Function at 0x14004401c
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2d0
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x140197b10]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov ebx, r9d
mov dword [rsp + 0x58], ebx
mov qword [rsp + 0x98], r8
mov qword [rsp + 0x88], rdx
mov qword [rsp + 0x78], rcx
mov r14, qword [rsp + 0x320]
mov rsi, qword [rsp + 0x330]
mov rax, qword [rsp + 0x338]
mov qword [rsp + 0x80], rax
and qword [rsp + 0x70], 0
lea r9, [rsp + 0x70]
lea r8, [0x14019bf80]
lea rdx, str.NTDLL.DLL
lea rcx, str.RtlCreateUnicodeString
call fcn.14005c580
lea r9, [rsp + 0x70]
lea r8, [0x14019bf88]
lea rdx, str.NTDLL.DLL
lea rcx, str.RtlFreeUnicodeString
call fcn.14005c580
mov r15d, dword [rsp + 0x340]
and r15d, 0x10
mov rax, qword [0x14019bf18]
test rax, rax
jne 0x1400440fb
mov eax, 3
jmp 0x1400447ea
lea rdx, str.DeviceImDiskCtl
lea rcx, [rsp + 0x40]
call rax
mov r12d, 0xc0000000
mov edx, r12d
lea rcx, [rsp + 0x40]
call qword [0x14019c138]
mov rbp, rax
or rdi, 0xffffffffffffffff
cmp rax, rdi
jne 0x1400441d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1400441bf
lea rcx, str.ImDisk
call qword [0x14019c158]
test eax, eax
je 0x14004416d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, r12d
lea rcx, [rsp + 0x40]
call qword [0x14019c138]
mov rbp, rax
cmp rax, rdi
je 0x14004412d
jmp 0x1400441d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x1400441a9
cmp eax, 3
jbe 0x14004419f
cmp eax, 0x422
je 0x140044195
cmp eax, 0x424
jne 0x1400441a9
mov eax, 4
jmp 0x1400447ea
mov eax, 4
jmp 0x1400447ea
mov eax, 4
jmp 0x1400447ea
lea rcx, str.Error_loading_ImDisk_Virtual_Disk_Driver:
call fcn.14002ecf8
mov eax, 4
jmp 0x1400447ea
lea rcx, str.Error_controlling_the_ImDisk_Virtual_Disk_Driver:
call fcn.14002ecf8
mov eax, 6
jmp 0x1400447ea
mov rcx, rbp
call fcn.14002ed74
test eax, eax
jne 0x1400441e9
lea edi, [rax + 5]
jmp 0x1400445a0
mov r12d, ebx
and r12d, 0xf00
mov r13d, ebx
and r13d, 0xf000
xor edx, edx
cmp r13d, 0x1000
sete dl
xor ecx, ecx
cmp r12d, 0x100
sete cl
xor eax, eax
test r12d, r12d
sete al
or ecx, eax
test edx, ecx
je 0x14004433f
lea rdx, str.DeviceAWEAlloc
lea rcx, [rsp + 0x60]
call qword [0x14019bf18]
mov edx, 0xc0000000
lea rcx, [rsp + 0x60]
call qword [0x14019c138]
mov rbx, rax
cmp rax, rdi
jne 0x140044314
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140044401
lea rcx, str.AWEAlloc
call qword [0x14019c158]
test eax, eax
je 0x14004429b
lea rcx, str.AWEAlloc_driver_was_loaded_into_the_kernel.
call fcn.14010e514
mov edx, 0xc0000000
lea rcx, [rsp + 0x60]
call qword [0x14019c138]
mov rbx, rax
cmp rax, rdi
je 0x140044255
jmp 0x140044314
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x1400442fe
cmp eax, 3
jbe 0x1400442e7
cmp eax, 0x422
je 0x1400442d0
cmp eax, 0x424
jne 0x1400442fe
call fcn.14010df94
lea rdx, [rax + 0x60]
lea rcx, str.The_AWEAlloc_driver_is_not_installed._r_nPlease_re_install_ImDisk._r_n
call fcn.14010e384
jmp 0x14004430a
call fcn.14010df94
lea rdx, [rax + 0x60]
lea rcx, str.The_AWEAlloc_driver_is_disabled._r_n
call fcn.14010e384
jmp 0x14004430a
call fcn.14010df94
lea rdx, [rax + 0x60]
lea rcx, str.Cannot_load_AWEAlloc_driver._r_nPlease_re_install_ImDisk._r_n
call fcn.14010e384
jmp 0x14004430a
lea rcx, str.Error_loading_AWEAlloc_driver:
call fcn.14002ecf8
mov edi, 7
jmp 0x1400445a0
xor r9d, r9d
lea r8, [0x14019bf90]
lea rdx, str.NTDLL.DLL
lea rcx, str.NtClose
call fcn.14005c580
mov rcx, rbx
call qword [0x14019bf90]
jmp 0x140044401
xor ecx, ecx
cmp r13d, 0x2000
sete cl
or ecx, edx
xor eax, eax
cmp r12d, 0x300
sete al
test eax, ecx
je 0x140044401
xor edx, edx
lea rbx, str..PIPEImDskSvc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
jne 0x140044401
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140044401
lea rcx, str.ImDskSvc
call qword [0x14019c158]
test eax, eax
je 0x1400443cd
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
jne 0x140044401
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140044401
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x1400443a6
jmp 0x140044401
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x1400443eb
cmp eax, 3
jbe 0x1400443f7
cmp eax, 0x422
je 0x1400443f7
cmp eax, 0x424
je 0x1400443f7
lea rcx, str.Error_starting_ImDisk_Virtual_Disk_Driver_Helper_Service:
call fcn.14002ecf8
mov edi, 7
jmp 0x1400445a0
test r14, r14
jne 0x14004441b
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [0x14019bf18]
xor r13d, r13d
jmp 0x1400445b0
cmp dword [rsp + 0x328], 0
je 0x140044444
mov rdx, r14
lea rcx, [rsp + 0x40]
call qword [0x14019bf80]
xor r13d, r13d
cmp eax, r13d
jne 0x1400445b0
jmp 0x1400445a0
xor ecx, ecx
cmp r13d, 0x3000
sete cl
xor r13d, r13d
mov eax, r13d
cmp r12d, 0x300
sete al
test eax, ecx
je 0x14004456a
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r13 + 1]
lea rcx, str._Global
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, r13d
cmp eax, 2
sete dl
mov ecx, r13d
cmp rbx, rdi
sete cl
test ecx, edx
lea r12, str.BaseNamedObjects_
lea rax, str.BaseNamedObjectsGlobal_
cmove r12, rax
cmp rbx, rdi
je 0x1400444d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [rax + rbx + 2]
lea rcx, [rsp + 0x60]
call fcn.140063580
nop
mov rbx, qword [rsp + 0x60]
cmp rbx, r13
jne 0x140044518
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x60]
call fcn.14005b520
mov eax, edi
jmp 0x1400447ea
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call qword [0x14019bf80]
cmp eax, r13d
jne 0x14004455e
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x60]
call fcn.14005b520
mov eax, edi
jmp 0x1400447ea
lea rcx, [rsp + 0x60]
call fcn.14005b520
jmp 0x1400445b0
xor r9d, r9d
lea r8, [0x14019bf78]
lea rdx, str.NTDLL.DLL
lea rcx, str.RtlDosPathNameToNtPathName_U
call fcn.14005c580
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, r14
call qword [0x14019bf78]
cmp eax, r13d
jne 0x1400445b0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x1400447ea
movzx edx, word [rsp + 0x40]
lea edx, [rdx + rdx + 0x38]
lea rcx, [rsp + 0x50]
call fcn.1400632b0
nop
mov rbx, qword [rsp + 0x50]
movzx r8d, word [rsp + 0x40]
add r8, 0x38
xor edx, edx
mov rcx, rbx
call fcn.14010c6c0
mov r12d, 0x3a
cmp rsi, r13
je 0x14004461c
cmp r15d, r13d
jne 0x14004461c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 2
jne 0x140044602
cmp word [rsi + 2], r12w
je 0x140044615
cmp eax, 3
jne 0x14004461c
cmp word [rsi + 2], r12w
jne 0x14004461c
cmp word [rsi + 4], 0x5c
jne 0x14004461c
movzx eax, word [rsi]
mov word [rbx + 0x2c], ax
mov rdi, qword [rsp + 0x78]
mov eax, dword [rdi]
mov dword [rbx], eax
mov rcx, qword [rsp + 0x88]
mov rax, qword [rcx]
mov qword [rbx + 8], rax
mov rax, qword [rcx + 8]
mov qword [rbx + 0x10], rax
mov rax, qword [rcx + 0x10]
mov qword [rbx + 0x18], rax
mov rax, qword [rsp + 0x98]
mov rax, qword [rax]
mov qword [rbx + 0x20], rax
mov eax, dword [rsp + 0x58]
mov dword [rbx + 0x28], eax
movzx eax, word [rsp + 0x40]
mov word [rbx + 0x2e], ax
movzx eax, word [rsp + 0x40]
cmp ax, r13w
je 0x14004468b
movzx r8d, ax
lea rcx, [rbx + 0x30]
mov rdx, qword [rsp + 0x48]
call fcn.14010cd30
lea rcx, [rsp + 0x40]
call qword [0x14019bf88]
movzx r9d, word [rbx + 0x2e]
add r9d, 0x38
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rbx
mov r8, rbx
mov edx, 0x8372e004
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, r13d
jne 0x1400446f0
lea rcx, str.Error_creating_virtual_disk:
call fcn.14002ecf8
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x50]
call fcn.14005b520
mov eax, 3
jmp 0x1400447ea
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r11d, dword [rbx]
mov dword [rdi], r11d
cmp rsi, r13
je 0x1400447c3
mov r9d, dword [rbx]
lea r8, str.DeviceImDisk_u
mov edx, 0x103
lea rcx, [rsp + 0xb0]
call fcn.14010e29c
mov word [rsp + 0x2b6], r13w
cmp word [rbx + 0x2c], r13w
jne 0x14004479c
lea rdx, [rsp + 0xb0]
mov rcx, rsi
call qword [0x14019c160]
cmp eax, r13d
jne 0x1400447c3
call qword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 1
je 0x140044796
sub eax, 0x56
je 0x140044796
sub eax, r12d
je 0x140044796
sub eax, 0x7a
je 0x140044796
sub eax, 0x101b
je 0x140044796
cmp eax, 2
je 0x14004477e
lea rcx, str.Error_creating_mount_point:
call fcn.14002ecf8
jmp 0x140044796
call fcn.14010df94
mov r8, rsi
lea rdx, str.Invalid_mount_point_path:__1_ws__n
lea rcx, [rax + 0x60]
call fcn.14002ec70
mov word [rsi], r13w
jmp 0x1400447c3
lea r8, [rsp + 0xb0]
mov rdx, rsi
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
cmp eax, r13d
jne 0x1400447c3
lea rcx, str.Error_creating_mount_point:
call fcn.14002ecf8
mov rax, qword [rsp + 0x80]
cmp rax, r13
je 0x1400447de
mov r8, rax
mov rdx, rsi
mov ecx, dword [rbx]
call fcn.14003aae8
nop
lea rcx, [rsp + 0x50]
call fcn.14005b520
xor eax, eax
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.14010bcc0
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret