Function at 0x140004f70
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [rcx + 0x48]
test rax, rax
je 0x140005262
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov r14, qword [rsi + 0x58]
test r14, r14
je 0x14000522e
mov rax, qword [rsp + 0x28]
mov r15, qword [rax + 0x40]
movdqa xmm0, xmmword [r15]
pmovmskb eax, xmm0
not eax
lea r12, [r15 + 0x10]
jmp 0x140004fe0
lea eax, [r13 - 1]
and eax, r13d
dec r14
je 0x14000522e
test ax, ax
jne 0x14000500e
nop word cs:[rax + rax]
movdqa xmm0, xmmword [r12]
pmovmskb eax, xmm0
add r15, 0xffffffffffffea00
add r12, 0x10
cmp eax, 0xffff
je 0x140004ff0
not eax
mov r13d, eax
tzcnt eax, r13d
neg rax
imul rax, rax, 0x160
lea rbp, [r15 + rax]
cmp qword [r15 + rax - 0x148], 0
je 0x140005044
mov r8, qword [rbp - 0x140]
mov rcx, qword [0x1401120f0]
xor edx, edx
call fcn.14005177c
mov rdi, qword [rbp - 0x120]
mov rbx, qword [rbp - 0x118]
test rbx, rbx
je 0x140005090
lea rsi, [rdi + 8]
jmp 0x140005069
add rsi, 0x20
dec rbx
je 0x140005090
cmp qword [rsi - 8], 0
je 0x140005060
mov r8, qword [rsi]
mov rcx, qword [0x1401120f0]
xor edx, edx
call fcn.14005177c
jmp 0x140005060
cmp qword [rbp - 0x128], 0
je 0x1400050ab
mov rcx, qword [0x1401120f0]
xor edx, edx
mov r8, rdi
call fcn.14005177c
mov rax, qword [rbp - 0xf8]
shl rax, 1
test rax, rax
jne 0x1400050f0
mov rax, qword [rbp - 0xd8]
shl rax, 1
test rax, rax
jne 0x140005114
mov rdi, qword [rbp - 0x108]
mov rbx, qword [rbp - 0x100]
test rbx, rbx
jne 0x14000513c
jmp 0x140005180
mov r8, qword [rbp - 0xf0]
mov rcx, qword [0x1401120f0]
xor edx, edx
call fcn.14005177c
mov rax, qword [rbp - 0xd8]
shl rax, 1
test rax, rax
je 0x1400050c9
mov r8, qword [rbp - 0xd0]
mov rcx, qword [0x1401120f0]
xor edx, edx
call fcn.14005177c
mov rdi, qword [rbp - 0x108]
mov rbx, qword [rbp - 0x100]
test rbx, rbx
je 0x140005180
lea rsi, [rdi + 8]
jmp 0x140005159
add rsi, 0x20
dec rbx
je 0x140005180
cmp qword [rsi - 8], 0
je 0x140005150
mov r8, qword [rsi]
mov rcx, qword [0x1401120f0]
xor edx, edx
call fcn.14005177c
jmp 0x140005150
cmp qword [rbp - 0x110], 0
je 0x14000519b
mov rcx, qword [0x1401120f0]
xor edx, edx
mov r8, rdi
call fcn.14005177c
mov rax, qword [rbp - 0xc0]
shl rax, 1
test rax, rax
jne 0x1400051d0
mov rax, qword [rbp - 0xa0]
shl rax, 1
test rax, rax
jne 0x1400051f4
mov rax, qword [rbp - 0x60]
test rax, rax
jne 0x140005216
jmp 0x140004fd0
mov r8, qword [rbp - 0xb8]
mov rcx, qword [0x1401120f0]
xor edx, edx
call fcn.14005177c
mov rax, qword [rbp - 0xa0]
shl rax, 1
test rax, rax
je 0x1400051b9
mov r8, qword [rbp - 0x98]
mov rcx, qword [0x1401120f0]
xor edx, edx
call fcn.14005177c
mov rax, qword [rbp - 0x60]
test rax, rax
je 0x140004fd0
lock dec qword [rax]
jne 0x140004fd0
mov rcx, qword [rbp - 0x60]
call fcn.140006670
jmp 0x140004fd0
mov r8, qword [rsp + 0x30]
lea rax, [r8 + 1]
mov ecx, 0x160
mul rcx
add r8, rax
cmp r8, 0xffffffffffffffef
mov rsi, qword [rsp + 0x28]
je 0x140005262
mov r8, qword [rsi + 0x40]
sub r8, rax
mov rcx, qword [0x1401120f0]
xor edx, edx
call fcn.14005177c
mov rax, qword [rsi + 0x18]
shl rax, 1
test rax, rax
jne 0x140005280
mov rdi, qword [rsi + 8]
mov rbx, qword [rsi + 0x10]
test rbx, rbx
jne 0x1400052a3
jmp 0x14000532c
mov r8, qword [rsi + 0x20]
mov rcx, qword [0x1401120f0]
xor edx, edx
call fcn.14005177c
mov rdi, qword [rsi + 8]
mov rbx, qword [rsi + 0x10]
test rbx, rbx
je 0x14000532c
lea r14, [rdi + 0x50]
jmp 0x1400052b9
add r14, 0x70
dec rbx
je 0x14000532c
cmp qword [r14 - 0x50], 0
je 0x1400052d2
mov r8, qword [r14 - 0x48]
mov rcx, qword [0x1401120f0]
xor edx, edx
call fcn.14005177c
cmp qword [r14 - 0x38], 0
je 0x1400052eb
mov r8, qword [r14 - 0x30]
mov rcx, qword [0x1401120f0]
xor edx, edx
call fcn.14005177c
mov rax, qword [r14 - 8]
shl rax, 1
test rax, rax
jne 0x140005300
cmp qword [r14 - 0x20], 0
jne 0x140005318
jmp 0x1400052b0
mov r8, qword [r14]
mov rcx, qword [0x1401120f0]
xor edx, edx
call fcn.14005177c
cmp qword [r14 - 0x20], 0
je 0x1400052b0
mov r8, qword [r14 - 0x18]
mov rcx, qword [0x1401120f0]
xor edx, edx
call fcn.14005177c
jmp 0x1400052b0
cmp qword [rsi], 0
je 0x140005343
mov rcx, qword [0x1401120f0]
xor edx, edx
mov r8, rdi
call fcn.14005177c
mov rdi, qword [rsi + 0x90]
test rdi, rdi
je 0x1400054d9
mov rbx, qword [rsi + 0xa8]
test rbx, rbx
je 0x1400053da
lea r14, [rdi + 0x10]
movdqa xmm0, xmmword [rdi]
pmovmskb eax, xmm0
not eax
mov r15, rdi
mov r12, rbx
jmp 0x1400053a2
lea ebp, [rax - 1]
and ebp, eax
tzcnt eax, eax
shl eax, 5
mov rcx, r15
sub rcx, rax
mov rcx, qword [rcx - 8]
call sub.pdh.dll_PdhRemoveCounter
mov eax, ebp
dec r12
je 0x1400053da
test ax, ax
jne 0x140005380
nop word [rax + rax]
movdqa xmm0, xmmword [r14]
pmovmskb eax, xmm0
add r15, 0xfffffffffffffe00
add r14, 0x10
cmp eax, 0xffff
je 0x1400053b0
mov ecx, 0xfffffffe
sub ecx, eax
not eax
mov ebp, eax
and ebp, ecx
jmp 0x140005385
mov rcx, qword [rsi + 0xc8]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x1400053f4
call sub.KERNEL32.dll_CloseHandle
test eax, eax
je 0x140005416
mov rcx, qword [rsi + 0xc0]
lea rax, [rcx + 1]
cmp rax, 2
jae 0x14000542c
mov r14, qword [rsi + 0x98]
test r14, r14
jne 0x140005441
jmp 0x1400054d9
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [rsi + 0xc0]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x140005405
call sub.pdh.dll_PdhCloseQuery
mov r14, qword [rsi + 0x98]
test r14, r14
je 0x1400054d9
test rbx, rbx
je 0x1400054ca
movdqa xmm0, xmmword [rdi]
pmovmskb r12d, xmm0
not r12d
lea r15, [rdi + 0x10]
jmp 0x140005470
lea eax, [r12 - 1]
and eax, r12d
mov r12d, eax
dec rbx
je 0x1400054ca
test r12w, r12w
jne 0x1400054a1
nop word cs:[rax + rax]
movdqa xmm0, xmmword [r15]
pmovmskb r12d, xmm0
add rdi, 0xfffffffffffffe00
add r15, 0x10
cmp r12d, 0xffff
je 0x140005480
not r12d
tzcnt ecx, r12d
shl ecx, 5
mov rax, rdi
sub rax, rcx
cmp qword [rax - 0x20], 0
je 0x140005460
mov r8, qword [rax - 0x18]
mov rcx, qword [0x1401120f0]
xor edx, edx
call fcn.14005177c
jmp 0x140005460
movabs rax, 0x7c1f07c1f07c1ef
cmp r14, rax
jne 0x1400054ea
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
shl r14, 5
mov rax, qword [rsi + 0x90]
neg r14
lea r8, [rax + r14]
add r8, 0xffffffffffffffe0
mov rcx, qword [0x1401120f0]
xor edx, edx
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.14005177c