Function at 0x140022370
Capabilities:
Check if file exists
Create process on windows
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x258]
sub rsp, 0x358
mov r14, rdx
mov r15, rcx
mov edx, 0x104
lea rcx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor r13d, r13d
mov qword [rbp - 0x70], r13
mov ebx, 7
mov qword [rbp - 0x68], rbx
mov word [rbp - 0x80], r13w
lea rax, [rbp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r13w
jne 0x1400223d4
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x80]
call fcn.14000cfd0
nop
mov r8d, 1
lea rdx, [0x14004df38]
lea rcx, [rbp - 0x80]
call fcn.14000e560
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r13
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], rbx
mov word [rax], r13w
mov rdx, r15
cmp qword [r15 + 0x18], 8
jb 0x140022436
mov rdx, qword [r15]
mov r8, qword [r15 + 0x10]
lea rcx, [rsp + 0x60]
call fcn.14000e560
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], rbx
mov word [rax], r13w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x1400224a1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002249c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400227cf
call fcn.1400243b8
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], rbx
mov word [rsp + 0x60], r13w
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x1400224f1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400224ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400227d5
call fcn.1400243b8
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], rbx
mov word [rbp - 0x80], r13w
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
lea rax, [rsp + 0x40]
mov qword [rbp + 0x30], rax
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
mov r12, qword [r14 + 0x10]
mov rsi, r14
cmp qword [r14 + 0x18], 8
jb 0x140022541
mov rsi, qword [r14]
movabs rax, 0x7ffffffffffffffe
cmp r12, 8
jae 0x14002255e
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x40], xmm0
mov rdi, rbx
jmp 0x14002259c
mov rdi, r12
or rdi, 7
cmp rdi, rax
cmova rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rsp + 0x40]
call fcn.14000d3b0
mov qword [rsp + 0x40], rax
lea r8, [r12*2 + 2]
mov rdx, rsi
mov rcx, rax
call fcn.1400266b0
movabs rax, 0x7ffffffffffffffe
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r13
lea r12, [rbp + 0x10]
mov rdi, qword [rbp + 0x10]
mov rsi, qword [rbp + 0x28]
cmp rsi, 8
cmovae r12, rdi
mov r13, qword [rbp + 0x20]
cmp r13, 8
jae 0x1400225da
movups xmm0, xmmword [r12]
movups xmmword [rsp + 0x20], xmm0
jmp 0x14002260e
mov rbx, r13
or rbx, 7
cmp rbx, rax
cmova rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rsp + 0x20]
call fcn.14000d3b0
mov qword [rsp + 0x20], rax
lea r8, [r13*2 + 2]
mov rdx, r12
mov rcx, rax
call fcn.1400266b0
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], rbx
lea rcx, [rsp + 0x20]
cmp rbx, 8
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400226aa
lea rcx, [rsp + 0x20]
call fcn.14000c530
lea rcx, [rsp + 0x40]
call fcn.14000c530
nop
cmp rsi, 8
jb 0x140022683
lea rdx, [rsi*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14002267a
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400227c9
mov rcx, rdi
call fcn.1400243b8
nop
mov rcx, r15
call fcn.14000c530
nop
mov rcx, r14
call fcn.14000c530
xor eax, eax
add rsp, 0x358
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
mov qword [rbp + 4], rax
mov dword [rbp + 0xc], eax
mov dword [rbp - 0x60], 0x70
mov dword [rbp - 0x5c], 0x440
xor ecx, ecx
mov qword [rbp - 0x58], rcx
lea rax, str.open
mov qword [rbp - 0x50], rax
lea rax, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rax, qword [rsp + 0x20]
mov qword [rbp - 0x48], rax
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rax, qword [rsp + 0x40]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rcx
mov dword [rbp - 0x30], ecx
lea rcx, [rbp - 0x60]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ebx, eax
lea rcx, [rsp + 0x20]
call fcn.14000c530
lea rcx, [rsp + 0x40]
call fcn.14000c530
test ebx, ebx
je 0x140022647
cmp dword [rbp + 0x2b0], 0
je 0x140022776
mov edx, 0xffffffff
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword [rbp + 0x2b8]
test rax, rax
je 0x14002276b
mov rdx, rax
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp rsi, 8
jb 0x1400227ae
lea rdx, [rsi*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400227a5
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400227c9
mov rcx, rdi
call fcn.1400243b8
nop
mov rcx, r15
call fcn.14000c530
nop
mov rcx, r14
call fcn.14000c530
mov eax, 1
jmp 0x140022696
call fcn.1400303f4
nop
call fcn.1400303f4
nop
call fcn.1400303f4
int3