Function at 0x180035620
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x430]
sub rsp, 0x530
mov rax, qword [0x1801044f8]
xor rax, rsp
mov qword [rbp + 0x420], rax
mov r15d, r8d
mov rax, rdx
mov rdi, rcx
mov qword [rbp - 0x80], rdx
xor r13d, r13d
mov dword [rsp + 0x30], r13d
mov dword [rcx + 0x428], r8d
mov qword [rcx + 0x10], rdx
lea rdx, [rbp + 0x50]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rbp + 0x58]
sub eax, dword [rbp + 0x50]
mov dword [rdi + 0x42c], eax
mov eax, dword [rbp + 0x5c]
sub eax, dword [rbp + 0x54]
mov dword [rdi + 0x430], eax
lea rcx, [rbp + 0x80]
call fcn.18000de10
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r13
mov qword [rbp + 0x48], r13
lea r8d, [r13 + 0xa]
lea rdx, [0x1800ce3e0]
lea rcx, [rbp + 0x30]
call fcn.18002fd30
nop
mov r8d, 0xd7b
lea rdx, str.NoxVMHandle.exe
lea rcx, [rbp + 0x80]
call fcn.18000e360
mov r12d, r13d
test eax, eax
js 0x180035af8
xor r14b, r14b
lea rax, [0x1800e2cc4]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 2
xor r9d, r9d
lea r8, [rbp + 0x30]
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0xa0]
call fcn.180002300
nop
xor edx, edx
lea rcx, [rbp + 0xa0]
call fcn.180002ae0
mov rbx, rax
mov ecx, dword [rax]
mov dword [rsp + 0x40], ecx
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
lea ecx, [r13 + 0x48]
call fcn.18009354c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], r13
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov rax, qword [rbx + 0x30]
mov qword [rsp + 0x70], rax
mov rax, qword [rbx + 0x38]
mov qword [rsp + 0x78], rax
mov rdx, qword [rbx + 0x20]
sub rdx, qword [rbx + 0x18]
sar rdx, 3
mov r8, qword [rsp + 0x48]
lea rcx, [rsp + 0x58]
call fcn.180005b00
mov rdx, qword [rbx + 8]
mov r8, rdx
mov rdx, qword [rdx]
lea rcx, [rsp + 0x40]
call fcn.180034630
nop
lea esi, [r13 - 1]
cmp qword [rbp - 0x40], r13
jne 0x18003597d
lea rdx, [rdi + 0x440]
lea r8, [0x1800e313c]
lea rcx, [rbp + 0x60]
call fcn.180019500
nop
lea rdx, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rdx, qword [rbp + 0x30]
mov r8, qword [rbp + 0x40]
mov rcx, rax
call fcn.1800111c0
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov edi, 1
mov dword [rsp + 0x30], edi
mov rdx, qword [rbp + 0x78]
cmp rdx, 8
jb 0x180035856
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180035851
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180035b9d
call fcn.180093588
movdqa xmm0, xmmword [0x1800ce060]
movdqu xmmword [rbp + 0x70], xmm0
mov word [rbp + 0x60], r13w
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae rcx, qword [rbp + 0x10]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1800358f4
lea rax, [rbp - 0x60]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x60], xmm0
lea r9, [rbp - 0x60]
lea r8, [rbp + 0x10]
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0xa0]
call fcn.180003a20
nop
cmp dword [rbp - 0x30], 0
setge r14b
lea rax, [rbp - 0x28]
mov qword [rbp - 0x78], rax
cmp byte [rbp - 0x18], 0
je 0x18003590e
mov rbx, qword [rbp - 0x20]
test rbx, rbx
je 0x18003590e
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x18003590e
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x18003590e
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
jmp 0x18003590e
lea rdx, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae rdx, qword [rbp + 0x10]
lea rcx, str.file:__s__not_exists_
call fcn.180047fb0
and edi, 0xfffffffe
mov dword [rsp + 0x30], edi
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x180035955
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180035950
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180035ba3
call fcn.180093588
movdqa xmm0, xmmword [0x1800ce060]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], r13w
test r14b, r14b
jne 0x18003597d
lea rcx, str.Inject_false.
call fcn.180047fb0
jmp 0x180035a24
lea rax, [rbp - 0x50]
mov qword [rbp - 0x78], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x50], xmm0
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
lea r9, [0x1800ce440]
lea r8, [rbp + 0x30]
lea rdx, [rbp + 0x80]
lea rcx, [rbp - 0x10]
call fcn.180034180
nop
cmp qword [rbp - 8], 0
je 0x1800359e4
mov dword [rsp + 0x38], r15d
lea r9, [rsp + 0x38]
lea r8, [rbp - 0x80]
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x10]
call fcn.180034e40
cmp byte [rbp - 0x68], 0
je 0x180035ba9
mov r12d, dword [rbp - 0x6c]
jmp 0x1800359f1
lea rcx, str.remote_function_not_found.
call fcn.180047fb0
nop
mov rbx, qword [rbp + 8]
test rbx, rbx
je 0x180035a24
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x180035a24
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x180035a24
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x180035a7a
mov rax, qword [rsp + 0x68]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180035a67
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180035baf
call fcn.180093588
mov qword [rsp + 0x58], r13
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx + 8]
mov qword [rax], r13
mov rdi, qword [rcx]
test rdi, rdi
je 0x180035ab6
nop
mov rbx, qword [rdi]
lea rdx, [rdi + 0x10]
lea rcx, [rsp + 0x48]
call fcn.180006ce0
mov edx, 0x48
mov rcx, rdi
call fcn.180093588
mov rdi, rbx
test rbx, rbx
jne 0x180035a90
mov edx, 0x48
mov rcx, qword [rsp + 0x48]
call fcn.180093588
nop
mov rbx, qword [rbp - 0x38]
test rbx, rbx
je 0x180035b04
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x180035b04
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x180035b04
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
jmp 0x180035b04
lea rcx, str.attach_false.
call fcn.180047fb0
lea rcx, [rbp + 0x80]
call fcn.18000e660
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x180035b4d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180035b48
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180035b97
call fcn.180093588
mov qword [rbp + 0x40], r13
mov qword [rbp + 0x48], 7
mov word [rbp + 0x30], r13w
lea rcx, [rbp + 0x80]
call fcn.18000e170
mov eax, r12d
mov rcx, qword [rbp + 0x420]
xor rcx, rsp
call fcn.180093c30
mov rbx, qword [rsp + 0x588]
add rsp, 0x530
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.18009a4c4
nop
call fcn.18009a4c4
nop
call fcn.18009a4c4
nop
call fcn.180001e50
nop
call fcn.18009a4c4
int3