Function at 0x1400f3090
Capabilities:
Check if file exists
Create process on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x1230
call fcn.1401da720
sub rsp, rax
mov qword [rsp + 0x1120], 0xfffffffffffffffe
mov rax, qword [0x1402aa5c0]
xor rax, rsp
mov qword [rsp + 0x1220], rax
cmp qword [rsp + 0x1248], 1
je 0x1400f30e1
cmp qword [rsp + 0x1248], 2
jne 0x1400f3116
mov rax, qword [rsp + 0x1240]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x1240]
call qword [rax + 0x2d0]
mov edx, 2
mov rcx, qword [rsp + 0x1240]
call fcn.140078c20
mov eax, 1
jmp 0x1400f3bd5
mov rax, qword [rsp + 0x1248]
and rax, 0xffff
movzx eax, ax
mov dword [rsp + 0x1128], eax
cmp dword [rsp + 0x1128], 0x803f
jg 0x1400f31a2
cmp dword [rsp + 0x1128], 0x803f
je 0x1400f352f
cmp dword [rsp + 0x1128], 0x50d
je 0x1400f3b12
cmp dword [rsp + 0x1128], 0x8003
je 0x1400f33dc
cmp dword [rsp + 0x1128], 0x800c
je 0x1400f31eb
cmp dword [rsp + 0x1128], 0x800d
je 0x1400f3288
cmp dword [rsp + 0x1128], 0x8011
je 0x1400f3698
jmp 0x1400f3bb8
cmp dword [rsp + 0x1128], 0x8043
je 0x1400f3419
cmp dword [rsp + 0x1128], 0x809c
je 0x1400f39c0
cmp dword [rsp + 0x1128], 0x80a1
je 0x1400f3340
cmp dword [rsp + 0x1128], 0xe146
je 0x1400f382c
jmp 0x1400f3bb8
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8002
xor edx, edx
lea rcx, [0x1403b5c10]
call fcn.1400d71f0
mov rcx, qword [rsp + 0x1240]
add rcx, 0x220
call fcn.14000d4e0
test rax, rax
je 0x1400f327e
mov rcx, qword [rsp + 0x1240]
add rcx, 0x220
xor r8d, r8d
mov edx, 0x800c
call fcn.14000cc20
mov rcx, qword [rsp + 0x1240]
add rcx, 0x220
mov r8d, 1
mov edx, 0x800d
call fcn.14000cc20
mov rcx, qword [rsp + 0x1240]
add rcx, 0x220
mov r8d, 1
mov edx, 0x8030
call fcn.14000cc20
mov eax, 1
jmp 0x1400f3bd5
mov r8d, 0xffffffff
mov edx, 0x124
mov ecx, 0x75
call fcn.1400f16c0
cmp eax, 6
jne 0x1400f3336
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8003
xor edx, edx
lea rcx, [0x1403b5c10]
call fcn.1400d71f0
mov rcx, qword [rsp + 0x1240]
add rcx, 0x220
call fcn.14000d4e0
test rax, rax
je 0x1400f3336
mov rcx, qword [rsp + 0x1240]
add rcx, 0x220
mov r8d, 1
mov edx, 0x800c
call fcn.14000cc20
mov rcx, qword [rsp + 0x1240]
add rcx, 0x220
xor r8d, r8d
mov edx, 0x800d
call fcn.14000cc20
mov rcx, qword [rsp + 0x1240]
add rcx, 0x220
xor r8d, r8d
mov edx, 0x8030
call fcn.14000cc20
mov eax, 1
jmp 0x1400f3bd5
lea rcx, [rsp + 0x1058]
call fcn.140001000
mov qword [rsp + 0x1130], rax
mov rax, qword [rsp + 0x1130]
mov qword [rsp + 0x1138], rax
lea r8, [0x14021d644]
mov rdx, qword [rsp + 0x1138]
lea rcx, [rsp + 0x1060]
call fcn.1400010b0
mov qword [rsp + 0x1140], rax
mov rcx, qword [rsp + 0x1140]
call fcn.14000f8f0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x1060]
call fcn.140001490
nop
lea rcx, [rsp + 0x1058]
call fcn.140001490
mov eax, 1
jmp 0x1400f3bd5
mov rdx, qword [rsp + 0x1240]
add rdx, 0x4e8
mov ecx, 2
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov rax, qword [rsp + 0x1240]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x1240]
call qword [rax + 0x2b0]
mov eax, 1
jmp 0x1400f3bd5
lea rcx, [rsp + 0x840]
call fcn.140002de0
nop
xor eax, eax
mov word [rsp + 0x40], ax
lea rdi, [rsp + 0x42]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
mov r8d, 0x400
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dx, VarDateFromDisp
lea rcx, [rsp + 0x40]
call fcn.140001460
mov rdx, rax
xor eax, eax
mov word [rdx], ax
lea r8, [0x14021d8e0]
mov edx, 0x400
lea rcx, [rsp + 0x40]
call fcn.1400aa190
lea rcx, [rsp + 0x1068]
call fcn.14000e290
lea r8, [0x14021d8f0]
lea rdx, [rsp + 0x1070]
mov rcx, rax
call fcn.14000c960
mov qword [rsp + 0x1148], rax
mov rax, qword [rsp + 0x1148]
mov qword [rsp + 0x1150], rax
mov r9, qword [rsp + 0x1150]
mov r9, qword [r9]
lea r8, [rsp + 0x40]
lea rdx, str._sLog__s.txt
lea rcx, [rsp + 0x840]
call fcn.140002c70
nop
lea rcx, [rsp + 0x1070]
call fcn.140001490
lea rcx, [rsp + 0x840]
call fcn.14000f8f0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x840]
call fcn.140001490
mov eax, 1
jmp 0x1400f3bd5
lea rcx, [rsp + 0x1050]
call fcn.140002de0
nop
xor eax, eax
mov word [rsp + 0x850], ax
lea rdi, [rsp + 0x852]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
mov r8d, 0x400
lea rdx, [rsp + 0x850]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dx, VarDateFromDisp
lea rcx, [rsp + 0x850]
call fcn.140001460
mov rdx, rax
xor eax, eax
mov word [rdx], ax
lea r8, [0x14021d928]
mov edx, 0x400
lea rcx, [rsp + 0x850]
call fcn.1400aa190
lea rcx, [rsp + 0x1078]
call fcn.14000e290
lea r8, [0x14021d938]
lea rdx, [rsp + 0x1080]
mov rcx, rax
call fcn.14000c960
mov qword [rsp + 0x1158], rax
mov rax, qword [rsp + 0x1158]
mov qword [rsp + 0x1160], rax
mov r9, qword [rsp + 0x1160]
mov r9, qword [r9]
lea r8, [rsp + 0x850]
lea rdx, str._sFatal__s.txt
lea rcx, [rsp + 0x1050]
call fcn.140002c70
nop
lea rcx, [rsp + 0x1080]
call fcn.140001490
lea rcx, [rsp + 0x1050]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400f3652
xor r8d, r8d
mov edx, 0x40
lea rcx, str.No_errors
call fcn.1400ef950
nop
lea rcx, [rsp + 0x1050]
call fcn.140001490
jmp 0x1400f3bb8
lea rcx, [rsp + 0x1050]
call fcn.14000f8f0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x1050]
call fcn.140001490
mov eax, 1
jmp 0x1400f3bd5
lea rdx, [0x14021d9a0]
lea rcx, [rsp + 0x1090]
call fcn.1400ef320
mov qword [rsp + 0x1168], rax
lea rdx, [0x14021d988]
mov rcx, qword [rsp + 0x1168]
call fcn.140006d90
mov byte [rsp + 0x1088], al
lea rcx, [rsp + 0x1090]
call fcn.140001490
movzx edx, byte [rsp + 0x1088]
test edx, edx
je 0x1400f3746
lea rdx, [0x14021d9b8]
lea rcx, [rsp + 0x1098]
call fcn.1400ef320
mov qword [rsp + 0x1170], rax
mov rcx, qword [rsp + 0x1170]
call fcn.14000f8f0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x1098]
call fcn.140001490
xor eax, eax
jmp 0x1400f3bd5
call fcn.14000e2c0
mov rdx, rax
lea rcx, [rsp + 0x10a0]
call fcn.140002100
mov qword [rsp + 0x1178], rax
mov rax, qword [rsp + 0x1178]
mov qword [rsp + 0x1180], rax
mov r8, qword [rsp + 0x1180]
lea rdx, [0x14021d9f0]
lea rcx, [rsp + 0x10a8]
call fcn.140006c90
mov qword [rsp + 0x1188], rax
mov rax, qword [rsp + 0x1188]
mov qword [rsp + 0x1190], rax
lea r8, [0x14021d9d0]
mov rdx, qword [rsp + 0x1190]
lea rcx, [rsp + 0x10b0]
call fcn.1400010b0
mov qword [rsp + 0x1198], rax
mov rcx, qword [rsp + 0x1198]
call fcn.14000f8f0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x10b0]
call fcn.140001490
nop
lea rcx, [rsp + 0x10a8]
call fcn.140001490
nop
lea rcx, [rsp + 0x10a0]
call fcn.140001490
mov eax, 1
jmp 0x1400f3bd5
lea rdx, [0x14021da20]
lea rcx, [rsp + 0x10c0]
call fcn.1400ef320
mov qword [rsp + 0x11a0], rax
lea rdx, [0x14021da08]
mov rcx, qword [rsp + 0x11a0]
call fcn.140006d90
mov byte [rsp + 0x10b8], al
lea rcx, [rsp + 0x10c0]
call fcn.140001490
movzx edx, byte [rsp + 0x10b8]
test edx, edx
je 0x1400f38da
lea rdx, [0x14021da38]
lea rcx, [rsp + 0x10c8]
call fcn.1400ef320
mov qword [rsp + 0x11a8], rax
mov rcx, qword [rsp + 0x11a8]
call fcn.14000f8f0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x10c8]
call fcn.140001490
xor eax, eax
jmp 0x1400f3bd5
call fcn.14000e2c0
mov rdx, rax
lea rcx, [rsp + 0x10d0]
call fcn.140002100
mov qword [rsp + 0x11b0], rax
mov rax, qword [rsp + 0x11b0]
mov qword [rsp + 0x11b8], rax
mov r8, qword [rsp + 0x11b8]
lea rdx, str.http:__www.
lea rcx, [rsp + 0x10d8]
call fcn.140006c90
mov qword [rsp + 0x11c0], rax
mov rax, qword [rsp + 0x11c0]
mov qword [rsp + 0x11c8], rax
lea r8, str..com__refprog
mov rdx, qword [rsp + 0x11c8]
lea rcx, [rsp + 0x10e0]
call fcn.1400010b0
mov qword [rsp + 0x11d0], rax
mov rcx, qword [rsp + 0x11d0]
call fcn.14000f8f0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x10e0]
call fcn.140001490
nop
lea rcx, [rsp + 0x10d8]
call fcn.140001490
nop
lea rcx, [rsp + 0x10d0]
call fcn.140001490
mov eax, 1
jmp 0x1400f3bd5
lea rdx, [0x14021daa8]
lea rcx, [rsp + 0x10f0]
call fcn.1400ef320
mov qword [rsp + 0x11d8], rax
lea rdx, [0x14021da88]
mov rcx, qword [rsp + 0x11d8]
call fcn.140006d90
mov byte [rsp + 0x10e8], al
lea rcx, [rsp + 0x10f0]
call fcn.140001490
movzx edx, byte [rsp + 0x10e8]
test edx, edx
je 0x1400f3a6e
lea rdx, [0x14021dac8]
lea rcx, [rsp + 0x10f8]
call fcn.1400ef320
mov qword [rsp + 0x11e0], rax
mov rcx, qword [rsp + 0x11e0]
call fcn.14000f8f0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x10f8]
call fcn.140001490
xor eax, eax
jmp 0x1400f3bd5
call fcn.14000e2c0
mov rdx, rax
lea rcx, [rsp + 0x1100]
call fcn.140002100
mov qword [rsp + 0x11e8], rax
mov rax, qword [rsp + 0x11e8]
mov qword [rsp + 0x11f0], rax
mov r8, qword [rsp + 0x11f0]
lea rdx, str.http:__forum.icafeman.com__ref
lea rcx, [rsp + 0x1108]
call fcn.140006c90
mov qword [rsp + 0x11f8], rax
mov rcx, qword [rsp + 0x11f8]
call fcn.14000f8f0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x1108]
call fcn.140001490
nop
lea rcx, [rsp + 0x1100]
call fcn.140001490
mov eax, 1
jmp 0x1400f3bd5
lea rcx, [rsp + 0x1110]
call fcn.14018aa70
mov qword [rsp + 0x1200], rax
mov rax, qword [rsp + 0x1200]
mov qword [rsp + 0x1208], rax
call fcn.14000e2c0
mov rdx, rax
lea rcx, [rsp + 0x1118]
call fcn.1400ef320
mov qword [rsp + 0x1210], rax
mov rax, qword [rsp + 0x1210]
mov qword [rsp + 0x1218], rax
mov rcx, qword [rsp + 0x1208]
call fcn.14000f8f0
mov rdi, rax
mov rcx, qword [rsp + 0x1218]
call fcn.14000f8f0
lea r9, str.http:__update.youngzsoft.com_updatesystem_update.php
mov r8, rdi
mov rdx, rax
xor ecx, ecx
call fcn.1400de2f0
nop
lea rcx, [rsp + 0x1118]
call fcn.140001490
nop
lea rcx, [rsp + 0x1110]
call fcn.140001490
mov eax, 1
jmp 0x1400f3bd5
mov r8, qword [rsp + 0x1250]
mov rdx, qword [rsp + 0x1248]
mov rcx, qword [rsp + 0x1240]
call fcn.14007ee44
mov rcx, qword [rsp + 0x1220]
xor rcx, rsp
call fcn.1400a8790
add rsp, 0x1230
pop rdi
ret