Function at 0x180026b70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
lea rbp, [r11 - 0x158]
sub rsp, 0x240
mov rax, qword [0x1800e10f8]
xor rax, rsp
mov qword [rbp + 0x110], rax
mov qword [r11 + 0x18], rbx
mov qword [r11 - 0x20], r12
mov r12, rcx
mov qword [r11 - 0x28], r13
xor r13d, r13d
mov qword [r11 - 0x30], r14
mov esi, r13d
mov dword [rsp + 0x7c], r13d
mov edi, r13d
mov dword [rsp + 0x78], r13d
mov r14, rdx
mov dword [rsp + 0x74], r13d
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
mov qword [r11 - 0x38], r15
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18002708f
test al, 0x50
jne 0x18002708f
call fcn.180026220
cmp eax, 1
je 0x180026bfb
lea esi, [r13 + 0x7e]
jmp 0x180027094
mov qword [rsp + 0x50], r13
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rax
mov r9d, 2
lea rax, [rsp + 0x60]
mov r8d, 0x400
mov qword [rsp + 0x40], rax
mov rdx, r12
lea rax, [rsp + 0x74]
mov qword [rsp + 0x38], rax
lea ecx, [r9 - 1]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x28], rax
mov rax, qword [0x1800e3400]
mov dword [rsp + 0x20], r13d
call qword [case.0x1800152ca.0]
mov edi, eax
test eax, eax
jne 0x180026c6a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x180027094
mov ecx, 0x23f0
call fcn.1800226e0
test eax, eax
jne 0x180026f5c
mov rcx, r12
call fcn.1800223c0
test eax, eax
je 0x180026f5c
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp + 0x100], rax
mov r15d, r13d
mov dword [rbp + 0x108], eax
mov rax, qword [0x1800e3420]
movups xmmword [rbp + 0xf0], xmm0
test rax, rax
jne 0x180026cd2
xor edx, edx
lea rcx, str.Advapi32.dll
call fcn.180022920
mov qword [0x1800e3420], rax
test rax, rax
je 0x180026e37
cmp qword [0x1800e3448], rsi
jne 0x180026d02
lea rdx, str.OpenSCManagerW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800e3448], rax
test rax, rax
je 0x180026e37
mov rax, qword [0x1800e3420]
cmp qword [0x1800e3450], rsi
jne 0x180026d32
lea rdx, str.OpenServiceW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800e3450], rax
test rax, rax
je 0x180026e37
mov rax, qword [0x1800e3420]
cmp qword [0x1800e3460], rsi
jne 0x180026d62
lea rdx, str.QueryServiceStatus
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800e3460], rax
test rax, rax
je 0x180026e37
mov rax, qword [0x1800e3420]
cmp qword [0x1800e3468], rsi
jne 0x180026d8b
lea rdx, str.CloseServiceHandle
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800e3468], rax
test rax, rax
je 0x180026e37
mov rax, qword [0x1800e3448]
xor edx, edx
xor ecx, ecx
mov r8d, 0x80000000
call qword [case.0x1800152ca.0]
mov rdi, rax
test rax, rax
je 0x180026e2e
mov rcx, rax
lea rdx, str.CryptSvc
mov rax, qword [0x1800e3450]
mov r8d, 4
call qword [case.0x1800152ca.0]
mov rbx, rax
test rax, rax
je 0x180026e1e
mov rcx, rax
lea rdx, [rbp + 0xf0]
mov rax, qword [0x1800e3460]
call qword [case.0x1800152ca.0]
test eax, eax
je 0x180026e0e
mov ecx, dword [rbp + 0xf4]
sub ecx, 4
je 0x180026e08
sub ecx, 1
je 0x180026e08
sub ecx, 1
je 0x180026e08
cmp ecx, 1
jne 0x180026e0e
mov r15d, 1
mov rax, qword [0x1800e3468]
mov rcx, rbx
call qword [case.0x1800152ca.0]
mov rax, qword [0x1800e3468]
mov rcx, rdi
call qword [case.0x1800152ca.0]
test r15d, r15d
jne 0x180026f5c
mov rdi, qword [rsp + 0x68]
lea rax, [rsp + 0x70]
mov rsi, qword [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rax, qword [0x1800e33f8]
mov rcx, rdi
lea edx, [r9 + 6]
call qword [case.0x1800152ca.0]
test eax, eax
jne 0x180026e7e
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x180026f47
mov edx, dword [rsp + 0x70]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
jne 0x180026eab
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x180026f47
xor r8d, r8d
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov rax, qword [0x1800e33f8]
mov rcx, rdi
lea edx, [r8 + 6]
call qword [case.0x1800152ca.0]
test eax, eax
je 0x180026e95
movups xmm0, xmmword [rbx + 8]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
mov r9d, 0xb0000
mov rax, qword [0x1800e33f0]
xor r8d, r8d
movaps xmmword [rbp + 0x50], xmm0
mov edx, 0x10001
movups xmm1, xmmword [rbx + 0x18]
mov rcx, rsi
movups xmmword [rbp + 0x28], xmm1
call qword [case.0x1800152ca.0]
mov rdi, rax
test rax, rax
je 0x180026e95
test r14, r14
je 0x180026f2b
mov rcx, rax
call fcn.180022340
mov dword [r14], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [0x1800e33e8]
mov rcx, rdi
call qword [case.0x1800152ca.0]
mov edi, r13d
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, 1
mov esi, r13d
jmp 0x180027094
xorps xmm1, xmm1
mov qword [rbp], 0x20
xor eax, eax
movaps xmmword [rbp - 0x40], xmm1
movups xmmword [rbp - 0x70], xmm1
mov qword [rbp - 0x30], rax
mov ecx, 0x23f0
movups xmmword [rbp - 0x60], xmm1
mov qword [rbp + 8], r12
movups xmmword [rbp - 0x80], xmm1
mov dword [rbp - 0x80], 0x58
movups xmmword [rbp - 0x50], xmm1
mov dword [rbp - 0x50], 1
psrldq xmm1, 8
xorps xmm0, xmm0
movd eax, xmm1
movdqu xmmword [rbp + 0x10], xmm0
mov dword [rbp - 0x68], 2
bts eax, 0xc
mov dword [rbp - 0x64], 1
mov dword [rbp - 0x38], eax
lea rax, [rbp]
mov qword [rbp - 0x58], rax
mov dword [rbp - 0x60], 1
call fcn.1800226e0
mov r8, qword [rsp + 0x68]
mov r9, r14
mov rdx, qword [rsp + 0x60]
lea rcx, [rbp - 0x80]
test eax, eax
jne 0x180027003
call fcn.1800237a0
mov edi, eax
test eax, eax
jne 0x180027094
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x180027094
xorps xmm0, xmm0
mov dword [rbp - 4], r13d
lea rax, [rbp - 0x20]
mov qword [rbp - 0x20], 0x20
movdqu xmmword [rbp - 0x14], xmm0
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x18], 3
call fcn.1800237a0
mov edi, eax
test eax, eax
jne 0x180027094
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ebx, 1
mov rax, qword [rbp - 0x30]
cmp dword [rax + 0xc], ebx
jb 0x180027094
nop word [rax + rax]
mov qword [rbp - 0x48], r13
lea rcx, [rbp - 0x80]
mov dword [rbp - 0x50], 1
mov r9, r14
mov dword [rax + 4], ebx
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
call fcn.1800237a0
mov edi, eax
test eax, eax
jne 0x180027094
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
inc ebx
mov rax, qword [rbp - 0x30]
cmp ebx, dword [rax + 0xc]
jbe 0x180027050
jmp 0x180027094
mov esi, 2
mov rcx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x220]
mov r14, qword [rsp + 0x228]
mov r13, qword [rsp + 0x230]
mov r12, qword [rsp + 0x238]
mov rbx, qword [rsp + 0x270]
test rcx, rcx
je 0x1800270d5
mov rax, qword [0x1800e33e0]
xor edx, edx
call qword [case.0x1800152ca.0]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1800270ec
mov rax, qword [0x1800e33d8]
call qword [case.0x1800152ca.0]
test edi, edi
jne 0x1800270f4
mov ecx, esi
jmp 0x1800270f6
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.180057160
add rsp, 0x240
pop rdi
pop rsi
pop rbp
ret