Function at 0x1400608e0
Capabilities:
Create directory
Get common file path

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x80
mov qword [r11 - 0x50], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x1401b5030]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, rcx
mov qword [r11 - 0x48], rcx
lea rax, vtable.VNCOptions.0
mov qword [rcx], rax
lea rdi, [rcx + 0x330]
xor esi, esi
mov qword [rdi], rsi
mov qword [rdi + 8], rsi
mov qword [rdi + 0x10], rsi
add rcx, 0xa82
xor edx, edx
mov r8d, 0xff
call fcn.14011fff0
mov qword [rbx + 0x4b3], rsi
mov qword [rbx + 0x4bb], rsi
mov qword [rbx + 0x4c3], rsi
mov dword [rbx + 0x4cb], esi
mov word [rbx + 0x4cf], si
mov word [rbx + 0x4b3], 0x101
mov byte [rbx + 0x4b5], 1
mov dword [rbx + 0x4b7], 0x1010101
mov word [rbx + 0x4bb], 0x101
mov dword [rbx + 0x4c3], 0x1010101
mov byte [rbx + 0x4bd], 1
mov dword [rbx + 0x4cc], 0x10101
mov byte [rbx + 0x4d0], 1
mov word [rbx + 0x31e], si
mov dword [rbx + 0x321], esi
mov word [rbx + 0x325], 1
mov dword [rbx + 0x328], esi
mov word [rbx + 0x361], si
mov byte [rbx + 0x363], sil
mov byte [rbx + 0x320], sil
mov dword [rsp + 0x30], 0xa
mov rdx, qword [rdi + 8]
cmp rdx, qword [rdi + 0x10]
je 0x1400609fa
mov dword [rdx], 0xa
add qword [rdi + 8], 4
jmp 0x140060a07
lea r8, [rsp + 0x30]
mov rcx, rdi
call fcn.14002de10
mov dword [rbx + 0x348], 0x10000
mov dword [rbx + 0x34c], WSAAsyncSelect
mov dword [rbx + 0x350], 4
mov dword [rbx + 0x354], 1
mov dword [rbx + 0x358], 1
mov dword [rbx + 0x360], 0
mov dword [rbx + 0x364], WSAAsyncSelect
mov dword [rbx + 0x368], WSAAsyncSelect
mov dword [rbx + 0x380], 1
mov qword [rbx + 0x384], 3
mov qword [rbx + 0x38c], rsi
mov dword [rbx + 0x394], esi
mov dword [rbx + 0x398], 0x100
mov byte [rbx + 0x4d1], 0
mov byte [rbx + 0x5d0], 0
mov dword [rbx + 0x5cc], 0xffffffff
mov dword [rbx + 0x6cc], 0xffffffff
mov byte [rbx + 0x4a9], 0
mov byte [rbx + 0x4b2], 0
mov qword [rbx + 0x6dc], rsi
mov word [rbx + 0x6e4], 0
mov byte [rbx + 0x6e6], 0
mov dword [rbx + 0x7ec], esi
mov word [rbx + 0x10], 0
mov byte [rbx + 0x218], 0
mov byte [rbx + 8], 0
mov dword [rbx + 0xc], 0x157c
mov word [rbx + 0x31c], 0
mov byte [rbx + 0x36c], 1
mov dword [rbx + 0x370], 6
mov byte [rbx + 0x374], 1
mov dword [rbx + 0x378], 8
mov word [rbx + 0x37c], 1
mov byte [rbx + 0x12], 0
mov byte [rbx + 0x112], 0
mov dword [rbx + 0x214], 1
mov byte [rbx + 0x49f], 0
mov dword [rbx + 0x6d0], 0
mov word [rbx + 0x6d4], 0
mov byte [rbx + 0x6d6], 0
mov dword [rbx + 0x6d8], esi
lea rdi, [rbx + 0x809]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 5]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x140060bbe
lea r8, [0x1401987b4]
mov edx, 0x104
mov rcx, rdi
call fcn.1401220fc
lea r8, [0x14019a258]
mov edx, 0x104
mov rcx, rdi
call fcn.1401220fc
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.1401308ac
cmp eax, 0xffffffff
jne 0x140060be6
mov rcx, rdi
call fcn.14012e6b0
jmp 0x140060be6
lea rcx, str.TEMP
call fcn.140130b90
mov edx, 0x104
mov rcx, rdi
test rax, rax
mov r8, rax
jne 0x140060be1
lea r8, [0x14019581a]
call fcn.14012209c
lea rcx, [rbx + 0x90d]
lea r8, str.vnc_
mov edx, 0x38
call fcn.14012209c
lea rcx, [rbx + 0x945]
lea r8, str..jpeg
mov edx, 0x38
call fcn.14012209c
mov word [rbx + 0x807], 0
mov word [rbx + 0x804], 0
mov byte [rbx + 0x806], 0
mov dword [rbx + 0x4a0], 0x64
mov dword [rbx + 0x4a4], 0x64
mov byte [rbx + 0x4a8], 0
mov dword [rbx + 0x7f0], 3
mov word [rbx + 0x7f4], 0
mov qword [rbx + 0xb88], rsi
mov dword [rbx + 0x7f8], 0x1e
mov qword [rbx + 0x7fc], 5
mov dword [rbx + 0x35c], esi
lea rdx, [rbx + 0x97e]
mov rcx, rbx
call fcn.1400634d0
nop
mov rax, rbx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14011b0c0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret