Function at 0x18000f030
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x480
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rax, qword [0x180064138]
xor rax, rsp
mov qword [rsp + 0x470], rax
xor esi, esi
mov ebx, esi
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x50]
call fcn.180027560
lea edx, [rsi + 1]
lea rcx, [rsp + 0x50]
call fcn.1800094b0
test eax, eax
je 0x18000f121
mov ecx, 0x104
lea rax, [rsp + 0x50]
cmp word [rax], bx
je 0x18000f0a2
add rax, 2
sub rcx, 1
jne 0x18000f093
mov eax, 0x104
sub rax, rcx
mov r8, rsi
test rcx, rcx
cmovne r8, rax
je 0x18000f10f
mov edx, 0x104
sub rdx, r8
lea rcx, [rsp + 0x50]
lea rcx, [rcx + r8*2]
je 0x18000f101
lea rax, [r8 + 0x7ffffefa]
add rax, rdx
lea r9, str..service.dll
sub r9, rcx
nop dword [rax]
test rax, rax
je 0x18000f101
movzx r8d, word [r9 + rcx]
test r8w, r8w
je 0x18000f101
mov word [rcx], r8w
add rcx, 2
dec rax
sub rdx, 1
jne 0x18000f0e0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], si
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.180009de0
mov rbx, rax
mov rcx, rbx
call fcn.18000d5e0
mov edi, esi
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x260]
call fcn.180027560
mov edx, 0x104
lea rcx, [rsp + 0x260]
call fcn.180009320
test eax, eax
je 0x18000f196
lea rcx, [rsp + 0x260]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18000f196
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, [rsp + 0x260]
mov rdx, qword [str.RunAs]
mov rcx, rbx
call fcn.18000a120
cmp eax, 0x20
setae dil
lea rax, str.open_maintab_succeed
lea rbx, str.open_maintab_fail
test edi, edi
cmovne rbx, rax
call fcn.180007b50
mov rcx, rax
test rax, rax
je 0x18000f2f5
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov rdi, 0xffffffffffffffff
cmp rbx, 0x10000
jae 0x18000f1e9
movzx edx, bx
lea rcx, [rsp + 0x38]
call fcn.18000cc80
jmp 0x18000f20b
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x18000f1f0
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.18000fcf0
nop
call fcn.180007b50
mov rcx, rax
test rax, rax
je 0x18000f2ea
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rdx, str.LDSShellExt
cmp rdx, 0x10000
jae 0x18000f24a
movzx edx, dx
lea rcx, [rsp + 0x30]
call fcn.18000cc80
jmp 0x18000f268
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x18000f250
mov r8d, eax
lea rcx, [rsp + 0x30]
call fcn.18000fcf0
nop
call fcn.18000c770
mov rcx, rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x30]
call fcn.180017910
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000f2a7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x18000f2c3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xor eax, eax
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.18001e0c0
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov ecx, 0x80004005
call fcn.180008e40
nop
mov ecx, 0x80004005
call fcn.180008e40
int3