Function at 0x18001e660
Capabilities:
Check if file exists

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x7b0
mov rax, qword [0x180036040]
xor rax, rsp
mov qword [rsp + 0x7a0], rax
mov r12, r9
mov r13, r8
mov r14, rdx
mov r15, rcx
xor esi, esi
mov qword [rsp + 0xd0], rsi
mov ebx, 0x20a
mov r8d, ebx
xor edx, edx
lea rcx, [rsp + 0x590]
call sub.ucrtbase.dll_memset
mov r8d, ebx
xor edx, edx
lea rcx, [rsp + 0x380]
call sub.ucrtbase.dll_memset
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], rax
lea rdi, [rsp + 0xd0]
mov qword [rsp + 0xa0], rdi
lea eax, [rsi + 1]
mov byte [rsp + 0xa8], al
mov rcx, qword [rsp + 0x7e8]
cmp qword [r14 + 8], rsi
je 0x18001eccf
mov r8d, eax
xor edx, edx
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
mov qword [rsp + 0x160], rax
mov rcx, qword [rsp + 0x7e8]
test rax, rax
je 0x18001ecda
mov rsi, qword [rsp + 0x7e8]
mov r8d, 0x104
lea rdx, [rsp + 0x590]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x18001ecdf
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x18
lea r8, [rsp + 0xb0]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov rcx, qword [rsp + 0x7e8]
test eax, eax
je 0x18001ece7
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x104
mov qword [rsp + 0x38], rdx
lea rax, [rsp + 0x380]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x380]
mov qword [rsp + 0x20], rax
mov r9d, 2
lea r8, [rsp + 0x590]
xor edx, edx
call qword [sym.imp.dbghelp.dll_SymGetSymbolFileW]
test eax, eax
jne 0x18001ebec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x7e8]
cmp eax, 2
jne 0x18001ecec
xor edx, edx
mov r8d, 0x20a
lea rcx, [rsp + 0x170]
call sub.ucrtbase.dll_memset
mov rsi, qword [rsp + 0x7e8]
mov r8d, 0x104
lea rdx, [rsp + 0x170]
lea rcx, [0x180000000]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x18001ecf3
mov edx, 0x104
lea rcx, [rsp + 0x170]
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchRemoveFileSpec]
mov rcx, qword [rsp + 0x7e8]
xor esi, esi
test eax, eax
js 0x18001ecfb
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x90], xmm1
mov r8d, 4
lea rdx, str.SRV
lea rcx, [rsp + 0x80]
call fcn.180010228
nop
lea rax, [rsp + 0x170]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], si
jne 0x18001e890
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x80]
call fcn.18001369c
xorps xmm0, xmm0
movups xmmword [rsp + 0xd8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xe8], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xd8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xe8], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov r8d, 0x33
lea rdx, str._symbolshttp:__msdl.microsoft.com_download_symbols
lea rcx, [rsp + 0xd8]
call fcn.18001369c
xorps xmm0, xmm0
movups xmmword [rsp + 0xf8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x108], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xf8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x108], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rcx, [rsp + 0xd8]
call fcn.18000b9d0
nop
lea rcx, [rsp + 0x80]
call fcn.18000b9d0
call qword [sym.imp.dbghelp.dll_SymGetOptions]
bts eax, 0x1f
mov ecx, eax
call qword [sym.imp.dbghelp.dll_SymSetOptions]
mov dword [rsp + 0xc8], eax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0xd8], xmm0
mov qword [rsp + 0xe8], rax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xe0], r15
mov byte [rsp + 0xe8], 1
lea rsi, [r15 + 0x10]
xor ecx, ecx
mov qword [rsp + 0x78], rcx
mov r8, qword [r13 + 0x38]
xor r13d, r13d
mov r9d, r13d
test r8, r8
je 0x18001e9de
mov rax, qword [r8]
lea rdx, [rsp + 0x40]
mov rcx, r8
call qword [rax]
mov rcx, rax
mov qword [rsp + 0x78], rax
mov r9, rax
lea rax, [rsp + 0x40]
cmp r9, rax
je 0x18001ea00
cmp qword [rsi + 0x38], rsi
je 0x18001ea00
mov rcx, qword [rsi + 0x38]
mov qword [rsp + 0x78], rcx
mov qword [rsi + 0x38], r9
jmp 0x18001eb1a
mov r8, r13
mov qword [rsp + reloc.COMCTL32.dll_Ordinal_344], r13
test r9, r9
je 0x18001ea6e
lea rax, [rsp + 0x40]
cmp r9, rax
jne 0x18001ea5b
mov rax, qword [r9]
lea rdx, [rsp + 0x120]
mov rcx, r9
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8, rax
mov qword [rsp + reloc.COMCTL32.dll_Ordinal_344], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x18001ea6e
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov r8, qword [rsp + reloc.COMCTL32.dll_Ordinal_344]
jmp 0x18001ea66
mov r8, r9
mov qword [rsp + reloc.COMCTL32.dll_Ordinal_344], r9
mov rcx, r13
mov qword [rsp + 0x78], rcx
mov r9, qword [rsi + 0x38]
test r9, r9
je 0x18001eacc
mov rcx, r9
cmp r9, rsi
jne 0x18001eac3
mov rax, qword [r9]
lea rdx, [rsp + 0x40]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, rax
mov qword [rsp + 0x78], rax
mov r8, qword [rsi + 0x38]
test r8, r8
je 0x18001eab9
mov rax, qword [r8]
cmp r8, rsi
setne dl
mov rcx, r8
call qword [rax + 0x20]
mov rcx, qword [rsp + 0x78]
mov r8, qword [rsp + reloc.COMCTL32.dll_Ordinal_344]
jmp 0x18001eac8
mov r8, qword [rsp + reloc.COMCTL32.dll_Ordinal_344]
jmp 0x18001eacc
mov qword [rsp + 0x78], rcx
mov qword [rsi + 0x38], r13
test r8, r8
je 0x18001eb1a
lea rax, [rsp + 0x120]
cmp r8, rax
jne 0x18001eb16
mov rax, qword [r8]
mov rdx, rsi
mov rcx, r8
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rsi + 0x38], rax
mov rcx, qword [rsp + reloc.COMCTL32.dll_Ordinal_344]
test rcx, rcx
je 0x18001eb0f
mov rax, qword [rcx]
lea rdx, [rsp + 0x120]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov rcx, qword [rsp + 0x78]
jmp 0x18001eb1a
mov qword [rsi + 0x38], r8
test rcx, rcx
je 0x18001eb30
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
lea rcx, [r15 + 0x50]
mov r8, qword [r14 + 8]
mov rdx, qword [r14]
call fcn.18000b458
lea rsi, [rsp + 0xf8]
cmp qword [rsp + 0x110], 7
cmova rsi, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0x104
mov qword [rsp + 0x38], rdx
lea rcx, [rsp + 0x380]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rdx
lea rcx, [rsp + 0x380]
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, [rsp + 0x590]
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.dbghelp.dll_SymGetSymbolFileW]
mov rcx, qword [rsp + 0x7e8]
test eax, eax
je 0x18001ed03
mov ecx, dword [rsp + 0xc8]
call qword [sym.imp.dbghelp.dll_SymSetOptions]
lea rsi, [r15 + 0x10]
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x18001ebdd
mov rax, qword [rcx]
cmp rcx, rsi
setne dl
call qword [rax + 0x20]
mov qword [rsi + 0x38], r13
lea rcx, [rsp + 0xf8]
call fcn.18000b9d0
jmp 0x18001ebef
xor r13d, r13d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x590]
xor edx, edx
call qword [sym.imp.dbghelp.dll_SymLoadModuleExW]
mov rsi, rax
mov qword [rsp + 0xd0], rax
mov rcx, qword [rsp + 0x7e8]
test rax, rax
je 0x18001ed09
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x20], r12
lea r9, [0x18001ed18]
xor r8d, r8d
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.dbghelp.dll_SymEnumSymbols]
mov rcx, qword [rsp + 0x7e8]
test eax, eax
je 0x18001ed0e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
mov rbx, qword [rdi]
test rbx, rbx
je 0x18001eca1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.dbghelp.dll_SymUnloadModule64]
mov qword [rdi], r13
xor eax, eax
jmp 0x18001ecac
mov rcx, qword [rsp + 0x7a0]
xor rcx, rsp
call fcn.180023360
add rsp, 0x7b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov edx, 0x80070057
call fcn.18000a450
nop
call fcn.180010844
mov rcx, rsi
call fcn.180010844
call fcn.180010844
mov edx, eax
call fcn.1800184d0
mov rcx, rsi
call fcn.180010844
mov edx, eax
call fcn.18000a450
nop
call fcn.180010844
nop
call fcn.180010844
call fcn.180010844
int3