Function at 0x140014bb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x630]
sub rsp, 0x730
mov rax, qword [0x1400400b0]
xor rax, rsp
mov qword [rbp + 0x620], rax
mov rcx, qword [rcx + 0x70]
xor ebx, ebx
movsxd r15, r8d
mov r14d, ebx
mov dword [rsp + 0x40], r15d
mov edi, ebx
mov r13, rdx
call fcn.140015950
mov rsi, rax
mov r12d, 0x7fe7
test rax, rax
je 0x140014c2d
mov rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], bx
jne 0x140014c10
cmp rdi, r12
jb 0x140014c2d
mov dword [0x14004cc50], 0x233f
jmp 0x1400157c6
cmp byte [0x14004cbc5], bl
je 0x140014c7d
test rax, rax
je 0x140014c5a
mov r8d, 4
lea rdx, [0x140038770]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsnicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140014c7d
lea rcx, str.COMSPEC
call fcn.1400149d8
mov rsi, rax
test rax, rax
jne 0x140014c7d
mov dword [0x14004cc50], 0x400023d2
jmp 0x1400157c6
mov qword [rbp + 0x198], rbx
lea rcx, [rbp - 0x70]
mov ebx, 0x104
mov byte [rbp + 0x1a0], 1
mov r8d, ebx
mov qword [rbp + 0x1a8], rbx
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
cmp byte [rbp + 0x1a0], r14b
lea rcx, [rbp - 0x70]
cmovne rbx, r12
mov rdx, rbx
call fcn.140010e10
test eax, eax
jns 0x140014cdf
mov rcx, qword [rbp + 0x198]
xor edx, edx
mov qword [rbp + 0x198], rdx
mov dword [0x14004cc50], 8
jmp 0x140015793
mov rdx, rsi
lea rcx, [rbp - 0x70]
call fcn.140016cc0
mov rax, qword [rbp + 0x198]
lea rcx, [rbp - 0x70]
test rax, rax
mov edx, 0x2f
cmovne rcx, rax
call fcn.14001a578
mov ebx, 0x5c
test rax, rax
je 0x140014d27
mov edx, 0x2f
mov word [rax], bx
lea rcx, [rax + 2]
call fcn.14001a578
test rax, rax
jne 0x140014d11
mov rax, qword [rbp + 0x198]
lea rcx, [rbp - 0x70]
xor r12d, r12d
mov dword [rbp + 0x400], 0x3a005c
test rax, rax
mov word [rbp + 0x404], r12w
lea rdx, [rbp + 0x400]
mov esi, 0x3a
cmovne rcx, rax
call fcn.14001dbd8
mov rcx, qword [rbp + 0x198]
cmp rax, rdi
jae 0x140014dcb
mov word [rbp + 0x402], r12w
mov r12d, 1
mov dword [rsp + 0x34], r12d
test rcx, rcx
jne 0x140014d87
lea rcx, [rbp - 0x70]
mov edx, ebx
call fcn.14001683c
mov rcx, qword [rbp + 0x198]
mov rbx, rax
test rax, rax
jne 0x140014dc3
mov dword [rsp + 0x34], r12d
test rcx, rcx
jne 0x140014dab
lea rcx, [rbp - 0x70]
mov edx, esi
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x198]
mov rbx, rax
xor esi, esi
add rbx, 2
jmp 0x140014dea
xor esi, esi
mov dword [rsp + 0x34], esi
mov word [rbp + 0x402], si
test rcx, rcx
je 0x140014de2
mov rbx, rcx
jmp 0x140014dea
lea rbx, [rbp - 0x70]
mov dword [rsp + 0x34], esi
cmp word [rbx], r14w
je 0x14001572e
cmp word [rbx], 0x2e
jne 0x140014e1d
cmp word [rbx + 2], r14w
je 0x14001572e
cmp word [rbx], 0x2e
jne 0x140014e1d
cmp word [rbx + 2], 0x2e
jne 0x140014e1d
cmp word [rbx + 4], r14w
je 0x14001572e
mov ecx, 0x1ff9c
call fcn.140011100
mov rdi, rax
test rax, rax
jne 0x140014e3e
mov dword [0x14004cc50], 8
jmp 0x140015785
mov r8, qword [rbp + 0x198]
test r8, r8
jne 0x140014e53
lea r8, [rbp - 0x70]
mov dword [rsp + 0x34], r12d
mov rdx, r15
mov rcx, r13
mov rsi, r15
call fcn.1400158f0
mov rcx, qword [rbp + 0x198]
test rcx, rcx
jne 0x140014e76
lea rcx, [rbp - 0x70]
mov dword [rsp + 0x34], r12d
mov rax, rbx
lea r8, [0x1400379e0]
sub rax, rcx
xor r15d, r15d
sar rax, 1
mov rdx, rsi
mov rcx, r13
mov word [r13 + rax*2], r15w
call fcn.1400157fc
mov r8, r13
mov edx, 0xffce
mov rcx, rdi
call fcn.140018ed8
test eax, eax
je 0x140014ef5
cmp byte [0x14004cbc5], r14b
je 0x140014ee2
mov rcx, r13
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x140014ee2
test al, 0x10
je 0x140014ee2
mov rcx, qword [rbp + 0x198]
mov qword [rbp + 0x198], r15
jmp 0x14001575d
mov rcx, qword [rbp + 0x198]
mov qword [rbp + 0x198], r15
jmp 0x1400157b2
mov rcx, rdi
call fcn.140016ca4
cmp word [rax], 0x5c
je 0x140014f17
lea r8, [0x140037cbc]
mov edx, 0xffce
mov rcx, rdi
call fcn.1400157fc
mov r8, rbx
mov edx, 0xffce
mov rcx, rdi
call fcn.1400157fc
mov rdx, 0xffffffffffffffff
nop
cmp word [rdi + rdx*2 + 2], r14w
lea rdx, [rdx + 1]
jne 0x140014f30
lea rdx, [rdx*2 + 2]
mov rcx, rdi
call fcn.14000edf4
mov rdi, rax
test rax, rax
jne 0x140014f71
mov rcx, qword [rbp + 0x198]
mov qword [rbp + 0x198], r15
mov dword [0x14004cc50], 8
jmp 0x140015793
mov edx, 0x5c
mov rcx, rdi
call fcn.14001683c
mov word [rax], r15w
add rax, 2
mov qword [rsp + 0x70], rax
test r12d, r12d
jne 0x140014f9f
lea rcx, [0x140038690]
call fcn.1400149d8
mov r14, rax
mov rcx, r13
call qword [sym.imp.api_ms_win_core_processenvironment_l1_2_0.dll_NeedCurrentDirectoryForExePathW]
nop dword [rax + rax]
mov r15d, eax
test eax, eax
je 0x140014fd0
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp word [rdi + rcx*2], 0
jne 0x140014fc0
add rcx, 2
jmp 0x140014fd4
xor edx, edx
mov ecx, edx
lea esi, [rcx + 2]
test r14, r14
je 0x140014ff0
mov rax, 0xffffffffffffffff
inc rax
cmp word [r14 + rax*2], 0
jne 0x140014fe3
add esi, eax
lea ecx, [rsi + rsi]
call fcn.140011100
mov rbx, rax
test rax, rax
jne 0x14001501d
mov rcx, qword [rbp + 0x198]
mov qword [rbp + 0x198], rax
mov dword [0x14004cc50], 8
jmp 0x140015793
movsxd rsi, esi
test r15d, r15d
je 0x140015057
lea r8, [0x140037e60]
mov rdx, rsi
mov rcx, rbx
call fcn.1400157fc
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.1400157fc
lea r8, [0x140037e60]
mov rdx, rsi
mov rcx, rbx
call fcn.1400157fc
test r12d, r12d
jne 0x140015086
test r14, r14
je 0x140015086
test r15d, r15d
je 0x140015078
lea r8, [0x1400385a8]
mov rdx, rsi
mov rcx, rbx
call fcn.1400157fc
mov r8, r14
mov rdx, rsi
mov rcx, rbx
call fcn.1400157fc
mov rcx, rbx
call fcn.140017d00
mov r8d, 1
lea rdx, [0x1400385a8]
mov rcx, rbx
call fcn.140011180
mov r15, qword [rsp + 0x70]
mov r14, rax
mov rax, 0xffffffffffffffff
inc rax
cmp word [r15 + rax*2], 0
jne 0x1400150b2
mov qword [rsp + 0x58], rax
inc rax
cmp byte [0x14004cbc5], 0
mov qword [rsp + 0x78], rax
je 0x1400150f1
lea rcx, str.PATHEXT
call fcn.1400149d8
mov r10, rax
test rax, rax
je 0x1400150f1
mov rcx, rax
call fcn.140017d00
jmp 0x1400150f8
lea r10, str..COM_.EXE_.BAT_.CMD_.VBS_.JS_.WS_.MSC
mov r8d, 1
lea rdx, [0x1400385a8]
mov rcx, r10
call fcn.140011180
mov qword [rbp - 0x80], rax
jmp 0x140015120
mov r12d, dword [rsp + 0x34]
nop dword [rax + rax]
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [r14 + rbx*2], 0
jne 0x140015130
mov rcx, r14
lea edi, [rbx + 1]
call fcn.140015950
mov r8, rax
movsxd rdx, edi
mov rcx, r14
call fcn.1400158f0
mov rdx, 0xffffffffffffffff
nop dword [rax + rax]
inc rdx
cmp word [r14 + rdx*2], 0
jne 0x140015160
mov rcx, r14
call fcn.140016ca4
movzx esi, word [rax]
cmp si, 0x5c
cmove edi, ebx
cmp word [r14], 0
je 0x1400156fe
lea ecx, [rdx + 1]
cmp si, 0x5c
cmove ecx, edx
add rcx, qword [rsp + 0x78]
call fcn.1400176e8
test al, al
je 0x1400151b4
cmp si, 0x5c
jne 0x1400151a8
inc edi
movsxd rax, edi
lea r14, [r14 + rax*2]
jmp 0x140015120
movsxd rax, dword [rsp + 0x40]
mov r8, r14
mov rdx, rax
mov rcx, r13
mov rbx, rax
call fcn.1400158f0
cmp si, 0x5c
je 0x1400151f5
movsxd rax, edi
lea r8, [rbp + 0x400]
mov rdx, rbx
mov rcx, r13
lea r14, [r14 + rax*2]
mov qword [rsp + 0x68], r14
call fcn.1400157fc
mov dword [rsp + 0x34], r12d
jmp 0x140015204
lea eax, [rdi + 1]
movsxd rcx, eax
lea r14, [r14 + rcx*2]
mov qword [rsp + 0x68], r14
mov r8, r15
mov rdx, rbx
mov rcx, r13
call fcn.1400157fc
mov rcx, r13
call fcn.140015950
mov r8, rax
mov rdx, rbx
mov rcx, r13
call fcn.1400158f0
mov r12, 0xffffffffffffffff
nop
inc r12
cmp word [r13 + r12*2], 0
jne 0x140015230
cmp word [r13 + 2], 0x3a
jne 0x140015256
movzx ecx, word [r13]
call fcn.1400176fc
test eax, eax
je 0x140015113
mov edx, 0x2e
mov rcx, r15
call fcn.14001683c
test rax, rax
je 0x1400152bc
cmp word [rax + 2], 0
je 0x1400152bc
mov edx, dword [rsp + 0x40]
mov rcx, r13
call fcn.140018fb8
test eax, eax
jne 0x140015290
cmp dword [rsp + 0x34], eax
je 0x1400152a9
mov eax, dword [0x14004cc50]
cmp eax, 5
jne 0x1400152af
mov edx, 0x2e
mov rcx, r13
call fcn.14001683c
mov rbx, rax
test rax, rax
jne 0x14001564c
mov eax, dword [0x14004cc50]
cmp eax, 2
je 0x1400152bc
test eax, eax
jne 0x140015113
test r15, r15
je 0x1400152f9
mov edx, 0x2a
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
test rax, rax
jne 0x1400156c8
lea edx, [rax + 0x3f]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
test rax, rax
jne 0x1400156c8
xor r8d, r8d
movsxd rax, r12d
mov dil, 1
mov dword [rsp + 0x64], r8d
movzx ecx, dil
mov byte [rsp + 0x30], dil
xor dl, dl
mov dword [rsp + 0x3c], ecx
mov rsi, 0xffffffffffffffff
mov byte [rsp + 0x38], dl
mov qword [rsp + 0x50], rsi
mov r15d, 0xffffffff
mov dword [rsp + 0x60], r8d
mov qword [rsp + 0x48], rax
mov r14, qword [rsp + 0x58]
nop dword [rax + rax]
xor bl, bl
test cl, cl
je 0x1400155de
test dil, dil
je 0x1400153ba
movsxd rdx, dword [rsp + 0x40]
mov rcx, r13
mov word [r13 + rax*2], r8w
lea r8, [0x14003877c]
call fcn.1400157fc
test eax, eax
js 0x140015389
lea r9, [rsp + 0x50]
mov edx, 0x1027
lea r8, [rbp + 0x1b0]
mov rcx, r13
call fcn.1400345ac
movzx ebx, al
mov rsi, qword [rsp + 0x50]
xor dil, dil
mov byte [rsp + 0x30], dil
jmp 0x1400153d1
movzx edi, byte [rsp + 0x30]
mov rsi, qword [rsp + 0x50]
jmp 0x140015336
movzx edi, byte [rsp + 0x30]
jmp 0x140015336
mov rsi, qword [rsp + 0x50]
jmp 0x140015340
mov r8, rsi
lea rcx, [rbp + 0x1b0]
mov edx, 0x1027
call fcn.1400345dc
movzx ebx, al
test bl, bl
je 0x1400155d6
mov edx, 0x2e
lea rcx, [rbp + 0x1dc]
call fcn.14001683c
mov ecx, dword [rsp + 0x3c]
mov r14, rax
test rax, rax
mov r8d, 0
mov rax, qword [rsp + 0x48]
je 0x140015336
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp word [r14 + rdi*2], r8w
jne 0x140015410
mov ecx, dword [rsp + 0x3c]
cmp rdi, 1
jbe 0x1400153ac
mov rax, qword [rbp - 0x80]
mov esi, r8d
mov rbx, rax
cmp word [rax], r8w
mov rax, qword [rsp + 0x48]
je 0x1400153a0
nop dword [rax]
mov ecx, dword [rsp + 0x3c]
mov r8d, 0
mov rax, qword [rsp + 0x48]
cmp esi, r15d
jae 0x1400153a0
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp word [rbx + rcx*2], r8w
jne 0x140015460
cmp rdi, rcx
jne 0x1400154b0
lea rdx, [rbp + 0x1dc]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rdx + rax*2], r8w
jne 0x140015480
add rcx, qword [rsp + 0x58]
cmp rax, rcx
jne 0x1400154b0
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x1400154e2
nop word [rax + rax]
movzx eax, word [rbx]
add rbx, 2
test ax, ax
jne 0x1400154b0
inc esi
cmp word [rbx], ax
jne 0x140015440
movzx edi, byte [rsp + 0x30]
xor r8d, r8d
mov ecx, dword [rsp + 0x3c]
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x48]
jmp 0x140015336
lea rax, [rbp + 0x1dc]
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], 0
jne 0x1400154f0
mov r14, qword [rsp + 0x58]
mov eax, r12d
movzx edi, byte [rsp + 0x30]
sub eax, r14d
add ecx, eax
mov r8d, 0
cmp ecx, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x3c]
mov rax, qword [rsp + 0x48]
jge 0x1400153b3
lea r8, [rbp + 0x1dc]
lea rcx, [rbp + 0x410]
call fcn.140024b98
mov ecx, dword [rsp + 0x3c]
test eax, eax
mov rax, qword [rsp + 0x48]
mov r8d, 0
js 0x1400153b3
mov eax, ecx
mov byte [rsp + 0x38], 1
movzx eax, al
lea rdx, str..BAT
test esi, esi
mov rcx, rbx
mov r15d, esi
cmove eax, r8d
mov dword [rsp + 0x3c], eax
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x1400155b8
lea rdx, str..CMD
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x1400155b8
mov ecx, dword [rsp + 0x3c]
xor r8d, r8d
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x48]
mov dword [rsp + 0x60], 1
jmp 0x140015340
mov ecx, dword [rsp + 0x3c]
xor r8d, r8d
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x48]
mov dword [rsp + 0x60], 2
jmp 0x140015340
mov rax, qword [rsp + 0x48]
xor r8d, r8d
cmp byte [rsp + 0x38], 0
je 0x14001560c
movsxd rdx, dword [rsp + 0x40]
sub rax, r14
mov rcx, r13
mov word [r13 + rax*2], r8w
lea r8, [rbp + 0x410]
call fcn.1400157fc
test eax, eax
js 0x14001560c
mov ebx, dword [rsp + 0x60]
jmp 0x140015627
mov eax, dword [0x14004cc50]
mov ecx, 2
mov ebx, dword [rsp + 0x64]
cmp eax, 0x12
cmove eax, ecx
mov dword [0x14004cc50], eax
cmp rsi, 0xffffffffffffffff
je 0x140015635
mov rcx, rsi
call fcn.140019110
test ebx, ebx
jne 0x1400156dd
mov r14, qword [rsp + 0x68]
mov r15, qword [rsp + 0x70]
jmp 0x140015113
lea rdx, str..CMD
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x140015680
lea rdx, str..BAT
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x1400156a4
mov rcx, qword [rbp + 0x198]
xor eax, eax
mov qword [rbp + 0x198], rax
test rcx, rcx
je 0x14001569a
call fcn.14001fe90
mov eax, 2
jmp 0x1400157c8
mov rcx, qword [rbp + 0x198]
xor eax, eax
mov qword [rbp + 0x198], rax
test rcx, rcx
je 0x1400156be
call fcn.14001fe90
mov eax, 1
jmp 0x1400157c8
mov rcx, qword [rbp + 0x198]
xor eax, eax
mov qword [rbp + 0x198], rax
jmp 0x1400157b2
mov rcx, qword [rbp + 0x198]
xor eax, eax
mov qword [rbp + 0x198], rax
test rcx, rcx
je 0x1400156f7
call fcn.14001fe90
mov eax, ebx
jmp 0x1400157c8
test r12d, r12d
je 0x14001570f
test dword [0x14004cc50], 0xfffffffd
jne 0x140015719
mov dword [0x14004cc50], 0x2331
mov rcx, qword [rbp + 0x198]
xor eax, eax
mov qword [rbp + 0x198], rax
jmp 0x1400157bc
cmp byte [0x14004cbc5], r14b
je 0x1400157ab
mov rcx, r13
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x14001576e
test al, 0x10
je 0x1400157a4
mov rcx, qword [rbp + 0x198]
mov qword [rbp + 0x198], rsi
test rcx, rcx
je 0x140015767
call fcn.14001fe90
mov eax, 5
jmp 0x1400157c8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x15
jne 0x1400157a4
mov dword [0x14004cc50], eax
mov rcx, qword [rbp + 0x198]
mov qword [rbp + 0x198], rsi
test rcx, rcx
je 0x14001579d
call fcn.14001fe90
mov eax, 3
jmp 0x1400157c8
mov rcx, qword [rbp + 0x198]
mov qword [rbp + 0x198], rsi
mov dword [0x14004cc50], 0x2331
test rcx, rcx
je 0x1400157c6
call fcn.14001fe90
xor eax, eax
mov rcx, qword [rbp + 0x620]
xor rcx, rsp
call fcn.14001f920
mov rbx, qword [rsp + 0x788]
add rsp, 0x730
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret