Function at 0x1400a8bf0
Capabilities:
Check if file exists

Disassembly:
mov r11, rsp
push rdi
push r14
push r15
sub rsp, 0x70
mov qword [r11 - 0x40], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov rax, qword [0x1403a0088]
xor rax, rsp
mov qword [rsp + 0x68], rax
movzx ebx, cx
xor r15d, r15d
mov edi, r15d
mov qword [r11 - 0x30], r15
mov qword [r11 - 0x28], r15
call fcn.14005bba0
mov qword [rsp + 0x58], rax
mov word [str.X:WindowsWeb], bx
lea r14, str.X:WindowsWeb
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryEmptyW]
test eax, eax
jne 0x1400a8e94
xor edx, edx
mov r8d, 0x208
lea rcx, [0x1404578c0]
call fcn.1402767a0
lea r8, str.WallPaper
lea rdx, str.Control_PanelDesktop
mov rcx, 0xffffffff80000001
call fcn.14005f970
mov rsi, rax
test rax, rax
je 0x1400a8e94
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400a8e94
xor r8d, r8d
lea rdx, str.:WindowsWeb
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecExW]
test eax, eax
jne 0x1400a8d10
mov r8, rsi
mov edx, 0x104
lea rcx, [0x1404578c0]
call fcn.140285f3c
mov eax, Ordinal_46
mov word [0x1404578c0], ax
mov ebp, 1
lea r8d, [r15 + 3]
mov edx, ebp
mov rcx, r14
call fcn.140052070
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400a8d45
lea r9, [rsp + 0x58]
mov r8, r14
lea rdx, [0x1400a8a30]
mov rcx, rax
call fcn.140052330
jmp 0x1400a8d3c
mov ebp, 1
lea r8d, [rbp + 2]
mov edx, ebp
mov rcx, r14
call fcn.140052070
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400a8d45
lea r9, [rsp + 0x58]
mov r8, r14
mov rcx, rax
call fcn.1400538d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x60], 0
jbe 0x1400a8e85
mov r8, qword [rsp + 0x58]
mov rax, qword [r8]
cmp rax, r8
je 0x1400a8dc3
mov edx, dword [0x140455b64]
test edx, edx
jne 0x1400a8e99
mov rcx, qword [rax + 0x40]
add rdi, qword [rcx + 0x28]
cmp byte [rax + 0x19], dl
jne 0x1400a8dbe
mov rcx, qword [rax + 0x10]
cmp byte [rcx + 0x19], dl
jne 0x1400a8d9e
mov rax, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], dl
jne 0x1400a8dbe
nop dword [rax]
mov rax, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x1400a8d90
jmp 0x1400a8dbe
mov rcx, qword [rax + 8]
cmp byte [rcx + 0x19], 0
jne 0x1400a8dbb
cmp rax, qword [rcx + 0x10]
jne 0x1400a8dbb
mov rax, rcx
mov rcx, qword [rcx + 8]
cmp byte [rcx + 0x19], 0
je 0x1400a8da8
mov rax, rcx
cmp rax, r8
jne 0x1400a8d64
call fcn.14007e670
mov rbx, rax
mov qword [rax + 0x68], rdi
mov dword [rax + 0x71], r15d
mov dword [rax + 4], reloc.WS2_32.dll_recvfrom
cmp word [str.X:WindowsWeb], 0
jne 0x1400a8de9
mov r8, r15
jmp 0x1400a8dfb
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [r14 + r8*2], 0
jne 0x1400a8df0
lea rcx, [rax + 0x28]
mov rdx, r14
call fcn.14004db90
lea rcx, [rbx + 8]
cmp rcx, rax
je 0x1400a8e1f
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
call fcn.14004e170
lea rcx, [rbx + 0x48]
mov r8d, 4
lea rdx, [0x140333fd0]
call fcn.14004db90
lea rdi, [rbx + 0x75]
lea rax, [rsp + 0x58]
cmp rdi, rax
je 0x1400a8e7d
mov rdx, qword [rdi]
mov rdx, qword [rdx + 8]
mov rcx, rdi
call fcn.140068590
mov rax, qword [rdi]
mov qword [rax + 8], rax
mov rax, qword [rdi]
mov qword [rax], rax
mov rax, qword [rdi]
mov qword [rax + 0x10], rax
mov qword [rdi + 8], r15
movzx r8d, byte [rsp + 0x40]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.1400686d0
mov rcx, rbx
call fcn.14007e010
mov rcx, rsi
call fcn.140125e14
mov r8, qword [rsp + 0x58]
jmp 0x1400a8e9c
mov r8, qword [rsp + 0x58]
mov ebp, r15d
mov r9, r8
mov r8, qword [r8]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x58]
call fcn.140067fb0
mov rcx, qword [rsp + 0x58]
call fcn.140125e0c
mov eax, ebp
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140125a70
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret