Function at 0x180003b60
Capabilities:
Check if file exists
Create process on windows
Create thread
Get file attributes

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
lea rbp, [rax - 0x168]
sub rsp, 0x250
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1800d1eb0]
xor rax, rsp
mov qword [rbp + 0x148], rax
mov rsi, rcx
xor r13d, r13d
mov r12d, r13d
mov dword [rsp + 0x30], r13d
test edx, edx
je 0x1800047c7
dec edx
jne 0x1800047e1
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov ecx, 0xf8
call fcn.18007b11c
mov rbx, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x180003bf5
mov rcx, rax
call fcn.180032c70
lea r11, vtable.CDetoursFileLogic.0
mov qword [rbx], r11
mov dword [rbx + 0xf0], 1
jmp 0x180003bf8
mov rbx, r13
mov qword [0x1800d6f38], rbx
mov ecx, 8
call fcn.18007b11c
test rax, rax
je 0x180003c1a
lea rcx, vtable.CIatHookFileLogic.0
mov qword [rax], rcx
jmp 0x180003c1d
mov rax, r13
mov qword [0x1800d6f30], rax
mov rcx, rsi
call fcn.180010670
test al, al
jne 0x180003c48
lea rdx, [0x1800a91e8]
lea rcx, [0x1800d7100]
call fcn.180006930
jmp 0x1800047e1
mov rcx, rsi
call fcn.180008c30
test al, al
jne 0x180003c6c
lea rdx, [0x1800a9200]
lea rcx, [0x1800d7100]
call fcn.180006930
jmp 0x1800047e1
lea rcx, [rbp - 0x48]
call fcn.1800112e0
nop
lea rcx, [rsp + 0x40]
call fcn.18000b6c0
nop
mov eax, r13d
mov r9, qword [rsp + 0x50]
test r9, r9
setne al
test eax, eax
sete al
test al, al
sete al
or edi, 0xffffffff
test al, al
je 0x180003d66
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rdx, qword [rbp - 0x48]
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
mov r10, qword [rbp - 0x38]
mov r8, r10
cmp r9, r10
cmovb r8, r9
test r8, r8
je 0x180003cfc
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x180003ced
add rcx, 2
add rdx, 2
dec r8
jne 0x180003cd6
jmp 0x180003cfc
mov r8d, 1
cmp word [rcx], ax
cmovb r8d, edi
jmp 0x180003cff
mov r8d, r13d
movsxd rax, r8d
test r8d, r8d
jne 0x180003d19
cmp r9, r10
jae 0x180003d10
mov eax, edi
jmp 0x180003d19
mov eax, r13d
cmp r9, r10
setne al
test eax, eax
sete al
test al, al
sete al
test al, al
je 0x180003d66
lea rdx, [0x1800a9220]
lea rcx, [0x1800d7100]
call fcn.180006930
nop
cmp qword [rsp + 0x58], 8
jb 0x180003d4d
mov rcx, qword [rsp + 0x40]
call fcn.18007a7a4
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r13
mov word [rsp + 0x40], r13w
jmp 0x180004769
call fcn.180011b50
test al, al
je 0x180003d76
call fcn.180001fd0
jmp 0x180003d7d
xor ecx, ecx
call fcn.180001510
mov ebx, eax
call fcn.180014210
call fcn.180046360
test ebx, ebx
jne 0x180003dcc
lea rdx, [0x1800a9238]
lea rcx, [0x1800d7100]
call fcn.180006930
nop
cmp qword [rsp + 0x58], 8
jb 0x180003db3
mov rcx, qword [rsp + 0x40]
call fcn.18007a7a4
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r13
mov word [rsp + 0x40], r13w
jmp 0x180004769
lea rcx, [rbp + 0xd0]
call fcn.1800112e0
mov r11, rax
mov r8, qword [rax + 0x10]
cmp r8, r8
cmp qword [rax + 0x18], 8
jb 0x180003dec
mov r11, qword [rax]
mov edx, 0x18
cmp r8, rdx
cmovb rdx, r8
lea rcx, str.B08E_U2L9_QC7Z_I2HP_125P
test rdx, rdx
je 0x180003e2a
movzx eax, word [rcx]
cmp word [r11], ax
jne 0x180003e1c
add r11, 2
add rcx, 2
dec rdx
jne 0x180003e04
jmp 0x180003e2a
mov edx, 1
cmp word [r11], ax
cmovb edx, edi
jmp 0x180003e2d
mov edx, r13d
movsxd rax, edx
test edx, edx
jne 0x180003e48
cmp r8, 0x18
jae 0x180003e3e
mov eax, edi
jmp 0x180003e48
mov eax, r13d
cmp r8, 0x18
setne al
test eax, eax
sete bl
cmp qword [rbp + 0xe8], 8
jb 0x180003e63
mov rcx, qword [rbp + 0xd0]
call fcn.18007a7a4
mov qword [rbp + 0xe8], 7
mov qword [rbp + 0xe0], r13
mov word [rbp + 0xd0], r13w
test bl, bl
je 0x180003ecf
mov ebx, dword [0x1800d92b0]
call fcn.180010e00
cmp ebx, eax
je 0x180003ecf
lea rdx, [0x1800a9288]
lea rcx, [0x1800d7100]
call fcn.180006930
nop
cmp qword [rsp + 0x58], 8
jb 0x180003eb6
mov rcx, qword [rsp + 0x40]
call fcn.18007a7a4
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r13
mov word [rsp + 0x40], r13w
jmp 0x180004769
lea rcx, [rsp + 0x68]
call fcn.18000fcf0
nop
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rdx, qword [rbp - 0x48]
lea rcx, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rcx, qword [rsp + 0x68]
mov r9, qword [rbp - 0x38]
mov r8, r9
mov r10, qword [rsp + 0x78]
cmp r10, r9
cmovb r8, r10
test r8, r8
je 0x180003f36
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x180003f27
add rcx, 2
add rdx, 2
dec r8
jne 0x180003f10
jmp 0x180003f36
mov r8d, 1
cmp word [rcx], ax
cmovb r8d, edi
jmp 0x180003f39
mov r8d, r13d
movsxd rax, r8d
test r8d, r8d
jne 0x180003f53
cmp r10, r9
jae 0x180003f4a
mov eax, edi
jmp 0x180003f53
mov eax, r13d
cmp r10, r9
setne al
test eax, eax
sete al
test al, al
sete al
test al, al
je 0x180003fc4
lea rdx, [0x1800a92b0]
lea rcx, [0x1800d7100]
call fcn.180006930
nop
cmp qword [rbp - 0x80], 8
jb 0x180003f86
mov rcx, qword [rsp + 0x68]
call fcn.18007a7a4
mov qword [rbp - 0x80], 7
mov qword [rsp + 0x78], r13
mov word [rsp + 0x68], r13w
cmp qword [rsp + 0x58], 8
jb 0x180003fab
mov rcx, qword [rsp + 0x40]
call fcn.18007a7a4
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r13
mov word [rsp + 0x40], r13w
jmp 0x180004769
call fcn.180001150
lea r11, [rax + 0x230]
mov r8, qword [r11 + 0x10]
cmp r8, r8
cmp qword [r11 + 0x18], 8
jb 0x180003fe1
mov r11, qword [r11]
mov edx, 3
cmp r8, rdx
cmovb rdx, r8
lea rcx, [0x1800a92c8]
test rdx, rdx
je 0x180004026
nop dword [rax]
movzx eax, word [rcx]
cmp word [r11], ax
jne 0x180004018
add r11, 2
add rcx, 2
dec rdx
jne 0x180004000
jmp 0x180004026
mov edx, 1
cmp word [r11], ax
cmovb edx, edi
jmp 0x180004029
mov edx, r13d
movsxd rax, edx
test edx, edx
jne 0x180004044
cmp r8, 3
jae 0x18000403a
mov eax, edi
jmp 0x180004044
mov eax, r13d
cmp r8, 3
setne al
test eax, eax
sete al
test al, al
je 0x18000408b
call fcn.180001150
mov rcx, rax
lea rdx, [rbp + 0xf8]
call fcn.180015ac0
mov r12d, 1
cmp qword [rax + 0x18], 8
jb 0x180004071
mov rax, qword [rax]
lea rdx, [0x1800a92d0]
mov rcx, rax
call fcn.18007b05c
test rax, rax
je 0x18000408b
movzx edi, r12b
jmp 0x18000408e
xor dil, dil
test r12b, 1
je 0x1800040c4
cmp qword [rbp + 0x110], 8
jb 0x1800040aa
mov rcx, qword [rbp + 0xf8]
call fcn.18007a7a4
mov qword [rbp + 0x110], 7
mov qword [rbp + 0x108], r13
mov word [rbp + 0xf8], r13w
mov ebx, 1
test dil, dil
cmovne ebx, r13d
call fcn.180003a80
test eax, eax
je 0x18000477b
call fcn.180011b50
movzx edx, al
mov ecx, ebx
call fcn.1800036c0
test eax, eax
je 0x18000477b
call fcn.180011b50
test al, al
jne 0x180004155
call fcn.1800039b0
test eax, eax
jne 0x180004155
cmp qword [rbp - 0x80], 8
jb 0x180004117
mov rcx, qword [rsp + 0x68]
call fcn.18007a7a4
mov qword [rbp - 0x80], 7
mov qword [rsp + 0x78], r13
mov word [rsp + 0x68], r13w
cmp qword [rsp + 0x58], 8
jb 0x18000413c
mov rcx, qword [rsp + 0x40]
call fcn.18007a7a4
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r13
mov word [rsp + 0x40], r13w
jmp 0x180004769
mov eax, dword [0x1800d9c5c]
test al, 1
jne 0x180004182
or eax, 1
mov dword [0x1800d9c5c], eax
mov qword [0x1800d9be8], r13
mov qword [0x1800d9bf0], r13
lea rcx, [0x1800a02e0]
call fcn.18007b044
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
lea r9, [0x1800d9be8]
lea r8, [0x180018da0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 8], 7
mov qword [rbp - 0x10], r13
mov word [rbp - 0x20], r13w
lea rdx, [rbp - 0x20]
mov rcx, rsi
call fcn.180027eb0
mov qword [rbp + 0x98], 7
mov qword [rbp + 0x90], r13
mov word [rbp + 0x80], r13w
mov r8d, recv
lea rdx, str.PiLogSave.dll
lea rcx, [rbp + 0x80]
call fcn.180004cc0
nop
lea r8, [rbp + 0x80]
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 8]
call fcn.180027780
nop
cmp qword [rbp + 0x98], 8
jb 0x180004220
mov rcx, qword [rbp + 0x80]
call fcn.18007a7a4
mov qword [rbp + 0x98], 7
mov qword [rbp + 0x90], r13
mov word [rbp + 0x80], r13w
lea rcx, [rbp + 8]
cmp qword [rbp + 0x20], 8
cmovae rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180004540
shr eax, 4
not eax
and eax, 1
je 0x180004540
call fcn.180013580
test al, al
je 0x180004540
lea rcx, [rbp + 8]
cmp qword [rbp + 0x20], 8
cmovae rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x180004540
lea rdx, str.PushLogInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800d7080], rax
test rax, rax
je 0x180004540
mov qword [rbp + 0xc0], 7
mov qword [rbp + 0xb8], r13
mov word [rbp + 0xa8], r13w
mov r8d, send
lea rdx, str.PiLogUpload.exe
lea rcx, [rbp + 0xa8]
call fcn.180004cc0
nop
lea r8, [rbp + 0xa8]
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x70]
call fcn.180027780
nop
cmp qword [rbp + 0xc0], 8
jb 0x18000430e
mov rcx, qword [rbp + 0xa8]
call fcn.18007a7a4
mov qword [rbp + 0xc0], 7
mov qword [rbp + 0xb8], r13
mov word [rbp + 0xa8], r13w
lea r8, str.D059A644_F318_468f_9E4E_8F759A18F9E2
xor edx, edx
mov ecx, 0x1f0001
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
test rax, rax
jne 0x18000451f
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180004397
shr eax, 4
not eax
and eax, 1
je 0x180004397
lea r8, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae r8, qword [rbp - 0x70]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x18000451f
mov qword [rbp + 0x70], 7
mov qword [rbp + 0x68], r13
mov word [rbp + 0x58], r13w
lea rdx, [rbp + 0x58]
lea rcx, [rbp - 0x20]
call fcn.180027180
mov qword [rbp + 0x48], 7
mov qword [rbp + 0x40], r13
mov word [rbp + 0x30], r13w
mov r8d, send
lea rdx, str.PiLogUpload.exe
lea rcx, [rbp + 0x30]
call fcn.180004cc0
nop
lea r8, [rbp + 0x30]
lea rdx, [rbp + 0x58]
lea rcx, [rbp + 0x120]
call fcn.180027780
mov rbx, rax
lea rax, [rbp - 0x70]
cmp rax, rbx
je 0x18000445f
cmp qword [rbp - 0x58], 8
jb 0x18000440d
mov rcx, qword [rbp - 0x70]
call fcn.18007a7a4
mov qword [rbp - 0x58], 7
mov qword [rbp - 0x60], r13
mov word [rbp - 0x70], r13w
cmp qword [rbx + 0x18], 8
jae 0x18000443d
mov r8, qword [rbx + 0x10]
inc r8
add r8, r8
mov rdx, rbx
lea rcx, [rbp - 0x70]
call fcn.18007abc0
jmp 0x180004447
mov rax, qword [rbx]
mov qword [rbp - 0x70], rax
mov qword [rbx], r13
mov rax, qword [rbx + 0x10]
mov qword [rbp - 0x60], rax
mov rax, qword [rbx + 0x18]
mov qword [rbp - 0x58], rax
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r13
cmp qword [rbp + 0x138], 8
jb 0x180004475
mov rcx, qword [rbp + 0x120]
call fcn.18007a7a4
mov qword [rbp + 0x138], 7
mov qword [rbp + 0x130], r13
mov word [rbp + 0x120], r13w
cmp qword [rbp + 0x48], 8
jb 0x18000449f
mov rcx, qword [rbp + 0x30]
call fcn.18007a7a4
mov qword [rbp + 0x48], 7
mov qword [rbp + 0x40], r13
mov word [rbp + 0x30], r13w
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800044fe
shr eax, 4
not eax
and eax, 1
je 0x1800044fe
lea r8, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae r8, qword [rbp - 0x70]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
cmp qword [rbp + 0x70], 8
jb 0x18000450e
mov rcx, qword [rbp + 0x58]
call fcn.18007a7a4
mov qword [rbp + 0x70], 7
mov qword [rbp + 0x68], r13
mov word [rbp + 0x58], r13w
cmp qword [rbp - 0x58], 8
jb 0x18000452f
mov rcx, qword [rbp - 0x70]
call fcn.18007a7a4
mov qword [rbp - 0x58], 7
mov qword [rbp - 0x60], r13
mov word [rbp - 0x70], r13w
call fcn.180013580
test al, al
je 0x180004600
cmp qword [0x1800d7080], 0
jne 0x180004600
lea rdx, str.:_6R
lea rcx, [0x1800d7100]
call fcn.1800069c0
nop
cmp qword [rbp + 0x20], 8
jb 0x18000457f
mov rcx, qword [rbp + 8]
call fcn.18007a7a4
mov qword [rbp + 0x20], 7
mov qword [rbp + 0x18], r13
mov word [rbp + 8], r13w
cmp qword [rbp - 8], 8
jb 0x1800045a0
mov rcx, qword [rbp - 0x20]
call fcn.18007a7a4
mov qword [rbp - 8], 7
mov qword [rbp - 0x10], r13
mov word [rbp - 0x20], r13w
cmp qword [rbp - 0x80], 8
jb 0x1800045c2
mov rcx, qword [rsp + 0x68]
call fcn.18007a7a4
mov qword [rbp - 0x80], 7
mov qword [rsp + 0x78], r13
mov word [rsp + 0x68], r13w
cmp qword [rsp + 0x58], 8
jb 0x1800045e7
mov rcx, qword [rsp + 0x40]
call fcn.18007a7a4
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r13
mov word [rsp + 0x40], r13w
jmp 0x180004769
call fcn.180001050
test eax, eax
je 0x180004650
call fcn.180047140
mov rcx, qword [rax + 8]
mov rbx, qword [rcx + 0x38]
movzx eax, byte [rbx + 0x48]
test al, al
jne 0x180004650
lea rax, [rbx + 0x18]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
mov r9, rbx
lea r8, [0x18006a6d0]
xor edx, edx
xor ecx, ecx
call fcn.18009751c
mov qword [rbx + 8], rax
test rax, rax
setne al
mov byte [rbx + 0x48], al
movzx eax, byte [rbx + 0x48]
mov ecx, 0x888
call fcn.18007b11c
mov rbx, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x18000467b
mov rcx, rax
call fcn.1800371a0
lea r11, vtable.CIatFileProcess.0
mov qword [rbx], r11
jmp 0x18000467e
mov rbx, r13
mov qword [0x1800d6f28], rbx
mov ecx, 0x1230
call fcn.18007b11c
mov rbx, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1800046b0
mov rcx, rax
call fcn.1800494d0
lea r11, vtable.COleEnclogic.0
mov qword [rbx], r11
jmp 0x1800046b3
mov rbx, r13
mov rcx, qword [0x1800d6f38]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [0x1800d6f38]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [0x1800d6f30]
mov rax, qword [rcx]
call qword [rax]
nop
cmp qword [rbp + 0x20], 8
jb 0x1800046ed
mov rcx, qword [rbp + 8]
call fcn.18007a7a4
mov qword [rbp + 0x20], 7
mov qword [rbp + 0x18], r13
mov word [rbp + 8], r13w
cmp qword [rbp - 8], 8
jb 0x18000470e
mov rcx, qword [rbp - 0x20]
call fcn.18007a7a4
mov qword [rbp - 8], 7
mov qword [rbp - 0x10], r13
mov word [rbp - 0x20], r13w
cmp qword [rbp - 0x80], 8
jb 0x180004730
mov rcx, qword [rsp + 0x68]
call fcn.18007a7a4
mov qword [rbp - 0x80], 7
mov qword [rsp + 0x78], r13
mov word [rsp + 0x68], r13w
cmp qword [rsp + 0x58], 8
jb 0x180004755
mov rcx, qword [rsp + 0x40]
call fcn.18007a7a4
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r13
mov word [rsp + 0x40], r13w
cmp qword [rbp - 0x30], 8
jb 0x1800047e1
mov rcx, qword [rbp - 0x48]
call fcn.18007a7a4
jmp 0x1800047e1
cmp qword [rbp - 0x80], 8
jb 0x18000478c
mov rcx, qword [rsp + 0x68]
call fcn.18007a7a4
mov qword [rbp - 0x80], 7
mov qword [rsp + 0x78], r13
mov word [rsp + 0x68], r13w
cmp qword [rsp + 0x58], 8
jb 0x1800047b1
mov rcx, qword [rsp + 0x40]
call fcn.18007a7a4
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r13
mov word [rsp + 0x40], r13w
jmp 0x180004769
mov rcx, qword [0x1800d6f38]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rcx, qword [0x1800d6f30]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 1
mov rcx, qword [rbp + 0x148]
xor rcx, rsp
call fcn.18007a7c0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rbp
ret