Function at 0x12881490
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x1d0
mov qword [rsp + 0x98], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x12a52ee0]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov r13, rcx
mov eax, dword [0x129ade28]
xor r14d, r14d
test eax, eax
je 0x128819a1
mov rbx, qword [0x129abc80]
test rbx, rbx
jne 0x1288150f
lea rcx, [0x129b4df0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.LdrEnumerateLoadedModules
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [0x129abc80], rax
test rbx, rbx
je 0x128819a1
mov qword [rsp + 0x120], r14
xor eax, eax
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x150], 7
mov qword [rsp + 0x148], r14
mov word [rsp + 0x138], r14w
lea ecx, [rax + 8]
call fcn.12958d80
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x1288156e
lea rcx, [rsp + 0x158]
mov qword [rax], rcx
jmp 0x12881571
mov rax, r14
mov qword [rsp + 0x158], rax
lea rcx, [rsp + 0x158]
call fcn.12828770
mov qword [rsp + 0x180], rax
mov qword [rsp + 0x188], r14
mov qword [rsp + 0x1b0], 7
mov qword [rsp + 0x1a8], r14
mov word [rsp + 0x198], r14w
lea r8, [rsp + 0x120]
lea rdx, [0x128610b0]
xor ecx, ecx
call rbx
mov rsi, qword [r13]
test rsi, rsi
je 0x12881640
mov rbp, qword [rsi + 0x30]
test rbp, rbp
je 0x12881640
mov r12, qword [rsp + 0x180]
lea rax, [rsp + 0x158]
cmp rax, rsi
je 0x12881640
mov rdi, qword [rsi + 0x28]
mov rbx, qword [rdi]
mov rdx, rbp
lea rcx, [rsp + 0x158]
call fcn.1283f480
sub qword [rsi + 0x30], rbp
mov rax, qword [rbx + 8]
mov qword [rax], rdi
mov rax, qword [rdi + 8]
mov qword [rax], r12
mov rax, qword [r12 + 8]
mov qword [rax], rbx
mov rcx, qword [r12 + 8]
mov rax, qword [rdi + 8]
mov qword [r12 + 8], rax
mov rax, qword [rbx + 8]
mov qword [rdi + 8], rax
mov qword [rbx + 8], rcx
nop dword [rax + rax]
cmp qword [rsp + 0x188], 0
je 0x12881994
mov dword [rsp + 0x74], r14d
mov dword [rsp + 0x70], r14d
mov dword [rsp + 0x88], r14d
mov qword [rsp + 0x90], r14
mov qword [rsp + 0xc0], 7
mov qword [rsp + 0xb8], r14
mov word [rsp + 0xa8], r14w
mov qword [rsp + 0xe8], 7
mov qword [rsp + 0xe0], r14
mov word [rsp + 0xd0], r14w
mov qword [rsp + 0x110], 7
mov qword [rsp + 0x108], r14
mov word [rsp + 0xf8], r14w
mov r12, qword [rsp + 0x180]
mov rbx, qword [r12]
mov rdi, qword [rsp + 0x158]
test rdi, rdi
je 0x128816de
cmp rdi, rdi
je 0x128816e3
call fcn.1295850c
cmp rbx, r12
je 0x128818f5
test rdi, rdi
jne 0x128816fb
call fcn.1295850c
mov r11, r14
jmp 0x128816fe
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x28]
jne 0x12881709
call fcn.1295850c
cmp qword [rbx + 0x40], 8
jb 0x12881716
mov rcx, qword [rbx + 0x28]
jmp 0x1288171a
lea rcx, [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x128818d0
mov dword [rsp + 0x84], r14d
mov dword [rsp + 0x80], r14d
lea rcx, [rsp + 0xa0]
call fcn.12803f90
lea rcx, [rsp + 0xc8]
call fcn.12803f90
lea rcx, [rsp + 0xf0]
call fcn.12803f90
cmp qword [rbx + 0x40], 8
jb 0x1288176d
mov rbp, qword [rbx + 0x28]
jmp 0x12881771
lea rbp, [rbx + 0x28]
mov esi, dword [rbx + 0x38]
mov qword [rsp + 0x78], r14
mov rdx, rsi
lea r8, [rsp + 0x78]
mov rcx, rbp
call fcn.12826020
cmp eax, 0x10
je 0x12881793
cmp eax, 8
jne 0x128817a6
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x128817a6
sub rax, rbp
mov rsi, rax
sar rsi, 1
lea rax, [rsp + 0x84]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x60], 1
lea rax, [rsp + 0x90]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x50], rax
mov byte [rsp + 0x48], 1
lea rax, [rsp + 0x74]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x80]
mov r8d, esi
mov rdx, rbp
lea rcx, [0x129acba0]
call fcn.1286cab0
test eax, eax
je 0x128818d0
mov rax, qword [rsp + 0xb8]
cmp qword [rsp + 0xe0], rax
jne 0x12881886
lea rdx, [rsp + 0xa8]
cmp qword [rsp + 0xc0], 8
cmovae rdx, qword [rsp + 0xa8]
lea rcx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 8
cmovae rcx, qword [rsp + 0xd0]
call fcn.1295a6e4
test eax, eax
je 0x128818d0
cmp dword [rsp + 0x70], 0
jne 0x128818d0
mov qword [rsp + 0x48], r14
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r14d
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x20], eax
mov r9d, 0x801200a9
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0xc8]
lea rcx, [0x129acba0]
call fcn.1287ee40
test rdi, rdi
jne 0x128818df
call fcn.1295850c
mov r11, r14
jmp 0x128818e2
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x28]
jne 0x128818ed
call fcn.1295850c
mov rbx, qword [rbx]
jmp 0x128816d4
cmp qword [rsp + 0x110], 8
jb 0x1288190d
mov rcx, qword [rsp + 0xf8]
call fcn.12958250
mov qword [rsp + 0x110], 7
mov qword [rsp + 0x108], r14
mov word [rsp + 0xf8], r14w
cmp qword [rsp + 0xe8], 8
jb 0x12881942
mov rcx, qword [rsp + 0xd0]
call fcn.12958250
mov qword [rsp + 0xe8], 7
mov qword [rsp + 0xe0], r14
mov word [rsp + 0xd0], r14w
cmp qword [rsp + 0xc0], 8
jb 0x12881977
mov rcx, qword [rsp + 0xa8]
call fcn.12958250
mov qword [rsp + 0xc0], 7
mov qword [rsp + 0xb8], r14
mov word [rsp + 0xa8], r14w
lea rcx, [rsp + 0x120]
call fcn.1285cac0
mov rbx, qword [r13]
mov qword [rsp + 0x90], rbx
test rbx, rbx
je 0x128819dd
mov rcx, rbx
call fcn.1284b340
mov rcx, qword [rbx + 0x28]
call fcn.12958250
mov qword [rbx + 0x28], r14
mov rcx, qword [rbx]
call fcn.12958250
mov rcx, rbx
call fcn.12958250
mov qword [r13], r14
jmp 0x128819e1
mov qword [r13], r14
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.12959850
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret