Function at 0x140093880
Capabilities:
Check if file exists
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x30
mov qword [rsp + 0x40], rdi
mov rbx, rdx
mov rsi, rcx
test rdx, rdx
je 0x14009399d
mov rcx, qword [rdx + 0x480]
test rcx, rcx
je 0x14009399d
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14009399d
cmp dword [rbx + 0x4a0], 0
jne 0x14009399d
cmp dword [rbx + 0x4a4], 0
jne 0x14009399d
mov rcx, qword [rbx + 0x480]
call fcn.1400693f0
test eax, eax
jne 0x14009399d
mov rcx, qword [rbx + 0x488]
mov rdi, qword [rbx + 0x480]
test rcx, rcx
je 0x14009390e
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14009390e
mov rdi, qword [rbx + 0x488]
cmp dword [0x140455d78], 0
jne 0x140093995
test rdi, rdi
je 0x140093995
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
jne 0x140093995
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140093995
or rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x140093940
cmp rax, 2
jbe 0x140093995
mov r8d, 1
lea rdx, str.:_AttrDef_:_BadClus_:_BitMap_:_Boot_:_LogFile_:_Mft_:_MftMirr_:_Secure_:_TxfLog_:_UpCase_:_Volume_:_Extend_:_Extend_:_bootmgr_:_bootmgr.efi_:NTLDR_:BOOTMGR_:BOOT_:BOOT_:EFI_:EFI_:System_Volume_Information_:System_Volume_Information_:Recovery__HOMEDRIVE___USERPROFILE___HOMEPATH___temp___PATH___SystemDrive___APPDATA___ProgramFiles_x86____ProgramFiles___windir___systemroot__:Windows_:WindowsWinSxS_:WindowsWinSxSManifests_:WindowsWinSxSFileMaps_:WindowsInstaller_:WindowsFonts_:WindowsINF_:WindowsSystemApps_:WindowsServiceProfiles_:WindowsServiceProfilesLocalService_:WindowsServiceProfilesNetworkService_:WindowsServiceProfilesAppData_:WindowsServiceProfilesAppDataLocal_:WindowsServiceProfilesAppDataLocalLow_:WindowsServiceProfilesAppDataRoaming_:WindowsBoot_:WindowsBoot_:WindowsMicrosoft.NET_:Windows_assembly_:WindowsSysWOW64_:WindowsSystem32_:WindowsSystem32Boot_:WindowsSystem32Boot_:WindowsSystem32config_:WindowsSystem32config_:WindowsSystem32drivers_:WindowsSystem32drivers_:WindowsSystem32DriverStore_:WindowsSystem32DriverStore_:Documents_and_Settings_:ProgramData_:Program_Files__x86__:Program_Files__x86_Microsoft_:Program_Files__x86_Windows_:Program_Files_:Program_FilesWindowsApps_:Program_FilesMicrosoft_:Program_FilesWindows_:Users_:UsersAppData_:UsersAppDataLocal_:UsersAppDataLocalMicrosoft_:UsersAppDataLocalMicrosoftWindows_:UsersAppDataLocalLow_:UsersAppDataLocalLowMicrosoft_:UsersAppDataRoaming_:UsersAppDataRoamingMicrosoft_:UsersOneDrive_:UsersDocuments_:UsersDesktop_
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecExW]
test eax, eax
je 0x140093995
xor eax, eax
mov dword [rbx + 0x4a4], 1
mov qword [rsp + 0x28], rax
lea r8, [0x140093810]
mov r9, rdi
mov dword [rsp + 0x20], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x1400939bd
xor r8d, r8d
mov rdx, rdi
jmp 0x1400939b4
mov dword [rbx + 0x4a4], 1
lea rdx, [0x14032f580]
mov r8d, 0xa
mov rcx, qword [rsi + 8]
call fcn.140080080
cmp dword [rbx + 0x4a4], 0
mov rdi, qword [rsp + 0x40]
je 0x140093a0d
mov rcx, qword [rbx + 0x4a8]
test rcx, rcx
jne 0x1400939de
mov rcx, qword [rsi + 0x1b8]
mov r10, qword [rcx]
lea r8, [0x14032f608]
xor r9d, r9d
lea rdx, [0x1400c1bd0]
call qword [r10 + 0x268]
test rax, rax
je 0x140093a0d
mov r8, qword [rax]
xor edx, edx
mov rcx, rax
call qword [r8 + 0x208]
mov eax, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
ret