Function at 0x140033250
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x100
lea rax, [0x140070890]
mov qword [rsp + 0xc0], rax
mov r8, qword [rsp + 0x110]
mov rdx, qword [rsp + 0xc0]
lea rcx, [0x1400708e0]
call fcn.14002d730
mov dword [rsp + 0xc8], 0
mov dword [rsp + 0xcc], 0
mov dword [rsp + 0x40], 0
lea rdi, [rsp + 0x44]
xor eax, eax
mov ecx, 0x6c
rep stosb byte [rdi], al
mov dword [rsp + 0x30], 0x2a
mov qword [rsp + 0xb8], 0
mov edx, 0x7fffffff
lea rcx, [0x140070910]
call fcn.140030c00
mov qword [rsp + 0xb8], rax
cmp qword [rsp + 0xb8], 0
ja 0x140033311
lea r8, str.StringLength_worked_with_unexpectly__
mov rdx, qword [rsp + 0xc0]
lea rcx, [0x1400709b0]
call fcn.14002d610
mov eax, 2
jmp 0x140033603
mov rax, qword [rsp + 0xb8]
add rax, 0x104
mov qword [rsp + 0xb8], rax
mov eax, 2
mul qword [rsp + 0xb8]
mov rcx, rax
mov rax, 0xffffffffffffffff
cmovo rcx, rax
call fcn.140006748
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0xb0], rax
cmp qword [rsp + 0xb0], 0
jne 0x14003338f
lea r8, [0x1400709d8]
mov rdx, qword [rsp + 0xc0]
lea rcx, [0x140070a10]
call fcn.14002d610
mov eax, 0x7a
jmp 0x140033603
mov r8, qword [rsp + 0xb8]
shl r8, 1
xor edx, edx
mov rcx, qword [rsp + 0xb0]
call fcn.14001c3c0
mov rdx, qword [rsp + 0xb0]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [rsp + 0xcc], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xc8], eax
cmp dword [rsp + 0xcc], 0
jl 0x1400335c3
lea rdx, str.Epson_SoftwareFax_UtilityEPFDPSET.EXE
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edx, 0x7fffffff
mov rcx, qword [rsp + 0xb0]
call fcn.140030c00
mov qword [rsp + 0xb8], rax
cmp qword [rsp + 0xb8], 0
jbe 0x1400335b8
mov eax, 2
mul qword [rsp + 0xb8]
mov rcx, rax
mov rax, 0xffffffffffffffff
cmovo rcx, rax
call fcn.140006748
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0xd0], rax
cmp qword [rsp + 0xd0], 0
je 0x1400335ab
mov r8, qword [rsp + 0xb8]
shl r8, 1
xor edx, edx
mov rcx, qword [rsp + 0xd0]
call fcn.14001c3c0
mov r8, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xd0]
call fcn.140001c10
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov dword [rsp + 0x40], 0x70
mov dword [rsp + 0x44], 0x40
mov qword [rsp + 0x48], 0
lea rax, str.open
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [rsp + 0xd8], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xc8], eax
cmp dword [rsp + 0xd8], 0
je 0x14003358c
cmp qword [rsp + 0xa8], 0
je 0x14003358c
xor edx, edx
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xc8], eax
cmp dword [rsp + 0xc8], 0x102
jne 0x14003356a
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14003356c
jmp 0x140033573
xor eax, eax
cmp eax, 1
jne 0x14003353c
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0xc8], 0
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0xf0], rax
mov rcx, qword [rsp + 0xf0]
call fcn.140006750
jmp 0x1400335b6
mov dword [rsp + 0xc8], 0x7a
jmp 0x1400335c3
mov dword [rsp + 0xc8], 2
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xf8], rax
mov rcx, qword [rsp + 0xf8]
call fcn.140006750
mov r8d, dword [rsp + 0xc8]
mov rdx, qword [rsp + 0xc0]
lea rcx, [0x140070aa0]
call fcn.14002e080
mov eax, dword [rsp + 0xc8]
add rsp, 0x100
pop rdi
ret