Function at 0x140001710
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x480
mov rax, qword [0x14001c008]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov rbx, qword [rcx]
mov rdi, rcx
test byte [rbx + 8], 2
je 0x14000188a
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rsp + 0x260]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x260]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r8, qword [rbx + 0x10]
lea rcx, [rsp + 0x50]
test r8, r8
jne 0x1400017ed
movups xmm0, xmmword [str.NtoskrnlOffsets.csv]
movzx eax, word [0x14000a918]
mov r9d, 0x104
movups xmm1, xmmword [0x14000a900]
lea r8, [rsp + 0x260]
mov edx, r9d
movups xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x48], ax
movsd xmm0, qword [0x14000a910]
movsd qword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x30], xmm1
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat_s]
mov r9d, 0x15
lea r8, [rsp + 0x20]
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat_s]
jmp 0x1400017f8
mov edx, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140001871
test al, 0x10
jne 0x140001871
lea rcx, str.___Loading_kernel_related_offsets_from_the_CSV_file
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__putws]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsdup]
mov rcx, rax
mov qword [rbx + 0x10], rax
call fcn.1400020f0
cmp qword [0x14001c6a0], 0
je 0x140001862
cmp qword [0x14001c6a8], 0
je 0x140001862
cmp qword [0x14001c6b0], 0
je 0x140001862
lea rcx, str.___Kernel_offsets_were_loaded_from_the_CSV_file_for_the_version_of_ntoskrnl_in_use.
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__putws]
xor eax, eax
jmp 0x1400018f3
lea rcx, str.____Kernel_offsets_are_missing_from_the_CSV_for_the_version_of_ntoskrnl_in_use.
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__putws]
jmp 0x14000188a
lea rdx, [rsp + 0x50]
lea rcx, str.____Kernel_offsets_file_not_present_at__s_n
call fcn.140001430
mov qword [rbx + 0x10], 0
mov rax, qword [rdi]
test byte [rax + 8], 4
je 0x1400018e1
lea rcx, str.___Downloading_kernel_offsets_from_the_MS_Symbol_Server__will_drop_a_.pdb_file_in_current_directory_
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__putws]
call fcn.140002280
cmp qword [0x14001c6a0], 0
je 0x1400018d4
cmp qword [0x14001c6a8], 0
je 0x1400018d4
cmp qword [0x14001c6b0], 0
je 0x1400018d4
lea rcx, str.___Downloading_kernel_offsets_succeeded_
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__putws]
xor eax, eax
jmp 0x1400018f3
lea rcx, str.____Downloading_kernel_offsets_from_the_internet_failed_
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__putws]
lea rcx, str.____The_kernel_offsets_required_couldnt_be_retrieve_using_any_of_the_methods_specified_n
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__putws]
mov eax, 4
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.1400085d0
mov rbx, qword [rsp + 0x498]
add rsp, 0x480
pop rdi
ret