Function at 0x18002c96c
Capabilities:
Check if file exists

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x7b0
mov rax, qword [0x18004d040]
xor rax, rsp
mov qword [rsp + 0x7a0], rax
mov r12, r9
mov r13, r8
mov r14, rdx
mov r15, rcx
xor esi, esi
mov qword [rsp + 0xd0], rsi
mov ebx, 0x20a
mov r8d, ebx
xor edx, edx
lea rcx, [rsp + 0x380]
call sub.ucrtbase.dll_memset
mov r8d, ebx
xor edx, edx
lea rcx, [rsp + 0x170]
call sub.ucrtbase.dll_memset
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], rax
lea rdi, [rsp + 0xd0]
mov qword [rsp + 0xa0], rdi
lea eax, [rsi + 1]
mov byte [rsp + 0xa8], al
mov rcx, qword [rsp + 0x7e8]
cmp qword [r14 + 8], rsi
je 0x18002cfc5
mov r8d, eax
xor edx, edx
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
mov qword [rsp + 0x160], rax
mov rcx, qword [rsp + 0x7e8]
test rax, rax
je 0x18002cfd0
mov rsi, qword [rsp + 0x7e8]
mov r8d, 0x104
lea rdx, [rsp + 0x380]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x18002cfd5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x18
lea r8, [rsp + 0xb0]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov rcx, qword [rsp + 0x7e8]
test eax, eax
je 0x18002cfdd
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x104
mov qword [rsp + 0x38], rdx
lea rax, [rsp + 0x170]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x170]
mov qword [rsp + 0x20], rax
mov r9d, 2
lea r8, [rsp + 0x380]
xor edx, edx
call qword [sym.imp.dbghelp.dll_SymGetSymbolFileW]
test eax, eax
jne 0x18002cee2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x7e8]
cmp eax, 2
jne 0x18002cfe2
xor edx, edx
mov r8d, 0x20a
lea rcx, [rsp + 0x590]
call sub.ucrtbase.dll_memset
mov rsi, qword [rsp + 0x7e8]
mov r8d, 0x104
lea rdx, [rsp + 0x590]
lea rcx, [0x180000000]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x18002cfe9
mov edx, 0x104
lea rcx, [rsp + 0x590]
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchRemoveFileSpec]
mov rcx, qword [rsp + 0x7e8]
xor esi, esi
test eax, eax
js 0x18002cff1
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x90], xmm1
mov r8d, 4
lea rdx, str.SRV
lea rcx, [rsp + 0x80]
call fcn.180009cd4
nop
lea rdx, [rsp + 0x590]
lea rcx, [rsp + 0x80]
call fcn.1800092f4
xorps xmm0, xmm0
movups xmmword [rsp + 0xd8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xe8], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xd8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xe8], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rdx, str._symbolshttp:__msdl.microsoft.com_download_symbols
lea rcx, [rsp + 0xd8]
call fcn.1800092f4
xorps xmm0, xmm0
movups xmmword [rsp + 0xf8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x108], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xf8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x108], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rcx, [rsp + 0xd8]
call fcn.18000abfc
nop
lea rcx, [rsp + 0x80]
call fcn.18000abfc
call qword [sym.imp.dbghelp.dll_SymGetOptions]
bts eax, 0x1f
mov ecx, eax
call qword [sym.imp.dbghelp.dll_SymSetOptions]
mov dword [rsp + 0xc8], eax
xor eax, eax
mov qword [rsp + 0xe8], rax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], r15
movups xmm0, xmmword [rsp + 0x80]
movdqu xmmword [rsp + 0xd8], xmm0
mov byte [rsp + 0xe8], 1
lea rsi, [r15 + 0x10]
xor ecx, ecx
mov qword [rsp + 0x78], rcx
mov r8, qword [r13 + 0x38]
xor r13d, r13d
mov r9d, r13d
test r8, r8
je 0x18002ccd4
mov rax, qword [r8]
lea rdx, [rsp + 0x40]
mov rcx, r8
call qword [rax]
mov rcx, rax
mov qword [rsp + 0x78], rax
mov r9, rax
lea rax, [rsp + 0x40]
cmp r9, rax
je 0x18002ccf6
cmp qword [rsi + 0x38], rsi
je 0x18002ccf6
mov rcx, qword [rsi + 0x38]
mov qword [rsp + 0x78], rcx
mov qword [rsi + 0x38], r9
jmp 0x18002ce10
mov r8, r13
mov qword [rsp + reloc.COMCTL32.dll_Ordinal_344], r13
test r9, r9
je 0x18002cd64
lea rax, [rsp + 0x40]
cmp r9, rax
jne 0x18002cd51
mov rax, qword [r9]
lea rdx, [rsp + 0x120]
mov rcx, r9
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8, rax
mov qword [rsp + reloc.COMCTL32.dll_Ordinal_344], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x18002cd64
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov r8, qword [rsp + reloc.COMCTL32.dll_Ordinal_344]
jmp 0x18002cd5c
mov r8, r9
mov qword [rsp + reloc.COMCTL32.dll_Ordinal_344], r9
mov rcx, r13
mov qword [rsp + 0x78], rcx
mov r9, qword [rsi + 0x38]
test r9, r9
je 0x18002cdc2
mov rcx, r9
cmp r9, rsi
jne 0x18002cdb9
mov rax, qword [r9]
lea rdx, [rsp + 0x40]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, rax
mov qword [rsp + 0x78], rax
mov r8, qword [rsi + 0x38]
test r8, r8
je 0x18002cdaf
mov rax, qword [r8]
cmp r8, rsi
setne dl
mov rcx, r8
call qword [rax + 0x20]
mov rcx, qword [rsp + 0x78]
mov r8, qword [rsp + reloc.COMCTL32.dll_Ordinal_344]
jmp 0x18002cdbe
mov r8, qword [rsp + reloc.COMCTL32.dll_Ordinal_344]
jmp 0x18002cdc2
mov qword [rsp + 0x78], rcx
mov qword [rsi + 0x38], r13
test r8, r8
je 0x18002ce10
lea rax, [rsp + 0x120]
cmp r8, rax
jne 0x18002ce0c
mov rax, qword [r8]
mov rdx, rsi
mov rcx, r8
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rsi + 0x38], rax
mov rcx, qword [rsp + reloc.COMCTL32.dll_Ordinal_344]
test rcx, rcx
je 0x18002ce05
mov rax, qword [rcx]
lea rdx, [rsp + 0x120]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov rcx, qword [rsp + 0x78]
jmp 0x18002ce10
mov qword [rsi + 0x38], r8
test rcx, rcx
je 0x18002ce26
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
lea rcx, [r15 + 0x50]
mov r8, qword [r14 + 8]
mov rdx, qword [r14]
call fcn.180009b34
lea rsi, [rsp + 0xf8]
cmp qword [rsp + 0x110], 7
cmova rsi, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0x104
mov qword [rsp + 0x38], rdx
lea rcx, [rsp + 0x170]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rdx
lea rcx, [rsp + 0x170]
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, [rsp + 0x380]
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.dbghelp.dll_SymGetSymbolFileW]
mov rcx, qword [rsp + 0x7e8]
test eax, eax
je 0x18002cff9
mov ecx, dword [rsp + 0xc8]
call qword [sym.imp.dbghelp.dll_SymSetOptions]
lea rsi, [r15 + 0x10]
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x18002ced3
mov rax, qword [rcx]
cmp rcx, rsi
setne dl
call qword [rax + 0x20]
mov qword [rsi + 0x38], r13
lea rcx, [rsp + 0xf8]
call fcn.18000abfc
jmp 0x18002cee5
xor r13d, r13d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x380]
xor edx, edx
call qword [sym.imp.dbghelp.dll_SymLoadModuleExW]
mov rsi, rax
mov qword [rsp + 0xd0], rax
mov rcx, qword [rsp + 0x7e8]
test rax, rax
je 0x18002cfff
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x20], r12
lea r9, [0x18002d00c]
xor r8d, r8d
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.dbghelp.dll_SymEnumSymbols]
mov rcx, qword [rsp + 0x7e8]
test eax, eax
je 0x18002d004
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
mov rbx, qword [rdi]
test rbx, rbx
je 0x18002cf97
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.dbghelp.dll_SymUnloadModule64]
mov qword [rdi], r13
xor eax, eax
jmp 0x18002cfa2
mov rcx, qword [rsp + 0x7a0]
xor rcx, rsp
call fcn.180031670
add rsp, 0x7b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov edx, 0x80070057
call fcn.18000abb4
nop
call fcn.18000a760
mov rcx, rsi
call fcn.18000a760
call fcn.18000a760
mov edx, eax
call fcn.180025d58
mov rcx, rsi
call fcn.18000a760
mov edx, eax
call fcn.18000abb4
nop
call fcn.18000a760
nop
call fcn.18000a760
call fcn.18000a760
int3