Function at 0x140097c80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xe8
mov qword [rsp + 0xd0], 0xfffffffffffffffe
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
lea rdx, str.AutoProtect
lea rcx, str.ImageGuardian
call fcn.14001ee20
test eax, eax
jne 0x140097cc7
xor al, al
jmp 0x140097fc8
call fcn.140096f40
movzx eax, al
test eax, eax
je 0x140097cdf
call fcn.140096f10
movzx eax, al
test eax, eax
jne 0x140097ce6
xor al, al
jmp 0x140097fc8
mov rcx, qword [rsp + 0xf0]
call fcn.140004a80
test eax, eax
jne 0x140097cfe
xor al, al
jmp 0x140097fc8
mov rdx, qword [rsp + 0xf0]
lea rcx, [rsp + 0x38]
call fcn.140004cb0
nop
lea r8, [0x1401486f4]
lea rdx, [0x1401486fc]
lea rcx, [rsp + 0x38]
call fcn.140003570
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x50]
call fcn.140004cb0
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x70]
call fcn.14001a6e0
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x68], rax
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x38]
call fcn.140004b30
nop
lea rcx, [rsp + 0x70]
call fcn.140001910
lea rcx, [rsp + 0x40]
call fcn.140004d40
nop
mov r8d, 3
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x38]
call fcn.140048770
mov qword [rsp + 0x78], rax
lea rdx, [0x140148708]
mov rcx, qword [rsp + 0x78]
call fcn.140045140
mov byte [rsp + 0x30], al
lea rcx, [rsp + 0x80]
call fcn.140001910
movzx eax, byte [rsp + 0x30]
test eax, eax
je 0x140097ec4
mov r8d, 4
lea rdx, [0x140147f04]
lea rcx, [rsp + 0x38]
call fcn.1400034e0
mov dword [rsp + 0x48], eax
mov r8d, dword [rsp + 0x48]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x38]
call fcn.140048770
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x90], rax
mov r8w, 0x5c
mov rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0xa8]
call fcn.14009b910
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0xa0], rax
mov rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x40]
call fcn.140004b30
nop
lea rcx, [rsp + 0xa8]
call fcn.140001910
nop
lea rcx, [rsp + 0xb0]
call fcn.140001910
lea rcx, [rsp + 0x40]
call fcn.140004640
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140097ebf
mov byte [rsp + 0x31], 0
lea rcx, [rsp + 0x40]
call fcn.140001910
nop
lea rcx, [rsp + 0x38]
call fcn.140001910
movzx eax, byte [rsp + 0x31]
jmp 0x140097fc8
jmp 0x140097f9e
lea rcx, [rsp + 0x38]
call fcn.140004a80
cmp eax, 3
jl 0x140097f7d
mov edx, 1
lea rcx, [rsp + 0x38]
call fcn.140048070
movzx eax, ax
cmp eax, 0x3a
jne 0x140097f7d
mov r8d, 3
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x38]
call fcn.140048770
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0xc0], rax
mov rdx, qword [rsp + 0xc0]
lea rcx, [rsp + 0x40]
call fcn.140004b30
nop
lea rcx, [rsp + 0xc8]
call fcn.140001910
lea rcx, [rsp + 0x40]
call fcn.140004640
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140097f7b
mov byte [rsp + 0x32], 0
lea rcx, [rsp + 0x40]
call fcn.140001910
nop
lea rcx, [rsp + 0x38]
call fcn.140001910
movzx eax, byte [rsp + 0x32]
jmp 0x140097fc8
jmp 0x140097f9e
mov byte [rsp + 0x33], 0
lea rcx, [rsp + 0x40]
call fcn.140001910
nop
lea rcx, [rsp + 0x38]
call fcn.140001910
movzx eax, byte [rsp + 0x33]
jmp 0x140097fc8
mov dl, 1
lea rcx, [rsp + 0x40]
call fcn.1400978b0
mov byte [rsp + 0x34], al
lea rcx, [rsp + 0x40]
call fcn.140001910
nop
lea rcx, [rsp + 0x38]
call fcn.140001910
movzx eax, byte [rsp + 0x34]
add rsp, 0xe8
ret