Function at 0x140034128
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x740
mov qword [rsp + 0xb8], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov rax, qword [0x140048148]
xor rax, rsp
mov qword [rsp + 0x730], rax
mov r13, rdx
mov r12, rcx
xor r14d, r14d
mov rbx, r14
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], r14
mov word [r11 - 0x248], r14w
mov edi, 0x208
mov r8, rdi
xor edx, edx
lea rcx, [r11 - 0x246]
call sub.msvcrt.dll_memset
mov word [rsp + 0x100], r14w
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x102]
call sub.msvcrt.dll_memset
mov word [rsp + 0x310], r14w
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x312]
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x60]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
lea rdx, [rsp + 0x520]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, r14d
jne 0x14003421b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, r14d
jne 0x140034203
mov ebp, 0x8000ffff
jmp 0x1400342ec
movzx ebp, ax
or ebp, 0x80070000
cmp eax, r14d
cmovle ebp, eax
cmp ebp, r14d
jl 0x1400342ec
lea rcx, [rsp + 0xf0]
call qword [sym.imp.ole32.dll_CoCreateGuid]
mov ebp, eax
cmp eax, r14d
jl 0x1400342ec
mov edi, 0x105
mov r8d, edi
lea rdx, [rsp + 0x310]
lea rcx, [rsp + 0xf0]
call qword [sym.imp.ole32.dll_StringFromGUID2]
mov esi, 0x80004005
cmp eax, r14d
cmove ebp, esi
cmp ebp, r14d
jl 0x1400342ec
lea rax, [rsp + 0x310]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x520]
lea r8, [0x140006d48]
mov rdx, rdi
lea rcx, [rsp + 0x100]
call fcn.140012698
mov ebp, eax
cmp eax, r14d
jl 0x1400342ec
lea rcx, [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
cmovne ebp, esi
cmp ebp, r14d
jl 0x1400342ec
lea r8, [rsp + 0x38]
lea rdx, [0x140006cc0]
mov rcx, r12
call fcn.1400353c4
mov ebp, eax
cmp eax, r14d
jl 0x1400342e7
mov rbx, qword [rsp + 0x38]
mov rax, qword [rbx]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x168]
mov ebp, eax
jmp 0x1400342ec
mov rbx, qword [rsp + 0x38]
mov qword [rsp + 0x40], r14
lea rcx, [0x140006d5c]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
mov qword [rsp + 0xc0], rax
cmp rax, r14
jne 0x140034319
mov ecx, 0x8007000e
call fcn.14000f038
nop
mov rax, qword [rbx]
lea r8, [rsp + 0x40]
mov rdx, rdi
mov rcx, rbx
call qword [rax + 0x188]
nop
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
call qword [rax + 0xa8]
cmp ebp, r14d
jl 0x1400347bc
mov rax, qword [r12 + 8]
mov rcx, qword [rax + 0x20]
cmp rcx, r14
jne 0x14003436e
mov rdi, r14
mov qword [rsp + 0x78], r14
jmp 0x14003438c
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
mov qword [rsp + 0x78], rax
cmp rax, r14
jne 0x14003438c
mov ecx, 0x8007000e
call fcn.14000f038
nop
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, [0x140006d60]
mov r8, qword [rsp + 0x30]
mov rdx, rbx
mov rcx, r12
call fcn.1400354e4
mov ebp, eax
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp ebp, r14d
jl 0x1400347bc
mov rcx, qword [0x140049cd8]
cmp rcx, r14
jne 0x1400343da
mov rdi, r14
mov qword [rsp + 0x98], r14
jmp 0x1400343fb
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
mov qword [rsp + 0x98], rax
cmp rax, r14
jne 0x1400343fb
mov ecx, 0x8007000e
call fcn.14000f038
nop
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
lea r9, [0x140006bf8]
mov r8, qword [rsp + 0x30]
mov rdx, rbx
mov rcx, r12
call fcn.1400354e4
mov ebp, eax
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp ebp, r14d
jl 0x1400347bc
mov rcx, qword [0x140049ce0]
cmp rcx, r14
jne 0x140034449
mov rdi, r14
mov qword [rsp + 0x58], r14
jmp 0x140034467
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
mov qword [rsp + 0x58], rax
cmp rax, r14
jne 0x140034467
mov ecx, 0x8007000e
call fcn.14000f038
nop
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [0x140006c10]
mov r8, qword [rsp + 0x30]
mov rdx, rbx
mov rcx, r12
call fcn.1400354e4
mov ebp, eax
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp ebp, r14d
jl 0x1400347bc
lea rcx, [0x140048170]
mov rax, qword [0x140048170]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x90], rax
mov r8d, dword [r12 + 0x10]
lea rdx, [0x140003a20]
lea rcx, [rsp + 0x90]
call fcn.140018948
mov rsi, qword [rsp + 0x90]
cmp rsi, r14
jne 0x1400344ec
mov rdi, r14
mov qword [rsp + 0x80], r14
jmp 0x140034510
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
mov qword [rsp + 0x80], rax
cmp rax, r14
jne 0x140034510
mov ecx, 0x8007000e
call fcn.14000f038
nop
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [0x140006d80]
mov r8, qword [rsp + 0x30]
mov rdx, rbx
mov rcx, r12
call fcn.1400354e4
mov ebp, eax
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
lea rdx, [rsi - 0x18]
or rsi, 0xffffffffffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
cmp eax, r14d
jg 0x14003455f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
cmp ebp, r14d
jl 0x1400347b7
lea rcx, [0x140048170]
mov rax, qword [0x140048170]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea rax, [0x140006d98]
lea rdx, [0x140006da8]
cmp byte [0x140049cf0], r14b
cmovne rdx, rax
cmp rdx, r14
jne 0x1400345a5
mov ecx, r14d
jmp 0x1400345b6
xor eax, eax
mov rcx, rsi
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
lea rcx, [rsp + 0x50]
call fcn.14000d0f0
mov rbx, qword [rsp + 0x50]
cmp rbx, r14
jne 0x1400345d7
mov rdi, r14
mov qword [rsp + 0x48], r14
jmp 0x1400345f8
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
mov qword [rsp + 0x48], rax
cmp rax, r14
jne 0x1400345f8
mov ecx, 0x8007000e
call fcn.14000f038
nop
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [0x140006db8]
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, r12
call fcn.1400354e4
mov ebp, eax
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
cmp eax, r14d
jg 0x140034642
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
cmp ebp, r14d
jl 0x1400347b7
mov rcx, qword [0x140049ce8]
cmp rcx, r14
jne 0x140034664
mov rdi, r14
mov qword [rsp + 0x88], r14
jmp 0x140034685
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
mov qword [rsp + 0x88], rax
cmp rax, r14
jne 0x140034685
mov ecx, 0x8007000e
call fcn.14000f038
nop
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
lea r9, [0x140006dd0]
mov r8, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rdx, rbx
mov rcx, r12
call fcn.1400354e4
mov ebp, eax
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp ebp, r14d
jl 0x1400347bc
lea rcx, [rsp + 0x60]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov edi, 8
mov word [rsp + 0x60], di
lea rcx, [rsp + 0x100]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsp + 0x68], rax
cmp rax, r14
jne 0x14003470a
lea eax, [rdi + 2]
mov word [rsp + 0x60], ax
mov dword [rsp + 0x68], 0x8007000e
mov ecx, 0x8007000e
call fcn.14000f038
int3
lea rcx, [rsp + 0xa0]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov r9d, edi
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
cmp eax, r14d
jge 0x14003473f
mov ecx, eax
call fcn.14000f038
int3
mov rdx, qword [rsp + 0xa8]
cmp rdx, r14
jne 0x140034751
mov ecx, r14d
jmp 0x140034762
xor eax, eax
mov rcx, rsi
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
mov rcx, r13
call fcn.14000d0f0
nop
lea rcx, [rsp + 0xa0]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x60]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [rdx + 0x10], rax
mov rax, qword [rbx]
lea rdx, [rsp + 0xd0]
mov rcx, rbx
call qword [rax + 0x210]
mov ebp, eax
jmp 0x1400347bc
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
cmp rcx, r14
je 0x1400347cd
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov rcx, qword [rsp + 0x30]
cmp rcx, r14
je 0x1400347ea
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov eax, ebp
mov rcx, qword [rsp + 0x730]
xor rcx, rsp
call fcn.140037b50
lea r11, [rsp + 0x740]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret