Function at 0x140009d50
Capabilities:
Check if file exists
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0xf0
mov qword [rsp + 0x98], 0xfffffffffffffffe
lea rcx, [rsp + 0x30]
call fcn.1400181d0
nop
lea rcx, [rsp + 0x40]
call fcn.1400181d0
nop
mov rcx, qword [rsp + 0x100]
add rcx, 0xb8
call fcn.140002d50
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.14000bcb0
mov rcx, qword [rsp + 0x100]
add rcx, 0xc0
call fcn.140002d50
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14000bcb0
mov rax, qword [rsp + 0x100]
movzx eax, byte [rax + 0xc8]
test eax, eax
jne 0x140009df4
lea rcx, [rsp + 0x30]
call fcn.14000bd30
test eax, eax
je 0x140009df4
lea rcx, [rsp + 0x40]
call fcn.14000bd30
test eax, eax
jne 0x140009ed0
lea rcx, [rsp + 0x30]
call fcn.140017780
lea r9, [0x140035070]
mov r8d, 0x2793
mov rdx, rax
mov rcx, qword [rsp + 0x100]
call fcn.140009bd0
test eax, eax
jne 0x140009e39
lea rcx, [rsp + 0x40]
call fcn.140004a00
nop
lea rcx, [rsp + 0x30]
call fcn.140004a00
jmp 0x14000a2ee
lea rcx, [rsp + 0x40]
call fcn.14000bd30
test eax, eax
jne 0x140009ed0
lea rcx, [rsp + 0x30]
call fcn.140002d50
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov qword [rsp + 0x48], rax
lea rdx, [0x140035110]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140009ea5
lea rdx, [0x140035120]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140009ea5
lea rdx, str..wim
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140009ebe
lea rcx, [rsp + 0x30]
call fcn.14000bd50
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14000bcb0
jmp 0x140009ed0
lea rcx, [rsp + 0x40]
call fcn.140017780
mov rcx, rax
call fcn.14001da20
mov r9d, 0x2819
mov r8d, 0x2818
mov edx, 0x27dd
mov rcx, qword [rsp + 0x100]
call fcn.140008d50
cmp qword [rsp + 0x100], 0
je 0x140009f0f
mov rax, qword [rsp + 0x100]
add rax, 0x50
mov qword [rsp + 0xa0], rax
jmp 0x140009f1b
mov qword [rsp + 0xa0], 0
mov rcx, qword [rsp + 0x100]
add rcx, 0xa0
call fcn.140002d50
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x40]
call fcn.140002d50
mov rbx, rax
lea rcx, [rsp + 0x30]
call fcn.140002d50
mov rdx, rax
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov r9, qword [rsp + 0xa0]
mov r8, rbx
mov rcx, qword [rsp + 0xa8]
call qword [rax + 0x28]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jl 0x14000a06e
cmp dword [rsp + 0x38], 0
jne 0x14000a044
lea rcx, [rsp + 0x30]
call fcn.140002d50
mov r9, rax
mov r8d, 0x281d
mov edx, 0x27dd
mov rcx, qword [rsp + 0x100]
call fcn.140008ef0
call fcn.14001dd80
test eax, eax
je 0x14000a042
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], 0
mov dword [rsp + 0x54], 0
jmp 0x140009fe5
mov eax, dword [rsp + 0x54]
add eax, 1
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0xa
jge 0x14000a042
lea rcx, [rsp + 0x40]
call fcn.140002d50
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14000a035
lea rcx, [rsp + 0x40]
call fcn.140002d50
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x140035140]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x14000a042
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140009fda
jmp 0x14000a069
lea rcx, [rsp + 0x30]
call fcn.140002d50
mov r9, rax
mov r8d, 0x2800
mov edx, 0x27dd
mov rcx, qword [rsp + 0x100]
call fcn.140008ef0
jmp 0x14000a2d9
cmp dword [rsp + 0x38], 0xeeee0001
jne 0x14000a186
lea rcx, [rsp + 0x58]
call fcn.1400181d0
nop
mov edx, 0x27ff
lea rcx, [rsp + 0x30]
call fcn.140004770
lea rdx, [0x140034f68]
lea rcx, [rsp + 0x68]
call fcn.14000dc10
nop
lea rcx, [rsp + 0x58]
call fcn.140002d50
mov rbx, rax
lea rcx, [rsp + 0x30]
call fcn.140002d50
lea r8, [rsp + 0x68]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.14000df80
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xb8], rax
mov r8, rbx
mov rdx, qword [rsp + 0xb8]
lea rcx, [rsp + 0x78]
call fcn.14000dda0
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0xc8], rax
mov rcx, qword [rsp + 0xc8]
call fcn.140002d50
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.14000bcb0
nop
lea rcx, [rsp + 0x78]
call fcn.140005d50
nop
lea rcx, [rsp + 0x70]
call fcn.140005d50
nop
lea rcx, [rsp + 0x68]
call fcn.140005d50
lea rcx, [rsp + 0x58]
call fcn.140002d50
mov r9, rax
mov r8d, 0x27fe
mov edx, 0x27dd
mov rcx, qword [rsp + 0x100]
call fcn.140008ef0
nop
lea rcx, [rsp + 0x58]
call fcn.140004a00
jmp 0x14000a2d9
cmp dword [rsp + 0x38], 0xeeee0002
jne 0x14000a2b0
lea rcx, [rsp + 0x60]
call fcn.1400181d0
nop
mov edx, 0x27fd
lea rcx, [rsp + 0x60]
call fcn.140004770
lea rdx, [0x140035068]
lea rcx, [rsp + 0x80]
call fcn.14000dc10
nop
lea rcx, [rsp + 0x60]
call fcn.140002d50
mov rbx, rax
lea rcx, [rsp + 0x30]
call fcn.140002d50
lea r8, [rsp + 0x80]
mov rdx, rax
lea rcx, [rsp + 0x88]
call fcn.14000df80
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0xd8], rax
mov r8, rbx
mov rdx, qword [rsp + 0xd8]
lea rcx, [rsp + 0x90]
call fcn.14000dda0
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0xe8], rax
mov rcx, qword [rsp + 0xe8]
call fcn.140002d50
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.14000bcb0
nop
lea rcx, [rsp + 0x90]
call fcn.140005d50
nop
lea rcx, [rsp + 0x88]
call fcn.140005d50
nop
lea rcx, [rsp + 0x80]
call fcn.140005d50
lea rcx, [rsp + 0x60]
call fcn.140002d50
mov r9, rax
mov r8d, 0x27fe
mov edx, 0x27dd
mov rcx, qword [rsp + 0x100]
call fcn.140008ef0
nop
lea rcx, [rsp + 0x60]
call fcn.140004a00
jmp 0x14000a2d9
cmp dword [rsp + 0x38], 0x80004004
je 0x14000a2d9
mov rcx, qword [rsp + 0x100]
add rcx, 0x50
mov rax, qword [rsp + 0x100]
mov rax, qword [rax + 0x50]
mov edx, dword [rsp + 0x38]
call qword [rax]
nop
lea rcx, [rsp + 0x40]
call fcn.140004a00
nop
lea rcx, [rsp + 0x30]
call fcn.140004a00
add rsp, 0xf0
pop rbx
ret