Function at 0x140035db0
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov dword [rax + 0x20], r9d
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x290
mov r12d, r9d
mov r15, rcx
lea r8, [0x14013cd68]
lea r9, [rsp + 0x70]
lea rcx, str.RtlCreateUnicodeString
lea rdx, str.NTDLL.DLL
xor ebx, ebx
mov qword [rsp + 0x70], rbx
call fcn.14005c57c
lea r9, [rsp + 0x70]
lea r8, [0x14013cd70]
lea rdx, str.NTDLL.DLL
lea rcx, str.RtlFreeUnicodeString
call fcn.14005c57c
mov r14d, dword [rsp + 0x310]
mov r8, qword [0x14013cb48]
xor eax, eax
and r14d, 0x10
mov word [rsp + 0x40], bx
mov qword [rsp + 0x42], rax
mov dword [rsp + 0x4a], eax
mov word [rsp + 0x4e], ax
mov dword [rsp + 0x68], ebx
cmp r8, rbx
jne 0x140035e5b
mov eax, 3
jmp 0x1400363f3
mov rsi, qword [rsp + 0x300]
cmp r14d, ebx
je 0x140035e8a
cmp rsi, rbx
je 0x140035e8a
movzx eax, word [rsi]
cmp ax, 0x41
jb 0x140035e8a
cmp ax, 0x5a
ja 0x140035e8a
or ax, 0x20
mov word [rsi], ax
mov r8, qword [0x14013cb48]
lea rdx, str.DeviceImDiskCtl
lea rcx, [rsp + 0x40]
call r8
mov r13d, 0xc0000000
lea rcx, [rsp + 0x40]
mov edx, r13d
call qword [0x14013d0b8]
or rdi, 0xffffffffffffffff
jmp 0x140035ee5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140035f13
lea rcx, str.ImDisk
call qword [0x14013d0d8]
cmp eax, ebx
je 0x140035f03
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x40]
mov edx, r13d
call qword [0x14013d0b8]
mov rbp, rax
cmp rax, rdi
je 0x140035eb3
mov rcx, rax
call fcn.14001c888
cmp eax, ebx
jne 0x140035f1d
mov edi, 5
jmp 0x1400362ff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 4
jmp 0x1400363f3
mov eax, 6
jmp 0x1400363f3
mov r13d, r12d
mov ebx, r12d
xor r12d, r12d
and r13d, 0xf000
and ebx, 0xf00
mov edx, r12d
cmp r13d, 0x1000
mov ecx, r12d
mov eax, r12d
sete dl
cmp ebx, 0x100
sete cl
cmp ebx, r12d
sete al
or ecx, eax
test edx, ecx
je 0x140035fcf
lea rdx, str.DeviceAWEAlloc
lea rcx, [rsp + 0x58]
call qword [0x14013cb48]
jmp 0x140035f9c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x14003604b
lea rcx, str.AWEAlloc
call qword [0x14013d0d8]
cmp eax, r12d
je 0x140035fbf
lea rcx, str.AWEAlloc_driver_was_loaded_into_the_kernel.
call fcn.140103310
lea rcx, [rsp + 0x58]
mov edx, 0xc0000000
call qword [0x14013d0b8]
cmp rax, rdi
je 0x140035f6f
mov rcx, rax
call qword [0x14013cd40]
jmp 0x14003604b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 7
jmp 0x1400362ff
cmp r13d, 0x2000
mov ecx, r12d
mov eax, r12d
sete cl
or ecx, edx
cmp ebx, 0x300
sete al
test eax, ecx
je 0x14003604b
lea rcx, str..PIPEImDskSvc
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
cmp eax, r12d
jne 0x14003604b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x14003604b
lea rcx, str.ImDskSvc
call qword [0x14013d0d8]
cmp eax, r12d
je 0x140035fbf
jmp 0x140036037
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x14003604b
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str..PIPEImDskSvc
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
cmp eax, r12d
je 0x140036021
mov r12, qword [rsp + 0x2f0]
test r12, r12
jne 0x14003619b
lea rcx, [rsp + 0x40]
xor edx, edx
call qword [0x14013cb48]
xor r13d, r13d
movzx eax, word [rsp + 0x40]
lea rcx, [rsp + 0x50]
add eax, eax
movsxd rdx, eax
add rdx, 0x38
call fcn.140063028
mov rbx, qword [rsp + 0x50]
movzx r8d, word [rsp + 0x40]
add r8, 0x38
mov rcx, rbx
xor edx, edx
call fcn.140101f00
mov edi, 0x3a
cmp rsi, r13
je 0x1400360d9
cmp r14d, r13d
jne 0x1400360d9
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 2
jne 0x1400360c0
cmp word [rsi + 2], di
je 0x1400360d2
cmp eax, 3
jne 0x1400360d9
cmp word [rsi + 2], di
jne 0x1400360d9
cmp word [rsi + 4], 0x5c
jne 0x1400360d9
movzx eax, word [rsi]
mov word [rbx + 0x2c], ax
mov eax, dword [r15]
mov rcx, qword [rsp + 0x2d8]
mov dword [rbx], eax
mov rax, qword [rcx]
mov qword [rbx + 8], rax
mov rax, qword [rcx + 8]
mov qword [rbx + 0x10], rax
mov rax, qword [rcx + 0x10]
mov qword [rbx + 0x18], rax
mov rax, qword [rsp + 0x2e0]
mov rax, qword [rax]
mov qword [rbx + 0x20], rax
mov eax, dword [rsp + 0x2e8]
mov dword [rbx + 0x28], eax
movzx eax, word [rsp + 0x40]
mov word [rbx + 0x2e], ax
movzx eax, word [rsp + 0x40]
cmp ax, r13w
je 0x140036147
mov rdx, qword [rsp + 0x48]
lea rcx, [rbx + 0x30]
movzx r8d, ax
call fcn.140102b50
lea rcx, [rsp + 0x40]
call qword [0x14013cd70]
movzx r9d, word [rbx + 0x2e]
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
add r9d, 0x38
mov r8, rbx
mov dword [rsp + 0x28], r9d
mov edx, 0x8372e004
mov rcx, rbp
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rbp
cmp eax, r13d
jne 0x14003630f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x50]
call fcn.14005aef8
jmp 0x140035e51
cmp dword [rsp + 0x2f8], 0
je 0x1400361bb
lea rcx, [rsp + 0x40]
mov rdx, r12
call qword [0x14013cd68]
xor r13d, r13d
jmp 0x1400362f6
xor ecx, ecx
cmp r13d, 0x3000
sete cl
xor r13d, r13d
cmp ebx, 0x300
mov eax, r13d
sete al
xor r9d, r9d
test eax, ecx
je 0x1400362c8
mov qword [rsp + 0x30], r13
lea r8d, [r13 + 1]
lea rcx, str._Global
xor edx, edx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, r13d
cmp eax, 2
mov ecx, r13d
lea r13, str.BaseNamedObjects_
sete dl
cmp rbx, rdi
lea rax, str.BaseNamedObjectsGlobal_
sete cl
test ecx, edx
cmove r13, rax
cmp rbx, rdi
je 0x140036246
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, r12
movsxd rbx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [rax + rbx + 2]
movsxd rdx, ecx
lea rcx, [rsp + 0x58]
call fcn.140063314
mov rbx, qword [rsp + 0x58]
test rbx, rbx
jne 0x14003628b
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x58]
call fcn.14005aef8
jmp 0x140036308
mov rdx, r13
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x40]
mov rdx, rbx
call qword [0x14013cd68]
xor r13d, r13d
cmp eax, r13d
je 0x140036276
lea rcx, [rsp + 0x58]
call fcn.14005aef8
jmp 0x14003606c
lea r8, [0x14013cd60]
lea rdx, str.NTDLL.DLL
lea rcx, str.RtlDosPathNameToNtPathName_U
call fcn.14005c57c
lea rdx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
call qword [0x14013cd60]
cmp eax, r13d
jne 0x14003606c
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x1400363f3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r11d, dword [rbx]
mov dword [r15], r11d
cmp rsi, r13
je 0x1400363d0
mov r9d, dword [rbx]
lea r8, str.DeviceImDisk_u
lea rcx, [rsp + 0x80]
mov edx, 0x103
mov word [rsp + 0x80], r13w
call fcn.140103198
mov word [rsp + 0x286], r13w
cmp word [rbx + 0x2c], r13w
jne 0x1400363b2
lea rdx, [rsp + 0x80]
mov rcx, rsi
call qword [0x14013d0e0]
cmp eax, r13d
jne 0x1400363d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 1
je 0x1400363ac
sub eax, 0x56
je 0x1400363ac
sub eax, edi
je 0x1400363ac
sub eax, 0x7a
je 0x1400363ac
sub eax, 0x101b
je 0x1400363ac
cmp eax, 2
jne 0x1400363ac
call fcn.140102e90
lea rdx, str.Invalid_mount_point_path:__1_ws__n
mov r8, rsi
lea rcx, [rax + 0x60]
call fcn.14001c878
mov word [rsi], r13w
jmp 0x1400363d0
lea rcx, [rsp + 0x80]
mov r9d, 1
xor r8d, r8d
mov rdx, rsi
mov byte [rsp + 0x20], r13b
call fcn.140075bfc
mov r8, qword [rsp + 0x308]
cmp r8, r13
je 0x1400363e7
mov ecx, dword [rbx]
mov rdx, rsi
call fcn.140027a48
lea rcx, [rsp + 0x50]
call fcn.14005aef8
xor eax, eax
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x290
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret