Function at 0x140004afa
Capabilities:
Check os version
Create directory
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x368
mov r14, rcx
mov rax, qword [0x14006d038]
xor rax, rsp
mov qword [rsp + 0x360], rax
lea rsi, [rsp + 0x40]
mov dword [rsi], 0xaaaaaaaa
lea rcx, str.Logging
mov edx, 4
mov r8, rsi
mov r9d, 4
call fcn.14000474e
xor ecx, ecx
test eax, eax
jne 0x140004b4a
mov ecx, dword [rsp + 0x40]
mov dword [0x1400703f8], ecx
test cl, 0x20
je 0x140004da9
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
lea rbx, [rsp + 0x24c]
mov r8d, 0x110
mov rcx, rbx
xor edx, edx
call fcn.140010270
mov dword [rbx - 4], 0x114
lea rbx, [rsp + 0x248]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rbx + 4], 6
jb 0x140004bfb
lea r9, [rsp + 0x40]
mov qword [r9], 0
lea rcx, section..rdata
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
je 0x140004bdf
lea rcx, [0x140055010]
lea r9, [rsp + 0x40]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x140004d98
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.14000beda
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x140004c3b
lea rbx, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.140010270
xor ecx, ecx
mov rdx, rbx
mov r8d, 0x1c
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x140004d98
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0x40]
call fcn.14000beda
lea rdx, [0x140061890]
lea rbx, [rsp + 0x20]
mov rcx, rbx
call fcn.140006e4e
cmp byte [rax + 0x17], 0
jns 0x140004c58
mov rax, qword [rax]
mov rdi, qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rcx, rax
xor edx, edx
call rdi
lea rdx, str.EdgeBho
mov rcx, rbx
call fcn.140006e4e
cmp byte [rax + 0x17], 0
jns 0x140004c7e
mov rax, qword [rax]
mov rcx, rax
xor edx, edx
call rdi
lea rdx, [0x14006186c]
mov rcx, rbx
call fcn.140006e4e
mov rcx, rbx
mov rdx, r14
call fcn.140006e4e
test byte [0x1400703f9], 0x20
je 0x140004cfd
lea rdx, [0x1400618b8]
lea rdi, [rsp + 0x20]
mov rcx, rdi
call fcn.140006e4e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, rsi
mov edx, eax
call fcn.14005286f
movzx r8d, byte [rsp + 0x57]
test r8b, r8b
jns 0x140004ce1
mov r8, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
call fcn.14000bbe0
cmp byte [rsp + 0x57], 0
jns 0x140004cfd
mov rcx, qword [rsp + 0x40]
call fcn.14000c794
lea rdx, [0x1400618bc]
lea rsi, [rsp + 0x20]
mov rcx, rsi
call fcn.140006e4e
xor edi, edi
test byte [0x1400703f9], 0x10
sete bl
cmp qword [0x140070330], 0
je 0x140004d46
lea rax, [0x1400702b0]
mov rcx, qword [0x1400702b0]
movsxd rdx, dword [rcx + 4]
lea rcx, [rax + rdx]
mov edx, dword [rdx + rax + 0x20]
or edx, 4
jmp 0x140004d93
cmp byte [rsp + 0x37], 0
jns 0x140004d52
mov rsi, qword [rsp + 0x20]
lea rdx, [0x1400618c6]
mov rcx, rsi
call fcn.140021874
mov qword [0x140070330], rax
test rax, rax
je 0x140004d27
mov dil, bl
shl edi, 5
or edi, 0x10
mov dword [0x140070350], edi
lea rax, [0x1400702b0]
mov rcx, qword [0x1400702b0]
movsxd rcx, dword [rcx + 4]
add rcx, rax
xor edx, edx
call fcn.14000a438
cmp byte [rsp + 0x37], 0
jns 0x140004da9
mov rcx, qword [rsp + 0x20]
call fcn.14000c794
mov rcx, qword [rsp + 0x360]
xor rcx, rsp
call fcn.14000e2f0
nop
add rsp, 0x368
pop rbx
pop rdi
pop rsi
pop r14
ret