Function at 0x14000d830
Capabilities:
Check if file exists
Create process on windows
Create process suspended
Get common file path
Get file attributes
Set environment variable

Disassembly:
mov r11, rsp
push r13
push r14
push r15
sub rsp, 0xca0
mov qword [rsp + 0xe8], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r12
mov rax, qword [0x140029ab0]
xor rax, rsp
mov qword [rsp + 0xc90], rax
xor ebx, ebx
mov word [rsp + 0x490], bx
xor edx, edx
mov r8d, 0x7fe
lea rcx, [r11 - 0x826]
call fcn.14000fca0
mov dword [rsp + 0x160], ebx
xor edx, edx
mov r8d, 0x118
lea rcx, [rsp + 0x164]
call fcn.14000fca0
lea rcx, [rsp + 0x490]
call fcn.14000c6b0
mov r13, rax
test rax, rax
jne 0x14000d8c5
or eax, 0xffffffff
jmp 0x14000e072
cmp word [rax], 0x24
jne 0x14000db77
lea rcx, [rax + 2]
call fcn.140010484
add eax, 0xfffffffd
cmp eax, 0x61
ja 0x14000db63
mov edi, 0x104
mov edx, edi
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r11, [rsp + 0x50]
mov rcx, rdi
lea rax, [rsp + 0x280]
mov edx, ebx
nop dword [rax + rax]
test rcx, rcx
je 0x14000d923
cmp word [rax], dx
je 0x14000d928
add rax, 2
dec rcx
jmp 0x14000d910
mov edx, 0x80070057
test r11, r11
je 0x14000d93f
test edx, edx
js 0x14000d93c
mov rax, rdi
sub rax, rcx
mov qword [r11], rax
jmp 0x14000d93f
mov qword [r11], rbx
test edx, edx
js 0x14000d998
mov r10d, 0x7fffffff
mov rdx, r10
lea r8, [0x140020a28]
mov rax, qword [rsp + 0x50]
sub rdi, rax
lea rcx, [rsp + rax*2 + 0x280]
mov r9, rbx
test rdi, rdi
je 0x14000d98f
test rdx, rdx
je 0x14000d993
movzx eax, word [r8]
test ax, ax
je 0x14000d993
mov word [rcx], ax
add rcx, 2
add r8, 2
dec rdi
dec rdx
inc r9
jmp 0x14000d966
sub rcx, 2
mov word [rcx], bx
jmp 0x14000d99e
mov r10d, 0x7fffffff
mov r11d, 0x7ffffffe
mov rdx, r11
lea r8, [rsp + 0x280]
mov ecx, 0x400
mov rdi, rcx
lea rax, [rsp + 0x490]
mov rsi, rbx
test rdi, rdi
je 0x14000d9ed
test rdx, rdx
je 0x14000d9f1
movzx r9d, word [r8]
test r9w, r9w
je 0x14000d9f1
mov word [rax], r9w
add rax, 2
add r8, 2
dec rdi
dec rdx
inc rsi
jmp 0x14000d9c2
sub rax, 2
mov word [rax], bx
lea r8, [rsp + 0x50]
mov rdx, rcx
lea rax, [rsp + 0x490]
mov edi, ebx
test rdx, rdx
je 0x14000da19
cmp word [rax], di
je 0x14000da1e
add rax, 2
dec rdx
jmp 0x14000da06
mov edi, 0x80070057
test r8, r8
je 0x14000da35
test edi, edi
js 0x14000da32
mov rax, rcx
sub rax, rdx
mov qword [r8], rax
jmp 0x14000da35
mov qword [r8], rbx
test edi, edi
js 0x14000da90
mov r8, r10
lea r9, [0x140020a24]
mov rdi, rcx
mov rax, qword [rsp + 0x50]
sub rdi, rax
lea rdx, [rsp + rax*2 + 0x490]
mov rsi, rbx
nop dword [rax]
test rdi, rdi
je 0x14000da89
test r8, r8
je 0x14000da8d
movzx eax, word [r9]
test ax, ax
je 0x14000da8d
mov word [rdx], ax
add rdx, 2
add r9, 2
dec rdi
dec r8
inc rsi
jmp 0x14000da60
sub rdx, 2
mov word [rdx], bx
lea r8, [rsp + 0x50]
mov rdx, rcx
lea rax, [rsp + 0x490]
mov edi, ebx
test rdx, rdx
je 0x14000dab5
cmp word [rax], di
je 0x14000daba
add rax, 2
dec rdx
jmp 0x14000daa2
mov edi, 0x80070057
test r8, r8
je 0x14000dad1
test edi, edi
js 0x14000dace
mov rax, rcx
sub rax, rdx
mov qword [r8], rax
jmp 0x14000dad1
mov qword [r8], rbx
test edi, edi
js 0x14000db1f
lea rdi, [r13 + 2]
mov rax, qword [rsp + 0x50]
sub rcx, rax
lea rdx, [rsp + rax*2 + 0x490]
mov r8, rbx
nop dword [rax]
test rcx, rcx
je 0x14000db18
test r10, r10
je 0x14000db1c
movzx eax, word [rdi]
test ax, ax
je 0x14000db1c
mov word [rdx], ax
add rdx, 2
add rdi, 2
dec rcx
dec r10
inc r8
jmp 0x14000daf0
sub rdx, 2
mov word [rdx], bx
lea rdx, [rsp + 0x280]
mov ecx, 0x105
mov rax, r13
mov r8, rbx
test rcx, rcx
je 0x14000db5a
test r11, r11
je 0x14000db5e
movzx edi, word [rdx]
test di, di
je 0x14000db5e
mov word [rax], di
add rax, 2
add rdx, 2
dec rcx
dec r11
inc r8
jmp 0x14000db32
sub rax, 2
mov word [rax], bx
jmp 0x14000db77
mov eax, 0xfffffff3
jmp 0x14000e072
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000db8f
mov eax, 0xfffffff6
jmp 0x14000e072
test al, 0x10
je 0x14000db9d
mov eax, 0xfffffffc
jmp 0x14000e072
call fcn.14000e180
mov edx, eax
test eax, eax
jne 0x14000dbb0
lea eax, [rdx - 0xb]
jmp 0x14000e072
movzx eax, byte [0x14002b6dc]
mov ecx, 1
cmp edx, 0xffffffff
cmove eax, ecx
mov byte [0x14002b6dc], al
test ebx, ebx
jne 0x14000dbdd
call fcn.14000d740
test eax, eax
jne 0x14000dbdd
lea eax, [rbx - 2]
jmp 0x14000e072
xor eax, eax
or r14, 0xffffffffffffffff
mov rcx, r14
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
lea r15, [rcx - 1]
mov eax, 2
mul rcx
cmovo rax, r14
mov rcx, rax
call fcn.14000f89c
mov rsi, rax
test rax, rax
jne 0x14000dc17
lea eax, [rsi - 5]
jmp 0x14000e072
lea rcx, [r15 + 3]
mov eax, 2
mul rcx
cmovo rax, r14
mov rcx, rax
call fcn.14000f89c
mov r12, rax
test rax, rax
jne 0x14000dc49
mov rcx, rsi
call fcn.14000f894
lea eax, [r12 - 5]
jmp 0x14000e072
lea rdi, [r15 + r15 + 2]
mov r8, rdi
mov rdx, r13
mov rcx, rsi
call fcn.14000f080
mov r8, rdi
mov rdx, r13
mov rcx, r12
call fcn.14000f080
lea rdx, [rsi + r15*2]
cmp rdx, rsi
jb 0x14000e05d
movzx eax, word [rdx]
cmp ax, 0x5c
je 0x14000dc94
cmp ax, 0x2f
je 0x14000dc94
sub rdx, 2
cmp rdx, rsi
jae 0x14000dc77
jmp 0x14000e05d
mov word [rdx + 2], bx
cmp rdx, rsi
jb 0x14000e05d
xor eax, eax
mov rcx, r14
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea rcx, [r12 + rcx*2 - 2]
mov edi, 0x2e
mov edx, edi
call fcn.14000efd0
mov r13, rax
test rax, rax
jne 0x14000dcda
mov word [r12 + r15*2], di
mov word [r12 + r15*2 + 2], bx
lea r13, [0x140020a20]
lea rcx, [rsp + 0x160]
call fcn.14000c4b0
test eax, eax
je 0x14000dd0c
cmp dword [rsp + 0x16c], 0x42ed
jb 0x14000dd0c
lea rdx, [0x140020a1c]
lea rcx, str.SEE_MASK_NOZONECHECKS
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x60], 0x70
mov dword [rsp + 0x64], 0x1500
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xb0], rbx
mov dword [rsp + 0xb8], ebx
mov qword [rsp + 0xc8], rbx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x78], r12
mov qword [rsp + 0xa0], rbx
lea rax, [rsp + 0x490]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x70], rbx
mov r15d, 1
mov dword [rsp + 0x90], r15d
mov rcx, r13
call fcn.14000c350
test eax, eax
je 0x14000ddbc
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x14000ddfd
mov rcx, rsi
call fcn.14000f894
mov rcx, r12
call fcn.14000f894
lea eax, [r15 - 4]
jmp 0x14000e072
call fcn.14000c2a0
test eax, eax
je 0x14000de14
mov rcx, r13
call fcn.14000c300
cmp eax, r15d
je 0x14000de14
mov rdx, r13
mov rcx, qword [rsp + 0x78]
call fcn.14000c900
test eax, eax
jne 0x14000ddfd
mov rcx, rsi
call fcn.14000f894
mov rcx, r12
call fcn.14000f894
mov eax, 0xfffffffd
jmp 0x14000e072
mov rcx, rsi
call fcn.14000f894
mov rcx, r12
call fcn.14000f894
xor eax, eax
jmp 0x14000e072
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0xf0]
call fcn.14000fca0
mov dword [rsp + 0xf0], 0x68
cmp dword [0x14002b6d8], 0
je 0x14000df5c
xor eax, eax
mov rcx, r14
mov rdi, qword [rsp + 0x78]
repne scasw ax, word [rdi]
not rcx
lea r15, [rcx - 1]
mov rcx, r14
mov rdi, qword [rsp + 0x80]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov qword [rsp + 0x50], rcx
lea rax, [r15 + rcx]
mov qword [rsp + 0x58], rax
lea rdi, [rax + 4]
mov eax, 2
mul rdi
cmovo rax, r14
mov rcx, rax
call fcn.14000f89c
mov r14, rax
test rax, rax
jne 0x14000de9e
lea eax, [r14 - 0xe]
jmp 0x14000e072
lea r8, [rdi + rdi]
xor edx, edx
mov rcx, rax
call fcn.14000fca0
mov eax, 0x22
mov word [r14], ax
lea rdi, [r15 + r15]
lea rcx, [r14 + 2]
mov r8, rdi
mov rdx, qword [rsp + 0x78]
call fcn.14000f080
mov eax, 0x22
mov word [rdi + r14 + 2], ax
mov eax, 0x20
mov word [r14 + r15*2 + 4], ax
mov r8, qword [rsp + 0x50]
add r8, r8
lea rcx, [r14 + r15*2 + 6]
mov rdx, qword [rsp + 0x80]
call fcn.14000f080
mov rax, qword [rsp + 0x58]
mov word [r14 + rax*2 + 6], bx
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
mov rcx, r14
call fcn.14000f894
mov r15d, 1
jmp 0x14000dfab
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
test edi, edi
jne 0x14000e022
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2e4
jne 0x14000e022
mov dword [rsp + 0x50], ebx
lea rdx, [rsp + 0x50]
mov rcx, r13
call fcn.14000c3a0
test eax, eax
je 0x14000e022
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edi, eax
test eax, eax
jne 0x14000dfea
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp dword [rsp + 0x50], 0
je 0x14000dff9
mov rcx, r13
call fcn.14000c480
mov rcx, rsi
call fcn.14000f894
mov rcx, r12
call fcn.14000f894
test edi, edi
jne 0x14000e01e
mov eax, 0xfffffffd
cmp ebx, 0x4c7
cmove eax, r15d
jmp 0x14000e072
xor eax, eax
jmp 0x14000e072
mov rcx, rsi
call fcn.14000f894
mov rcx, r12
call fcn.14000f894
test edi, edi
je 0x14000e056
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14000e072
mov eax, 0xfffffff7
jmp 0x14000e072
mov rcx, rsi
call fcn.14000f894
mov rcx, r12
call fcn.14000f894
mov eax, 0xfffffff9
mov rcx, qword [rsp + 0xc90]
xor rcx, rsp
call fcn.14000f6d0
lea r11, [rsp + 0xca0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret