Function at 0x18001ef30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r13
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x1800ea530]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov rdi, rcx
xor r15d, r15d
xor ecx, ecx
mov r13d, r15d
mov esi, r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x18001f59c
mov r12, 0xffffffffffffffff
mov edx, r15d
mov rax, r12
inc rax
cmp word [rdi + rax*2], dx
jne 0x18001ef87
test rax, rax
je 0x18001efc4
mov rcx, r15
nop dword [rax + rax]
movzx r8d, word [rdi + rcx*2]
cmp r8w, 0x5c
je 0x18001f59c
cmp r8w, 0x2f
je 0x18001f59c
inc edx
mov ecx, edx
cmp rcx, rax
jb 0x18001efa0
mov qword [rsp + 0x298], rbx
mov ecx, 0x42ea
mov qword [rsp + 0x2a0], r14
call fcn.18001d510
test eax, eax
je 0x18001f1b7
xor edx, edx
lea rcx, [rsp + 0x42]
mov r8d, 0x208
call fcn.180069880
mov rax, qword [0x1800ea018]
mov word [rsp + 0x40], r15w
test rax, rax
je 0x18001f0ac
mov r14, r15
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18001f06c
mov r8d, 0x104
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, eax
test eax, eax
je 0x18001f06c
movzx eax, word [rsp + 0x40]
cmp eax, 0x5c
je 0x18001f081
cmp eax, 0x2f
je 0x18001f081
mov ecx, eax
call fcn.18009c860
test eax, eax
je 0x18001f06c
cmp word [rsp + 0x42], 0x3a
jne 0x18001f06c
movzx eax, word [rsp + 0x44]
cmp ax, 0x5c
je 0x18001f081
cmp ax, 0x2f
je 0x18001f081
inc r14
lea rax, [0x1800ea018]
mov rax, qword [rax + r14*8]
test rax, rax
jne 0x18001f011
jmp 0x18001f0a5
lea rcx, [rsp + 0x40]
lea rcx, [rcx + rbx*2]
nop word [rax + rax]
cmp word [rcx], 0x5c
je 0x18001f09f
sub rcx, 2
add ebx, 0xffffffff
jne 0x18001f090
mov word [rsp + rbx*2 + 0x40], r15w
cmp word [rsp + 0x40], si
jne 0x18001f0b6
lea rcx, [rsp + 0x40]
call fcn.18001b780
lea rax, [rsp + 0x40]
mov rcx, r12
nop
inc rcx
cmp word [rax + rcx*2], si
jne 0x18001f0c0
mov rdx, r12
nop dword [rax]
inc rdx
cmp word [rdi + rdx*2], si
jne 0x18001f0d0
test rcx, rcx
je 0x18001f0f7
cmp word [rsp + rcx*2 + 0x3e], 0x5c
je 0x18001f0f7
test rdx, rdx
je 0x18001f0f7
cmp word [rdi], 0x5c
mov r14d, 1
jne 0x18001f0fa
mov r14d, r15d
mov eax, r14d
add rax, rdx
add rax, rcx
mov ecx, 0x40
lea r15, [rax*2 + 2]
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x18001f195
lea r8, [rsp + 0x40]
mov rdx, r15
mov rcx, rax
call fcn.18001dec0
test eax, eax
jns 0x18001f146
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor r15d, r15d
mov ebx, r15d
jmp 0x18001f198
test r14d, r14d
je 0x18001f172
lea r8, [0x1800c7700]
mov rdx, r15
mov rcx, rbx
call fcn.18001de00
test eax, eax
jns 0x18001f172
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor r15d, r15d
mov ebx, r15d
jmp 0x18001f198
mov r8, rdi
mov rdx, r15
mov rcx, rbx
call fcn.18001de00
test eax, eax
jns 0x18001f195
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor r15d, r15d
mov ebx, r15d
jmp 0x18001f198
xor r15d, r15d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18001f1ae
test al, 0x50
je 0x18001f410
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ecx, ecx
call fcn.18001f5d0
mov r13, rax
mov rbx, r15
test rax, rax
je 0x18001f410
lea r14, [0x1800c7960]
mov rdx, r12
nop word [rax + rax]
cmp word [r14 + rdx*2 + 2], si
lea rdx, [rdx + 1]
jne 0x18001f1e0
mov rcx, r12
nop
cmp word [rdi + rcx*2 + 2], si
lea rcx, [rcx + 1]
jne 0x18001f1f0
mov rax, r12
nop
cmp word [rdi + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x18001f200
lea r9, [rdi + rax*2]
mov r11d, 0x5c
mov rax, r9
lea r10d, [r11 - 0x2e]
cmp rdi, r9
jae 0x18001f23a
movzx r8d, word [rax]
cmp r11w, r8w
je 0x18001f23a
cmp r10w, r8w
je 0x18001f23a
sub rax, 2
cmp rdi, rax
jb 0x18001f221
cmp r10w, word [rax]
cmove r9, rax
mov rax, r12
inc rax
cmp word [r9 + rax*2], si
jne 0x18001f245
test rax, rax
je 0x18001f509
cmp rax, 1
je 0x18001f432
mov rbx, r12
inc rbx
cmp word [rdi + rbx*2], si
jne 0x18001f265
inc rbx
mov ecx, 0x40
lea rdx, [rbx + rbx]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x18001f560
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.18001e080
test eax, eax
jns 0x18001f2aa
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rsi, r15
mov r11d, 0x5c
lea r10d, [r11 - 0x2e]
mov rbx, r15
test rsi, rsi
je 0x18001f410
cmp word [rsi + r12*2 + 2], 0
lea r12, [r12 + 1]
jne 0x18001f2c0
lea rdi, [rsi + r12*2]
mov rax, rdi
cmp rsi, rdi
jae 0x18001f2f8
nop word [rax + rax]
movzx ecx, word [rax]
cmp r11w, cx
je 0x18001f2f8
cmp r10w, cx
je 0x18001f2f8
sub rax, 2
cmp rsi, rax
jb 0x18001f2e0
cmp r10w, word [rax]
mov rdx, r14
cmove rdi, rax
mov rcx, rdi
call fcn.18009d1ac
test eax, eax
je 0x18001f326
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x18001f326
xor edx, edx
mov rcx, rsi
call fcn.18001ab40
mov rbx, rax
lea rdx, [0x1800c7970]
mov rcx, rdi
call fcn.18009d1ac
test eax, eax
je 0x18001f3d6
test rbx, rbx
jne 0x18001f410
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x18001f398
lea rax, [0x1800c7980]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x20]
lea rax, [0x1800c79b0]
mov r8, r13
mov qword [rsp + 0x28], rax
mov rdx, 0xffffffff80000002
lea rax, [0x1800c79e0]
mov rcx, rsi
mov qword [rsp + 0x30], rax
call fcn.18001b040
mov rbx, rax
test rax, rax
jne 0x18001f410
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x18001f3db
lea rax, [0x1800c7a10]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x20]
lea rax, [0x1800c7a50]
mov rdx, 0xffffffff80000002
mov rcx, rsi
mov qword [rsp + 0x28], rax
call fcn.18001ade0
mov rbx, rax
test rbx, rbx
jne 0x18001f410
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x18001f410
lea rax, [0x1800c7a90]
mov qword [rsp + 0x28], r15
lea r9, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov r8, r13
mov rdx, 0xffffffff80000002
mov rcx, rsi
call fcn.18001b040
mov rbx, rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rbx, rbx
je 0x18001f574
xor ecx, ecx
jmp 0x18001f581
lea r14, [rcx - 1]
test r14, r14
js 0x18001f4fa
mov rbx, r12
inc rbx
cmp word [rdi + rbx*2], si
jne 0x18001f442
cmp r14, rbx
mov ecx, 0x40
cmovb rbx, r14
inc rbx
lea rdx, [rbx + rbx]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
jne 0x18001f486
mov rcx, r13
mov rbx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x18001f574
test rbx, rbx
je 0x18001f4e2
cmp rbx, 0x7fffffff
jbe 0x18001f49a
mov word [rax], r15w
jmp 0x18001f4e2
cmp r14, 0x7ffffffe
jbe 0x18001f4a9
mov word [rax], r15w
jmp 0x18001f4e2
sub r14, rbx
mov rcx, rsi
sub rdi, rsi
lea rax, [rbx + r14]
test rax, rax
je 0x18001f4d1
movzx eax, word [rcx + rdi]
test ax, ax
je 0x18001f4d1
mov word [rcx], ax
add rcx, 2
sub rbx, 1
jne 0x18001f4b2
test rbx, rbx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r15w
jne 0x18001f4ee
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rsi, r15
lea r14, [0x1800c7960]
jmp 0x18001f2aa
mov rsi, r15
lea r14, [0x1800c7960]
jmp 0x18001f2b4
lea rax, [rcx + rdx]
mov ecx, 0x40
lea rbx, [rax*2 + 2]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x18001f2aa
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.18001dec0
mov rcx, rsi
test eax, eax
js 0x18001f55a
mov r8, r14
mov rdx, rbx
call fcn.18001de00
test eax, eax
jns 0x18001f2aa
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, r13
mov rbx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalFree]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x18001f587
lea ecx, [rax + 0x7e]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14, qword [rsp + 0x2a0]
mov rax, rbx
mov rbx, qword [rsp + 0x298]
jmp 0x18001f5a9
mov ecx, 0xa0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.180066c30
mov rsi, qword [rsp + 0x2a8]
add rsp, 0x260
pop r15
pop r13
pop r12
pop rdi
pop rbp
ret