Function at 0x140002b10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
mov eax, 0x1250
call fcn.14000a8c0
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1240], rax
cmp qword [0x14001fb50], 0
mov ebp, edx
mov rsi, rcx
jne 0x140002d88
xor r15d, r15d
lea rbx, [0x14001fb50]
lea r14, [0x14001fba8]
test rcx, rcx
je 0x140002d00
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140002b83
test al, 0x10
lea eax, [r15 + 1]
je 0x140002b86
mov eax, r15d
test eax, eax
je 0x140002d00
call fcn.140003160
mov rdx, rax
lea rcx, str.___Systems_fltmgr.sys_file_version_is:__s_n
mov rdi, rax
call fcn.140001480
lea r8, [0x14000d420]
mov qword [rsp + 0x20], r15
mov rdx, rsi
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
mov r8, qword [rsp + 0x20]
test r8, r8
jne 0x140002bda
lea rcx, str.____Offset_CSV_file_not_found___invalid._A_valid_offset_file_must_be_specifed_
call sub.api_ms_win_crt_stdio_l1_1_0.dll__putws
jmp 0x140002cf4
mov edx, 0x800
lea rcx, [rsp + 0x240]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgetws]
test rax, rax
je 0x140002cd4
nop word [rax + rax]
lea rcx, [rsp + 0x240]
call sub.api_ms_win_crt_string_l1_1_0.dll__wcsdup
lea r8, [rsp + 0x28]
mov qword [rsp + 0x28], r15
lea rdx, [0x14000d4e8]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
mov edx, pe_nt_image_headers64
lea rcx, [rsp + 0x40]
mov r8, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x40]
mov rax, rdi
sub r8, rdi
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140002c64
add rax, 2
test ecx, ecx
jne 0x140002c50
test edx, edx
je 0x140002c8b
mov r8, qword [rsp + 0x20]
lea rcx, [rsp + 0x240]
mov edx, 0x800
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgetws]
test rax, rax
jne 0x140002c00
jmp 0x140002cd4
mov rdx, rdi
lea rcx, str.___Offsets_are_available_for_this_version_of_fltmgr.sys___s___n
call fcn.140001480
mov rdi, rbx
nop dword [rax]
lea r8, [rsp + 0x28]
xor ecx, ecx
lea rdx, [0x14000d4e8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
mov r8d, 0x10
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoull]
mov qword [rdi], rax
add rdi, 8
cmp rdi, r14
jl 0x140002ca0
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, r15d
cmp qword [0x14001fb50], rax
setne al
test eax, eax
jne 0x140002d88
lea rcx, str.____Offsets_are_missing_from_the_CSV_for_the_version_of_fltmgr.sys_in_use.
call sub.api_ms_win_crt_stdio_l1_1_0.dll__putws
test ebp, ebp
je 0x140002e1b
lea rcx, str.___Downloading_fltmgr.sys_related_offsets_from_the_MS_Symbol_Server__will_drop_a_.pdb_file_in_current_directory_
call sub.api_ms_win_crt_stdio_l1_1_0.dll__putws
call fcn.140002e30
test eax, eax
je 0x140002e0f
lea rcx, str.___Downloading_offsets_succeeded__
call sub.api_ms_win_crt_stdio_l1_1_0.dll__putws
test rsi, rsi
je 0x140002d88
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140002d88
test al, 0x10
jne 0x140002d88
lea rcx, str.___Saving_them_to_the_CSV_file...
call sub.api_ms_win_crt_stdio_l1_1_0.dll__putws
call fcn.140003160
lea r8, [0x14000d574]
mov qword [rsp + 0x20], r15
mov rdx, rsi
lea rcx, [rsp + 0x20]
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
jne 0x140002dba
lea rcx, str.____Offset_CSV_file_connot_be_opened
call sub.api_ms_win_crt_stdio_l1_1_0.dll__putws
mov eax, 1
mov rcx, qword [rsp + 0x1240]
xor rcx, rsp
call fcn.140009ae0
lea r11, [rsp + 0x1250]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov r8, rdi
lea rdx, [0x14000d578]
call fcn.1400022c0
nop dword [rax]
mov r8, qword [rbx]
lea rdx, str.__llx
mov rcx, qword [rsp + 0x20]
call fcn.1400022c0
add rbx, 8
cmp rbx, r14
jl 0x140002dd0
mov rdx, qword [rsp + 0x20]
lea rcx, [0x14000b928]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputws]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x140002d88
lea rcx, str.____Downloading_offsets_from_the_internet_failed__
call sub.api_ms_win_crt_stdio_l1_1_0.dll__putws
xor eax, eax
jmp 0x140002d8d