Function at 0x14000dac0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x310
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x140036080]
xor rax, rsp
mov qword [rsp + 0x300], rax
mov rbx, rdx
mov qword [r11 - 0x278], rdx
mov rdx, qword [rdx + 0x18]
test rdx, rdx
je 0x14000db29
cmp qword [rbx + 0x20], 8
jb 0x14000db0e
mov rax, qword [rbx + 8]
jmp 0x14000db12
lea rax, [rbx + 8]
cmp word [rax + rdx*2 - 2], 0x5c
jne 0x14000db29
dec rdx
or r8, 0xffffffffffffffff
mov rcx, rbx
call fcn.140008370
mov qword [rsp + 0x98], 7
xor esi, esi
mov qword [rsp + 0x90], rsi
mov word [rsp + 0x80], si
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.140008210
nop
lea r8d, [rsi + 0x16]
lea rdx, str.System32Kernel32.dll
lea rcx, [rsp + 0x78]
call fcn.14000fdd0
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], rsi
mov word [rsp + 0x58], si
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140008210
nop
lea r8d, [rsi + 0x19]
lea rdx, str.System32configSOFTWARE
lea rcx, [rsp + 0x50]
call fcn.14000fdd0
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rsi
mov word [rsp + 0x30], si
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140008210
nop
lea r8d, [rsi + 0x17]
lea rdx, str.System32configSYSTEM
lea rcx, [rsp + 0x28]
call fcn.14000fdd0
lea rdi, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdi, qword [rsp + 0x58]
mov rcx, rdi
call qword [0x14002e0f8]
cmp eax, 0xffffffff
jne 0x14000dc35
lea rdx, [rsp + 0xb0]
mov rcx, rdi
call qword [0x14002e258]
cmp rax, 0xffffffffffffffff
je 0x14000dd28
mov rcx, rax
call qword [0x14002e158]
mov eax, dword [rsp + 0xb0]
cmp eax, 0xffffffff
je 0x14000dd28
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
call fcn.140018e40
test al, al
je 0x14000dd28
lea rcx, [rsp + 0x80]
cmp qword [rsp + 0x98], 8
cmovae rcx, qword [rsp + 0x80]
call fcn.140018e40
test al, al
je 0x14000dd28
cmp qword [rsp + 0x48], 8
jb 0x14000dc95
mov rcx, qword [rsp + 0x30]
call fcn.14001b8a4
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rsi
mov word [rsp + 0x30], si
cmp qword [rsp + 0x70], 8
jb 0x14000dcba
mov rcx, qword [rsp + 0x58]
call fcn.14001b8a4
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], rsi
mov word [rsp + 0x58], si
cmp qword [rsp + 0x98], 8
jb 0x14000dce5
mov rcx, qword [rsp + 0x80]
call fcn.14001b8a4
mov qword [rsp + 0x98], 7
mov qword [rsp + 0x90], rsi
mov word [rsp + 0x80], si
cmp qword [rbx + 0x20], 8
jb 0x14000dd11
mov rcx, qword [rbx + 8]
call fcn.14001b8a4
mov qword [rbx + 0x20], 7
mov qword [rbx + 0x18], rsi
mov word [rbx + 8], si
mov al, 1
jmp 0x14000ddc8
cmp qword [rsp + 0x48], 8
jb 0x14000dd3a
mov rcx, qword [rsp + 0x30]
call fcn.14001b8a4
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rsi
mov word [rsp + 0x30], si
cmp qword [rsp + 0x70], 8
jb 0x14000dd5f
mov rcx, qword [rsp + 0x58]
call fcn.14001b8a4
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], rsi
mov word [rsp + 0x58], si
cmp qword [rsp + 0x98], 8
jb 0x14000dd8a
mov rcx, qword [rsp + 0x80]
call fcn.14001b8a4
mov qword [rsp + 0x98], 7
mov qword [rsp + 0x90], rsi
mov word [rsp + 0x80], si
cmp qword [rbx + 0x20], 8
jb 0x14000ddb6
mov rcx, qword [rbx + 8]
call fcn.14001b8a4
mov qword [rbx + 0x20], 7
mov qword [rbx + 0x18], rsi
mov word [rbx + 8], si
xor al, al
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.14001b530
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret