Function at 0x14000b560
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get program files directory
Get startup folder

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0x1d8]
sub rsp, 0x2b0
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov r14d, r8d
mov rsi, rdx
mov rdi, rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], r15
mov word [rcx], r15w
mov dword [rsp + 0x30], 1
mov word [rbp - 0x60], r15w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp - 0x5e]
call fcn.14000fbf0
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r15 + 0x26]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14000b86b
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], r15
mov word [rsp + 0x58], r15w
cmp word [rbp - 0x60], ax
jne 0x14000b60d
mov r8d, r15d
jmp 0x14000b620
lea rax, [rbp - 0x60]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x14000b615
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x58]
call fcn.1400065b0
nop
lea r8, [0x14002a6a0]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x38]
call fcn.140006d70
mov rbx, rax
cmp rdi, rax
je 0x14000b677
cmp qword [rdi + 0x18], 8
jb 0x14000b65c
mov rcx, qword [rdi]
call fcn.14000d11c
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], r15
mov word [rdi], r15w
mov rdx, rbx
mov rcx, rdi
call fcn.140006040
cmp qword [rsp + 0x50], 8
jb 0x14000b689
mov rcx, qword [rsp + 0x38]
call fcn.14000d11c
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r15
mov word [rsp + 0x38], r15w
cmp qword [rsp + 0x70], 8
jb 0x14000b6af
mov rcx, qword [rsp + 0x58]
call fcn.14000d11c
lea r9, [0x14002a608]
lea r8, [0x14002a69c]
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.14000b1d0
cmp qword [rax + 0x10], 0
setne bl
cmp qword [rsp + 0x50], 8
jb 0x14000b6e3
mov rcx, qword [rsp + 0x38]
call fcn.14000d11c
test bl, bl
je 0x14000b7bc
lea r9, [0x14002a608]
lea r8, [0x14002a69c]
xor edx, edx
lea rcx, [rsp + 0x78]
call fcn.14000b1d0
mov rbx, rax
lea r8, [0x14002a608]
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.140006e50
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.14000a460
mov rbx, rax
cmp rdi, rax
je 0x14000b75f
cmp qword [rdi + 0x18], 8
jb 0x14000b744
mov rcx, qword [rdi]
call fcn.14000d11c
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], r15
mov word [rdi], r15w
mov rdx, rbx
mov rcx, rdi
call fcn.140006040
cmp qword [rsp + 0x50], 8
jb 0x14000b771
mov rcx, qword [rsp + 0x38]
call fcn.14000d11c
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r15
mov word [rsp + 0x38], r15w
cmp qword [rsp + 0x70], 8
jb 0x14000b797
mov rcx, qword [rsp + 0x58]
call fcn.14000d11c
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], r15
mov word [rsp + 0x58], r15w
cmp qword [rbp - 0x70], 8
jb 0x14000b7bc
mov rcx, qword [rsp + 0x78]
call fcn.14000d11c
cmp qword [rsi + 0x10], 0
je 0x14000b839
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0x78]
mov rcx, rsi
call fcn.140005e90
nop
mov qword [rsp + 0x20], 1
lea r9, [0x14002a608]
mov r8, qword [rax + 0x10]
xor edx, edx
mov rcx, rax
call fcn.14000b9c0
test eax, eax
setne bl
cmp qword [rbp - 0x70], 8
jb 0x14000b80e
mov rcx, qword [rsp + 0x78]
call fcn.14000d11c
test bl, bl
je 0x14000b827
mov r8d, 1
lea rdx, [0x14002a608]
mov rcx, rdi
call fcn.140007090
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call fcn.140006f50
test r14d, r14d
je 0x14000b86b
cmp qword [rdi + 0x18], 8
jb 0x14000b84a
mov rcx, qword [rdi]
jmp 0x14000b84d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000b86b
xor r8d, r8d
lea rdx, [0x14002a60c]
mov rcx, rdi
call fcn.1400065b0
nop
cmp qword [rsi + 0x18], 8
jb 0x14000b87a
mov rcx, qword [rsi]
call fcn.14000d11c
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], r15
mov word [rsi], r15w
mov rax, rdi
mov rbx, qword [rsp + 0x2f0]
add rsp, 0x2b0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret