Function at 0x14000947c
Capabilities:
Create directory
Delete file
Delete registry key
Get common file path
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x270]
sub rsp, 0x370
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rbp + 0x260], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersion_
lea rcx, [rsp + 0x50]
call fcn.1400e9c20
lea rbx, [rsp + 0x50]
mov edx, 0x600684c5
movsxd rcx, eax
mov r8d, 0xa
add rbx, rcx
lea rcx, str._b1H_
call fcn.140001318
sub rbx, rax
xor edi, edi
mov cl, byte [rax]
mov byte [rbx + rax], cl
inc rax
test cl, cl
jne 0x1400094df
lea rax, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov r9d, 0x2010e
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140009668
mov edx, 0xb5ae7f71
mov ecx, 0x9dfae2e8
mov r8d, 0x2091e7e3
call fcn.140001390
lea r8, [0x140129d88]
lea rcx, [rbp + 0x160]
mov rdx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [rsp + 0x40]
lea rdx, [rbp + 0x160]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x50]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x50]
mov edx, 0x5c
call fcn.1400e9f08
mov rbx, rax
test rax, rax
je 0x140009668
mov edx, 0xc4d01dbf
mov ecx, 0xec848016
mov r8d, 0x51ef8527
add rbx, 2
call fcn.140001390
mov rdx, rbx
sub rdx, rax
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x1400095ae
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, 0xa6d95566
mov ecx, 0x8e8dc82b
mov r8d, 0x33e6cdfe
call fcn.140001390
mov rdx, rbx
sub rdx, rax
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x1400095e4
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, 0x3b9ae6c4
mov ecx, 0x13ce7b95
mov r8d, 0xaea57e5c
call fcn.140001390
mov rdx, rbx
sub rdx, rax
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x14000961a
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, 0x9f0d1121
mov ecx, 0xb7598c54
mov r8d, 0xa3289a4
call fcn.140001390
sub rbx, rax
movzx ecx, word [rax]
mov word [rbx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x14000964d
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, 1
call fcn.1400087d0
mov rdx, qword [0x140175b50]
lea r8, [rsp + 0x40]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x14000969f
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140009927
call fcn.140023d28
xor r9d, r9d
lea rax, [rsp + 0x50]
lea edx, [r9 + 0x1a]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x140009713
mov edx, 0xbda16580
mov ecx, 0x95f5f897
mov r8d, 0x289efd05
call fcn.140001390
lea rcx, [rsp + 0x50]
mov r8, rax
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x1400096e5
xor edx, edx
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
inc rdx
test ax, ax
jne 0x1400096f0
lea rcx, [rsp + 0x50]
call fcn.140022910
cmp al, 1
je 0x140009878
xor r9d, r9d
lea rax, [rsp + 0x50]
xor r8d, r8d
lea ebx, [r9 + 0x23]
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov edx, ebx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x140009786
mov edx, 0x3de7ef9b
mov ecx, 0x15b372aa
mov r8d, 0xa8d8771e
call fcn.140001390
lea rcx, [rsp + 0x50]
mov r9, rax
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x140009756
xor r8d, r8d
movzx eax, word [r9 + r8*2]
mov word [rcx + r8*2], ax
inc r8
test ax, ax
jne 0x140009762
lea rcx, [rsp + 0x50]
call fcn.140022910
cmp al, 1
je 0x140009878
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x140009878
mov edx, 0xe7fd3743
mov ecx, 0xcfa9ab90
mov r8d, 0x72c2afd1
call fcn.140001390
lea rcx, [rsp + 0x50]
mov r8, rax
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x1400097c9
xor edx, edx
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
inc rdx
test ax, ax
jne 0x1400097d4
lea rcx, [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, 0x84cadb78
mov ecx, 0xac9e479b
mov r8d, 0x11f543e7
call fcn.140001390
lea rcx, [rsp + 0x50]
mov r9, rax
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x140009813
xor edx, edx
movzx eax, word [r9 + rdx*2]
mov word [rcx + rdx*2], ax
inc rdx
test ax, ax
jne 0x14000981e
lea rcx, [rsp + 0x50]
call fcn.140022910
test al, al
jne 0x140009878
xor r9d, r9d
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x50]
lea r8d, [r9 + 2]
mov edx, 0x40000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x140009878
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [0x140175b50]
lea r8, [rsp + 0x48]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x1400098ec
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, 0x9b170c10
mov ecx, 0xb3439099
mov r8d, 0xe289483
lea ebx, [rax*2 + 2]
call fcn.140001390
mov rcx, qword [rsp + 0x48]
mov r9d, 1
mov rdx, rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [0x140165902]
mov edx, 0xc7ad3c9f
mov r8d, 0x14
call fcn.140001318
lea r8, str.2.6.6
lea rcx, [rsp + 0x50]
mov rdx, rax
mov r9d, 1
call fcn.1400e9c20
lea rcx, [rsp + 0x50]
call fcn.14000a180
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.1400e8bc0
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret