Function at 0x1400011d0
Capabilities:
Create directory
Hash data using fnv
Terminate process
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movzx r9d, byte [r8]
mov rbx, rdx
mov rdx, qword [0x140c9eb60]
mov rsi, rcx
cmp byte [rdx], 0
je 0x1400014a4
nop word [rax + rax]
mov r10, rdx
nop dword [rax + rax]
add r10, 1
cmp byte [r10], 0
jne 0x140001208
test r9b, r9b
je 0x1400012a8
mov ecx, r9d
xor eax, eax
jmp 0x140001235
add rax, 1
movzx ecx, byte [r8 + rax]
test cl, cl
je 0x1400012a8
cmp byte [rdx + rax], cl
je 0x140001228
lea rdx, [r10 + 1]
nop
movzx eax, byte [rdx + 1]
movzx r10d, byte [rdx + 2]
add rdx, 8
movzx ecx, byte [rdx - 8]
movzx edi, byte [rdx - 3]
shl r10d, 0x10
shl eax, 8
or cl, byte [rdx - 4]
movzx r11d, byte [rdx - 2]
or eax, r10d
movzx r10d, byte [rdx - 5]
movzx ecx, cl
shl edi, 8
shl r11d, 0x10
shl r10d, 0x18
or eax, r10d
movzx r10d, byte [rdx - 1]
or eax, ecx
or eax, edi
shl r10d, 0x18
or eax, r11d
or eax, r10d
jne 0x140001240
cmp byte [rdx], 0
jne 0x140001200
mov r10, rdx
jmp 0x14000121b
mov r15d, dword [r10 + 5]
mov edi, dword [r10 + 1]
lea r12, [r10 + 9]
xor r14d, r14d
mov rbp, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rbp
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r10, qword [0x140c9eb50]
mov r13, rax
test rax, rax
je 0x1400014ac
nop dword [rax]
mov r9d, dword [r12]
mov ecx, dword [r12 + 4]
add r12, 8
mov eax, r9d
or eax, ecx
je 0x140001337
lea r8, [rcx + r14]
cmp r15, r8
jb 0x1400014da
xor eax, eax
lea r11, [r13 + r14]
add r9, r10
test rcx, rcx
je 0x140001332
nop dword [rax + rax]
movzx edx, byte [r9 + rax]
mov byte [r11 + rax], dl
add rax, 1
cmp rcx, rax
jne 0x140001320
mov r14, r8
jmp 0x1400012e8
cmp r15, r14
jne 0x1400014da
mov eax, 0x84222325
test r14, r14
je 0x140001385
mov rdx, r13
lea r9, [r13 + r14]
movabs rax, 0xcbf29ce484222325
movabs r8, 0x100000001b3
nop word cs:[rax + rax]
movzx ecx, byte [rdx]
add rdx, 1
xor rax, rcx
imul rax, r8
cmp r9, rdx
jne 0x140001370
mov eax, eax
cmp rdi, rax
jne 0x1400014da
movzx eax, word [rbx]
mov r12, qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rdi, rbx
test ax, ax
jne 0x1400013b5
jmp 0x1400013de
movzx eax, word [rdi + 2]
add rdi, 2
test ax, ax
je 0x1400013de
cmp ax, 0x5c
jne 0x1400013a8
xor eax, eax
xor edx, edx
mov rcx, rbx
add rdi, 2
mov word [rdi - 2], ax
call r12
mov edx, 0x5c
mov word [rdi - 2], dx
movzx eax, word [rdi]
test ax, ax
jne 0x1400013b5
mov rcx, rbx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001485
lea r9, [rsp + 0x4c]
mov r8d, r14d
mov rdx, r13
mov rcx, rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000143e
mov eax, dword [rsp + 0x4c]
cmp r14, rax
je 0x14000145b
xor r9d, r9d
xor r8d, r8d
lea rdx, str.The_installation_folder_was_inaccessible._Regency_could_not_be_installed.
mov rcx, rsi
call qword [sym.imp.USER32.dll_MessageBoxW]
mov byte [0x141cb1860], 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbp
mov r8, r13
xor edx, edx
mov rcx, rax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
xor r9d, r9d
xor r8d, r8d
lea rdx, str.The_installation_folder_was_inaccessible._Regency_could_not_be_installed.
mov rcx, rsi
call qword [sym.imp.USER32.dll_MessageBoxW]
mov byte [0x141cb1860], 1
jmp 0x140001464
mov r10, rdx
jmp 0x140001212
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Insufficient_memory_was_available._Regency_could_not_be_installed.
mov rcx, rsi
mov byte [0x141cb1860], 1
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, rsi
xor r9d, r9d
lea rdx, str.The_installer_has_been_corrupted._Please_download_Regency_again.
xor r8d, r8d
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]