Function at 0x1400dcd90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xd8
movaps xmmword [rsp + 0xc0], xmm6
mov rax, qword [0x140430040]
xor rax, rsp
mov qword [rsp + 0xb8], rax
movabs rbx, 0x8000000000000054
movabs r14, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x70], r14
movaps xmm6, xmmword [0x1403d4b30]
movaps xmmword [rsp + 0x60], xmm6
lea rcx, str.LOCALAPPDATA
call fcn.14028db3c
test rax, rax
lea rsi, [0x1403db93a]
cmovne rsi, rax
mov rcx, rsi
call fcn.14029c474
mov rdi, rax
lea rax, [rbx - 0x5d]
cmp rdi, rax
ja 0x1400dd45f
cmp rdi, 0xa
jbe 0x1400dcf7e
mov rax, rdi
or rax, 3
lea rcx, [rax + 1]
cmp rax, 0xb
mov r15d, reloc.WS2_32.dll_listen
cmovne r15, rcx
test r15, r15
js 0x1400dd45a
lea rcx, [r15 + r15]
call fcn.14027768c
mov rcx, rax
mov qword [rsp + 0xa0], rax
lea rax, [rbx + r15]
add rax, 0xffffffffffffffac
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xa8], rdi
lea r15, [rcx + rdi*2]
cmp rsi, rcx
setb al
cmp rsi, r15
setae dl
or dl, al
je 0x1400dd458
test rdi, rdi
je 0x1400dce94
add rdi, rdi
mov rdx, rsi
mov r8, rdi
call fcn.1402b6370
mov word [r15], 0
movsx rsi, byte [rsp + 0xb7]
test rsi, rsi
jns 0x1400dd038
lea rdx, [rbx - 0x55]
and rdx, qword [rsp + 0xb0]
dec rdx
mov rsi, qword [rsp + 0xa8]
mov rax, rdx
sub rax, rsi
cmp rax, 0x25
jb 0x1400dcf94
mov rdi, qword [rsp + 0xa0]
lea rcx, [rdi + rsi*2]
lea rax, [rdi + rsi*2]
add rax, 0x4a
lea rdx, str.OneStart.aiOneStartApplicationBar
cmp rcx, rdx
seta r8b
cmp rax, rdx
setbe al
or al, r8b
je 0x1400dd458
lea rdx, str.OneStart.aiOneStartApplicationBar
mov r8d, Ordinal_79
call fcn.1402b6370
add rsi, 0x25
mov qword [rsp + 0xa8], rsi
mov word [rdi + rsi*2], 0
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x70], rax
movaps xmm0, xmmword [rsp + 0xa0]
movaps xmmword [rsp + 0x60], xmm0
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], 0
cmp byte [rsp + 0xb7], 0
jns 0x1400dcf70
mov rcx, qword [rsp + 0xa0]
call fcn.1402776c8
cmp byte [rsp + 0x77], 0
js 0x1400dcfd6
lea rcx, [rsp + 0x60]
jmp 0x1400dcfdb
lea rcx, [rsp + 0xa0]
mov byte [rcx + 0x17], dil
jmp 0x1400dce69
mov edx, 0xa
mov r8, rsi
sub r8, rdx
add r8, 0x25
lea rax, str.OneStart.aiOneStartApplicationBar
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], Ordinal_41
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0xa0]
mov r9, rsi
call fcn.14020a830
jmp 0x1400dcf28
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
sete cl
test al, 0x10
sete al
or al, cl
je 0x1400dd09e
cmp byte [rsp + 0x77], 0
jns 0x1400dd005
mov rcx, qword [rsp + 0x60]
call fcn.1402776c8
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
cmp rcx, qword [0x140430040]
je 0x1400dd01f
call fcn.140278ca0
int3
movaps xmm6, xmmword [rsp + 0xc0]
add rsp, 0xd8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
cmp sil, 0xb
jb 0x1400dcf8f
lea rcx, [rsp + rsi*2]
add rcx, 0xa0
lea rax, [rsp + rsi*2]
add rax, 0xea
lea rdx, str.OneStart.aiOneStartApplicationBar
cmp rcx, rdx
setbe r8b
cmp rax, rdx
seta al
test r8b, al
jne 0x1400dd458
lea rdx, str.OneStart.aiOneStartApplicationBar
mov r8d, Ordinal_79
call fcn.1402b6370
add rsi, 0x25
mov eax, esi
and al, 0x7f
lea rdi, [rsp + 0xa0]
mov byte [rdi + 0x17], al
jmp 0x1400dcf22
mov ecx, 0xa8
call fcn.14027768c
mov rsi, rax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xa8], 0x53
add rax, 0xa6
lea rcx, str.reg_delete__HKCUSOFTWAREMicrosoftWindowsCurrentVersionRun___v__OneStartBar___f
cmp rsi, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x1400dd458
lea rdx, str.reg_delete__HKCUSOFTWAREMicrosoftWindowsCurrentVersionRun___v__OneStartBar___f
mov r8d, Ordinal_167
mov rcx, rsi
call fcn.1402b6370
mov word [rsi + 0xa6], 0
lea rsi, [rsp + 0xa0]
mov rcx, rsi
xor edx, edx
call fcn.1400dd470
cmp byte [rsi + 0x17], 0
jns 0x1400dd12b
mov rcx, qword [rsp + 0xa0]
call fcn.1402776c8
mov ecx, 0xa8
call fcn.14027768c
mov rsi, rax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xa8], 0x51
add rax, 0xa2
lea rcx, str.__LOCALAPPDATA_OneStart.aiOneStartApplicationBar_binDBar.exe___dereg
cmp rsi, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x1400dd458
lea rdx, str.__LOCALAPPDATA_OneStart.aiOneStartApplicationBar_binDBar.exe___dereg
mov r8d, Ordinal_167
mov rcx, rsi
call fcn.1402b6370
mov word [rsi + 0xa2], 0
lea rsi, [rsp + 0xa0]
mov rcx, rsi
mov edx, 0x3e8
call fcn.1400dd470
cmp byte [rsi + 0x17], 0
jns 0x1400dd1bb
mov rcx, qword [rsp + 0xa0]
call fcn.1402776c8
mov edi, 8
lea r15, [rbx - 0x3c]
lea r12, str.taskkill__im_DBar.exe
lea rsi, [rsp + 0xa0]
jmp 0x1400dd1ea
mov rcx, qword [rsp + 0xa0]
call fcn.1402776c8
dec edi
je 0x1400dd26e
mov ecx, 0x30
call fcn.14027768c
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xb0], r15
mov qword [rsp + 0xa8], reloc.WS2_32.dll_setsockopt
lea rcx, [rax + 0x2a]
cmp rax, r12
seta dl
cmp rcx, r12
setbe cl
or cl, dl
je 0x1400dd458
movups xmm0, xmmword [0x1403df8f8]
movups xmmword [rax + 0x1a], xmm0
movups xmm0, xmmword [0x1403df8ee]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str.taskkill__im_DBar.exe]
movups xmmword [rax], xmm0
mov word [rax + 0x2a], 0
mov rcx, rsi
mov edx, 0x64
call fcn.1400dd470
cmp byte [rsp + 0xb7], 0
jns 0x1400dd1e2
jmp 0x1400dd1d5
mov ecx, gethostname
call fcn.14027768c
mov qword [rsp + 0xa0], rax
lea rcx, [rbx - 0x38]
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xa8], Ordinal_27
lea rcx, [rax + 0x30]
lea rdx, str.taskkill__f__im_DBar.exe
cmp rax, rdx
seta r8b
cmp rcx, rdx
setbe cl
or cl, r8b
je 0x1400dd458
movups xmm0, xmmword [0x1403df92a]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [0x1403df91a]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str.taskkill__f__im_DBar.exe]
movups xmmword [rax], xmm0
mov word [rax + 0x30], 0
lea rsi, [rsp + 0xa0]
mov rcx, rsi
mov edx, 0x64
call fcn.1400dd470
cmp byte [rsi + 0x17], 0
jns 0x1400dd307
mov rcx, qword [rsp + 0xa0]
call fcn.1402776c8
mov qword [rsp + 0xb0], r14
movaps xmmword [rsp + 0xa0], xmm6
mov rcx, rsi
call fcn.1400d8b80
mov qword [rsp + 0x90], r14
movaps xmmword [rsp + 0x80], xmm6
movsx r9, byte [rsp + 0xb7]
test r9, r9
jns 0x1400dd34d
mov rsi, qword [rsp + 0xa0]
mov r9, qword [rsp + 0xa8]
lea r8, [rsi + r9]
lea rdi, [rsp + 0x80]
mov rcx, rdi
mov rdx, rsi
call fcn.1402d70a0
lea rdx, [0x1403e051c]
lea rcx, [rsp + 0x48]
mov r8, rdi
call fcn.1400c9e20
cmp byte [rdi + 0x17], 0
jns 0x1400dd38b
mov rcx, qword [rsp + 0x80]
call fcn.1402776c8
cmp byte [rsp + 0xb7], 0
jns 0x1400dd3a2
mov rcx, qword [rsp + 0xa0]
call fcn.1402776c8
lea rsi, [rsp + 0x48]
mov rcx, rsi
call fcn.1400dd7a0
cmp byte [rsi + 0x17], 0
jns 0x1400dd3bf
mov rcx, qword [rsp + 0x48]
call fcn.1402776c8
mov ecx, 0x88
call fcn.14027768c
mov rsi, rax
mov qword [rsp + 0xa0], rax
add rbx, 0xfffffffffffffff0
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xa8], Ordinal_73
add rax, 0x82
lea rcx, str.rmdir___LOCALAPPDATA_OneStart.aiOneStartApplicationBar___s__q
cmp rsi, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x1400dd458
lea rdx, str.rmdir___LOCALAPPDATA_OneStart.aiOneStartApplicationBar___s__q
mov r8d, Ordinal_133
mov rcx, rsi
call fcn.1402b6370
mov word [rsi + 0x82], 0
lea rsi, [rsp + 0xa0]
mov rcx, rsi
mov edx, 0x64
call fcn.1400dd470
cmp byte [rsi + 0x17], 0
jns 0x1400dcff4
mov rcx, qword [rsp + 0xa0]
call fcn.1402776c8
jmp 0x1400dcff4
ud2
call fcn.1402b9a10
lea rcx, [rsp + 0xa0]
call fcn.1402b99d0
int3