Function at 0x18000f730
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x8820]
mov eax, 0x8920
call fcn.180066fc0
sub rsp, rax
imul eax, edx, 0x215
mov r8d, edx
mov rbx, rcx
mov r12d, edx
mov dword [rsp + 0x60], eax
cmp edx, eax
ja 0x18000fe73
mov rdi, qword [rbp + 0x8870]
movabs rdx, 0x7fffffffffffffff
mov r13, qword [rbp + 0x8870]
movabs r9, 0x616d6759514e5155
cmp r12d, 0xb7c
ja 0x18000fb8d
je 0x18000fe73
cmp r12d, 0x103
ja 0x18000f994
je 0x18000feb6
cmp r12d, 0x25
je 0x18000f87c
cmp r12d, 0x31
je 0x18000f81a
cmp r12d, 0x46
jne 0x18000fe61
mov r9d, 0xdd
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.18000d1a0
xor r8d, r8d
test al, al
je 0x18000fe93
lea edx, [r12 + 0x4d]
mov rcx, rbx
call fcn.1800499e0
mov r8d, dword [rbp + 0x8868]
movabs rdx, 0x7fffffffffffffff
mov byte [rsp + 0x68], al
jmp 0x18000fe61
xor edx, edx
lea rcx, [rbp + 0x4820]
mov r8d, 0x4000
call fcn.180069450
mov r8d, 0x4000
lea rdx, [rbp + 0x4820]
lea rcx, [rbp + 0x820]
call fcn.180069040
lea r8, str.SNAPSHOT:__s_Deleted_directory:___s
mov qword [rsp + 0x58], rdi
lea rdx, [0x180098954]
lea rcx, [rbp + 0x820]
call fcn.180040db0
mov r8d, dword [rbp + 0x8868]
movabs rdx, 0x7fffffffffffffff
jmp 0x18000fe61
mov r15, qword [rbx + 0x10]
cmp r15, 0x40
ja 0x18000fe61
mov r14, qword [rbx + 0x18]
cmp r14, 0x3f
ja 0x18000fe61
mov ecx, 0x40
mov rax, rdx
sub rcx, r15
sub rax, r15
cmp rax, rcx
jb 0x180010001
mov rcx, r14
mov rax, rdx
shr rcx, 1
sub rax, rcx
cmp r14, rax
jbe 0x18000f8c5
mov rdi, rdx
jmp 0x18000f8d5
lea rax, [rcx + r14]
mov edi, 0x4f
cmp rax, rdi
cmova rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x18000f90e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180010007
mov rcx, rax
call fcn.180066be4
test rax, rax
je 0x18001000d
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x18000f91f
test rcx, rcx
je 0x18000f91d
call fcn.180066be4
mov rsi, rax
jmp 0x18000f91f
xor esi, esi
mov qword [rbx + 0x10], 0x40
lea r8, [r15 + 1]
mov qword [rbx + 0x18], rdi
mov rcx, rsi
cmp r14, 0x10
jb 0x18000f980
mov rdi, qword [rbx]
mov rdx, rdi
call fcn.180069040
lea rdx, [r14 + 1]
cmp rdx, 0x1000
jb 0x18000f96c
mov rcx, qword [rdi - 8]
add rdx, 0x27
sub rdi, rcx
lea rax, [rdi - 8]
cmp rax, 0x1f
ja 0x18001000d
mov rdi, rcx
mov rcx, rdi
call fcn.180066c20
mov qword [rbx], rsi
mov qword [rbx + 0x10], r15
jmp 0x18000fe22
mov rdx, rbx
call fcn.180069040
mov qword [rbx], rsi
mov qword [rbx + 0x10], r15
jmp 0x18000fe22
cmp r12d, 0x612
je 0x18000fa9c
cmp r12d, 0x80a
jne 0x18000fe61
mov dword [rbp + 0x8870], 1
lea rcx, [rbp + 0x820]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x18000f9c6
mov dword [rbp + 0x8878], eax
lea r9, [rbp + 0x2a0]
lea rax, [rbp + 0x820]
mov r8d, 0x4f
lea rdx, [rbp + 0x8870]
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x8878]
call fcn.18000c5c0
mov rax, qword [rbp + 0x810]
lea r8, [rbp + 0x20]
mov r9, qword [rbp + 0x808]
lea rdx, [rbp + 0x8878]
mov qword [rbp + 0x8870], rax
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x40], 0xae
lea rax, [rbp - 0x50]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x8870]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x8878], 0x64
mov qword [rsp + 0x70], 0x64
call fcn.180034d90
inc dword [0x1800bb644]
mov r13, rax
cmp rax, qword [rbp + 0x810]
jae 0x18000fff5
mov r8d, dword [rbp + 0x8868]
movabs rdx, 0x7fffffffffffffff
jmp 0x18000fe61
mov dil, 0x61
nop
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x18000facc
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18000fac1
mov rax, qword [rbx]
mov byte [rax + rcx], dil
mov byte [rax + rcx + 1], 0
jmp 0x18000fadf
xor r8d, r8d
movzx r9d, dil
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.1800027a0
inc dil
cmp dil, 0x7a
jbe 0x18000faa0
mov dil, 0x41
nop dword [rax + rax]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x18000fb1c
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18000fb11
mov rax, qword [rbx]
mov byte [rax + rcx], dil
mov byte [rax + rcx + 1], 0
jmp 0x18000fb2f
xor r8d, r8d
movzx r9d, dil
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.1800027a0
inc dil
cmp dil, 0x5a
jbe 0x18000faf0
mov dil, 0x30
nop dword [rax + rax]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x18000fb6c
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18000fb61
mov rax, qword [rbx]
mov byte [rax + rcx], dil
mov byte [rax + rcx + 1], 0
jmp 0x18000fb7f
xor r8d, r8d
movzx r9d, dil
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.1800027a0
inc dil
cmp dil, 0x39
jbe 0x18000fb40
jmp 0x18000fe22
cmp r12d, 0x1f95
ja 0x18000fe3c
je 0x18000fd91
cmp r12d, 0xbff
je 0x18000fcf1
cmp r12d, 0xfe3
je 0x18000fc26
cmp r12d, 0x17bc
jne 0x18000fe61
mov eax, dword [0x1800bb644]
inc eax
mov dword [0x1800bb644], eax
cmp r13, qword [rbp + 0x810]
jae 0x18000fff5
inc eax
mov dword [0x1800bb644], eax
test r13, r13
je 0x18000fff5
inc eax
cmp qword [rsp + 0x50], 0xa
mov dword [0x1800bb644], eax
je 0x18000fe61
mov rcx, qword [rsp + 0x50]
xorps xmm1, xmm1
test rcx, rcx
js 0x18000ff92
movsd xmm2, qword [0x1800a17f0]
cvtsi2sd xmm1, rcx
jmp 0x18000ffdf
mov eax, dword [0x1800bb644]
inc eax
mov dword [0x1800bb644], eax
test r13, r13
je 0x18000fff5
inc eax
cmp qword [rsp + 0x50], 0xa
mov dword [0x1800bb644], eax
jne 0x18000fc03
mov rcx, qword [rsp + 0x58]
inc eax
mov dword [0x1800bb644], eax
cmp qword [rcx], r9
jne 0x18000ffb1
cmp word [rcx + 8], 0x7755
jne 0x18000ffb1
mov rax, qword [rbp + 0x810]
lea r8, [rbp + 0x20]
mov r9, qword [rbp + 0x808]
lea rdx, [rbp - 0x80]
sub rax, r13
mov dword [rsp + 0x40], 0xae
mov qword [rsp + 0x78], rax
lea rcx, [rbp - 0x78]
lea rax, [rbp - 0x50]
mov qword [rbp - 0x80], 0x64
mov qword [rsp + 0x38], rax
add r9, r13
lea rax, [rsp + 0x78]
mov qword [rbp - 0x78], 0x64
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
call fcn.180034d90
mov r8d, dword [rbp + 0x8868]
mov r13, rax
movabs rdx, 0x7fffffffffffffff
jmp 0x18000fe61
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x18000fd1a
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18000fd12
mov rax, qword [rbx]
mov word [rax + rcx], 0x2d
jmp 0x18000fd33
xor r8d, r8d
mov r9b, 0x2d
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.1800027a0
mov r8d, dword [rbp + 0x8868]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x18000fd69
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18000fd54
mov rax, qword [rbx]
mov word [rax + rcx], 0x5f
movabs rdx, 0x7fffffffffffffff
jmp 0x18000fe61
xor r8d, r8d
mov r9b, 0x5f
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.1800027a0
mov r8d, dword [rbp + 0x8868]
movabs rdx, 0x7fffffffffffffff
jmp 0x18000fe61
mov rdi, qword [rsp + 0x58]
lea rdx, str.file2_data
mov r8, qword [rsp + 0x50]
mov rcx, rdi
inc dword [0x1800bb644]
call fcn.180068f40
test eax, eax
jne 0x18000ffc0
mov rax, qword [rbp + 0x810]
lea r8, [rbp + 0x20]
mov r9, qword [rbp + 0x808]
lea rdx, [rbp - 0x68]
sub rax, r13
mov dword [rsp + 0x40], 0xae
mov qword [rbp - 0x70], rax
lea rcx, [rbp - 0x60]
lea rax, [rbp - 0x50]
mov qword [rbp - 0x68], 0x64
mov qword [rsp + 0x38], rax
add r9, r13
lea rax, [rbp - 0x70]
mov qword [rbp - 0x60], 0x64
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
call fcn.180034d90
mov r13, rax
mov rdi, qword [rbp + 0x8870]
movabs rdx, 0x7fffffffffffffff
mov r8d, dword [rbp + 0x8868]
jmp 0x18000fe61
cmp r12d, 0x276e
je 0x18000fe52
cmp r12d, 0x2f47
jne 0x18000fe61
xor eax, eax
jmp 0x18000fe78
inc dword [0x1800bb644]
test r13, r13
jne 0x18000fff5
imul eax, r8d, 0x29
add r12d, eax
cmp r12d, dword [rsp + 0x60]
jbe 0x18000f78c
mov rax, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x8960]
add rsp, 0x8920
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x28], 0
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rbx
mov ecx, 0x98
call fcn.180016990
mov byte [rsp + 0x68], al
jmp 0x18000fe73
xor edi, edi
test rbx, rbx
jne 0x18000fecc
mov ecx, 0xa0
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
jmp 0x18000fe78
mov ecx, 0x360
call fcn.18006d050
mov rdi, rax
test rax, rax
jne 0x18000feec
lea ecx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
jmp 0x18000fe78
lea rax, [rbp + 0x90]
mov qword [rsp + 0x28], rbx
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor edx, edx
mov qword [rbp + 0x8870], 0x104
mov r8d, 0x137
lea rcx, [rbp + 0x8870]
call fcn.1800244e0
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18000ff81
test al, 0x10
je 0x18000ff81
lea rcx, [rbp + 0x90]
sub rcx, 2
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x18000ff40
mov eax, dword [0x18009b9d0]
lea rdx, [rdi + 8]
mov dword [rcx], eax
movzx eax, word [0x18009b9d4]
mov word [rcx + 4], ax
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rdi], rax
mov rax, rdi
mov byte [rdi + 0x258], 0
jmp 0x18000fe78
mov rcx, rdi
call fcn.18006e620
xor edi, edi
mov eax, edi
jmp 0x18000fe78
movsd xmm2, qword [0x1800a17f0]
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm1, rax
addsd xmm1, xmm1
jmp 0x18000ffdf
mov r8d, 0xa
lea rdx, str.s_dir_name
jmp 0x18000ffcf
mov r8, qword [rsp + 0x50]
lea rdx, str.ration_red
mov rcx, rdi
call fcn.180068f40
xorps xmm2, xmm2
movd xmm1, eax
cvtdq2pd xmm1, xmm1
movq r8, xmm2
lea rcx, str._f____f_n
movq rdx, xmm1
call fcn.180064fc0
lea rax, str.false
jmp 0x18000fe78
call fcn.180022310
int3
call fcn.180021e70
int3
call fcn.18006d284
int3