Function at 0x14000416a
Capabilities:
Check if file exists
Query environment variable

Disassembly:
jmp 0x140125cd0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xbe0
mov rdi, rsp
mov ecx, 0x2f8
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xbf0]
mov qword [rsp + 0xbc0], 0xfffffffffffffffe
mov rax, qword [0x1402840e8]
xor rax, rsp
mov qword [rsp + 0xbd0], rax
cmp qword [rsp + 0xbf8], 0
jne 0x140125d29
xor al, al
jmp 0x1401261d7
mov edx, 8
lea rcx, [rsp + 0x28]
call fcn.1400026b7
mov rax, qword [rsp + 0xbf0]
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.14000467e
nop
mov rax, qword [rsp + 0xbf0]
mov rax, qword [rax]
movzx eax, byte [rax + 0x98]
test eax, eax
jne 0x140125d86
mov byte [rsp + 0xba8], 0
lea rcx, [rsp + 0x28]
call fcn.140002595
movzx eax, byte [rsp + 0xba8]
jmp 0x1401261d7
mov dword [rsp + 0x48], 8
mov dword [rsp + 0x4c], 0xff
lea rcx, str.COMCTL32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x58], rax
lea rdx, str.InitCommonControlsEx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x140125dd0
lea rcx, [rsp + 0x48]
call qword [rsp + 0x60]
lea rcx, str.User32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x68], rax
lea rdx, str.MessageBoxW
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
je 0x140125eeb
mov rax, qword [rsp + 0xbf0]
mov rax, qword [rax]
add rax, 0xc8
mov rcx, rax
call fcn.14000179e
movzx eax, al
test eax, eax
jne 0x140125eeb
mov rax, qword [rsp + 0xbf0]
mov rax, qword [rax]
add rax, 0xa0
mov rcx, rax
call fcn.14000179e
movzx eax, al
test eax, eax
jne 0x140125eeb
mov rax, qword [rsp + 0xbf0]
mov rax, qword [rax]
add rax, 0xc8
mov rdx, rax
lea rcx, [rsp + 0x88]
call fcn.1400044f3
nop
lea rdx, [0x1402239cc]
lea rcx, [rsp + 0x88]
call fcn.1400079c8
mov rdx, qword [rsp + 0xbf8]
lea rcx, [rsp + 0x88]
call fcn.1400079c8
mov rax, qword [rsp + 0xbf0]
mov rax, qword [rax]
add rax, 0xa0
mov rcx, rax
call fcn.140004fac
mov qword [rsp + 0xbc8], rax
lea rcx, [rsp + 0x88]
call fcn.140004fac
xor r9d, r9d
mov rcx, qword [rsp + 0xbc8]
mov r8, rcx
mov rdx, rax
xor ecx, ecx
call qword [rsp + 0x70]
nop
lea rcx, [rsp + 0x88]
call fcn.1400073ce
mov qword [rsp + 0xb8], 0
lea rax, [rsp + 0xd0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov rax, qword [rsp + 0xbf0]
mov rax, qword [rax]
add rax, 0xf0
mov rcx, rax
call fcn.140004fac
mov r8, rax
mov edx, 0x103
lea rcx, [rsp + 0xd0]
call fcn.140004949
mov eax, 2
imul rax, rax, 0
movzx eax, word [rsp + rax + 0xd0]
test eax, eax
je 0x140125fa9
mov rax, qword [rsp + 0xbf0]
mov rax, qword [rax]
movzx eax, byte [rax + 0x118]
test eax, eax
je 0x140125fa9
lea rcx, [rsp + 0xd0]
call fcn.1400039ef
mov eax, 2
imul rax, rax, 0
mov qword [rsp + 0xbb0], rax
cmp qword [rsp + 0xbb0], 0x208
jae 0x140125f92
jmp 0x140125f97
call fcn.140005038
xor eax, eax
mov rcx, qword [rsp + 0xbb0]
mov word [rsp + rcx + 0xd0], ax
mov eax, 2
imul rax, rax, 0
movzx eax, word [rsp + rax + 0xd0]
test eax, eax
je 0x1401261bd
mov byte [rsp + 0x2e4], 0
mov dword [rsp + 0x2e8], 0x3fe
lea rax, [rsp + 0x300]
mov rdi, rax
xor eax, eax
mov ecx, 0x800
rep stosb byte [rdi], al
mov r8d, 0x3fe
lea rdx, [rsp + 0x300]
lea rcx, str._programfiles_Internet_Exploreriexplore.exe
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0xb04], eax
cmp dword [rsp + 0xb04], 0
jbe 0x140126057
cmp dword [rsp + 0xb04], 0x3fe
ja 0x140126057
lea rcx, [rsp + 0x300]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsp + 0xb08], eax
cmp dword [rsp + 0xb08], 0xffffffff
je 0x140126057
mov eax, dword [rsp + 0xb08]
and eax, 0x10
test eax, eax
jne 0x140126057
mov byte [rsp + 0x2e4], 1
movzx eax, byte [rsp + 0x2e4]
test eax, eax
jne 0x1401260d1
mov r8d, 0x3fe
lea rdx, [rsp + 0x300]
lea rcx, str._programfiles_x86__Internet_Exploreriexplore.exe
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0xb04], eax
cmp dword [rsp + 0xb04], 0
jbe 0x1401260d1
cmp dword [rsp + 0xb04], 0x3fe
ja 0x1401260d1
lea rcx, [rsp + 0x300]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsp + 0xb0c], eax
cmp dword [rsp + 0xb0c], 0xffffffff
je 0x1401260d1
mov eax, dword [rsp + 0xb0c]
and eax, 0x10
test eax, eax
jne 0x1401260d1
mov byte [rsp + 0x2e4], 1
movzx eax, byte [rsp + 0x2e4]
test eax, eax
je 0x1401261bd
lea rax, [rsp + 0xb20]
mov rdi, rax
xor eax, eax
mov ecx, 0x70
rep stosb byte [rdi], al
mov dword [rsp + 0xb20], 0x70
mov dword [rsp + 0xb24], 0
mov qword [rsp + 0xb28], 0
mov qword [rsp + 0xb30], 0
lea rax, [rsp + 0x300]
mov qword [rsp + 0xb38], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0xb40], rax
mov qword [rsp + 0xb48], 0
mov dword [rsp + 0xb50], 1
mov qword [rsp + 0xb88], 0
lea rcx, str.Shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0xb8], rax
cmp qword [rsp + 0xb8], 0
je 0x1401261bd
lea rdx, str.ShellExecuteExW
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xb98], rax
cmp qword [rsp + 0xb98], 0
je 0x1401261bd
lea rcx, [rsp + 0xb20]
call qword [rsp + 0xb98]
mov byte [rsp + 0xbb8], 1
lea rcx, [rsp + 0x28]
call fcn.140002595
movzx eax, byte [rsp + 0xbb8]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x140223f68]
call fcn.14000849f
mov rax, rdi
mov rcx, qword [rsp + 0xbd0]
xor rcx, rsp
call fcn.1400030d0
add rsp, 0xbe0
pop rdi
ret