Function at 0x140098550
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x26e0
call sub.ntdll.dll___chkstk
sub rsp, rax
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x26d0], rax
movzx r15d, r9b
mov r13, r8
mov r14, rdx
mov r12d, ecx
call fcn.140028250
mov rsi, rax
call fcn.1400306a0
mov rdi, rax
call fcn.14002bfe0
xor ebp, ebp
mov rbx, rax
xor eax, eax
mov rdx, r13
mov ecx, r12d
mov dword [rsp + Ordinal_3973], ebp
mov dword [rsp + 0x44], ebp
mov dword [rsp + Ordinal_3973], eax
mov dword [rsp + reloc.MFC80U.DLL_Ordinal_3976], eax
mov dword [rsp + reloc.MFC80U.DLL_Ordinal_3980], eax
mov dword [rsp + 0x40], ebp
call fcn.140097130
mov rax, qword [rbx]
mov edx, r12d
mov rcx, rbx
call qword [rax + 8]
test al, al
jne 0x1400986fa
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx]
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
call fcn.140049470
lea rsi, [0x140434120]
mov rcx, rsi
xor edx, edx
mov r8d, 0x80
mov rbx, rax
call sub.ntdll.dll_memset
lea edx, [rbp + 0x5c]
lea rcx, str...corehelp.cpp
call qword [sym.imp.ntdll.dll_strrchr]
test rax, rax
mov rdi, rax
je 0x1400986d3
xor eax, eax
lea rdx, [0x1402dfd08]
lea rcx, [rsp + 0x1f40]
mov r8d, Ordinal_431
mov byte [rsp + 0x1f40], bpl
mov qword [rsp + 0x1f41], rax
mov word [rsp + 0x1f49], ax
mov byte [rsp + 0x1f4b], al
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rsi
sub rcx, rdx
nop
nop
nop
movzx eax, byte [rdx]
add rdx, 1
test al, al
mov byte [rcx + rdx - 1], al
jne 0x140098690
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x1f40]
nop
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x1400986c0
mov rbp, rsi
mov rax, qword [rbx]
lea rdx, str._s_DiskIndex:_d_SystemStartSector:_d_BootStartSector:_d
mov r9d, r12d
mov r8, rbp
mov rcx, rbx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
call qword [rax + 0x10]
xor eax, eax
jmp 0x140098f0f
mov rax, qword [rbx]
lea rdx, [rsp + 0x48]
mov rcx, rbx
call qword [rax + 0x28]
mov rcx, rbx
test al, al
mov rax, qword [rbx]
jne 0x140098770
call qword [rax + 0x90]
mov rdx, qword [rsi]
mov rcx, rsi
call qword [rdx]
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx]
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
call fcn.140049470
lea rcx, str...corehelp.cpp
mov rbx, qword [rax]
mov edx, reloc.MFC80U.DLL_Ordinal_438
mov rdi, rax
call fcn.1400958d0
lea rdx, str._s_DiskIndex:_d_SystemStartSector:_d_BootStartSector:_d
mov r9d, r12d
mov rcx, rdi
mov r8, rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
call qword [rbx + 0x10]
xor eax, eax
jmp 0x140098f0f
lea rdx, [rsp + 0x40]
call qword [rax + 0x78]
mov rcx, rbx
test al, al
jne 0x1400987e0
mov rax, qword [rbx]
call qword [rax + 0x90]
mov rdx, qword [rsi]
mov rcx, rsi
call qword [rdx]
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx]
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
call fcn.140049470
lea rcx, str...corehelp.cpp
mov rbx, qword [rax]
mov edx, Ordinal_452
mov rdi, rax
call fcn.1400958d0
lea rdx, str._s_DiskIndex:_d_SystemStartSector:_d_BootStartSector:_d
mov r9d, r12d
mov rcx, rdi
mov r8, rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
call qword [rbx + 0x10]
xor eax, eax
jmp 0x140098f0f
xor eax, eax
cmp dword [rsp + 0x48], eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov rax, qword [rbx]
jne 0x140098815
lea rdx, [rsp + 0x44]
call qword [rax + 0x48]
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x60], eax
jmp 0x140098843
lea rdx, [rsp + 0xf80]
call qword [rax + 0x50]
lea rcx, [rsp + 0xf80]
lea rdx, [rsp + 0x60]
mov rax, qword [rcx]
mov dword [rsp + 0x50], 1
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x90]
lea rcx, [rsp + 0x1fd2]
xor edx, edx
mov r8d, 0xfe
mov word [rsp + 0x1fd0], bp
call sub.ntdll.dll_memset
lea rcx, [rsp + 0x20d2]
xor edx, edx
mov r8d, 0xfe
mov word [rsp + 0x20d0], bp
call sub.ntdll.dll_memset
mov edx, dword [rsp + 0x40]
lea rcx, [rsp + 0x50]
imul rdx, r14
mov qword [rsp + 0x58], rdx
mov rax, qword [rcx]
lea rdx, [rsp + 0x70]
lea r8, [rsp + 0x1fd0]
mov r9d, 0x100
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [rdx + 0x10], rax
mov rax, qword [rcx + 0x18]
mov rcx, rsi
mov qword [rdx + 0x18], rax
mov rax, qword [rsi]
lea rdx, [rsp + 0x70]
call qword [rax + 0xb0]
mov edx, dword [rsp + 0x40]
lea rcx, [rsp + 0x50]
imul rdx, r13
mov qword [rsp + 0x58], rdx
mov rax, qword [rcx]
lea rdx, [rsp + 0x70]
lea r8, [rsp + 0x20d0]
mov r9d, 0x100
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [rdx + 0x10], rax
mov rax, qword [rcx + 0x18]
mov rcx, rsi
mov qword [rdx + 0x18], rax
mov rax, qword [rsi]
lea rdx, [rsp + 0x70]
call qword [rax + 0xb0]
mov rax, qword [rsi]
lea rdx, [rsp + 0x1fd0]
mov rcx, rsi
call qword [rax + 8]
test al, al
jne 0x14009899e
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx]
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
call fcn.140049470
lea rcx, str...corehelp.cpp
mov rbx, qword [rax]
mov edx, 0x1de
mov rdi, rax
call fcn.1400958d0
lea rdx, str._s_DiskIndex:_d_SystemStartSector:_d_BootStartSector:_d
mov r9d, r12d
mov rcx, rdi
mov r8, rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
call qword [rbx + 0x10]
xor eax, eax
jmp 0x140098f0f
xor edx, edx
lea rcx, [rsp + 0x90]
lea r8d, [rdx + 0x58]
call sub.ntdll.dll_memset
mov rax, qword [rsi]
lea rdx, [rsp + 0x90]
mov rcx, rsi
call qword [rax + 0x58]
mov rcx, rsi
test al, al
mov rax, qword [rsi]
jne 0x140098a27
call qword [rax + 0x68]
mov rdx, qword [rsi]
mov rcx, rsi
call qword [rdx]
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx]
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
call fcn.140049470
lea rcx, str...corehelp.cpp
mov rbx, qword [rax]
mov edx, 0x1ea
mov rdi, rax
call fcn.1400958d0
lea rdx, str._s_DiskIndex:_d_SystemStartSector:_d_BootStartSector:_d
mov r9d, r12d
mov rcx, rdi
mov r8, rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
call qword [rbx + 0x10]
xor eax, eax
jmp 0x140098f0f
call qword [rax + 0x68]
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 0x30]
lea rcx, [rsp + 0x21d2]
xor edx, edx
mov r8d, 0xfe
mov word [rsp + 0x21d0], bp
call sub.ntdll.dll_memset
mov rax, qword [rsi]
lea r8, [rsp + 0x21d0]
lea rdx, [rsp + 0x1fd0]
mov r9d, 0x100
mov rcx, rsi
call qword [rax + 0x80]
lea rcx, [rsp + 0x22d2]
xor edx, edx
mov r8d, reloc.MFC80U.DLL_Ordinal_1022
mov word [rsp + 0x22d0], bp
call sub.ntdll.dll_memset
lea r8, [rsp + 0x21d0]
lea rdx, str.___s_boot_bcd
lea rcx, [rsp + 0x22d0]
call fcn.140002b60
lea rcx, [rsp + 0x22d0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140098ada
lea r8, [rsp + 0x21d0]
lea rdx, [0x1402e8f88]
lea rcx, [rsp + 0x22d0]
call fcn.140002b60
xor edx, edx
lea rcx, [rsp + 0x1f52]
mov word [rsp + 0x1f50], bp
lea r8d, [rdx + 0x7e]
call sub.ntdll.dll_memset
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rdx, str.BCD_d88888888
lea rcx, [rsp + 0x1f50]
mov r8d, eax
call fcn.140002b60
mov rax, qword [rdi]
lea r8, [rsp + 0x1f50]
lea rdx, [rsp + 0x22d0]
mov rcx, rdi
call qword [rax + 0x18]
test al, al
jne 0x140098b63
lea rcx, [rsp + 0x1f50]
xor edx, edx
mov r8d, 0x80
call sub.ntdll.dll_memset
mov rax, qword [rdi]
lea r8, [rsp + 0x1f50]
lea rdx, [rsp + 0x1fd0]
mov r9d, 0x80
mov rcx, rdi
call qword [rax + 0x38]
mov rax, qword [rdi]
lea r8, [rsp + 0x1fd0]
lea rdx, [rsp + 0x1f50]
mov rcx, rdi
call qword [rax + Ordinal_265]
test eax, eax
jne 0x140098bfb
mov rax, qword [rdi]
lea r8, [rsp + 0x1fd0]
lea rdx, [rsp + 0x1f50]
mov rcx, rdi
call qword [rax + 0xe0]
test al, al
jne 0x140098bfb
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx]
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
call fcn.140049470
lea rcx, str...corehelp.cpp
mov rbx, qword [rax]
mov edx, 0x215
mov rdi, rax
call fcn.1400958d0
lea rdx, str._s_DiskIndex:_d_SystemStartSector:_d_BootStartSector:_d
mov r9d, r12d
mov rcx, rdi
mov r8, rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
call qword [rbx + 0x10]
xor eax, eax
jmp 0x140098f0f
mov rax, qword [rdi]
lea r8, [rsp + 0x20d0]
lea rdx, [rsp + 0x1f50]
mov rcx, rdi
call qword [rax + Ordinal_277]
test eax, eax
jne 0x140098e9a
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_4272]
xor edx, edx
mov r8d, 0xe84
call sub.ntdll.dll_memset
lea r8, [rsp + 0x1f50]
lea rdx, [0x1403b5c74]
lea rcx, [rsp + 0x10b4]
call fcn.140002b60
lea rdx, [0x1402e8f58]
lea rcx, [rsp + 0x1534]
call fcn.140002b60
lea r8, [rsp + 0x20d0]
lea rdx, [0x1403b5c74]
lea rcx, [rsp + 0x1634]
call fcn.140002b60
lea r8, [rsp + 0x1fd0]
lea rdx, [0x1403b5c74]
lea rcx, [rsp + 0x14b4]
call fcn.140002b60
lea rcx, [rsp + 0xf94]
xor edx, edx
mov r8d, 0x8c
mov dword [rsp + 0xf90], ebp
call sub.ntdll.dll_memset
lea rcx, [rsp + 0xf0]
lea rdx, [rsp + reloc.MFC80U.DLL_Ordinal_4272]
mov r8d, 0xe84
call sub.ntdll.dll_memcpy
mov rax, qword [rdi]
lea r8, [rsp + 0xf90]
lea rdx, [rsp + 0xf0]
mov rcx, rdi
call qword [rax + 0xb0]
test al, al
jne 0x140098d4b
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx]
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
call fcn.140049470
lea rcx, str...corehelp.cpp
mov rbx, qword [rax]
mov edx, Ordinal_555
mov rdi, rax
call fcn.1400958d0
lea rdx, str._s_DiskIndex:_d_SystemStartSector:_d_BootStartSector:_d
mov r9d, r12d
mov rcx, rdi
mov r8, rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
call qword [rbx + 0x10]
xor eax, eax
jmp 0x140098f0f
lea rcx, [rsp + 0x1024]
xor edx, edx
mov r8d, 0x8c
mov dword [rsp + Ordinal_4133], ebp
call sub.ntdll.dll_memset
lea rcx, [rsp + 0xf0]
lea rdx, [rsp + reloc.MFC80U.DLL_Ordinal_4272]
mov r8d, 0xe84
call sub.ntdll.dll_memcpy
mov rax, qword [rdi]
lea r8, [rsp + 0x1020]
lea rdx, [rsp + 0xf0]
mov rcx, rdi
call qword [rax + 0xc8]
test al, al
je 0x140098de2
mov rax, qword [rdi]
lea r9, [rsp + reloc.MFC80U.DLL_Ordinal_4144]
lea r8, [rsp + 0xfa0]
lea rdx, [rsp + 0x1f50]
mov rcx, rdi
call qword [rax + 0xd0]
mov rax, qword [rdi]
lea r8, [rsp + reloc.MFC80U.DLL_Ordinal_4144]
lea rdx, [rsp + 0x1f50]
mov rcx, rdi
call qword [rax + 0x80]
mov rax, qword [rdi]
lea r8, [rsp + 0xfa0]
lea rdx, [rsp + 0x1f50]
mov rcx, rdi
call qword [rax + 0x70]
test al, al
jne 0x140098e57
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx]
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
call fcn.140049470
lea rcx, str...corehelp.cpp
mov rbx, qword [rax]
mov edx, reloc.MFC80U.DLL_Ordinal_568
mov rdi, rax
call fcn.1400958d0
lea rdx, str._s_DiskIndex:_d_SystemStartSector:_d_BootStartSector:_d
mov r9d, r12d
mov rcx, rdi
mov r8, rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
call qword [rbx + 0x10]
xor eax, eax
jmp 0x140098f0f
test r15b, r15b
mov rax, qword [rdi]
lea rdx, [rsp + 0x1f50]
mov rcx, rdi
je 0x140098e6f
call qword [rax + 0x58]
jmp 0x140098e7e
lea r8, [rsp + 0xfa0]
call qword [rax + 0x68]
test al, al
jne 0x140098e9a
mov rax, qword [rdi]
lea r8, [rsp + 0xfa0]
lea rdx, [rsp + 0x1f50]
mov r9b, 1
mov rcx, rdi
call qword [rax + 0x48]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x30]
xor r9d, r9d
mov qword [rsp + 0x30], rbp
lea rcx, [rsp + 0x22d0]
lea r8d, [r9 + 1]
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbp, rax
je 0x140098eed
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140097b30
mov rdx, qword [rsi]
mov rcx, rsi
call qword [rdx]
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx]
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
mov eax, 1
mov rcx, qword [rsp + 0x26d0]
xor rcx, rsp
call fcn.140161080
mov rbx, qword [rsp + 0x2738]
add rsp, 0x26e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret