Function at 0x18001eb84
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x60
and qword [rax - 0x28], 0
mov rdi, rdx
mov rsi, rcx
mov rbx, 0xffffffff80000001
lea rdx, [0x180036327]
lea r8, [rax - 0x18]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x18001edf6
mov r8, qword [0x180033e60]
mov rcx, qword [rsp + 0x50]
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x88]
lea r9, [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.1800213b0
test eax, eax
je 0x18001ed84
test rdi, rdi
jne 0x18001ed75
mov rdx, qword [0x180033b20]
lea r8, [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x18001ed6e
mov r8, qword [0x180033e60]
mov rcx, qword [rsp + 0x48]
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x88]
lea r9, [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.1800213b0
test eax, eax
je 0x18001ed14
mov ebx, dword [rsi + 0x40]
mov rcx, qword [rsi + 0x38]
lea edx, [rbx + 0x104]
call fcn.18000715c
test rax, rax
mov rdi, rax
je 0x18001ed0d
lea rbp, [rax + rbx*2 + 2]
mov word [rax + rbx*2], 0x5c
mov rdx, qword [0x180033e68]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x180037ea8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, rdi
xor ebx, ebx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18001ecec
mov rdx, qword [0x180033e68]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x180037ef0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18001ed61
lea rdx, [0x18003774d]
mov rcx, rdi
call fcn.180003d54
jmp 0x18001ecf6
xor edx, edx
mov rcx, rdi
call fcn.18000715c
test rax, rax
mov rbx, rax
je 0x18001ed61
mov edx, 1
mov rcx, rax
call fcn.1800206d8
jmp 0x18001ed61
mov rbx, qword [rsp + 0x40]
jmp 0x18001ed61
mov rax, qword [0x180033e68]
mov rbx, qword [rsp + 0x40]
mov r9, qword [0x180033e70]
mov r8, qword [0x180033e60]
lea rdx, [rsp + 0x88]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.18001f74c
test eax, eax
jne 0x18001ed61
mov rcx, qword [0x1800339a8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18001ed94
mov rbx, qword [rsp + 0x40]
jmp 0x18001ede7
xor edx, edx
mov rcx, rdi
call fcn.18000715c
mov rbx, rax
jmp 0x18001ed94
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.180008398
mov rdi, rax
test rdi, rdi
je 0x18001ede7
and qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x18001edd1
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18001edd5
mov qword [rsi + 0x28], rax
mov rcx, qword [0x1800339a8]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x50]
mov qword [rsi + 0x30], rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret