Function at 0x140005df0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x460
xor r14d, r14d
mov rbp, rcx
add rcx, 0x1d8
mov dword [rcx + 0x1b0], r14d
lea r12d, [r14 + 1]
mov rbx, rdx
mov dword [rcx - 0x1d0], r12d
call fcn.140010428
lea rcx, [rbp + 0xd8]
mov r8d, 0xff
mov rdx, rbx
call fcn.140011854
cmp dword [rbx + 0x208], r14d
mov r15d, 0x104
je 0x140005e6f
lea rdx, [rbx + 0x20c]
cmp byte [rdx], r14b
je 0x140005e6f
or rsi, 0xffffffffffffffff
jmp 0x140005f1e
lea rcx, [rsp + 0x21]
mov r8, r15
xor edx, edx
mov byte [rsp + 0x20], r14b
call sub.msvcrt.dll_memset
or rsi, 0xffffffffffffffff
xor eax, eax
lea rdi, [rbx + 0x100]
mov rcx, rsi
repne scasb al, byte [rdi]
not rcx
add rcx, 0x21
cmp rcx, r15
jae 0x140005ebb
lea r8, [rsp + 0x20]
lea rdx, str.AppDataRoamingMicrosoftProtect
lea rcx, [rbx + 0x100]
call fcn.140012184
jmp 0x140005ec0
mov byte [rsp + 0x20], r14b
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x140005f09
xor eax, eax
lea rdi, [rbx + 0x100]
mov rcx, rsi
repne scasb al, byte [rdi]
not rcx
add rcx, 0x22
cmp rcx, r15
jae 0x140005f04
lea r8, [rsp + 0x20]
lea rdx, str.Application_DataMicrosoftProtect
lea rcx, [rbx + 0x100]
call fcn.140012184
jmp 0x140005f09
mov byte [rsp + 0x20], r14b
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140005f2d
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x1d8]
mov r8d, esi
call fcn.140010348
cmp dword [rbx + 0x208], r14d
je 0x140005f58
lea rdx, [rbx + 0x311]
cmp byte [rdx], r14b
je 0x140005f58
xor r8d, r8d
mov rcx, rbp
mov dword [rbp + 0xc], r12d
call fcn.140005b50
mov edi, eax
jmp 0x140006107
lea rcx, [rsp + 0x21]
mov r8, r15
xor edx, edx
mov byte [rsp + 0x20], r14b
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x131]
mov r8, r15
xor edx, edx
mov byte [rsp + 0x130], r14b
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x241]
mov r8, r15
xor edx, edx
mov byte [rsp + 0x240], r14b
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x351]
mov r8, r15
xor edx, edx
mov byte [rsp + 0x350], r14b
call sub.msvcrt.dll_memset
add rbx, 0x100
xor eax, eax
mov rdi, rbx
mov rcx, rsi
repne scasb al, byte [rdi]
not rcx
sub rcx, r12
add rcx, 0x11
cmp rcx, r15
jae 0x140005ff0
lea r8, [rsp + 0x20]
lea rdx, str.Application_Data
mov rcx, rbx
call fcn.140012184
jmp 0x140005ff5
mov byte [rsp + 0x20], r14b
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
sub rcx, r12
add rcx, 0x20
cmp rcx, r15
jae 0x140006027
lea r8, [rsp + 0x130]
lea rdx, str.Local_SettingsApplication_Data
mov rcx, rbx
call fcn.140012184
jmp 0x14000602f
mov byte [rsp + 0x130], r14b
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
sub rcx, r12
add rcx, 0x10
cmp rcx, r15
jae 0x140006061
lea r8, [rsp + 0x240]
lea rdx, str.AppDataRoaming
mov rcx, rbx
call fcn.140012184
jmp 0x140006069
mov byte [rsp + 0x240], r14b
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
sub rcx, r12
add rcx, 0xe
cmp rcx, r15
jae 0x14000609b
lea r8, [rsp + 0x350]
lea rdx, str.AppDataLocal
mov rcx, rbx
call fcn.140012184
jmp 0x1400060a3
mov byte [rsp + 0x350], r14b
lea rdx, [rsp + 0x20]
mov rcx, rbp
mov dword [rbp + 0xc], r14d
call fcn.140005d30
lea rdx, [rsp + 0x130]
mov edi, r14d
cmp eax, r14d
mov rcx, rbp
cmovne edi, r12d
call fcn.140005d30
lea rdx, [rsp + 0x240]
cmp eax, r14d
mov rcx, rbp
mov dword [rbp + 0xc], r12d
cmovne edi, r12d
call fcn.140005d30
lea rdx, [rsp + 0x350]
cmp eax, r14d
mov rcx, rbp
cmovne edi, r12d
call fcn.140005d30
cmp eax, r14d
cmovne edi, r12d
lea r11, [rsp + 0x460]
mov eax, edi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret