Function at 0x140078e90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x428]
sub rsp, 0x500
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x14015a138]
xor rax, rsp
mov qword [rbp + 0x3f0], rax
mov r14, rdx
mov r12, rcx
xor ebx, ebx
lea rdx, [rbp - 0x50]
mov rcx, r14
call fcn.14001c160
nop
lea rdi, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdi, qword [rbp - 0x50]
xor ecx, ecx
call fcn.140018180
mov rcx, rax
mov r9, rdi
lea r8, str.Begin_Loading_whitelist:__s
lea edx, [rbx + 5]
call fcn.140016a40
mov rcx, r14
cmp qword [r14 + 0x18], 8
jb 0x140078f17
mov rcx, qword [r14]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x140079554
mov rcx, r14
cmp qword [r14 + 0x18], 8
jb 0x140078f33
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140078f46
test al, 0x10
jne 0x140079554
xor edx, edx
mov r8d, 0x320
lea rcx, [rbp - 0x30]
call fcn.1400cef80
mov qword [rbp - 0x20], rbx
mov dword [rbp - 0x18], ebx
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x10], xmm0
mov dword [rbp], ebx
mov qword [rbp + 8], rbx
movdqa xmmword [rbp + 0x10], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x20], xmm1
mov qword [rbp + 0x30], rbx
lea rax, vtable.tinyxml2::XMLDocument.0
mov qword [rbp - 0x30], rax
mov word [rbp + 0x38], 0x100
mov qword [rbp + 0x3c], rbx
mov dword [rbp + 0x48], ebx
movdqa xmmword [rbp + 0x50], xmm0
mov dword [rbp + 0x60], ebx
mov qword [rbp + 0x68], rbx
mov qword [rbp + 0x70], rbx
mov dword [rbp + 0x78], ebx
mov qword [rbp + 0x80], rbx
mov dword [rbp + 0x88], ebx
lea rax, [rbp + 0x98]
mov qword [rbp + 0x90], rax
mov qword [rbp + 0xe8], 0xa
lea rax, vtable.tinyxml2::MemPoolT_120_.0
mov qword [rbp + 0xf0], rax
lea rax, [rbp + 0x100]
mov qword [rbp + 0xf8], rax
mov qword [rbp + 0x150], 0xa
mov qword [rbp + 0x158], rbx
movdqa xmmword [rbp + 0x160], xmm0
lea rax, vtable.tinyxml2::MemPoolT_80_.0
mov qword [rbp + 0x170], rax
lea rax, [rbp + 0x180]
mov qword [rbp + 0x178], rax
mov qword [rbp + 0x1d0], 0xa
mov qword [rbp + 0x1d8], rbx
movdqa xmmword [rbp + 0x1e0], xmm0
lea rax, vtable.tinyxml2::MemPoolT_112_.0
mov qword [rbp + 0x1f0], rax
lea rax, [rbp + 0x200]
mov qword [rbp + 0x1f8], rax
mov qword [rbp + 0x250], 0xa
mov qword [rbp + 0x258], rbx
movdqa xmmword [rbp + 0x260], xmm0
lea rax, vtable.tinyxml2::MemPoolT_104_.0
mov qword [rbp + 0x270], rax
lea rax, [rbp + 0x280]
mov qword [rbp + 0x278], rax
mov qword [rbp + 0x2d0], 0xa
mov qword [rbp + 0x2d8], rbx
movdqa xmmword [rbp + 0x2e0], xmm0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x28], rax
lea rdx, [rbp - 0x80]
mov rcx, r14
call fcn.14001efb0
mov rsi, rax
cmp qword [rax + 0x18], 0x10
jb 0x1400790c8
mov rsi, qword [rax]
lea rcx, [rbp - 0x30]
call fcn.1400073d0
test rsi, rsi
je 0x140079184
cmp byte [rsi], 0
je 0x140079184
mov rdi, 0xffffffffffffffff
nop word [rax + rax]
inc rdi
cmp byte [rsi + rdi], 0
jne 0x1400790f0
lea rcx, [rdi + 1]
call fcn.1400ccda8
mov qword [rbp + 0x80], rax
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call fcn.1400cf140
mov rax, qword [rbp + 0x80]
mov byte [rax + rdi], 0
lea rcx, [rbp - 0x30]
call fcn.1400075c0
cmp dword [rbp + 0x3c], 0
je 0x1400791c8
lea rcx, [rbp - 0x30]
call fcn.1400059d0
lea rcx, [rbp + 0xf0]
mov rax, qword [rbp + 0xf0]
call qword [rax + Ordinal_41]
lea rcx, [rbp + 0x170]
mov rax, qword [rbp + 0x170]
call qword [rax + Ordinal_41]
lea rcx, [rbp + 0x1f0]
mov rax, qword [rbp + 0x1f0]
call qword [rax + Ordinal_41]
lea rcx, [rbp + 0x270]
mov rax, qword [rbp + 0x270]
call qword [rax + Ordinal_41]
jmp 0x1400791c8
mov dword [rbp + 0x3c], reloc.WS2_32.dll_ntohs
test dword [rbp + 0x48], 0x200
je 0x14007919d
mov rcx, qword [rbp + 0x50]
call fcn.1400ccd64
mov dword [rbp + 0x48], ebx
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x50], xmm0
test dword [rbp + 0x60], 0x200
je 0x1400791ba
mov rcx, qword [rbp + 0x68]
call fcn.1400ccd64
mov dword [rbp + 0x60], ebx
mov qword [rbp + 0x68], rbx
mov qword [rbp + 0x70], rbx
mov dword [rbp + 0x78], ebx
mov r15d, dword [rbp + 0x3c]
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x140079207
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140079202
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140079617
call fcn.1400ccd64
test r15d, r15d
jne 0x140079390
mov rdi, qword [rbp + 8]
test rdi, rdi
je 0x140079239
nop dword [rax]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
mov rsi, rax
test rax, rax
jne 0x14007923c
mov rdi, qword [rdi + 0x50]
test rdi, rdi
jne 0x140079220
mov rsi, rbx
mov rdi, qword [rsi + 0x70]
test rdi, rdi
je 0x14007927c
lea r15, str.expiration
nop dword [rax]
lea rcx, [rdi + 8]
call fcn.140005200
cmp rax, r15
je 0x1400792bc
mov r8d, 0x7fffffff
mov rdx, r15
mov rcx, rax
call fcn.1400d4fe0
test eax, eax
je 0x1400792bc
mov rdi, qword [rdi + 0x40]
test rdi, rdi
jne 0x140079250
lea rdi, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdi, qword [rbp - 0x50]
xor ecx, ecx
call fcn.140018180
mov rcx, rax
mov r9, rdi
lea r8, str.whitelist.xml_file__s_is_expired
mov edx, 2
call fcn.140016a40
lea rdx, str..expired
mov rcx, r14
call fcn.14004e6d0
jmp 0x140079549
test rdi, rdi
je 0x14007927c
lea rcx, [rdi + 0x20]
call fcn.140005200
mov rdi, rax
test rax, rax
je 0x14007927c
mov qword [rbp - 0x58], rbx
xor edx, edx
mov r8d, 0xf8
lea rcx, [rbp + 0x2f0]
call fcn.1400cef80
lea rcx, [rbp + 0x2f0]
call fcn.14000a250
nop
mov rdx, rdi
lea rcx, [rbp + 0x300]
call fcn.140017c70
mov rdx, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
test byte [rcx + rdx + 0x10], 6
jne 0x14007933d
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 0x2f0]
call fcn.14000ada0
mov rdx, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
test byte [rcx + rdx + 0x10], 6
jne 0x14007933d
mov dil, 1
jmp 0x140079340
xor dil, dil
lea rcx, [rbp + 0x2f0]
call fcn.14000a140
test dil, dil
je 0x14007927c
mov ecx, 1
call fcn.140026130
mov rdx, qword [rbp - 0x58]
test rdx, rdx
js 0x140079371
cmp rax, rdx
jge 0x14007927c
mov rdx, rsi
mov rcx, r12
call fcn.140079620
mov ebx, eax
mov rdx, rsi
mov rcx, r12
call fcn.140079bd0
add ebx, eax
jmp 0x140079549
movsxd rax, dword [rbp + 0x3c]
lea rdx, str.XML_SUCCESS
mov qword [rbp - 0x60], rbx
mov rdx, qword [rdx + rax*8]
lea rcx, [rbp - 0x60]
call fcn.14007cbd0
nop
lea rcx, [rbp + 0x60]
call fcn.140005200
mov qword [rbp - 0x58], rbx
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.14007cbd0
nop
mov qword [rsp + 0x50], rbx
lea rdx, [0x14012a68c]
lea rcx, [rsp + 0x50]
call fcn.14007cbd0
nop
mov qword [rsp + 0x48], rbx
lea rdx, [0x14012343c]
lea rcx, [rsp + 0x48]
call fcn.14007cbd0
nop
lea rcx, [rbp + 0x48]
call fcn.140005200
mov qword [rsp + 0x40], rbx
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14007cbd0
nop
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x70]
call fcn.14007ced0
nop
lea r8, [rsp + 0x50]
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.14007ced0
nop
lea r8, [rbp - 0x58]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.14007ced0
nop
mov r8, rax
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x58]
call fcn.14007ced0
mov rdi, rax
xor edx, edx
lea rcx, [rbp - 0x60]
call fcn.14007cbd0
mov rcx, qword [rbp - 0x60]
mov rsi, qword [rdi]
mov qword [rbp - 0x60], rsi
mov qword [rdi], rcx
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.14007cbd0
nop
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.14007cbd0
nop
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.14007cbd0
nop
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.14007cbd0
nop
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.14007cbd0
nop
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.14007cbd0
nop
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.14007cbd0
nop
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.14007cbd0
nop
mov r12d, dword [rbp + 0x78]
test rsi, rsi
je 0x1400794f4
cmp qword [rsi + 0x18], 0x10
jb 0x1400794f7
mov rsi, qword [rsi]
jmp 0x1400794f7
mov rsi, rbx
lea rdi, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdi, qword [rbp - 0x50]
xor ecx, ecx
call fcn.140018180
mov rcx, rax
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], r15d
mov r9, rdi
lea r8, str.Cannot_load_whitelist_xml_file:__s_nxml_error_code:__d____s_nXml_error_line_number:_d
mov edx, 2
call fcn.140016a40
xor edx, edx
mov rcx, r14
call fcn.14004e6d0
nop
xor edx, edx
lea rcx, [rbp - 0x60]
call fcn.14007cbd0
nop
lea rcx, [rbp - 0x30]
call fcn.1400072f0
jmp 0x140079580
lea rdi, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdi, qword [rbp - 0x50]
xor ecx, ecx
call fcn.140018180
mov rcx, rax
mov r9, rdi
lea r8, str.Cannot_load_whitelist_xml_file_as_it_does_not_exist:__s
mov edx, 2
call fcn.140016a40
lea rdi, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdi, qword [rbp - 0x50]
xor ecx, ecx
call fcn.140018180
mov rcx, rax
mov r9, rdi
lea r8, str.End_Loading_whitelist:__s
mov edx, 5
call fcn.140016a40
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1400795e4
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400795df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140079611
call fcn.1400ccd64
mov eax, ebx
mov rcx, qword [rbp + 0x3f0]
xor rcx, rsp
call fcn.1400ccd40
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1400d1a34
nop
call fcn.1400d1a34
nop
int3