Function at 0x1400974e0
Capabilities:
Check if file exists
Create process on windows
Delete directory
Get disk information
Get disk size
Get file attributes
Query environment variable
Set file attributes

Disassembly:
mov r11, rsp
push r12
push r13
sub rsp, 0x2a8
mov rax, qword [0x1403a8088]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov qword [r11 + 0x18], rbx
mov r13, rcx
mov qword [r11 - 0x18], rbp
lea rcx, [rsp + 0x60]
mov qword [r11 - 0x20], rsi
mov rbp, rdx
mov qword [r11 - 0x28], rdi
movabs rax, 0x5c003a0058
mov qword [r11 - 0x30], r14
xor edx, edx
xor r14d, r14d
mov qword [r11 - 0x38], r15
mov r8d, 0x208
mov qword [rsp + 0x48], r14
mov r12d, r14d
mov qword [rsp + 0x58], rax
call fcn.14027b2c0
test rbp, rbp
je 0x140097b11
mov rcx, qword [rbp + 0x480]
test rcx, rcx
je 0x140097b11
cmp dword [rbp + 0x4a0], r14d
jne 0x140097b11
cmp dword [rbp + 0x4a4], r14d
jne 0x140097b11
cmp dword [rbp + 0x490], r14d
jne 0x140097b11
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
bt eax, 0xa
jb 0x140097b11
mov rcx, qword [rbp + 0x498]
test rcx, rcx
jne 0x1400975b6
mov rcx, qword [rbp + 0x480]
test rcx, rcx
je 0x140097b27
call fcn.14004bc80
mov rdi, rax
test rax, rax
je 0x140097b27
mov rcx, rax
call fcn.140055c90
test eax, eax
jne 0x140097b27
mov rcx, qword [r13 + 8]
call fcn.1400560b0
mov rbx, rax
test rax, rax
je 0x140097b27
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140097b27
mov rcx, rbx
call fcn.140055c90
test eax, eax
jne 0x140097b27
lea edx, [rax + 1]
mov rcx, rdi
lea r8d, [rax + 3]
call fcn.1400526c0
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140097645
lea r9, [rsp + 0x48]
mov r8, rdi
lea rdx, [0x140082180]
mov rcx, rax
call fcn.140052980
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x48], r12
jbe 0x140097b27
movzx eax, word [rbx]
lea rcx, [rsp + 0x58]
mov word [rsp + 0x58], ax
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x140097b27
lea r9, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x1400976b8
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jb 0x1400976b8
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathStripPathW]
lea r8, [0x140335e24]
mov r9, rbx
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.14004ebd0
jmp 0x140097b27
movzx ecx, word [rsp + 0x58]
call fcn.14004f160
test eax, eax
jne 0x1400976d8
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathStripPathW]
lea r8, [0x140335e1c]
jmp 0x1400976a1
mov rcx, rdi
call fcn.14005fa10
test eax, eax
je 0x140097702
mov rcx, qword [r13 + 8]
lea rdx, [0x140335e08]
mov r8d, 0x1e
call fcn.1400850d0
test eax, eax
je 0x140097b27
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov rsi, r14
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
or rcx, 0xffffffffffffffff
mov r15d, eax
test eax, eax
je 0x140097752
mov eax, 2
mul r15
cmovo rax, rcx
mov rcx, rax
call fcn.14012a2dc
lea r8, [r15 + r15]
xor edx, edx
mov rcx, rax
mov rsi, rax
call fcn.14027b2c0
mov r8d, r15d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
movzx ecx, word [rsp + 0x58]
mov word [rsi], cx
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14009778c
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryEmptyW]
test eax, eax
jne 0x14009778c
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathStripPathW]
mov r9, rsi
lea r8, [0x140335dfc]
jmp 0x1400976a4
mov rdx, rdi
lea rcx, [0x140335e78]
call fcn.14005fb50
mov rcx, rdi
mov dword [rsp + 0x40], eax
mov r15d, eax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400977c7
mov rcx, rdi
call fcn.14005f8a0
mov rcx, rdi
call fcn.140060d60
mov rcx, rdi
call fcn.1400547f0
call fcn.14005e1b0
mov rdx, rsi
mov dword [rsp + 0x44], eax
mov rcx, rdi
call fcn.140055750
test eax, eax
je 0x140097aa3
mov edx, 1
mov rcx, rdi
lea r8d, [rdx + 2]
call fcn.1400526c0
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14009781b
xor r9d, r9d
lea rdx, [0x140084880]
mov r8, rdi
mov rcx, rax
call fcn.140052980
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x80
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140097854
lea r8, [0x140335e40]
jmp 0x140097aaa
mov r8d, 1
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateSymbolicLinkW]
movzx r12d, al
test al, al
jne 0x14009787a
lea r8, [0x140335e30]
jmp 0x140097aaa
xor r8d, r8d
mov dword [rbp + 0x4a0], 1
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r15d, eax
test eax, eax
je 0x1400978d4
mov rcx, 0xffffffffffffffff
mov eax, 2
mul r15
cmovo rax, rcx
mov rcx, rax
call fcn.14012a2dc
lea r8, [r15 + r15]
xor edx, edx
mov rcx, rax
mov r14, rax
call fcn.14027b2c0
mov r8d, r15d
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rbx, qword [rbp + 0x4a8]
mov qword [rbp + 0x478], r14
test rbx, rbx
je 0x140097a73
movzx eax, word [0x14045e53c]
mov rcx, rbx
cmp word [rsi], ax
mov rax, qword [rbx]
jne 0x1400979b6
call qword [rax + gethostname]
mov rax, qword [rbx]
lea r8, [0x140335ed8]
xor r9d, r9d
lea rdx, [0x1400c6350]
mov rcx, rbx
call qword [rax + 0x268]
lea r8, [0x140335ec0]
mov rcx, rax
lea rdx, [0x140335ea8]
mov r9, qword [rax]
call qword [r9 + 0x290]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
mov rax, qword [rbx]
lea r8, [0x140335e98]
xor r9d, r9d
lea rdx, [0x1400c6350]
mov rcx, rbx
call qword [rax + 0x268]
lea r8, [0x140335f28]
mov rcx, rax
lea rdx, [0x140335f10]
mov r9, qword [rax]
call qword [r9 + 0x290]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
mov rax, qword [rbx]
lea r8, [0x140335f00]
xor r9d, r9d
lea rdx, [0x1400c6350]
mov rcx, rbx
call qword [rax + 0x268]
lea r8, [0x140335ee8]
lea rdx, [0x140335f80]
jmp 0x140097a66
call qword [rax + gethostname]
mov rax, qword [rbx]
lea r8, [0x140335f70]
xor r9d, r9d
lea rdx, [0x1400c6350]
mov rcx, rbx
call qword [rax + 0x268]
lea r8, [0x140335f58]
mov rcx, rax
lea rdx, [0x140335f40]
mov r9, qword [rax]
call qword [r9 + 0x290]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
mov rax, qword [rbx]
lea r8, [0x140335fd8]
xor r9d, r9d
lea rdx, [0x1400c6350]
mov rcx, rbx
call qword [rax + 0x268]
lea r8, [0x140335fc0]
mov rcx, rax
lea rdx, [0x140335fa8]
mov r9, qword [rax]
call qword [r9 + 0x290]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
mov rax, qword [rbx]
lea r8, [0x140335f98]
xor r9d, r9d
lea rdx, [0x1400c6350]
mov rcx, rbx
call qword [rax + 0x268]
lea r8, [0x140336020]
lea rdx, [0x140336008]
mov r9, qword [rax]
mov rcx, rax
call qword [r9 + 0x290]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x8000000
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
lea r8, [0x140335ff8]
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.14004ebd0
mov r15d, dword [rsp + 0x40]
jmp 0x140097aeb
lea r8, [0x140335e68]
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.14004ebd0
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov rdx, rdi
mov rcx, rsi
call fcn.140055750
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
jne 0x140097aeb
mov rcx, rsi
call fcn.1400849b0
cmp dword [rsp + 0x44], 0
je 0x140097af8
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
test r15d, r15d
je 0x140097b27
mov edx, 1
lea rcx, str.X:Windowsexplorer.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x140097b27
lea r8, [0x140335dc0]
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.14004ebd0
cmp word [rsp + 0x60], 0
mov r15, qword [rsp + 0x280]
mov r14, qword [rsp + 0x288]
mov rdi, qword [rsp + 0x290]
mov rsi, qword [rsp + 0x298]
mov rbp, qword [rsp + 0x2a0]
mov rbx, qword [rsp + 0x2d0]
je 0x140097b73
mov rcx, qword [r13 + 8]
lea rdx, [rsp + 0x60]
mov r8d, 0xa
call fcn.140084fe0
mov eax, r12d
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14012a2b0
add rsp, 0x2a8
pop r13
pop r12
ret