Function at 0x180004170
Capabilities:
Check if file exists
Create process on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x258]
sub rsp, 0x330
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x18002d008]
xor rax, rsp
mov qword [rbp + 0x220], rax
mov rbx, r9
mov r14, rdx
xor r12d, r12d
mov esi, r12d
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x10]
call sub.msvcrt.dll_memset
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1800042ac
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], r12
mov word [rbp - 0x30], r12w
lea r8d, [r12 + 5]
lea rdx, str.__hs_
lea rcx, [rbp - 0x30]
call fcn.1800031f0
nop
lea r8d, [r12 + 0xa]
lea rdx, [0x180029fa0]
lea rcx, [rbp - 0x30]
call fcn.180002aa0
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
mov r8, r14
lea rdx, str.XH::CProcess::CreateSuspendProcess
call fcn.1800027e0
nop
mov rax, qword [rbp - 0x18]
cmp rax, 8
jb 0x1800045aa
inc rax
mov rcx, qword [rbp - 0x30]
movabs rdi, 0x7fffffffffffffff
cmp rax, rdi
jbe 0x18000425d
call fcn.180005570
int3
add rax, rax
cmp rax, 0x1000
jb 0x1800042a1
test byte [rbp - 0x30], 0x1f
je 0x180004274
call fcn.180005570
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180004283
call fcn.180005570
int3
sub rcx, rax
cmp rcx, 8
jae 0x180004292
call fcn.180005570
int3
cmp rcx, 0x27
jbe 0x18000429e
call fcn.180005570
int3
mov rcx, rax
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
jmp 0x1800045aa
mov r8, r14
mov edx, 0x104
lea rcx, [rbp + 0x10]
call qword [sym.imp.msvcrt.dll_wcscpy_s]
lea rcx, [rbp + 0x10]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], r12
mov word [rbp - 0x30], r12w
mov r15d, 5
mov r8d, r15d
lea rdx, str.__hs_
lea rcx, [rbp - 0x30]
call fcn.1800031f0
nop
lea r8d, [r15 + 6]
lea rdx, [0x180029fe0]
lea rcx, [rbp - 0x30]
call fcn.180002aa0
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
lea r8, [rbp + 0x10]
lea rdx, str.XH::CProcess::CreateSuspendProcess
call fcn.1800027e0
nop
movabs rdi, 0x7fffffffffffffff
mov rax, qword [rbp - 0x18]
cmp rax, 8
jb 0x180004396
inc rax
mov rcx, qword [rbp - 0x30]
cmp rax, rdi
jbe 0x18000434c
call fcn.180005570
int3
add rax, rax
cmp rax, 0x1000
jb 0x180004390
test byte [rbp - 0x30], 0x1f
je 0x180004363
call fcn.180005570
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180004372
call fcn.180005570
int3
sub rcx, rax
cmp rcx, 8
jae 0x180004381
call fcn.180005570
int3
cmp rcx, 0x27
jbe 0x18000438d
call fcn.180005570
int3
mov rcx, rax
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x60], 0x68
xor eax, eax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
lea rax, [0x180029ff8]
mov qword [rsp + 0x70], rax
mov dword [rbp - 0x64], 1
mov word [rbp - 0x60], r15w
lea rax, [rbp - 0x10]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x4000414
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], r12
mov word [rbp - 0x30], r12w
lea rcx, [rbp - 0x30]
test eax, eax
jne 0x1800044e6
mov r8, r15
lea rdx, str.__hs_
call fcn.1800031f0
nop
lea r8d, [rsi + 0xf]
lea rdx, [0x18002a018]
lea rcx, [rbp - 0x30]
call fcn.180002aa0
lea rbx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rbx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.XH::CProcess::CreateSuspendProcess
mov rcx, rbx
call fcn.1800027e0
nop
mov rax, qword [rbp - 0x18]
cmp rax, 8
jb 0x1800045aa
inc rax
mov rcx, qword [rbp - 0x30]
cmp rax, rdi
jbe 0x18000449d
call fcn.180005570
int3
add rax, rax
cmp rax, 0x1000
jb 0x1800042a1
test byte [rbp - 0x30], 0x1f
je 0x1800044b8
call fcn.180005570
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800044c7
call fcn.180005570
int3
sub rcx, rax
cmp rcx, 8
jae 0x1800044d6
call fcn.180005570
int3
cmp rcx, 0x27
jbe 0x18000429e
call fcn.180005570
int3
mov r8d, 4
lea rdx, str.__s_
call fcn.1800031f0
nop
mov r8d, 0x10
lea rdx, [0x18002a048]
lea rcx, [rbp - 0x30]
call fcn.180002aa0
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
mov r8d, dword [rbp]
lea rdx, str.XH::CProcess::CreateSuspendProcess
call fcn.1800029b0
nop
mov rax, qword [rbp - 0x18]
cmp rax, 8
jb 0x180004594
inc rax
mov rcx, qword [rbp - 0x30]
cmp rax, rdi
jbe 0x18000454a
call fcn.180005570
int3
add rax, rax
cmp rax, 0x1000
jb 0x18000458e
test byte [rbp - 0x30], 0x1f
je 0x180004561
call fcn.180005570
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180004570
call fcn.180005570
int3
sub rcx, rax
cmp rcx, 8
jae 0x18000457f
call fcn.180005570
int3
cmp rcx, 0x27
jbe 0x18000458b
call fcn.180005570
int3
mov rcx, rax
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
movups xmm0, xmmword [rbp - 0x10]
movups xmmword [rbx], xmm0
movsd xmm1, qword [rbp]
movsd qword [rbx + 0x10], xmm1
mov esi, 1
mov eax, esi
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.180005c60
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret