Function at 0x180020220
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rsi, rcx
cmp dword [rdx], 0x38
jae 0x18002024c
mov eax, 0x80070057
jmp 0x180020513
xor r14d, r14d
cmp r14w, word [rdx + 0x12]
jne 0x180020242
movzx r15d, word [rdx + 0x10]
call fcn.180005850
mov rcx, rax
test rax, rax
jne 0x180020273
mov ecx, 0x80004005
call fcn.180005c20
int3
mov rax, qword [rax]
call qword [rax + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x78], rbx
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x104
or eax, ecx
jge 0x1800202aa
mov edx, 0x104
lea rcx, [rsp + 0x78]
call fcn.1800035c0
mov rbx, qword [rsp + 0x78]
cmp dword [rbx - 8], 1
jle 0x1800202c2
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x78]
call fcn.180002d30
mov rbx, qword [rsp + 0x78]
mov r8d, 0x104
mov rdx, rbx
mov rcx, qword [0x1800ec780]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp dword [rbx - 8], 1
jle 0x1800202f0
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x78]
call fcn.180002d30
mov rbx, qword [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdi, str.PhotoViewer
or rbp, 0xffffffffffffffff
test r15d, r15d
jne 0x1800204f2
mov ecx, dword [rsi + 0x48]
test ecx, ecx
jne 0x180020329
mov eax, dword [rsi + 0x4c]
test eax, eax
je 0x18002033a
cmp eax, 1
jne 0x18002033a
lea rdi, str.PdfReader
jmp 0x18002033a
lea rax, str.CaptureScreen
cmp ecx, 1
cmovne rax, rdi
mov rdi, rax
cmp dword [rbx - 8], 1
jle 0x180020352
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x78]
call fcn.180002d30
mov rbx, qword [rsp + 0x78]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.180088034
test eax, eax
js 0x1800204e7
cmp eax, dword [rbx - 0xc]
jg 0x1800204e7
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r14w
lea rdx, str..exe
mov rax, rbp
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x180020390
mov r8d, eax
lea rcx, [rsp + 0x78]
call fcn.180021230
cmp dword [rsi + 0x48], 1
jne 0x1800203dd
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r14
lea r9, str.__menu_
mov rbx, qword [rsp + 0x78]
mov r8, rbx
lea rdx, [0x1800b1ec8]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1800204f2
mov rsi, qword [rsi + 0x18]
test rsi, rsi
je 0x1800204e0
mov rcx, qword [rsi + 0x10]
mov rsi, qword [rsi]
sub rcx, 0x18
call fcn.180016600
lea rbx, [rax + 0x18]
mov qword [rsp + 0x88], rbx
mov rdi, qword [rsp + 0x78]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1800204b3
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1800204b3
call fcn.180005850
test rax, rax
je 0x1800204d5
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + Ordinal_26]
add rax, 0x18
mov qword [rsp + 0x80], rax
mov r8, rbx
lea rdx, [0x1800b2b68]
lea rcx, [rsp + 0x80]
call fcn.180003670
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r14
mov rbx, qword [rsp + 0x80]
mov r9, rbx
mov r8, rdi
lea rdx, [0x1800b1ec8]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rdx, [rbx - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1800204ab
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov rbx, qword [rsp + 0x88]
lea rdx, [rbx - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1800203e1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
jmp 0x1800203e1
mov ecx, 0x80004005
call fcn.180005c20
nop
mov rbx, qword [rsp + 0x78]
jmp 0x1800204f8
mov ecx, 0x80070057
call fcn.180005c20
int3
mov r14d, 0x80070057
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], ebp
sub ebp, 1
jg 0x180020510
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rioctlsocket + 8]
mov eax, r14d
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret