Function at 0x164f91bc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x408]
sub rsp, 0x4d0
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
mov rax, qword [0x16514b200]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov r15, qword [rbp + 0x410]
mov r14, qword [rbp + 0x418]
mov qword [rbp - 0x78], r14
mov dword [rsp + 0x30], 1
xorps xmm0, xmm0
movups xmmword [r14], xmm0
xor ebx, ebx
mov qword [r14], rbx
mov qword [r14 + 8], rbx
mov ecx, 0x88
call fcn.165001480
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [r14], rax
mov r12d, 1
mov dword [rsp + 0x30], r12d
mov rcx, qword [r15 + 8]
test rcx, rcx
je 0x164f92268
mov qword [rbp + 0xd8], rbx
mov rax, qword [rcx]
mov qword [rbp + 0xd8], rbx
lea r9, [rbp + 0xd8]
xor edx, edx
mov r8d, 0xe0
mov rax, qword [rax + 0x20]
call qword [case.0x164e9d7b8.0]
test eax, eax
js 0x164f922b5
xor ecx, ecx
call fcn.165018578
mov r13, rax
mov qword [rbp - 0x68], rbx
mov rcx, qword [rbp + 0xd8]
test rcx, rcx
je 0x164f922aa
mov edi, 0x40ff
mov esi, 0x11d2
nop word [rax + rax]
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [rbp - 0x68]
lea edx, [r9 + 1]
mov rax, qword [rax + 0x18]
call qword [case.0x164e9d7b8.0]
cmp eax, 1
je 0x164f9224a
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], rbx
mov qword [rbp + 0x128], 7
mov word [rbp + 0x110], bx
mov byte [rbp + 0x130], 0
movups xmmword [rbp + 0x138], xmm0
mov qword [rbp + 0x148], rbx
mov qword [rbp + 0x150], 7
mov word [rbp + 0x138], bx
movups xmmword [rbp + 0x158], xmm0
mov qword [rbp + 0x168], rbx
mov qword [rbp + 0x170], 7
mov word [rbp + 0x158], bx
mov qword [rbp + 0x178], 0xffffffffffffffff
mov qword [rbp + 0x180], rbx
mov rcx, qword [r15 + 8]
test rcx, rcx
je 0x164f9229f
mov rax, qword [rcx]
lea r9, [rbp - 0x40]
mov r8d, 0x8000
mov rdx, qword [rbp - 0x68]
mov rax, qword [rax + 0x58]
call qword [case.0x164e9d7b8.0]
test eax, eax
js 0x164f92215
mov rdx, qword [rbp - 0x38]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x164f91da0
lea rcx, [rbp + 0x110]
call fcn.164e54c60
lea rcx, [rbp + 0x110]
cmp qword [rbp + 0x128], 7
cmova rcx, qword [rbp + 0x110]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x164f91de1
test al, 0x10
jne 0x164f91de1
xor al, al
jmp 0x164f91e11
lea rcx, [rbp + 0x110]
cmp qword [rbp + 0x128], 7
cmova rcx, qword [rbp + 0x110]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x164f92215
test al, 0x10
je 0x164f92215
mov al, 1
mov byte [rbp + 0x130], al
mov rcx, qword [r15 + 8]
test rcx, rcx
je 0x164f9229f
mov rax, qword [rcx]
lea r9, [rbp - 0x40]
xor r8d, r8d
mov rdx, qword [rbp - 0x68]
mov rax, qword [rax + 0x58]
call qword [case.0x164e9d7b8.0]
test eax, eax
js 0x164f92215
lea rcx, [rbp + 0x110]
cmp qword [rbp + 0x128], 7
cmova rcx, qword [rbp + 0x110]
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call fcn.1650278a0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbx
mov rdx, qword [rbp - 0x38]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x164f91e91
lea rcx, [rsp + 0x48]
call fcn.164e485e0
nop
lea rax, [rbp + 0x1a0]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x164f91eb5
lea rdx, [rbp + 0x1a0]
lea rcx, [rsp + 0x48]
call fcn.164e54db0
movups xmm6, xmmword [rax]
movups xmmword [rsp + 0x68], xmm6
movups xmm7, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm7
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
or r12d, 2
mov dword [rsp + 0x30], r12d
mov rdx, qword [rbp + 0x150]
cmp rdx, 7
jbe 0x164f91f40
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x164f91f3b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x164f922da
call fcn.1650010a0
movups xmmword [rbp + 0x138], xmm6
movups xmmword [rbp + 0x148], xmm7
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], bx
lea rcx, [rsp + 0x68]
call fcn.164e54bf0
nop
lea rcx, [rsp + 0x48]
call fcn.164e54bf0
mov dword [rbp + 0xe0], 0x9b174b33
mov dword [rbp + 0xe4], 0x11d240ff
mov dword [rbp + 0xe8], 0xc0007ea2
mov dword [rbp + 0xec], 0x7108c34f
mov dword [rbp + 0xf0], 2
lea rcx, [rbp - 0x60]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [r15 + 8]
test rcx, rcx
je 0x164f922ed
mov rax, qword [rcx]
lea r9, [rbp - 0x60]
lea r8, [rbp + 0xe0]
mov rdx, qword [rbp - 0x68]
mov rax, qword [rax + 0x88]
call qword [case.0x164e9d7b8.0]
test eax, eax
js 0x164f9220a
mov rdx, qword [rbp - 0x58]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x164f91ff1
lea rcx, [rbp + 0x158]
call fcn.164e54c60
mov rcx, qword [r15 + 8]
test rcx, rcx
je 0x164f922ed
mov rax, qword [rcx]
lea r9, [rbp - 0x60]
lea r8, [0x1650cfa28]
mov rdx, qword [rbp - 0x68]
mov rax, qword [rax + 0x88]
call qword [case.0x164e9d7b8.0]
test eax, eax
js 0x164f9220a
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x178], rax
mov dword [rbp + 0xf8], 0x9b174b33
mov dword [rbp + 0xfc], 0x11d240ff
mov dword [rbp + 0x100], 0xc0007ea2
mov dword [rbp + 0x104], 0x7108c34f
mov dword [rbp + 0x108], 3
mov rcx, qword [r15 + 8]
test rcx, rcx
je 0x164f922ed
mov rax, qword [rcx]
lea r9, [rbp - 0x60]
lea r8, [rbp + 0xf8]
mov rdx, qword [rbp - 0x68]
mov rax, qword [rax + 0x88]
call qword [case.0x164e9d7b8.0]
test eax, eax
js 0x164f9220a
lea r8, [rbp + 0xd0]
lea rdx, [rbp + 0xd4]
movsd xmm0, qword [rbp - 0x58]
call qword [sym.imp.OLEAUT32.dll_DosDateTimeToVariantTime]
test eax, eax
je 0x164f9220a
lea r8, [rbp + 0x190]
movzx edx, word [rbp + 0xd0]
movzx ecx, word [rbp + 0xd4]
call qword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
test eax, eax
je 0x164f9220a
mov rcx, qword [rbp + 0x190]
mov rax, rcx
shr rax, 0x20
test ecx, ecx
jne 0x164f92113
test eax, eax
jne 0x164f92113
mov rdx, rbx
mov qword [rbp + 0x180], rbx
jmp 0x164f9214e
mov ecx, ecx
shl rax, 0x20
or rcx, rax
movabs rax, 0x19db1ded53e8000
sub rcx, rax
movabs rax, 0xd6bf94d5e57a42bd
imul rcx
add rdx, rcx
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rbp + 0x180], rdx
cmp r13, rdx
jle 0x164f9220a
mov rsi, qword [r14]
movabs rax, 0x1e1e1e1e1e1e1e1
cmp qword [r14 + 8], rax
je 0x164f922e0
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], rbx
mov ecx, 0x88
call fcn.165001480
mov rdi, rax
mov qword [rsp + 0x40], rax
lea rbx, [rax + 0x10]
mov qword [rbp - 0x70], rbx
lea rdx, [rbp + 0x110]
mov rcx, rbx
call fcn.164e539c0
nop
movzx ecx, byte [rbp + 0x130]
mov byte [rbx + 0x20], cl
lea rcx, [rbx + 0x28]
lea rdx, [rbp + 0x138]
call fcn.164e539c0
nop
lea rcx, [rbx + 0x48]
lea rdx, [rbp + 0x158]
call fcn.164e539c0
mov rax, qword [rbp + 0x178]
mov qword [rbx + 0x68], rax
mov rax, qword [rbp + 0x180]
mov qword [rbx + 0x70], rax
inc qword [r14 + 8]
mov rax, qword [rsi + 8]
mov qword [rdi], rsi
mov qword [rdi + 8], rax
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov qword [rsi + 8], rdi
mov qword [rax], rdi
mov edi, 0x40ff
mov esi, 0x11d2
lea rcx, [rbp - 0x60]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp + 0x158]
call fcn.164e54bf0
lea rcx, [rbp + 0x138]
call fcn.164e54bf0
lea rcx, [rbp + 0x110]
call fcn.164e54bf0
mov rcx, qword [rbp + 0xd8]
test rcx, rcx
je 0x164f922aa
jmp 0x164f91cc0
mov dword [rsp + 0x30], ebx
mov rcx, qword [rbp + 0xd8]
test rcx, rcx
je 0x164f92268
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x164e9d7b8.0]
nop
mov rax, r14
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.165001080
lea r11, [rsp + 0x4d0]
mov rbx, qword [r11 + 0x58]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004003
call fcn.165000ee0
nop
mov ecx, 0x80004003
call fcn.165000ee0
int3
lea r8, str.RecycleBin::enumerate_EnumObjects
mov edx, eax
lea rcx, [rsp + 0x48]
call fcn.164e47d40
lea rdx, [0x165147178]
lea rcx, [rsp + 0x48]
call fcn.165003be0
nop
call fcn.165016420
nop
lea rcx, str.list_too_long
call fcn.164ffeab4
int3
mov ecx, 0x80004003
call fcn.165000ee0
int3