003832a
cmp word [rsp + rax*2 + 0x3e], 0x5c
jne 0x14003832a
lea rcx, [rsp + 0x40]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], r12w
jne 0x140038313
test rax, rax
je 0x14003832a
mov word [rsp + rax*2 + 0x3e], r12w
jmp 0x1400382ec
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, ebx
je 0x140038347
test al, 0x10
jne 0x1400384bf
mov edx, esi
lea rcx, [rbp + 0x360]
mov ebx, 0x80004005
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x140038508
mov r8d, esi
lea rdx, [rbp + 0x150]
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
lea rdx, [0x14004b368]
lea rcx, [rbp + 0x150]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
mov edx, ebx
test rax, rax
je 0x140038508
mov rcx, rdi
inc rcx
cmp word [rax + rcx*2], r12w
jne 0x1400383ae
cmp rcx, 4
jbe 0x140038508
mov rcx, qword [0x140059d90]
lea r8, [rbp + 0x360]
mov r9d, esi
mov word [rax + 4], r12w
mov edx, 0x26fc
call qword [sym.imp.USER32.dll_LoadStringW]
nop dword [rax + rax]
test eax, eax
je 0x140038508
lea r8, [rbp + 0x360]
mov rdx, rsi
lea rcx, [rbp + 0x150]
call fcn.140010d0c
xor edx, edx
lea rcx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop dword [rax + rax]
lea rdx, [rbp + 0x150]
lea rax, [rsp + 0x40]
sub rdx, rax
lea rcx, [rsp + 0x40]
lea rax, [rsi + 0x7ffffefa]
test rax, rax
je 0x140038452
movzx eax, word [rcx + rdx]
test ax, ax
je 0x140038452
mov word [rcx], ax
add rcx, 2
sub rsi, 1
jne 0x140038430
test rsi, rsi
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r12w
je 0x140038508
lea rcx, [rsp + 0x40]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], r12w
jne 0x14003846f
test rax, rax
je 0x1400384a5
cmp word [rsp + rax*2 + 0x3e], 0x5c
jne 0x1400384a5
lea rcx, [rsp + 0x40]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], r12w
jne 0x14003848e
test rax, rax
je 0x1400384a5
mov word [rsp + rax*2 + 0x3e], r12w
jmp 0x140038467
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x140038508
test al, 0x10
je 0x140038508
mov rdx, r15
lea rax, [rbp + 0x150]
shr rdx, 1
inc rdi
cmp word [rax + rdi*2], r12w
jne 0x1400384cc
inc rdi
cmp rdx, rdi
jbe 0x1400384f2
lea r8, [rbp + 0x150]
mov rcx, r14
call fcn.140010dd0
mov ebx, r12d
jmp 0x140038508
mov ecx, 0x8007007a
mov ebx, 0x8007007a
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x570]
xor rcx, rsp
call fcn.1400017f0
lea r11, [rsp + 0x680]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret