Function at 0x140010a6c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x14003d0f8]
xor rax, rsp
mov qword [rbp + 0x178], rax
mov rcx, qword [rcx + 0x70]
xor r13d, r13d
movsxd r14, r8d
mov r12d, r13d
mov dword [rsp + 0x34], r14d
mov edi, r13d
mov rsi, rdx
call fcn.140011ea0
mov rbx, rax
test rax, rax
je 0x140010adc
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], r13w
jne 0x140010ac5
cmp rdi, 0x7fe7
jae 0x14001d8c8
cmp byte [0x140045b25], r13b
je 0x140010b12
test rax, rax
je 0x14001d8d7
mov r8d, 4
lea rdx, [0x1400344e8]
mov rcx, rax
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
je 0x14001d8d7
mov r15d, 0x104
mov qword [rbp + 0x158], r13
mov r8d, r15d
mov byte [rbp + 0x160], 1
xor edx, edx
mov qword [rbp + 0x168], r15
lea rcx, [rsp + 0x50]
call sub.msvcrt.dll_memset
mov al, byte [rbp + 0x160]
lea rcx, [rsp + 0x50]
neg al
sbb rdx, rdx
and edx, 0x7ee3
add rdx, r15
call fcn.14000ca40
test eax, eax
js 0x14001d8fe
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.14000b364
mov rax, qword [rbp + 0x158]
lea rcx, [rsp + 0x50]
test rax, rax
mov ebx, 0x5c
cmovne rcx, rax
test rcx, rcx
je 0x140010ba6
mov edx, 0x2f
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
test rax, rax
jne 0x1400112e7
mov rax, qword [rbp + 0x158]
lea rcx, [rsp + 0x50]
test rax, rax
mov dword [rbp + 0x170], 0x3a005c
lea rdx, [rbp + 0x170]
mov word [rbp + 0x174], r13w
cmovne rcx, rax
call fcn.140013bac
mov rcx, qword [rbp + 0x158]
mov word [rbp + 0x172], r13w
cmp rax, rdi
jae 0x1400111ba
test rcx, rcx
lea rax, [rsp + 0x50]
mov r15d, 1
cmovne rax, rcx
mov dword [rsp + 0x30], r15d
test rax, rax
je 0x14001d931
mov edx, ebx
mov rcx, rax
call qword [sym.imp.msvcrt.dll_wcsrchr]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x158]
mov rbx, rax
test rax, rax
je 0x14001d931
add rbx, 2
cmp word [rbx], r13w
je 0x14001da37
movzx edx, word [rbx]
mov r8d, 0x2e
movzx eax, r8w
sub edx, eax
jne 0x140010c5c
movzx edx, word [rbx + 2]
movzx eax, r13w
sub edx, eax
test edx, edx
je 0x14001da37
movzx edx, word [rbx]
movzx eax, r8w
sub edx, eax
jne 0x140010c85
movzx edx, word [rbx + 2]
movzx eax, r8w
sub edx, eax
jne 0x140010c85
movzx edx, word [rbx + 4]
movzx eax, r13w
sub edx, eax
test edx, edx
je 0x14001da37
mov ecx, 0x1ff9c
call fcn.14000cd90
mov rdi, rax
test rax, rax
je 0x14001d8fe
mov rax, qword [rbp + 0x158]
lea r8, [rsp + 0x50]
test rax, rax
mov qword [rsp + 0x38], r14
mov rdx, r14
mov rcx, rsi
cmovne r8, rax
call fcn.1400113e0
mov rax, qword [rbp + 0x158]
lea rcx, [rsp + 0x50]
test rax, rax
lea r8, [0x1400344e4]
mov rdx, r14
cmovne rcx, rax
mov rax, rbx
sub rax, rcx
mov rcx, rsi
sar rax, 1
mov word [rsi + rax*2], r13w
call fcn.140011300
mov r14d, 0xffce
mov r8, rsi
mov edx, r14d
mov rcx, rdi
call fcn.140013060
test eax, eax
jne 0x14001d96d
mov rcx, rdi
call fcn.140012378
mov ecx, 0x5c
cmp word [rax], cx
je 0x140010d39
lea r8, [0x1400344e0]
mov edx, r14d
mov rcx, rdi
call fcn.140011300
mov r8, rbx
mov rdx, r14
mov rcx, rdi
call fcn.140011300
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rdi + rdx*2], r13w
jne 0x140010d4b
lea rdx, [rdx*2 + 2]
mov rcx, rdi
call fcn.14000af74
mov r14, rax
test rax, rax
je 0x14001d8fe
mov edx, 0x5c
mov rcx, rax
call qword [sym.imp.msvcrt.dll_wcsrchr]
nop dword [rax + rax]
xor ebx, ebx
mov word [rax], bx
lea r13, [rax + 2]
test r15d, r15d
je 0x1400111d3
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_processenvironment_l1_2_0.dll_NeedCurrentDirectoryForExePathW]
nop dword [rax + rax]
mov r15d, eax
test eax, eax
je 0x14001d9c3
or rcx, 0xffffffffffffffff
inc rcx
cmp word [r14 + rcx*2], bx
jne 0x140010db5
add rcx, 2
lea edi, [rcx + 2]
test r12, r12
jne 0x1400111a5
lea ecx, [rdi + rdi]
call fcn.14000cd90
mov rbx, rax
xor eax, eax
test rbx, rbx
je 0x14001d9cb
movsxd rdi, edi
test r15d, r15d
je 0x140010e21
lea r8, [0x140034438]
mov rdx, rdi
mov rcx, rbx
call fcn.140011300
mov r8, r14
mov rdx, rdi
mov rcx, rbx
call fcn.140011300
lea r8, [0x140034438]
mov rdx, rdi
mov rcx, rbx
call fcn.140011300
xor eax, eax
lea r14, [0x140034428]
cmp dword [rsp + 0x30], eax
je 0x1400111e7
mov rcx, rbx
call fcn.140012b30
mov r8d, 1
mov rdx, r14
mov rcx, rbx
call fcn.14000d3f0
or r12, 0xffffffffffffffff
mov r15, rax
xor ebx, ebx
inc r12
cmp word [r13 + r12*2], bx
jne 0x140010e54
inc r12
cmp byte [0x140045b25], bl
je 0x14001d9e8
lea rcx, str.PATHEXT
call fcn.14001081c
mov r10, rax
test rax, rax
je 0x14001d9e8
mov rcx, rax
call fcn.140012b30
mov r8d, 1
mov rdx, r14
mov rcx, r10
call fcn.14000d3f0
mov qword [rsp + 0x40], rax
xor r14d, r14d
or rdi, 0xffffffffffffffff
inc rdi
cmp word [r15 + rdi*2], r14w
jne 0x140010eab
mov rcx, r15
call fcn.140011ea0
movsxd rdx, edi
mov r8, rax
inc rdx
mov rcx, r15
call fcn.1400113e0
or rdx, 0xffffffffffffffff
inc rdx
cmp word [r15 + rdx*2], r14w
jne 0x140010ed2
mov rcx, r15
call fcn.140012378
mov ecx, 0x5c
lea ebx, [rdi + 1]
movzx r14d, word [rax]
lea eax, [rdx + 1]
cmp r14w, cx
cmove eax, edx
cmove ebx, edi
xor edx, edx
cmp word [r15], dx
je 0x14001128f
mov qword [rsp + 0x48], rax
lea edi, [rbx + 1]
add rax, r12
cmp rax, 0x7fe7
ja 0x14001d9f4
mov rdx, qword [rsp + 0x38]
mov r8, r15
mov rcx, rsi
call fcn.1400113e0
mov ecx, 0x5c
cmp r14w, cx
cmove ebx, edi
movsxd rax, ebx
mov rbx, qword [rsp + 0x38]
lea r15, [r15 + rax*2]
je 0x140010f5c
lea r8, [rbp + 0x170]
mov rdx, rbx
mov rcx, rsi
call fcn.140011300
mov r8, r13
mov rdx, rbx
mov rcx, rsi
call fcn.140011300
mov rcx, rsi
call fcn.140011ea0
mov r8, rax
mov rdx, rbx
mov rcx, rsi
call fcn.1400113e0
or rdi, 0xffffffffffffffff
xor r14d, r14d
inc rdi
cmp word [rsi + rdi*2], r14w
jne 0x140010f87
mov eax, 0x3a
cmp word [rsi + 2], ax
jne 0x140010fac
movzx ecx, word [rsi]
call fcn.14001291c
test eax, eax
je 0x140010ea7
test r13, r13
je 0x140011008
mov ebx, 0x2e
mov rcx, r13
mov edx, ebx
call qword [sym.imp.msvcrt.dll_wcsrchr]
nop dword [rax + rax]
test rax, rax
jne 0x1400110d8
mov edx, 0x2a
mov rcx, r13
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
test rax, rax
jne 0x14001da14
lea edx, [rax + 0x3f]
mov rcx, r13
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
test rax, rax
jne 0x14001da14
mov r14, qword [rsp + 0x40]
lea r9, [0x140034488]
mov edx, dword [rsp + 0x34]
mov r8d, edi
and dword [rsp + 0x20], 0
mov rcx, rsi
mov rbx, r14
call fcn.140012eb4
xor ecx, ecx
test eax, eax
je 0x140010ea4
cmp word [r14], cx
je 0x140010ea4
mov r14, qword [rsp + 0x48]
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], cx
jne 0x140011048
add rax, r14
add rax, r12
cmp rax, 0x7fe7
ja 0x140011275
mov edx, dword [rsp + 0x34]
mov r9, rbx
mov r8d, edi
mov dword [rsp + 0x20], 1
mov rcx, rsi
call fcn.140012eb4
xor ecx, ecx
test eax, eax
je 0x140011266
lea rdx, str..BAT
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
xor edi, edi
test eax, eax
je 0x14001da24
lea rdx, str..CMD
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x14001da24
mov rcx, qword [rbp + 0x158]
mov qword [rbp + 0x158], rdi
jmp 0x140011164
cmp word [rax + 2], r14w
je 0x140010fd0
mov edx, dword [rsp + 0x34]
mov r8d, 1
mov rcx, rsi
call fcn.140012efc
test eax, eax
je 0x140011216
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_wcsrchr]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x140011221
lea rdx, str..CMD
mov rcx, rax
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x14001123d
lea rdx, str..BAT
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x158]
mov qword [rbp + 0x158], r14
test eax, eax
je 0x14001124b
test rcx, rcx
je 0x140011175
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
nop dword [rax + rax]
mov eax, 1
mov rcx, qword [rbp + 0x178]
xor rcx, rsp
call fcn.140018f90
mov rbx, qword [rsp + 0x2d8]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
or rax, 0xffffffffffffffff
inc rax
cmp word [r12 + rax*2], bx
jne 0x1400111a9
add edi, eax
jmp 0x140010dcf
test rcx, rcx
mov dword [rsp + 0x30], r13d
lea rbx, [rsp + 0x50]
mov r15d, r13d
cmovne rbx, rcx
jmp 0x140010c37
lea rcx, [0x140034580]
call fcn.14001081c
mov r12, rax
jmp 0x140010d97
test r12, r12
je 0x140010e32
test r15d, r15d
je 0x140011203
mov r8, r14
mov rdx, rdi
mov rcx, rbx
call fcn.140011300
mov r8, r12
mov rdx, rdi
mov rcx, rbx
call fcn.140011300
jmp 0x140010e32
cmp dword [rsp + 0x30], r14d
jne 0x1400112d3
mov eax, dword [0x140045ba8]
cmp eax, 2
je 0x140010fd0
test eax, eax
jne 0x140010ea7
jmp 0x140010fd0
mov rcx, qword [rbp + 0x158]
mov qword [rbp + 0x158], r14
test rcx, rcx
je 0x14001125c
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
nop dword [rax + rax]
mov eax, 2
jmp 0x14001117a
mov eax, dword [0x140045ba8]
cmp eax, 2
jne 0x14001da07
movzx eax, word [rbx]
add rbx, 2
test ax, ax
jne 0x140011275
cmp word [rbx], cx
jne 0x140011044
jmp 0x140010ea4
cmp dword [rsp + 0x30], edx
jne 0x1400112c5
mov dword [0x140045ba8], 0x2331
mov rcx, qword [rbp + 0x158]
mov qword [rbp + 0x158], rdx
test rcx, rcx
je 0x1400112be
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
nop dword [rax + rax]
xor eax, eax
jmp 0x14001117a
test dword [0x140045ba8], 0xfffffffd
je 0x140011295
jmp 0x14001129f
mov eax, dword [0x140045ba8]
cmp eax, 5
jne 0x140011227
jmp 0x1400110fd
mov word [rax], bx
lea rcx, [rax + 2]
jmp 0x140010b87
mov dword [0x140045ba8], 0x233f
jmp 0x1400112be
lea rcx, str.COMSPEC
call fcn.14001081c
mov rbx, rax
test rax, rax
jne 0x140010b12
mov dword [0x140045ba8], 0x400023d2
jmp 0x1400112be
mov dword [0x140045ba8], 8
mov rcx, qword [rbp + 0x158]
mov qword [rbp + 0x158], r13
test rcx, rcx
je 0x14001d927
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
nop dword [rax + rax]
mov eax, 3
jmp 0x14001117a
test rcx, rcx
lea rax, [rsp + 0x50]
cmovne rax, rcx
test rax, rax
jne 0x14001d94a
mov rbx, r13
jmp 0x140010c33
mov edx, 0x3a
mov rcx, rax
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x158]
mov rbx, rax
jmp 0x140010c33
cmp byte [0x140045b25], r13b
je 0x14001da74
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x14001da74
test al, 0x10
je 0x14001da74
mov rcx, qword [rbp + 0x158]
mov qword [rbp + 0x158], r13
test rcx, rcx
je 0x14001d9b9
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
nop dword [rax + rax]
mov eax, 5
jmp 0x14001117a
mov rcx, rbx
jmp 0x140010dc3
mov rcx, qword [rbp + 0x158]
mov qword [rbp + 0x158], rax
mov dword [0x140045ba8], 8
jmp 0x14001d916
lea r10, str..COM_.EXE_.BAT_.CMD_.VBS_.JS_.WS_.MSC
jmp 0x140010e8e
cmp r14w, cx
cmove ebx, edi
movsxd rax, ebx
lea r15, [r15 + rax*2]
jmp 0x140010ea4
test eax, eax
jne 0x140010ea4
jmp 0x140011275
mov rcx, qword [rbp + 0x158]
mov qword [rbp + 0x158], r14
jmp 0x14001da82
mov rcx, qword [rbp + 0x158]
mov qword [rbp + 0x158], rdi
jmp 0x14001124b
cmp byte [0x140045b25], r13b
je 0x14001da7b
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
jne 0x14001d992
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x15
jne 0x14001da74
mov dword [0x140045ba8], eax
jmp 0x14001d908
mov rcx, qword [rbp + 0x158]
mov qword [rbp + 0x158], r13
mov dword [0x140045ba8], 0x2331
jmp 0x1400112ad