Function at 0x1400b9e60
Capabilities:
Create directory
Query environment variable

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x490
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x4e0], rbx
mov rax, qword [0x140229498]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r15, rdx
mov r14, rcx
mov qword [rsp + 0x58], rcx
xor edi, edi
mov qword [rcx], rdi
mov dword [rsp + 0x40], 5
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x48], reloc.WS2_32.dll_recv
xor r12b, r12b
mov r13d, edi
lea rbp, [rsp + 0x40]
test r12b, r12b
jne 0x1400ba15f
mov eax, dword [0x14023c5f0]
test al, 1
jne 0x1400b9f11
or eax, 1
mov dword [0x14023c5f0], eax
xor r9d, r9d
lea r8, str.SHGetFolderPathW
lea rdx, str.Shell32
lea rcx, [0x14023c5e0]
call fcn.140086de0
lea rcx, [0x14018c9b0]
call fcn.14011f460
nop
mov eax, dword [0x14023c5f0]
test al, 2
jne 0x1400b9f4e
or eax, 2
mov dword [0x14023c5f0], eax
xor r9d, r9d
lea r8, str.SHGetFolderPathW
lea rdx, str.SHFolder
lea rcx, [0x14023c5d0]
call fcn.140086de0
lea rcx, [0x14018c9a0]
call fcn.14011f460
nop
mov eax, dword [0x14023c5f0]
test al, 4
jne 0x1400b9f85
or eax, 4
mov dword [0x14023c5f0], eax
xor r9d, r9d
lea r8, str.SHGetSpecialFolderPathW
lea rdx, str.Shell32
lea rcx, [0x14023c5c0]
call fcn.140086de0
lea rcx, [0x14018c990]
call fcn.14011f460
nop
mov ebx, 0x80070057
mov rax, qword [0x14023c5e0]
test rax, rax
je 0x1400b9fb8
lea rcx, [rsp + 0x270]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rbp]
mov rcx, r15
call rax
mov ebx, eax
jmp 0x1400ba047
mov rax, qword [0x14023c5d0]
test rax, rax
je 0x1400b9fe3
lea rcx, [rsp + 0x270]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rbp]
mov rcx, r15
call rax
mov ebx, eax
jmp 0x1400ba047
mov rax, qword [0x14023c5c0]
test rax, rax
je 0x1400ba00d
mov r9d, 1
mov r8d, dword [rbp]
lea rdx, [rsp + 0x270]
xor ecx, ecx
call rax
test eax, eax
je 0x1400ba047
mov ebx, edi
jmp 0x1400ba047
mov r8d, 0x104
lea rdx, [rsp + 0x270]
lea rcx, str._userprofile_Desktop
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rsi, [rsp + 0x270]
lea rdi, str._userprofile_Desktop
mov ecx, socket
repe cmpsw word [rsi], word [rdi]
mov edi, 0
cmovne ebx, edi
cmp ebx, 0x80004005
je 0x1400ba058
test ebx, ebx
je 0x1400ba079
cmp ebx, 1
jne 0x1400ba0ba
xor edx, edx
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400ba079
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400ba0cd
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
or r9d, 0xffffffff
mov r8d, 0xfde9
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x50]
call fcn.14007ba40
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x50], rdi
mov qword [r14], rdx
xor ecx, ecx
call fcn.14011e0c0
mov r12b, 1
add r13d, 1
add rbp, 4
cmp r13d, 3
jae 0x1400ba12d
jmp 0x1400b9ec5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov byte [rsp + 0x68], 0
or r9d, 0xffffffff
lea r8, str.CreateDirectory
mov edx, 0x100
lea rcx, [rsp + 0x68]
call fcn.14007b3b0
mov edx, edi
lea rcx, [rsp + 0x68]
call fcn.14007f910
lea rcx, [rsp + 0x16c]
lea rdx, [rsp + 0x68]
mov r8d, 0x104
call fcn.14011e9b0
lea rdx, [0x14020b6e8]
lea rcx, [rsp + 0x16c]
call fcn.14011f050
int3
test r12b, r12b
jne 0x1400ba15f
xor r8d, r8d
lea rdx, str._SYSTEMDRIVE
lea rcx, [rsp + 0x40]
call fcn.140089810
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x48], edi
mov qword [r14], rdx
xor ecx, ecx
call fcn.14011e950
nop
mov rax, r14
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.14011f1c0
mov rbx, qword [rsp + 0x4e0]
add rsp, 0x490
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret