Function at 0x1800253c4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov qword [rbp + 0x30], 0xfffffffffffffffe
mov r12, r8
mov r14, rdx
mov rsi, rcx
xor r13d, r13d
mov dword [rsp + 0x30], r13d
cmp dword [rcx + 0x10], 3
jle 0x18002541b
lea rdx, [0x18008ad98]
mov rcx, r14
call fcn.180005348
nop
mov dword [rsp + 0x30], 1
jmp 0x180025c3d
mov rcx, r12
call fcn.1800055b8
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
cmp dword [rsi + 0x20], 0x10
jne 0x180025506
mov rax, qword [rsi]
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [rax + ILClone]
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
sub rax, rdx
sar rax, 3
test rax, rax
je 0x180025506
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x180025c5d
mov rax, qword [rdx]
sub rcx, rax
movzx edx, word [rax]
movzx r8d, word [rax + rcx]
sub edx, r8d
jne 0x18002548c
add rax, 2
test r8d, r8d
jne 0x180025476
test edx, edx
je 0x180025506
lea r8, str.CLSID
lea rcx, [rbp - 0x50]
call fcn.18002039c
nop
lea rbx, vtable.CCLSIDParser.0
mov qword [rbp - 0x50], rbx
mov dword [rbp - 0x30], ILClone
mov eax, dword [rsi + 0x10]
inc eax
mov dword [rbp - 0x40], eax
mov rax, qword [rsp + 0x50]
mov rdx, qword [rax]
lea rcx, [rbp - 0x50]
call fcn.1800275e4
test eax, eax
je 0x1800254f9
mov r8, r12
mov rdx, r14
lea rcx, [rbp - 0x50]
call fcn.1800253c4
mov dword [rsp + 0x30], 1
mov qword [rbp - 0x50], rbx
lea rcx, [rbp - 0x50]
call fcn.180020588
jmp 0x180025c33
mov qword [rbp - 0x50], rbx
lea rcx, [rbp - 0x50]
call fcn.180020588
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r13
mov edi, 0x100
movabs rbx, 0x6666666666666667
cmp dword [rsi + 0x20], 0x10
jne 0x180025656
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [rsp + 0x38]
lea rdx, [0x18008d878]
mov rcx, rsi
call fcn.1800211d8
mov dword [rsp + 0x20], 0x200
xor r9d, r9d
lea r8, [rsp + 0x38]
lea rdx, [0x18008d878]
mov rcx, rsi
call fcn.1800211d8
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [rsp + 0x38]
lea rdx, str.LocalServer32
mov rcx, rsi
call fcn.1800211d8
mov dword [rsp + 0x20], 0x200
xor r9d, r9d
lea r8, [rsp + 0x38]
lea rdx, str.LocalServer32
mov rcx, rsi
call fcn.1800211d8
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [rsp + 0x38]
lea rdx, str.Server
mov rcx, rsi
call fcn.1800211d8
mov dword [rsp + 0x20], 0x200
xor r9d, r9d
lea r8, [rsp + 0x38]
lea rdx, str.Server
mov rcx, rsi
call fcn.1800211d8
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
sub rdx, rcx
mov rax, rbx
imul rdx
sar rdx, 5
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x180025656
lea rdx, [rsp + 0x68]
call fcn.18001b358
nop
mov rdx, rax
mov rcx, r12
call fcn.18000525c
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
or rdi, 0xffffffffffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x180025638
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rsp + 0x38]
add rdx, 0x10
mov rcx, r14
call fcn.1800053f4
mov dword [rsp + 0x30], 1
jmp 0x180025c28
mov rax, qword [rsi]
lea rdx, [rsp + 0x38]
mov rcx, rsi
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x38]
sub rcx, r9
mov rax, rbx
imul rcx
sar rdx, 5
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x1800256d6
mov r8d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rdx, str.ShellExecute
mov rcx, qword [r9 + 0x10]
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
jne 0x1800256d6
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax + 0x20]
mov rcx, qword [rax + 0x28]
sub rcx, rdx
sar rcx, 3
cmp rcx, 1
jbe 0x1800256d6
mov rcx, r12
call fcn.18000525c
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax + 0x20]
add rdx, 8
jmp 0x180025641
call fcn.18000a7ac
mov rcx, rax
test rax, rax
je 0x180025c52
mov rax, qword [rax]
call qword [rax + ILCombine]
add rax, 0x18
mov qword [rbp + 0xa0], rax
or rdi, 0xffffffffffffffff
cmp dword [rsi + 0x20], 2
jne 0x18002573f
lea rdx, [rsp + 0x70]
mov rcx, rsi
call fcn.1800247c4
nop
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.18000525c
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x18002573f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbp + 0xa0]
cmp dword [rax - 0x10], r13d
jne 0x180025789
lea rdx, [rsp + 0x78]
mov rcx, rsi
call fcn.1800285a0
nop
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.18000525c
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x180025789
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbp + 0xa0]
cmp dword [rax - 0x10], r13d
jne 0x1800257d1
lea rdx, [rbp - 0x80]
mov rcx, rsi
call fcn.1800236cc
nop
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.18000525c
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x1800257d1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp + 0xa0]
cmp dword [rbx - 0x10], r13d
je 0x180025935
lea rcx, [rbp + 0x38]
call fcn.18001ea54
nop
mov rdx, rbx
lea rcx, [rbp - 0x78]
call fcn.18001c714
nop
mov rdx, qword [rax]
test rdx, rdx
jne 0x180025806
mov eax, r13d
jmp 0x180025813
mov rax, rdi
inc rax
cmp word [rdx + rax*2], r13w
jne 0x180025809
mov r8d, eax
lea rcx, [rbp + 0x50]
call fcn.180005498
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x18002583e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8, r12
lea rdx, [rbp + 0xb8]
lea rcx, [rbp + 0x38]
call fcn.18001ec24
nop
cmp dword [rsi + 0x20], 2
jne 0x1800258ed
mov rcx, qword [rbp + 0xb8]
cmp dword [rcx - 0x10], r13d
jl 0x1800258a2
lea rdx, [0x18008d8dc]
call qword [sym.imp.msvcrt.dll_wcsstr]
test rax, rax
je 0x1800258a2
sub rax, qword [rbp + 0xb8]
sar rax, 1
cmp eax, edi
je 0x1800258a2
lea rdx, [rsi + 0x30]
mov rax, qword [rdx]
cmp dword [rax - 0x10], r13d
je 0x1800258a2
lea rcx, [rbp + 0xb8]
call fcn.18000525c
lea rcx, [rbp + 0xb8]
call fcn.18001b82c
mov r8, qword [rsi + 0x30]
cmp dword [r8 - 0x10], r13d
je 0x1800258c7
lea rdx, [0x18008d8dc]
mov rcx, r12
call fcn.180004d74
lea r8, [0x18008ad98]
lea rdx, [0x18008d8e4]
mov rcx, r12
call fcn.180004d74
mov rcx, r12
call fcn.180004b34
mov rcx, r12
call fcn.180004c44
lea rdx, [rbp + 0xb8]
mov rcx, r14
call fcn.1800053f4
mov dword [rsp + 0x30], 1
mov rdx, qword [rbp + 0xb8]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x180025926
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rbp + 0x38]
call fcn.18001eb20
nop
jmp 0x180025c06
cmp dword [rsi + 0x20], 0x10
jne 0x180025aa8
mov ebx, 0x100
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, [rsp + 0x38]
lea rdx, str.InprocServer
mov rcx, rsi
call fcn.180021038
mov dword [rsp + 0x20], 0x200
xor r9d, r9d
lea r8, [rsp + 0x38]
lea rdx, str.InprocServer
mov rcx, rsi
call fcn.180021038
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, [rsp + 0x38]
lea rdx, str.InprocServer32
mov rcx, rsi
call fcn.180021038
mov dword [rsp + 0x20], 0x200
xor r9d, r9d
lea r8, [rsp + 0x38]
lea rdx, str.InprocServer32
mov rcx, rsi
call fcn.180021038
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, [rsp + 0x38]
lea rdx, str.InprocHandler
mov rcx, rsi
call fcn.180021038
mov dword [rsp + 0x20], 0x200
xor r9d, r9d
lea r8, [rsp + 0x38]
lea rdx, str.InprocHandler
mov rcx, rsi
call fcn.180021038
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, [rsp + 0x38]
lea rdx, str.InprocHandler32
mov rcx, rsi
call fcn.180021038
mov dword [rsp + 0x20], 0x200
xor r9d, r9d
lea r8, [rsp + 0x38]
lea rdx, str.InprocHandler32
mov rcx, rsi
call fcn.180021038
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
sub rdx, rcx
movabs rax, 0x6666666666666667
imul rdx
sar rdx, 5
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x180025aa8
lea rdx, [rbp - 0x70]
call fcn.18001b358
nop
mov rdx, rax
mov rcx, r12
call fcn.18000525c
nop
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x180025a8a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rsp + 0x38]
add rdx, 0x10
mov rcx, r14
call fcn.1800053f4
mov dword [rsp + 0x30], 1
jmp 0x180025c06
cmp dword [rsi + 0x20], 2
jne 0x180025bef
mov rbx, qword [rsi + 0x28]
mov r8d, 4
lea rdx, [0x180089d10]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcsncmp]
test eax, eax
je 0x180025aea
mov r8d, 2
lea rdx, [0x180089d1c]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcsncmp]
test eax, eax
je 0x180025b0e
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x180025bef
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180025bef
test al, 0x10
jne 0x180025bef
xor r8d, r8d
lea rcx, [rbp - 0x10]
call fcn.18002039c
nop
lea rax, vtable.CFileTypeParser.0
mov qword [rbp - 0x10], rax
mov dword [rbp + 0x10], 2
mov eax, dword [rsi + 0x10]
inc eax
mov dword [rbp], eax
mov rax, qword [rsi]
lea rdx, [rbp - 0x68]
mov rcx, rsi
call qword [rax + 0x20]
nop
mov rax, qword [rax]
mov ebx, dword [rax - 0x10]
mov rdx, qword [rbp - 0x68]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x180025b67
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test ebx, ebx
je 0x180025bdb
mov rax, qword [rsi]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call qword [rax + 0x20]
nop
mov r8, qword [rsi + 0x28]
mov rdx, qword [rax]
lea rcx, [rbp - 0x10]
call fcn.180025ce0
mov ebx, eax
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
mov ecx, edi
lock xadd dword [rdx + 0x10], ecx
add ecx, edi
test ecx, ecx
jg 0x180025ba9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test ebx, ebx
je 0x180025bdb
mov r8, r12
mov rdx, r14
lea rcx, [rbp - 0x10]
call fcn.1800253c4
mov dword [rsp + 0x30], 1
lea rax, vtable.CFileTypeParser.0
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x10]
call fcn.180020588
nop
jmp 0x180025c06
lea rax, vtable.CFileTypeParser.0
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x10]
call fcn.180020588
lea rdx, [0x18008ad98]
mov rcx, r14
call fcn.180005348
mov dword [rsp + 0x30], 1
mov rdx, qword [rbp + 0xa0]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x180025c28
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x38]
call fcn.180030d04
nop
lea rcx, [rsp + 0x50]
call fcn.18000acdc
mov rax, r14
add rsp, 0x160
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.18000a540
nop
mov ecx, 0x80004005
call fcn.18000a540
int3