Function at 0x180002ca0
Capabilities:
Check if file exists
Create thread
Get file attributes
Get token membership

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x180127088]
xor rax, rsp
mov qword [rbp + 0x240], rax
xor esi, esi
cmp edx, 1
jne 0x180002f83
mov qword [rbp - 0x20], rsi
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], rsi
mov qword [rbp], rsi
lea r8d, [rsi + 0x1f]
lea rdx, str.C:WindowsSystem32iscomp.data
lea rcx, [rbp - 0x20]
call fcn.180005df0
lea rcx, [rbp - 0x18]
cmp qword [rbp], 8
cmovae rcx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea rcx, [rbp - 0x20]
cmp eax, 0xffffffff
jne 0x180002f7e
call fcn.180004950
mov dword [rbp - 0x50], esi
mov dword [rbp - 0x4c], esi
mov word [rbp - 0x48], 0x500
lea rax, [rbp - 0x40]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
mov r9d, 0x220
lea r8d, [rsi + 0x20]
mov dl, 2
lea rcx, [rbp - 0x4c]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x180002d90
lea r8, [rbp - 0x50]
mov rdx, qword [rbp - 0x40]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x180002d86
mov dword [rbp - 0x50], esi
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rbp - 0x50], esi
je 0x180002fb0
mov qword [rbp - 0x20], rsi
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], rsi
mov qword [rbp], rsi
mov ecx, 0x10
call fcn.180009c00
mov qword [rax + 8], rsi
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x20]
mov qword [rax], rcx
mov qword [rbp - 8], rsi
mov qword [rbp], 7
mov word [rbp - 0x18], si
mov r8d, 0x104
lea rdx, [rbp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x180002e40
lea rax, [rbp + 0x30]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], 0
jne 0x180002df6
mov rax, qword [rbp]
cmp rdx, rax
ja 0x180002e33
lea rdi, [rbp - 0x18]
cmp rax, 8
cmovae rdi, qword [rbp - 0x18]
mov qword [rbp - 8], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
lea rdx, [rbp + 0x30]
mov rcx, rdi
call fcn.18000d3b0
mov word [rbx + rdi], si
jmp 0x180002e40
lea r9, [rbp + 0x30]
lea rcx, [rbp - 0x20]
call fcn.180006720
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x60]
call fcn.180004bc0
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.180003050
nop
lea rcx, [rbp - 0x20]
call fcn.180004950
nop
lea rdx, str.Datainterface_
lea rcx, [rbp - 0x78]
call fcn.1800048c0
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.180004a80
nop
lea rcx, [rbp - 0x78]
call fcn.180004950
lea r8, str.fontconfig_en.txt
lea rdx, [rbp + 8]
lea rcx, [rsp + 0x60]
call fcn.180005b30
mov r8d, 0x4c9
lea rdx, str.fontlib__fonts_en__r_nmap___HandwrittenFont____Handwritten_Institute__Normal_r_nmap___MAIN_Font____NB_Architekt_Light__Normal_r_nmap___MAIN_Font_Bold____NB_Architekt__Normal_r_nmap___Controller_Buttons____Genesis_Controller__Buttons__Normal_r_nmap___Controller_Buttons_inverted____Genesis_Controller__Buttons_inv__Normal_r_nmap___Controller_Buttons_thin____Genesis_Controller__Buttons_thin__Normal_r_nmap___ConsoleFont____Arial__Normal_r_nmap___DebugTextFont____Consolas__Normal_r_nmap___NB_Grotesk_Semibold____NB_Grotesk_R_Semibold__Normal_r_nmap___NB_Grotesk_Bold____NB_Grotesk_R_Bold__Bold_r_nvalidNameChars___1234567890______:_QWERTYUIOP__ASDFGHJKL_ZXCVBNM_._qwertyuiop_asdfghjkli_zxcvbnm____r_nvalidBookChars___1234567890_______:_QWERTYUIOP__ASDFGHJKL_ZXCVBNM_._qwertyuiop_asdfghjkli_zxcvbnm_____
mov rcx, rax
call fcn.180003210
lea r8, str.fonts_en.gfx
lea rdx, [rbp + 8]
lea rcx, [rsp + 0x60]
call fcn.180005b30
mov r8d, 0x54708
lea rdx, str.GFX_f_bG
mov rcx, rax
call fcn.180003210
lea r8, str.fonts_en.swf
lea rdx, [rbp + 8]
lea rcx, [rsp + 0x60]
call fcn.180005b30
mov r8d, 0x36d85
lea rdx, str.CWS_f
mov rcx, rax
call fcn.180003210
mov ecx, 8
call fcn.180009c00
lea rcx, [0x180002790]
mov qword [rax], rcx
mov qword [rbp - 0x40], rax
lea rcx, [rbp - 0x28]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x180006bd0]
xor edx, edx
xor ecx, ecx
call fcn.180018320
mov qword [rbp - 0x30], rax
test rax, rax
je 0x180003036
cmp dword [rbp - 0x28], 0
je 0x18000302b
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x40], xmm0
lea rcx, [rbp - 0x40]
call fcn.180008c30
test eax, eax
jne 0x18000302b
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
lea rcx, [rbp + 8]
call fcn.180004950
mov eax, 1
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.180009bc0
lea r11, [rsp + 0x350]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
mov ecx, 8
call fcn.180009c00
lea rcx, [0x180002c20]
mov qword [rax], rcx
mov qword [rbp - 0x40], rax
lea rcx, [rbp - 0x28]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x180006bd0]
xor edx, edx
xor ecx, ecx
call fcn.180018320
mov qword [rbp - 0x30], rax
test rax, rax
je 0x18000301d
cmp dword [rbp - 0x28], 0
je 0x180003012
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x40], xmm0
lea rcx, [rbp - 0x40]
call fcn.180008c30
test eax, eax
jne 0x180003012
jmp 0x180002f83
mov ecx, 1
call fcn.1800074f0
nop
mov dword [rbp - 0x28], esi
mov ecx, 6
call fcn.1800074f0
nop
mov ecx, 1
call fcn.1800074f0
nop
mov dword [rbp - 0x28], esi
mov ecx, 6
call fcn.1800074f0
int3