Function at 0x1401f5e94
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp + 0xf], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rbx, rdx
mov r12, rcx
xor r15d, r15d
mov edi, 0x100000
test dword [rdx + 0x18], edi
jne 0x1401f5efa
lea rdx, str.DOMStore:
mov rcx, qword [rbx + 8]
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
jne 0x1401f5efa
lea rdx, str.UserData:
mov rcx, qword [rbx + 8]
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
je 0x1401f63dc
mov rax, qword [r12 - 0x70]
mov rdx, qword [rbx + 0x10]
lea rcx, [r12 - 0x70]
call qword [rax + 0x50]
test al, al
je 0x1401f63dc
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x39], rax
mov rdx, qword [rbx + 8]
test dword [rbx + 0x18], edi
je 0x1401f5f83
lea rcx, [rbp - 0x19]
call fcn.14000cb18
nop
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x11]
call fcn.1401f1a24
nop
mov rdx, rax
lea rcx, [rbp - 0x39]
call fcn.14000c244
nop
mov rdx, qword [rbp - 0x11]
add rdx, 0xffffffffffffffe8
or rsi, 0xffffffffffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1401f5f7d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x19]
jmp 0x1401f5fa2
lea rcx, [rbp - 1]
call fcn.1401ca284
nop
mov rdx, rax
lea rcx, [rbp - 0x39]
call fcn.14000c244
nop
mov rdx, qword [rbp - 1]
or rsi, 0xffffffffffffffff
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1401f5fbc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, [r12 + 8]
lea rcx, [rbp - 0x39]
call fcn.1401f1564
test al, al
jne 0x1401f63be
mov ecx, 0x88
call fcn.1400be454
mov qword [rbp + 0x17], rax
test rax, rax
je 0x1401f5ff4
mov rdx, qword [r12 - 0x60]
mov rcx, rax
call fcn.14006de38
jmp 0x1401f5ff7
mov rax, r15
mov rdx, rax
lea rcx, [rbp - 0x49]
call fcn.1400186f8
nop
mov rdx, qword [rbx + 0x10]
mov r9, qword [rbp - 0x49]
test rdx, rdx
jne 0x1401f6016
mov ecx, r15d
jmp 0x1401f6027
xor eax, eax
mov rcx, rsi
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
lea rcx, [r9 + 0x20]
call fcn.14000c9f8
mov edx, dword [rbx + 0x28]
shl rdx, 0x20
mov eax, dword [rbx + 0x24]
or rdx, rax
mov rax, qword [rbp - 0x49]
mov qword [rax + 0x28], rdx
mov rax, qword [rbp - 0x49]
mov dword [rax + 0x30], 1
mov rdx, qword [rbx + 0x10]
lea rcx, [rbp - 0x31]
call fcn.14000cb18
nop
lea rdx, [rbp - 0x31]
lea rcx, [r12 - 0x70]
call fcn.1401f5e24
mov r14b, al
mov rdx, qword [rbp - 0x31]
add rdx, 0xffffffffffffffe8
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
add ecx, esi
test ecx, ecx
jg 0x1401f6090
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [r12 - 0x50]
cmp byte [rax + 1], r15b
jne 0x1401f6367
test r14b, r14b
je 0x1401f60c8
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
movzx r14d, r14b
cmp eax, 0xffffffff
cmove r14d, r15d
lea rcx, [r12 - 0x68]
mov rax, qword [rcx]
lea rdx, [rbp - 0x49]
call qword [rax + 0x68]
mov rdi, qword [rbp - 0x49]
mov rcx, qword [rbx + 8]
call qword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
test eax, eax
setne al
mov byte [rdi + 0x70], al
mov rax, qword [rbp - 0x49]
cmp byte [rax + 0x70], r15b
jne 0x1401f6367
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rbx + 8]
lea rcx, [rbp + 0x7f]
call fcn.140020b2c
nop
mov rcx, qword [rbp + 0x7f]
cmp dword [rcx - 0x10], r15d
jl 0x1401f6341
lea rdx, [0x140368950]
call fcn.1400c4fd4
test rax, rax
je 0x1401f6341
mov rcx, qword [rbp + 0x7f]
sub eax, ecx
cmp eax, esi
jle 0x1401f6341
mov r9d, dword [rcx - 0x10]
sub r9d, eax
mov r8d, eax
lea rdx, [rbp - 0x29]
lea rcx, [rbp + 0x7f]
call fcn.1400798b4
nop
lea rcx, [rbp + 7]
call fcn.140239840
nop
mov rdx, qword [rax]
lea rcx, [rbp + 0x77]
call fcn.140020b2c
nop
mov rdx, qword [rbp + 7]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1401f617e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbp + 0x77]
cmp dword [rax - 0x10], r15d
jne 0x1401f628e
mov rdx, qword [rbx + 0x10]
lea rcx, [rbp + 0x6f]
call fcn.140020b2c
nop
mov rcx, qword [rbp + 0x6f]
mov edx, 1
sub edx, dword [rcx - 8]
mov eax, dword [rcx - 0xc]
mov edi, 0x104
sub eax, edi
or eax, edx
jge 0x1401f61c3
mov edx, edi
lea rcx, [rbp + 0x6f]
call fcn.14002194c
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.SHLWAPI.dll_PathStripPathA]
mov rcx, qword [rbp + 0x6f]
movsxd rdx, dword [rcx - 0xc]
call fcn.1400c1c2c
test eax, eax
js 0x1401f6283
mov rcx, qword [rbp + 0x6f]
cmp eax, dword [rcx - 0xc]
jg 0x1401f6283
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbp + 0x6f]
mov byte [rcx + rax], r15b
mov rax, qword [rbp + 0x6f]
cmp dword [rax - 0x10], r15d
jl 0x1401f6267
lea rdx, [0x140368950]
mov rcx, rax
call fcn.1400c4fd4
mov rdx, rax
test rax, rax
je 0x1401f6263
mov rax, qword [rbp + 0x6f]
sub edx, eax
cmp edx, esi
jle 0x1401f6267
mov r9d, edx
xor r8d, r8d
lea rdx, [rbp - 9]
lea rcx, [rbp + 0x6f]
call fcn.1400798b4
nop
mov rdx, rax
lea rcx, [rbp + 0x77]
call fcn.1400797d4
nop
mov rdx, qword [rbp - 9]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1401f6263
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbp + 0x6f]
lea rdx, [rax - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1401f628e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1401f628e
mov ecx, 0x80070057
call fcn.14000cbb8
nop
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x21], rax
mov r9, qword [rbp - 0x29]
mov r8, qword [rbp + 0x77]
lea rdx, str.Cookie:_s_s
lea rcx, [rbp - 0x21]
call fcn.14005ac18
mov rbx, qword [rbp - 0x49]
mov rdi, qword [rbp - 0x21]
mov rcx, rdi
call qword [sym.imp.WININET.dll_DeleteUrlCacheEntryA]
test eax, eax
setne al
mov byte [rbx + 0x70], al
mov rax, qword [rbp - 0x49]
cmp byte [rax + 0x70], r15b
jne 0x1401f62e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1401f6304
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x77]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1401f6323
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x29]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1401f6341
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbp - 0x49]
mov byte [rax + 0x70], 1
mov rdx, qword [rbp + 0x7f]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1401f6367
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r14b, r14b
je 0x1401f638c
mov rax, qword [r12 - 0x50]
lea rcx, [r12 - 0x68]
lea rdx, [rbp - 0x49]
cmp byte [rax + 1], r15b
mov rax, qword [rcx]
je 0x1401f6388
call qword [rax + 0x60]
jmp 0x1401f638c
call qword [rax + reloc.OLEAUT32.dll_VarBstrFromCy]
nop
mov rdi, qword [rbp - 0x41]
test rdi, rdi
je 0x1401f63be
mov eax, esi
lock xadd dword [rdi + 8], eax
add eax, esi
jne 0x1401f63be
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, esi
lock xadd dword [rdi + 0xc], eax
add eax, esi
jne 0x1401f63be
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
nop
mov rdx, qword [rbp - 0x39]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1401f63dc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret