Function at 0x14000b850
Capabilities:
Check if file exists
Get file attributes
Query environment variable
Read .ini file
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x840
mov rax, qword [0x14003f2f0]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov ecx, 0x200000
call fcn.140015468
lea rcx, [0x140042700]
mov edx, 0x5c
mov rbp, rax
call fcn.140016c54
lea r8, [0x140042700]
lea rcx, [rsp + 0x230]
lea rdx, str.._s
test rax, rax
je 0x14000b8c1
lea rdx, [0x140032624]
call fcn.140018028
lea r15, [0x14003f0f0]
xor r12d, r12d
lea r13, [0x14003f108]
nop word [rax + rax]
mov rcx, qword [r15]
lea r9, [rsp + 0x230]
mov r8d, 0x100000
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
test eax, eax
je 0x14000bcd7
mov r14, rbp
cmp word [rbp], r12w
je 0x14000bcd7
mov edx, 0x3d
mov rcx, r14
call fcn.140016c54
test rax, rax
je 0x14000bccd
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x204
mov dword [rsp + 0x20], r12d
call fcn.1400166f0
or rsi, 0xffffffffffffffff
inc rsi
cmp word [r14 + rsi*2], r12w
jne 0x14000b941
lea rdx, [rsp + 0x20]
inc esi
mov rcx, r14
sub rdx, r14
nop dword [rax + rax]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x14000b960
lea rdx, [0x14002ddf8]
lea rcx, [rsp + 0x20]
call fcn.140016fd4
mov rbx, rax
or rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rbx + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x14000b990
lea rdi, [rsp + 0x22]
lea rdi, [rdi + rax*2]
test rdi, rdi
je 0x14000bcc6
lea rdx, str.MoveFiles
mov rcx, rbx
call fcn.140017124
test eax, eax
jne 0x14000b9ce
mov rcx, rdi
call fcn.140010280
jmp 0x14000bcc6
lea rdx, str.CopyFiles
mov rcx, rbx
call fcn.140017124
test eax, eax
jne 0x14000b9ee
mov rcx, rdi
call fcn.140005ce0
jmp 0x14000bcc6
lea rdx, str.DropUrlIcon
mov rcx, rbx
call fcn.140017124
test eax, eax
jne 0x14000ba0e
mov rcx, rdi
call fcn.14000ce00
jmp 0x14000bcc6
lea rdx, str.DropLinkIcon
mov rcx, rbx
call fcn.140017124
test eax, eax
jne 0x14000ba2e
mov rcx, rdi
call fcn.14000bd20
jmp 0x14000bcc6
lea rdx, str.DropShellIcon
mov rcx, rbx
call fcn.140017124
test eax, eax
jne 0x14000ba4e
mov rcx, rdi
call fcn.14000c320
jmp 0x14000bcc6
lea rdx, str.CreateMFU
mov rcx, rbx
call fcn.140017124
test eax, eax
jne 0x14000ba8a
lea rcx, str.C:System.sav_flagsBtBOSWin10.flg
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, rdi
cmp eax, 0xffffffff
je 0x14000ba80
call fcn.14000a3b0
jmp 0x14000bcc6
call fcn.140009d90
jmp 0x14000bcc6
lea rdx, str.CreateMFUReg
mov rcx, rbx
call fcn.140017124
test eax, eax
jne 0x14000baaa
mov rcx, rdi
call fcn.140009fc0
jmp 0x14000bcc6
lea rdx, str.CreateMFUXml
mov rcx, rbx
call fcn.140017124
test eax, eax
jne 0x14000baca
mov rcx, rdi
call fcn.14000a3b0
jmp 0x14000bcc6
lea rdx, str.CreateTaskbarXml
mov rcx, rbx
call fcn.140017124
test eax, eax
jne 0x14000baea
mov rcx, rdi
call fcn.14000ab50
jmp 0x14000bcc6
lea rdx, str.CreateIEHomeReg
mov rcx, rbx
call fcn.140017124
test eax, eax
jne 0x14000bb0a
mov rcx, rdi
call fcn.140006e60
jmp 0x14000bcc6
lea rdx, str.CreateIESearchReg
mov rcx, rbx
call fcn.140017124
test eax, eax
jne 0x14000bb2a
mov rcx, rdi
call fcn.1400089a0
jmp 0x14000bcc6
lea rdx, str.CreateIEHome
mov rcx, rbx
call fcn.140017124
test eax, eax
jne 0x14000bb4a
mov rcx, rdi
call fcn.140006720
jmp 0x14000bcc6
lea rdx, str.CreateIESearch
mov rcx, rbx
call fcn.140017124
test eax, eax
jne 0x14000bb6a
mov rcx, rdi
call fcn.140007380
jmp 0x14000bcc6
lea rdx, str.CreateRegEntry
mov rcx, rbx
call fcn.140017124
test eax, eax
jne 0x14000bb8a
mov rcx, rdi
call fcn.14000a5b0
jmp 0x14000bcc6
lea rdx, str.CreateIniEntry
mov rcx, rbx
call fcn.140017124
test eax, eax
jne 0x14000bbaa
mov rcx, rdi
call fcn.140009b80
jmp 0x14000bcc6
lea rdx, str.RunFiles
mov rcx, rbx
call fcn.140017124
test eax, eax
jne 0x14000bbca
mov rcx, rdi
call fcn.140010ba0
jmp 0x14000bcc6
lea rdx, str.CreateIEWebSliceIns
mov rcx, rbx
call fcn.140017124
test eax, eax
jne 0x14000bbea
mov rcx, rdi
call fcn.1400097e0
jmp 0x14000bcc6
lea rdx, str.MergeIEWebSliceIns
mov rcx, rbx
call fcn.140017124
test eax, eax
jne 0x14000bc0a
mov rcx, rdi
call fcn.14000ff10
jmp 0x14000bcc6
lea rdx, str.CreateIEAcceleratorIns
mov rcx, rbx
call fcn.140017124
test eax, eax
jne 0x14000bc2a
mov rcx, rdi
call fcn.140005ff0
jmp 0x14000bcc6
lea rdx, str.MergeIEAcceleratorIns
mov rcx, rbx
call fcn.140017124
test eax, eax
jne 0x14000bc47
mov rcx, rdi
call fcn.14000f710
jmp 0x14000bcc6
lea rdx, str.SetEnvVar
mov rcx, rbx
call fcn.140017124
test eax, eax
jne 0x14000bc64
mov rcx, rdi
call fcn.140011360
jmp 0x14000bcc6
lea rdx, str.ExpandEnvVars
mov rcx, rbx
call fcn.140017124
test eax, eax
jne 0x14000bc81
mov rcx, rdi
call fcn.14000d680
jmp 0x14000bcc6
lea rcx, [rsp + 0x434]
xor edx, edx
mov r8d, 0x3fc
mov dword [rsp + 0x430], r12d
call fcn.1400166f0
lea rdx, [rsp + 0x430]
mov r8d, 0x200
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rsp + 0x430]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
movsxd rax, esi
lea r14, [r14 + rax*2]
cmp word [r14], r12w
jne 0x14000b910
add r15, 8
cmp r15, r13
jl 0x14000b8e0
mov rcx, rbp
call fcn.1400159b8
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.1400161c0
lea r11, [rsp + 0x840]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret