Function at 0x100067800
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x970
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x960], rax
xor r14d, r14d
mov r12, r8
mov rbp, rdx
mov rdi, rcx
mov ebx, r14d
cmp dword [rcx + 0x64], r14d
je 0x100067844
mov eax, 0x800704c7
jmp 0x100067a59
cmp rdx, r14
je 0x100067a39
cmp r8, r14
je 0x100067a39
cmp qword [rcx + 0x58], r14
jne 0x10006790c
cmp dword [rcx + 0x68], r14d
je 0x1000678ea
xor edx, edx
lea rax, [rsp + 0x48]
lea r9, [0x1000061e0]
lea rcx, [0x1000061f0]
lea r8d, [rdx + 1]
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, r14d
jl 0x1000678c6
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + 0x68]
cmp eax, r14d
jl 0x1000678c6
test byte [rsp + 0x40], 0x40
jne 0x1000678c1
bt dword [rsp + 0x40], 0xa
jae 0x1000678c6
mov ebx, 1
mov rcx, qword [rsp + 0x48]
cmp rcx, r14
je 0x1000678d6
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp ebx, r14d
je 0x1000678ea
lea rcx, [rdi + 0x58]
xor edx, edx
call fcn.100070e08
mov ebx, eax
jmp 0x1000678ef
mov ebx, 0xc00d0bca
cmp qword [rdi + 0x58], r14
jne 0x10006790c
mov eax, 0x80004005
cmp ebx, r14d
lea rdx, [0x10002dc58]
cmovge ebx, eax
jmp 0x100067a4a
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], r14
or r9d, 0xffffffff
mov r8, r12
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x105
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x160]
mov qword [rsp + 0x30], r14
or r9d, 0xffffffff
mov r8, rbp
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x800
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, 0x64
mov dword [rdi + 0x60], 1
mov qword [rdi + 0x50], rax
call fcn.100051b44
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rdi + 0x48], eax
cmp qword [rdi + 0x50], r14
je 0x100067a3e
mov rcx, qword [rdi + 0x58]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov rax, qword [rcx]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x160]
mov r9d, 2
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 0x8000080
call qword [rax + 0x28]
cmp eax, r14d
mov ebx, eax
jl 0x100067a0a
jmp 0x100067a04
mov rcx, qword [rdi + 0x50]
mov edx, 0x258
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x100067a0a
cmp dword [rdi + 0x60], r14d
je 0x100067a0a
mov rcx, rdi
call fcn.100067440
mov ebx, eax
cmp qword [rdi + 0x50], r14
jne 0x1000679de
lea rax, [rsp + 0x50]
cmp rax, r14
je 0x100067a2d
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x100067a2d
test al, 0x10
jne 0x100067a2d
cmp ebx, r14d
jge 0x100067a57
cmp ebx, r14d
jl 0x100067a43
mov ebx, 0x80070002
jmp 0x100067a43
mov ebx, 0x80070057
cmp ebx, r14d
jge 0x100067a57
lea rdx, [0x10002dc80]
mov r8d, ebx
mov ecx, 4
call fcn.1000527f4
mov eax, ebx
mov rcx, qword [rsp + 0x960]
xor rcx, rsp
call fcn.10007fa70
mov rbx, qword [rsp + 0x9b8]
add rsp, 0x970
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret