Function at 0x14003e7a0
Capabilities:
Create directory
Create thread
Get common file path
Set environment variable

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x90
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov qword [r11 + 0x20], rbx
mov edi, r9d
mov esi, r8d
mov rbx, rdx
mov eax, 0x5e
cmp ax, word [rdx]
jne 0x14003e7e0
add rbx, 2
mov qword [r11 + 0x10], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [rax + 0x400]
lea rcx, [rsp + 0x78]
call fcn.140063580
nop
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x50], rax
xor ebp, ebp
mov ax, bp
mov dword [rsp + 0x4c], eax
mov cx, bp
mov dword [rsp + 0x44], ecx
mov word [rsp + 0x40], bp
lea edx, [rbp + 0x23]
lea r8d, [rbp + 0x24]
cmp esi, r8d
jne 0x14003e82e
mov eax, r8d
mov dword [rsp + 0x4c], eax
jmp 0x14003e838
cmp esi, edx
jne 0x14003e838
mov ecx, edx
mov dword [rsp + 0x44], edx
cmp r8w, word [rbx]
jne 0x14003e857
cmp ax, bp
jne 0x14003e857
mov word [rsp + 0x4c], r8w
add rbx, 2
mov qword [rsp + 0xb8], rbx
jmp 0x14003e872
cmp dx, word [rbx]
jne 0x14003e872
cmp cx, bp
jne 0x14003e872
mov word [rsp + 0x44], dx
add rbx, 2
mov qword [rsp + 0xb8], rbx
mov eax, 0x20
cmp ax, word [rbx]
jne 0x14003e888
add rbx, 2
mov qword [rsp + 0xb8], rbx
mov ecx, 0x2a
lea eax, [rcx + 3]
cmp cx, word [rbx]
je 0x14003e89a
cmp ax, word [rbx]
jne 0x14003e8ae
movzx eax, word [rbx]
mov word [rsp + 0x40], ax
add rbx, 2
mov qword [rsp + 0xb8], rbx
mov dword [rsp + 0x48], ebp
cmp sil, bpl
setne al
mov byte [rsp + 0x30], al
lea rcx, [rsp + 0x60]
call fcn.140063500
nop
cmp word [rbx], bp
jne 0x14003e9de
cmp edi, ebp
je 0x14003e9d9
cmp edi, 0x23
je 0x14003e9d9
lea rdi, str.Favorites
mov ebp, 8
mov rbx, qword [rsp + 0x50]
mov r8, qword [rdi]
add r8, 2
lea rdx, str._s
mov rcx, rbx
call fcn.140029bc4
movsxd rcx, eax
lea rax, [rbx + rcx*2]
mov qword [rsp + 0x50], rax
mov r9d, 1
mov r8d, dword [rdi - 8]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x14003e9c1
cmp dword [rdi - 8], 0x1a
jne 0x14003e95f
lea rdx, str.MicrosoftInternet_ExplorerQuick_Launch
mov rcx, qword [rsp + 0x50]
call fcn.14010d9e4
mov rcx, qword [rsp + 0x50]
call fcn.14003050c
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rdx, str.HKCUEnvironment_
lea rcx, [rsp + 0x60]
call fcn.140071360
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.140063600
mov r8b, 1
mov rdx, qword [rsp + 0x60]
lea rcx, [0x14019c170]
call fcn.14008eab0
mov r8, qword [rsp + 0x50]
mov rdx, qword [rdi]
lea rcx, [0x14019c170]
call fcn.140061290
and qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, esi
mov rdx, rbx
mov rcx, qword [rsp + 0xb0]
call fcn.14003e7a0
add rdi, 0x10
sub rbp, 1
jne 0x14003e8f2
mov rbx, qword [rsp + 0xb8]
jmp 0x14003e9de
mov byte [rsp + 0x30], 0x10
mov sil, bpl
xor r10d, r10d
mov r8b, r10b
mov byte [rsp + 0xc0], r10b
mov rdi, qword [rsp + 0xd0]
cmp rdi, r10
je 0x14003ec28
mov rax, rdi
cmp word [rdi], r10w
je 0x14003ec28
lea ecx, [r10 + 9]
lea ebx, [rcx + 0x1b]
lea edi, [rcx + 0x25]
lea edx, [rcx + 0x17]
lea r11d, [r10 + 0x7e]
lea r9d, [r10 + 0x65]
cmp cx, word [rax]
ja 0x14003ea31
cmp word [rax], 0xd
jbe 0x14003ebcb
cmp dx, word [rax]
je 0x14003ebcb
cmp di, word [rax]
je 0x14003ebbd
cmp bx, word [rax]
je 0x14003ebbd
mov ecx, 0x25
cmp cx, word [rax]
je 0x14003ebb1
mov ecx, 0x2a
cmp cx, word [rax]
jne 0x14003ea72
or sil, 4
mov ecx, 9
jmp 0x14003ebbd
cmp r11w, word [rax]
jne 0x14003ea91
cmp r11w, word [rax + 2]
jne 0x14003ea91
or sil, 2
add rax, 2
mov ecx, 9
jmp 0x14003ebbd
cmp r11w, word [rax]
jne 0x14003eaaf
cmp di, word [rax + 2]
jne 0x14003eaaf
or sil, 8
add rax, 2
mov ecx, 9
jmp 0x14003ebbd
cmp r11w, word [rax]
jne 0x14003ead2
mov edx, ecx
cmp dx, word [rax + 2]
mov edx, 0x20
jne 0x14003ead2
or sil, 9
add rax, 2
lea ecx, [rdx - 0x17]
jmp 0x14003ebbd
cmp r11w, word [rax]
jne 0x14003eae6
or sil, 1
mov ecx, 9
jmp 0x14003ebbd
mov ecx, 0x2d
cmp cx, word [rax]
jne 0x14003eb22
cmp r9w, word [rax + 2]
jne 0x14003eb22
mov ecx, 0x6e
cmp cx, word [rax + 4]
jne 0x14003eb22
lea r9d, [rcx + 8]
cmp r9w, word [rax + 6]
jne 0x14003eb22
or bpl, 0x40
add rax, 6
lea ecx, [r9 - 0x6d]
lea r9d, [rcx + 0x5c]
jmp 0x14003ebbd
mov r9d, 0x2d
cmp r9w, word [rax]
jne 0x14003eb65
lea ecx, [r9 + 0x45]
cmp cx, word [rax + 2]
jne 0x14003eb65
lea ecx, [r9 + 0x34]
cmp cx, word [rax + 4]
jne 0x14003eb65
lea r9d, [rcx + 0x16]
cmp r9w, word [rax + 6]
jne 0x14003eb5f
or r8b, 0x40
add rax, 6
lea ecx, [r9 - 0x6e]
lea r9d, [rcx + 0x5c]
jmp 0x14003ebbd
mov r9d, 0x2d
cmp r9w, word [rax]
jne 0x14003eba6
mov r9d, 0x65
cmp r9w, word [rax + 2]
jne 0x14003ebb8
mov r9d, 0x78
cmp r9w, word [rax + 4]
jne 0x14003eb9b
mov byte [rsp + 0xc0], 1
add rax, 4
lea ecx, [r9 - 0x6f]
lea r9d, [rcx + 0x5c]
jmp 0x14003ebbd
mov ecx, 9
lea r9d, [rcx + 0x5c]
jmp 0x14003ebbd
mov ecx, 9
lea r9d, [rcx + 0x5c]
jmp 0x14003ebbd
mov ecx, 9
jmp 0x14003ebbd
mov ecx, 9
add rax, 2
cmp word [rax], r10w
jne 0x14003ea22
cmp r8b, r10b
mov rbx, qword [rsp + 0xb8]
mov rdi, qword [rsp + 0xd0]
movzx edx, word [rdi]
je 0x14003ec28
mov sil, r10b
mov eax, 0x20
cmp cx, dx
ja 0x14003ebf6
cmp dx, 0xd
jbe 0x14003ec08
cmp ax, dx
je 0x14003ec08
add rdi, 2
mov dx, word [rdi]
cmp dx, r10w
jne 0x14003ebeb
mov qword [rsp + 0xd0], rdi
lea rcx, [rsp + 0xd0]
call fcn.140029d28
mov rdi, qword [rsp + 0xd0]
mov rbx, rdi
mov edx, 0x3d
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov qword [rsp + 0x38], rax
xor ecx, ecx
cmp rax, rcx
je 0x14003ec4b
mov word [rax], cx
add qword [rsp + 0x38], 2
mov qword [rsp + 0x58], rcx
mov rax, qword [rsp + 0xb0]
cmp byte [rax + 0xba], cl
jne 0x14003ec80
test byte [rax + 0xf], 0xf
jne 0x14003ec80
mov byte [rsp + 0x20], 1
xor r9d, r9d
lea r8, [rsp + 0x58]
mov rdx, rbx
mov rcx, rax
call fcn.14006d6c0
jmp 0x14003ec98
mov byte [rsp + 0x20], 1
xor r9d, r9d
lea r8, [rsp + 0x58]
mov rdx, rbx
mov rcx, rax
call fcn.14006bc40
mov rbx, qword [rsp + 0x58]
xor ecx, ecx
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x70], rcx
mov dword [rsp + 0x68], ecx
cmp sil, cl
je 0x14003ecec
mov rax, qword [rsp + 0x38]
cmp rax, rcx
je 0x14003ed2d
or bpl, sil
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.140071360
mov rdx, rax
mov r8b, bpl
mov rcx, qword [rsp + 0xb0]
call fcn.140089570
mov qword [rsp + 0x38], rax
jmp 0x14003ecf1
mov rax, qword [rsp + 0x38]
xor esi, esi
cmp rax, rsi
je 0x14003ed2f
lea r9, [rsp + 0x68]
mov r8, rdi
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140077040
mov rax, qword [rsp + 0x38]
cmp rax, rsi
je 0x14003ed2f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
add edi, edi
mov rax, qword [rsp + 0x38]
jmp 0x14003ed31
xor esi, esi
mov edi, esi
cmp word [rbx], si
je 0x14003ee35
cmp word [rsp + 0x4c], si
je 0x14003ed8f
cmp rax, rsi
jne 0x14003ed64
mov r8, rbx
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment
mov rcx, 0xffffffff80000002
call qword [0x14019c380]
mov rax, qword [rsp + 0x38]
jmp 0x14003ed8f
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8, rbx
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment
mov rcx, 0xffffffff80000002
call qword [0x14019c378]
mov rax, qword [rsp + 0x38]
cmp word [rbx], si
je 0x14003ee2f
cmp word [rsp + 0x44], si
je 0x14003eded
cmp rax, rsi
jne 0x14003edc2
mov r8, rbx
lea rdx, str.Environment
mov rcx, 0xffffffff80000001
call qword [0x14019c380]
mov rax, qword [rsp + 0x38]
jmp 0x14003eded
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8, rbx
lea rdx, str.Environment
mov rcx, 0xffffffff80000001
call qword [0x14019c378]
mov rax, qword [rsp + 0x38]
cmp word [rbx], si
je 0x14003ee3b
cmp byte [rsp + 0xc0], sil
je 0x14003ee11
mov rdx, rax
mov rcx, qword [rsp + 0xb0]
call fcn.140067150
mov qword [rsp + 0x38], rax
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp eax, esi
je 0x14003ee25
mov ebx, esi
jmp 0x14003ee3f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x14003ee3f
mov ebx, dword [rsp + 0x48]
jmp 0x14003ee3f
mov ebx, dword [rsp + 0x48]
jmp 0x14003ee3f
mov ebx, dword [rsp + 0x48]
mov al, byte [rsp + 0x30]
cmp al, sil
je 0x14003eeac
mov cx, word [rsp + 0x40]
mov edx, 0x2a
cmp dx, cx
je 0x14003eeac
mov edx, 0x2d
cmp dx, cx
je 0x14003ee84
mov cl, byte [0x14019bf21]
cmp cl, dl
je 0x14003ee84
cmp al, 0x10
je 0x14003ee7d
cmp cl, sil
je 0x14003ee7d
mov byte [0x14019bf22], 1
jmp 0x14003eeac
call fcn.14002c3ac
jmp 0x14003eeac
lea rax, [0x14019bc94]
mov qword [rsp + 0x28], rax
mov edx, 0x10000
mov dword [rsp + 0x20], edx
xor r9d, r9d
lea r8, [0x14003e604]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
lea rcx, [rsp + 0x70]
call fcn.14005b520
nop
lea rcx, [rsp + 0x80]
call fcn.14005b520
nop
lea rcx, [rsp + 0x58]
call fcn.14005b520
nop
lea rcx, [rsp + 0x60]
call fcn.14005b520
nop
lea rcx, [rsp + 0x78]
call fcn.14005b520
mov eax, ebx
mov rbx, qword [rsp + 0xc8]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret