Function at 0x14000c320
Capabilities:
Check if file exists
Get file attributes
Query environment variable
Read .ini file
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x850
mov rax, qword [0x1400623d0]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov ecx, 0x200000
call fcn.140017d00
lea rcx, [0x140065980]
mov edx, 0x5c
mov r15, rax
mov qword [rsp + 0x20], rax
call fcn.14001ad74
lea r8, [0x140065980]
lea rcx, [rsp + 0x240]
lea rdx, str.._s
test rax, rax
je 0x14000c396
lea rdx, [0x14004d754]
call fcn.14001c9d4
lea r12, str.Default
xor r13d, r13d
nop word [rax + rax]
mov rcx, qword [r12]
lea r9, [rsp + 0x240]
mov r8d, 0x100000
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
test eax, eax
je 0x14000c848
xor bpl, bpl
mov r14, r15
cmp word [r15], r13w
je 0x14000c848
mov r15d, 1
nop dword [rax]
mov edx, 0x3d
mov rcx, r14
call fcn.14001ad74
test rax, rax
je 0x14000c839
lea rcx, [rsp + 0x34]
xor edx, edx
mov r8d, 0x204
mov dword [rsp + 0x30], r13d
call fcn.14001a650
or rsi, 0xffffffffffffffff
inc rsi
cmp word [r14 + rsi*2], r13w
jne 0x14000c421
lea rdx, [rsp + 0x30]
inc esi
mov rcx, r14
sub rdx, r14
nop dword [rax + rax]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x14000c440
lea rdx, [0x1400486e8]
lea rcx, [rsp + 0x30]
call fcn.14001b0f4
test bpl, bpl
je 0x14000c487
mov rdi, rax
or rax, 0xffffffffffffffff
nop
cmp word [rdi + rax*2 + 2], r13w
lea rax, [rax + 1]
jne 0x14000c470
lea rbx, [rsp + 0x32]
lea rbx, [rbx + rax*2]
jmp 0x14000c4a5
mov rbx, rax
or rax, 0xffffffffffffffff
nop
cmp word [rbx + rax*2 + 2], r13w
lea rax, [rax + 1]
jne 0x14000c490
lea rdi, [rsp + 0x32]
lea rdi, [rdi + rax*2]
lea rdx, str.ReverseKeyValue
mov rcx, rbx
call fcn.14001b25c
test eax, eax
jne 0x14000c4d1
lea rdx, [0x14004bcf8]
mov rcx, rdi
call fcn.14001b25c
movzx ebp, bpl
test eax, eax
cmove ebp, r15d
test rdi, rdi
je 0x14000c832
lea rdx, str.MoveFiles
mov rcx, rbx
call fcn.14001b25c
test eax, eax
jne 0x14000c4fa
mov rcx, rdi
call fcn.140010f60
jmp 0x14000c832
lea rdx, str.CopyFiles
mov rcx, rbx
call fcn.14001b25c
test eax, eax
jne 0x14000c51a
mov rcx, rdi
call fcn.140005e10
jmp 0x14000c832
lea rdx, str.DropUrlIcon
mov rcx, rbx
call fcn.14001b25c
test eax, eax
jne 0x14000c53a
mov rcx, rdi
call fcn.14000d980
jmp 0x14000c832
lea rdx, str.DropLinkIcon
mov rcx, rbx
call fcn.14001b25c
test eax, eax
jne 0x14000c55a
mov rcx, rdi
call fcn.14000c8a0
jmp 0x14000c832
lea rdx, str.DropShellIcon
mov rcx, rbx
call fcn.14001b25c
test eax, eax
jne 0x14000c57a
mov rcx, rdi
call fcn.14000cea0
jmp 0x14000c832
lea rdx, str.CreateMFU
mov rcx, rbx
call fcn.14001b25c
test eax, eax
jne 0x14000c5b6
lea rcx, str.C:System.sav_flagsBtBOSWin10.flg
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, rdi
cmp eax, 0xffffffff
je 0x14000c5ac
call fcn.14000aeb0
jmp 0x14000c832
call fcn.14000a890
jmp 0x14000c832
lea rdx, str.CreateMFUReg
mov rcx, rbx
call fcn.14001b25c
test eax, eax
jne 0x14000c5d6
mov rcx, rdi
call fcn.14000aac0
jmp 0x14000c832
lea rdx, str.CreateMFUXml
mov rcx, rbx
call fcn.14001b25c
test eax, eax
jne 0x14000c5f6
mov rcx, rdi
call fcn.14000aeb0
jmp 0x14000c832
lea rdx, str.CreateTaskbarXml
mov rcx, rbx
call fcn.14001b25c
test eax, eax
jne 0x14000c616
mov rcx, rdi
call fcn.14000b650
jmp 0x14000c832
lea rdx, str.CreateIEHomeReg
mov rcx, rbx
call fcn.14001b25c
test eax, eax
jne 0x14000c636
mov rcx, rdi
call fcn.140007960
jmp 0x14000c832
lea rdx, str.CreateIESearchReg
mov rcx, rbx
call fcn.14001b25c
test eax, eax
jne 0x14000c656
mov rcx, rdi
call fcn.1400094a0
jmp 0x14000c832
lea rdx, str.CreateIEHome
mov rcx, rbx
call fcn.14001b25c
test eax, eax
jne 0x14000c676
mov rcx, rdi
call fcn.140007220
jmp 0x14000c832
lea rdx, str.CreateIESearch
mov rcx, rbx
call fcn.14001b25c
test eax, eax
jne 0x14000c696
mov rcx, rdi
call fcn.140007e80
jmp 0x14000c832
lea rdx, str.CreateRegEntry
mov rcx, rbx
call fcn.14001b25c
test eax, eax
jne 0x14000c6b6
mov rcx, rdi
call fcn.14000b0b0
jmp 0x14000c832
lea rdx, str.CreateIniEntry
mov rcx, rbx
call fcn.14001b25c
test eax, eax
jne 0x14000c6d6
mov rcx, rdi
call fcn.14000a680
jmp 0x14000c832
lea rdx, str.RunFiles
mov rcx, rbx
call fcn.14001b25c
test eax, eax
jne 0x14000c6f6
mov rcx, rdi
call fcn.140011c80
jmp 0x14000c832
lea rdx, str.CreateIEWebSliceIns
mov rcx, rbx
call fcn.14001b25c
test eax, eax
jne 0x14000c716
mov rcx, rdi
call fcn.14000a2e0
jmp 0x14000c832
lea rdx, str.MergeIEWebSliceIns
mov rcx, rbx
call fcn.14001b25c
test eax, eax
jne 0x14000c736
mov rcx, rdi
call fcn.140010bf0
jmp 0x14000c832
lea rdx, str.CreateIEAcceleratorIns
mov rcx, rbx
call fcn.14001b25c
test eax, eax
jne 0x14000c756
mov rcx, rdi
call fcn.140006af0
jmp 0x14000c832
lea rdx, str.MergeIEAcceleratorIns
mov rcx, rbx
call fcn.14001b25c
test eax, eax
jne 0x14000c776
mov rcx, rdi
call fcn.1400103f0
jmp 0x14000c832
lea rdx, str.SetEnvVar
mov rcx, rbx
call fcn.14001b25c
test eax, eax
jne 0x14000c796
mov rcx, rdi
call fcn.140012450
jmp 0x14000c832
lea rdx, str.ExpandEnvVars
mov rcx, rbx
call fcn.14001b25c
test eax, eax
jne 0x14000c7b3
mov rcx, rdi
call fcn.14000e340
jmp 0x14000c832
lea rdx, str.CreateEdgeFavBar
mov rcx, rbx
call fcn.14001b25c
test eax, eax
jne 0x14000c7d0
mov rcx, rdi
call fcn.140006220
jmp 0x14000c832
lea rdx, str.CreateEdgeFavBarReg
mov rcx, rbx
call fcn.14001b25c
test eax, eax
jne 0x14000c7ed
mov rcx, rdi
call fcn.1400065a0
jmp 0x14000c832
lea rcx, [rsp + 0x444]
xor edx, edx
mov r8d, 0x3fc
mov dword [rsp + 0x440], r13d
call fcn.14001a650
lea rdx, [rsp + 0x440]
mov r8d, 0x200
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rsp + 0x440]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
movsxd rax, esi
lea r14, [r14 + rax*2]
cmp word [r14], r13w
jne 0x14000c3f0
mov r15, qword [rsp + 0x20]
lea rax, [0x140062108]
add r12, 8
cmp r12, rax
jl 0x14000c3b0
mov rcx, r15
call fcn.14001961c
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.14001a120
lea r11, [rsp + 0x850]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret