Function at 0x140008090
Capabilities:
Check if file exists
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0xf0
mov qword [rsp + 0x98], 0xfffffffffffffffe
lea rcx, [rsp + 0x30]
call fcn.14001ad70
nop
lea rcx, [rsp + 0x40]
call fcn.14001ad70
nop
mov rcx, qword [rsp + 0x100]
add rcx, 0xb8
call fcn.14000a6a0
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.14000a040
mov rcx, qword [rsp + 0x100]
add rcx, 0xc0
call fcn.14000a6a0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14000a040
mov rax, qword [rsp + 0x100]
movzx eax, byte [rax + 0xc8]
test eax, eax
jne 0x140008134
lea rcx, [rsp + 0x30]
call fcn.14000a0c0
test eax, eax
je 0x140008134
lea rcx, [rsp + 0x40]
call fcn.14000a0c0
test eax, eax
jne 0x140008210
lea rcx, [rsp + 0x30]
call fcn.14000a0e0
lea r9, [0x140035070]
mov r8d, 0x2793
mov rdx, rax
mov rcx, qword [rsp + 0x100]
call fcn.140007f10
test eax, eax
jne 0x140008179
lea rcx, [rsp + 0x40]
call fcn.140002d80
nop
lea rcx, [rsp + 0x30]
call fcn.140002d80
jmp 0x14000862e
lea rcx, [rsp + 0x40]
call fcn.14000a0c0
test eax, eax
jne 0x140008210
lea rcx, [rsp + 0x30]
call fcn.14000a6a0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov qword [rsp + 0x48], rax
lea rdx, [0x140035110]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400081e5
lea rdx, [0x140035120]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400081e5
lea rdx, str..wim
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400081fe
lea rcx, [rsp + 0x30]
call fcn.14000a0f0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14000a040
jmp 0x140008210
lea rcx, [rsp + 0x40]
call fcn.14000a0e0
mov rcx, rax
call fcn.14001d590
mov r9d, 0x2819
mov r8d, 0x2818
mov edx, 0x27dd
mov rcx, qword [rsp + 0x100]
call fcn.140007090
cmp qword [rsp + 0x100], 0
je 0x14000824f
mov rax, qword [rsp + 0x100]
add rax, 0x50
mov qword [rsp + 0xa0], rax
jmp 0x14000825b
mov qword [rsp + 0xa0], 0
mov rcx, qword [rsp + 0x100]
add rcx, 0xa0
call fcn.14000a6a0
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x40]
call fcn.14000a6a0
mov rbx, rax
lea rcx, [rsp + 0x30]
call fcn.14000a6a0
mov rdx, rax
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov r9, qword [rsp + 0xa0]
mov r8, rbx
mov rcx, qword [rsp + 0xa8]
call qword [rax + 0x28]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jl 0x1400083ae
cmp dword [rsp + 0x38], 0
jne 0x140008384
lea rcx, [rsp + 0x30]
call fcn.14000a6a0
mov r9, rax
mov r8d, 0x281d
mov edx, 0x27dd
mov rcx, qword [rsp + 0x100]
call fcn.140007230
call fcn.14001d8f0
test eax, eax
je 0x140008382
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], 0
mov dword [rsp + 0x54], 0
jmp 0x140008325
mov eax, dword [rsp + 0x54]
add eax, 1
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0xa
jge 0x140008382
lea rcx, [rsp + 0x40]
call fcn.14000a6a0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140008375
lea rcx, [rsp + 0x40]
call fcn.14000a6a0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x140035140]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x140008382
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000831a
jmp 0x1400083a9
lea rcx, [rsp + 0x30]
call fcn.14000a6a0
mov r9, rax
mov r8d, 0x2800
mov edx, 0x27dd
mov rcx, qword [rsp + 0x100]
call fcn.140007230
jmp 0x140008619
cmp dword [rsp + 0x38], 0xeeee0001
jne 0x1400084c6
lea rcx, [rsp + 0x58]
call fcn.14001ad70
nop
mov edx, 0x27ff
lea rcx, [rsp + 0x30]
call fcn.140002af0
lea rdx, [0x140034f68]
lea rcx, [rsp + 0x68]
call fcn.14000c070
nop
lea rcx, [rsp + 0x58]
call fcn.14000a6a0
mov rbx, rax
lea rcx, [rsp + 0x30]
call fcn.14000a6a0
lea r8, [rsp + 0x68]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.14000c3e0
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xb8], rax
mov r8, rbx
mov rdx, qword [rsp + 0xb8]
lea rcx, [rsp + 0x78]
call fcn.14000c200
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0xc8], rax
mov rcx, qword [rsp + 0xc8]
call fcn.14000a6a0
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.14000a040
nop
lea rcx, [rsp + 0x78]
call fcn.1400040d0
nop
lea rcx, [rsp + 0x70]
call fcn.1400040d0
nop
lea rcx, [rsp + 0x68]
call fcn.1400040d0
lea rcx, [rsp + 0x58]
call fcn.14000a6a0
mov r9, rax
mov r8d, 0x27fe
mov edx, 0x27dd
mov rcx, qword [rsp + 0x100]
call fcn.140007230
nop
lea rcx, [rsp + 0x58]
call fcn.140002d80
jmp 0x140008619
cmp dword [rsp + 0x38], 0xeeee0002
jne 0x1400085f0
lea rcx, [rsp + 0x60]
call fcn.14001ad70
nop
mov edx, 0x27fd
lea rcx, [rsp + 0x60]
call fcn.140002af0
lea rdx, [0x140035068]
lea rcx, [rsp + 0x80]
call fcn.14000c070
nop
lea rcx, [rsp + 0x60]
call fcn.14000a6a0
mov rbx, rax
lea rcx, [rsp + 0x30]
call fcn.14000a6a0
lea r8, [rsp + 0x80]
mov rdx, rax
lea rcx, [rsp + 0x88]
call fcn.14000c3e0
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0xd8], rax
mov r8, rbx
mov rdx, qword [rsp + 0xd8]
lea rcx, [rsp + 0x90]
call fcn.14000c200
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0xe8], rax
mov rcx, qword [rsp + 0xe8]
call fcn.14000a6a0
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.14000a040
nop
lea rcx, [rsp + 0x90]
call fcn.1400040d0
nop
lea rcx, [rsp + 0x88]
call fcn.1400040d0
nop
lea rcx, [rsp + 0x80]
call fcn.1400040d0
lea rcx, [rsp + 0x60]
call fcn.14000a6a0
mov r9, rax
mov r8d, 0x27fe
mov edx, 0x27dd
mov rcx, qword [rsp + 0x100]
call fcn.140007230
nop
lea rcx, [rsp + 0x60]
call fcn.140002d80
jmp 0x140008619
cmp dword [rsp + 0x38], 0x80004004
je 0x140008619
mov rcx, qword [rsp + 0x100]
add rcx, 0x50
mov rax, qword [rsp + 0x100]
mov rax, qword [rax + 0x50]
mov edx, dword [rsp + 0x38]
call qword [rax]
nop
lea rcx, [rsp + 0x40]
call fcn.140002d80
nop
lea rcx, [rsp + 0x30]
call fcn.140002d80
add rsp, 0xf0
pop rbx
ret