Function at 0x140047dd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rsi, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x70], rax
cmp byte [rcx + 0x17], 0
jns 0x140047dfb
mov rcx, qword [rsi]
lea rdx, [0x1402b9404]
mov r8d, 4
call fcn.1401cc8e8
xor ecx, ecx
test eax, eax
sete cl
movzx eax, byte [rsi + 0x17]
test al, al
js 0x140047e23
mov edx, eax
and edx, 0x7f
jmp 0x140047e27
mov rdx, qword [rsi + 8]
lea r8, [rcx*4 + 5]
cmp rdx, r8
jb 0x140047e60
shl rcx, 2
mov rdx, rsi
test al, al
jns 0x140047e42
mov rdx, qword [rsi]
lea rcx, [rdx + rcx*2]
lea rdx, str.pipe_
mov r8d, 5
call fcn.1401cc8e8
test eax, eax
je 0x140048099
xorps xmm0, xmm0
lea rdi, [rsp + 0x30]
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov rcx, rsi
mov rdx, rdi
call fcn.140048bf0
mov ebx, eax
movzx eax, byte [rdi + 0x17]
mov edx, eax
and edx, 0x7f
test al, al
mov rcx, qword [rdi + 8]
cmovs rdx, rcx
cmp rdx, 3
jb 0x140048092
test al, al
jns 0x14004805d
test rcx, rcx
je 0x140048192
mov rdi, qword [rsp + 0x30]
cmp word [rdi + 2], 0x3a
jne 0x140048092
cmp rcx, 2
jb 0x140048195
cmp word [rdi + 4], 0x5c
jne 0x140048092
movzx edx, word [rdi]
and edx, 0xffffffdf
add edx, 0xffffffbf
cmp dx, 0x1a
setb bpl
mov edx, eax
and edx, 0x78
test al, al
cmovs rdx, rcx
cmp rdx, 8
jb 0x140047f1f
test al, al
js 0x140047f00
lea rcx, [rsp + 0x30]
jmp 0x140047f05
mov rcx, qword [rsp + 0x30]
lea rdx, [0x1402b9610]
mov r8d, 8
call fcn.1401cc8e8
test eax, eax
je 0x1400480cf
or bl, bpl
cmp bl, 1
jne 0x1400480a0
test bpl, bpl
je 0x140048198
mov rbx, 0xffffffffffffffff
xor r14d, r14d
lea r15, [rsp + 0x60]
lea rsi, [rsp + 0x48]
lea rdi, [rsp + 0x30]
mov r12, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x140047fd9
xor r13d, r13d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7b
jne 0x140048121
cmp eax, 0x7b
je 0x140047f8c
jmp 0x1400480b8
mov rcx, qword [rsp + 0x30]
call r12
cmp eax, 0xffffffff
je 0x140047f59
bt eax, 0xa
jb 0x140048084
movzx ecx, byte [rsp + 0x47]
mov eax, ecx
and eax, 0x7f
test cl, cl
cmovs rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
cmovns rcx, rdi
mov rbx, 0xffffffffffffffff
mov r14b, 1
test rax, rax
je 0x140047fd3
add rax, rax
test rax, rax
je 0x140047fd3
lea rdx, [rax - 2]
cmp word [rcx + rax - 2], 0x5c
mov rax, rdx
jne 0x140047fb9
sar rdx, 1
mov rbx, rdx
cmp rbx, 2
jbe 0x140048027
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.14001e050
cmp byte [rsp + 0x47], 0
jns 0x140048000
mov rcx, qword [rsp + 0x30]
call fcn.1401cbbbc
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x40], rax
movups xmm0, xmmword [rsp + 0x48]
movaps xmmword [rsp + 0x30], xmm0
cmp byte [rsp + 0x47], 0
mov rcx, rdi
jns 0x140047f7a
jmp 0x140047f75
mov esi, 0x1126
cmp byte [rsp + 0x47], 0
jns 0x14004803d
mov rcx, qword [rsp + 0x30]
call fcn.1401cbbbc
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401ce5b0
mov eax, esi
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test rax, rax
je 0x140048192
cmp word [rsp + 0x32], 0x3a
jne 0x140048092
cmp al, 1
jbe 0x140048195
cmp word [rsp + 0x34], 0x5c
je 0x140047ed3
jmp 0x140048092
mov dword [rsp + 0x2c], 0
mov esi, dword [rsp + 0x2c]
jmp 0x14004802c
xor ebp, ebp
jmp 0x140047ee4
mov esi, 0x1126
jmp 0x14004803d
mov esi, 0x7b
jmp 0x14004802c
mov esi, 0x1126
cmp r13d, 2
je 0x14004802c
jmp 0x14004808c
add eax, 0xfffffffe
cmp eax, 2
jb 0x140047f8c
test r13d, r13d
je 0x140047fd3
jmp 0x1400480a7
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x48]
lea rsi, [rsp + 0x30]
mov r8d, 8
mov rdx, rsi
mov r9, 0xffffffffffffffff
call fcn.14001e050
cmp byte [rsi + 0x17], 0
jns 0x140048108
mov rcx, qword [rsp + 0x30]
call fcn.1401cbbbc
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x40], rax
movups xmm0, xmmword [rsp + 0x48]
movaps xmmword [rsp + 0x30], xmm0
jmp 0x140047f2b
lea ecx, [rax - 2]
cmp ecx, 2
jb 0x140047f6b
test r14b, 1
sete cl
or cl, bpl
jne 0x140048181
lea rcx, [rsp + 0x30]
movzx r8d, byte [rcx + 0x17]
mov edx, r8d
and edx, 0x7f
test r8b, r8b
cmovs rdx, qword [rcx + 8]
cmovs rcx, qword [rcx]
test rdx, rdx
je 0x140048181
add rdx, rdx
test rdx, rdx
je 0x140048181
lea r8, [rdx - 2]
cmp word [rcx + rdx - 2], 0x5c
mov rdx, r8
jne 0x14004815d
mov r13d, 2
cmp r8, 6
je 0x140047f6b
mov r13d, 1
mov ecx, eax
mov dword [rsp + 0x2c], eax
jmp 0x140047f6b
int3
int3
lea rdi, [rsp + 0x38]
lea rdx, [0x1402b94b0]
lea rsi, [rsp + 0x48]
mov rcx, rsi
call fcn.140207340
movzx eax, byte [rdi + 0xf]
mov r8d, eax
and r8d, 0x7f
test al, al
cmovs r8, qword [rdi]
lea r14, [rsp + 0x30]
mov rdx, qword [r14]
cmovns rdx, r14
mov rcx, rsi
call fcn.14001de40
mov rsi, qword [rax]
mov rcx, qword [rax + 8]
mov rdx, qword [rax + 0xf]
mov qword [rsp + 0x67], rdx
mov qword [rsp + 0x60], rcx
mov bl, byte [rax + 0x17]
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
cmp byte [r14 + 0x17], 0
jns 0x14004820d
mov rcx, qword [rsp + 0x30]
call fcn.1401cbbbc
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x67]
mov qword [rdi + 7], rcx
mov qword [rdi], rax
mov byte [rsp + 0x47], bl
cmp byte [rsp + 0x5f], 0
jns 0x140047f34
mov rcx, qword [rsp + 0x48]
call fcn.1401cbbbc
jmp 0x140047f34