Function at 0x140093010
Capabilities:
Check if file exists
Create process on windows
Delete directory
Get disk information
Get disk size
Get file attributes
Query environment variable
Set file attributes

Disassembly:
mov r11, rsp
push rbp
push rbx
push r13
lea rbp, [r11 - 0x1c8]
sub rsp, 0x2b0
mov rax, qword [0x1403a0088]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov qword [r11 + 0x18], rsi
mov rbx, rcx
mov qword [r11 - 0x38], r15
mov rsi, rdx
xor r15d, r15d
mov qword [rsp + 0x48], rcx
movabs rax, 0x5c003a0058
mov qword [rsp + 0x58], r15
xor edx, edx
mov qword [rsp + 0x68], rax
mov r8d, 0x208
lea rcx, [rsp + 0x70]
mov r13d, r15d
call fcn.1402767a0
test rsi, rsi
je 0x1400937e7
mov rcx, qword [rsi + 0x480]
test rcx, rcx
je 0x1400937e7
cmp dword [rsi + 0x49c], r15d
jne 0x1400937e7
cmp dword [rsi + 0x4a0], r15d
jne 0x1400937e7
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
bt eax, 0xa
jb 0x1400937e7
mov rcx, qword [rsi + 0x494]
mov qword [rsp + 0x2a8], rdi
test rcx, rcx
jne 0x1400930dc
mov rcx, qword [rsi + 0x480]
test rcx, rcx
je 0x14009375c
call fcn.14004baa0
mov rdi, rax
test rax, rax
je 0x14009375c
mov rcx, rax
call fcn.140055600
test eax, eax
jne 0x14009375c
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x298], r14
call fcn.140055a60
mov r14, rax
test rax, rax
je 0x140093754
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400937cc
mov rcx, r14
call fcn.140055600
test eax, eax
jne 0x1400937cc
lea edx, [rax + 1]
mov rcx, rdi
lea r8d, [rax + 3]
call fcn.140052070
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140093173
lea r9, [rsp + 0x58]
mov r8, rdi
lea rdx, [0x14007d250]
mov rcx, rax
call fcn.140052330
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x58], r13
jbe 0x14009320a
movzx eax, word [r14]
lea rcx, [rsp + 0x68]
mov word [rsp + 0x68], ax
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x14009320a
lea r9, [rsp + 0x60]
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x1400931e1
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x58], rax
jb 0x1400931e1
lea r9, [rsp + 0x68]
mov edx, 0x104
lea r8, [0x14032f330]
lea rcx, [rsp + 0x70]
call fcn.14004e9f0
mov rbx, qword [rsp + 0x48]
jmp 0x140093754
movzx ecx, word [rsp + 0x68]
call fcn.14004ef80
lea rcx, [rsp + 0x70]
test eax, eax
jne 0x140093214
lea r9, [rsp + 0x68]
mov edx, 0x104
lea r8, [0x14032f320]
call fcn.14004e9f0
mov rbx, qword [rsp + 0x48]
jmp 0x140093754
xor edx, edx
mov qword [rsp + 0x2a0], r12
mov r8d, 0x208
call fcn.1402767a0
mov rcx, r14
call fcn.140055d30
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov r12, r15
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
or rcx, 0xffffffffffffffff
mov r13d, eax
test eax, eax
je 0x140093285
mov eax, 2
mul r13
cmovo rax, rcx
mov rcx, rax
call fcn.140125a94
lea r8, [r13*2]
xor edx, edx
mov rcx, rax
mov r12, rax
call fcn.1402767a0
mov r8d, r13d
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_PathStripPathW]
mov r9, r14
mov qword [rsp + 0x20], r12
lea r8, [0x14032f3b8]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.14004e9f0
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x70]
call fcn.140055600
test eax, eax
jne 0x1400937ae
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400932f6
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryEmptyW]
test eax, eax
je 0x1400937ae
xor r8d, r8d
lea rcx, [rsp + 0x70]
xor edx, edx
mov r14, r15
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r12d, eax
test eax, eax
je 0x14009334d
mov rcx, 0xffffffffffffffff
mov eax, 2
mul r12
cmovo rax, rcx
mov rcx, rax
call fcn.140125a94
lea r8, [r12 + r12]
xor edx, edx
mov rcx, rax
mov r14, rax
call fcn.1402767a0
mov r8d, r12d
lea rcx, [rsp + 0x70]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x208
call fcn.1402767a0
mov rbx, qword [rsp + 0x48]
mov rdx, r14
mov rcx, rbx
call fcn.140091790
test eax, eax
jne 0x140093391
lea r8, [0x14032f388]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.14004e9f0
mov r13d, r15d
jmp 0x14009374c
mov rcx, rdi
call fcn.14005f3c0
test eax, eax
je 0x1400933b1
mov rcx, qword [rbx + 8]
lea rdx, [0x14032f370]
call fcn.140080170
test eax, eax
je 0x140093389
mov rdx, rdi
lea rcx, [0x14032f410]
call fcn.14005f500
mov rcx, rdi
mov dword [rsp + 0x50], eax
mov r12d, eax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400933ec
mov rcx, rdi
call fcn.14005f250
mov rcx, rdi
call fcn.140060640
mov rcx, rdi
call fcn.140054130
call fcn.14005db60
mov rdx, r14
mov dword [rsp + 0x54], eax
mov rcx, rdi
call fcn.140055090
test eax, eax
je 0x1400936d8
mov edx, 1
mov rcx, rdi
lea r8d, [rdx + 2]
call fcn.140052070
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140093440
xor r9d, r9d
lea rdx, [0x14007f9a0]
mov r8, rdi
mov rcx, rax
call fcn.140052330
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x80
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140093479
lea r8, [0x14032f3d8]
jmp 0x1400936df
mov r8d, 1
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateSymbolicLinkW]
movzx r13d, al
test al, al
jne 0x1400934ae
lea r8, [0x14032f3c8]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.14004e9f0
jmp 0x1400936f1
xor r8d, r8d
mov dword [rsi + 0x49c], 1
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r12d, eax
test eax, eax
je 0x140093508
mov rcx, 0xffffffffffffffff
mov eax, 2
mul r12
cmovo rax, rcx
mov rcx, rax
call fcn.140125a94
lea r8, [r12 + r12]
xor edx, edx
mov rcx, rax
mov r15, rax
call fcn.1402767a0
mov r8d, r12d
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rbx, qword [rsi + 0x4a8]
mov qword [rsi + 0x478], r15
test rbx, rbx
je 0x1400936a8
movzx eax, word [0x140455b60]
mov rcx, rbx
cmp word [r14], ax
mov rax, qword [rbx]
jne 0x1400935eb
call qword [rax + gethostname]
mov rax, qword [rbx]
lea r8, [0x14032f470]
xor r9d, r9d
lea rdx, [0x1400c1bd0]
mov rcx, rbx
call qword [rax + 0x268]
lea r8, [0x14032f458]
mov rcx, rax
lea rdx, [0x14032f440]
mov r9, qword [rax]
call qword [r9 + 0x290]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
mov rax, qword [rbx]
lea r8, [0x14032f430]
xor r9d, r9d
lea rdx, [0x1400c1bd0]
mov rcx, rbx
call qword [rax + 0x268]
lea r8, [0x14032f4c0]
mov rcx, rax
lea rdx, [0x14032f4a8]
mov r9, qword [rax]
call qword [r9 + 0x290]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
mov rax, qword [rbx]
lea r8, [0x14032f498]
xor r9d, r9d
lea rdx, [0x1400c1bd0]
mov rcx, rbx
call qword [rax + 0x268]
lea r8, [0x14032f480]
lea rdx, [0x14032f518]
jmp 0x14009369b
call qword [rax + gethostname]
mov rax, qword [rbx]
lea r8, [0x14032f508]
xor r9d, r9d
lea rdx, [0x1400c1bd0]
mov rcx, rbx
call qword [rax + 0x268]
lea r8, [0x14032f4f0]
mov rcx, rax
lea rdx, [0x14032f4d8]
mov r9, qword [rax]
call qword [r9 + 0x290]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
mov rax, qword [rbx]
lea r8, [0x14032f570]
xor r9d, r9d
lea rdx, [0x1400c1bd0]
mov rcx, rbx
call qword [rax + 0x268]
lea r8, [0x14032f558]
mov rcx, rax
lea rdx, [0x14032f540]
mov r9, qword [rax]
call qword [r9 + 0x290]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
mov rax, qword [rbx]
lea r8, [0x14032f530]
xor r9d, r9d
lea rdx, [0x1400c1bd0]
mov rcx, rbx
call qword [rax + 0x268]
lea r8, [0x14032f5b8]
lea rdx, [0x14032f5a0]
mov r9, qword [rax]
mov rcx, rax
call qword [r9 + 0x290]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x8000000
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
lea r8, [0x14032f590]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.14004e9f0
mov r12d, dword [rsp + 0x50]
jmp 0x140093723
lea r8, [0x14032f400]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.14004e9f0
mov r13d, r15d
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov rdx, rdi
mov rcx, r14
call fcn.140055090
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
jne 0x140093723
mov rcx, r14
call fcn.14007fad0
cmp dword [rsp + 0x54], 0
je 0x140093730
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
test r12d, r12d
je 0x140093747
mov edx, 1
lea rcx, str.X:Windowsexplorer.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov rbx, qword [rsp + 0x48]
mov r12, qword [rsp + 0x2a0]
mov r14, qword [rsp + 0x298]
mov rdi, qword [rsp + 0x2a8]
cmp word [rsp + 0x70], 0
mov r15, qword [rsp + 0x290]
mov rsi, qword [rsp + 0x2e0]
je 0x140093790
mov rcx, qword [rbx + 8]
lea rdx, [rsp + 0x70]
mov r8d, 0xa
call fcn.140080080
mov eax, r13d
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.140125a70
add rsp, 0x2b0
pop r13
pop rbx
pop rbp
ret
lea r8, [0x14032f3a0]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.14004e9f0
mov r13d, r15d
jmp 0x140093747
lea r8, [0x14032f348]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.14004e9f0
jmp 0x140093754
lea r8, [0x14032f360]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.14004e9f0
jmp 0x140093764