Function at 0x14004dd44
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5b8]
sub rsp, 0x690
mov rax, qword [0x1400a0008]
xor rax, rsp
mov qword [rbp + 0x580], rax
mov rbx, rcx
mov edi, 0x20e
xor r12d, r12d
lea rcx, [rbp + 0x370]
mov r8d, edi
xor edx, edx
mov r15d, r12d
call sub.msvcrt.dll_memset
xor edx, edx
mov dword [rsp + 0x40], r12d
lea r8d, [rdi - 4]
lea rcx, [rsp + 0x50]
call sub.msvcrt.dll_memset
or qword [rsp + 0x48], 0xffffffffffffffff
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], r12
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
lea rax, [rbp + 0x370]
mov dword [rsp + 0x28], edi
mov edx, 0x4d0008
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_io_l1_1_1.dll_DeviceIoControl]
test eax, eax
jne 0x14004de05
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x14004e03c
lea rsi, str._GLOBALROOT
mov edi, 0x105
mov r8, rsi
lea rax, [rsp + 0x50]
sub r8, rax
lea rcx, [rsp + 0x50]
mov edx, edi
mov ebx, r12d
mov r13d, 1
lea rax, [rdx + 0x7ffffef9]
test rax, rax
je 0x14004de4e
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14004de4e
mov word [rcx], ax
add rcx, 2
sub rdx, r13
jne 0x14004de2c
test rdx, rdx
jne 0x14004de5c
sub rcx, 2
mov ebx, 0x8007007a
mov word [rcx], r12w
test ebx, ebx
js 0x14004e03c
movzx r9d, word [rbp + 0x370]
lea r8, [rbp + 0x372]
shr r9, 1
lea rcx, [rsp + 0x50]
call fcn.14004e34c
mov ebx, eax
test eax, eax
js 0x14004e03c
lea r8, str.System_Volume_InformationFVE.e40ad34d_dae9_4bc7_95bd_b16218c10f72.X
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.14004daf0
mov ebx, eax
test eax, eax
js 0x14004e03c
mov rax, rdi
lea rcx, [rsp + 0x50]
mov ebx, r12d
cmp word [rcx], r12w
je 0x14004dec6
add rcx, 2
sub rax, r13
jne 0x14004deb7
test rax, rax
je 0x14004e037
mov r14, rdi
sub r14, rax
je 0x14004e03c
lea rax, [rbp + 0x160]
mov rdx, rdi
sub rsi, rax
lea rcx, [rbp + 0x160]
lea rax, [rdx + 0x7ffffef9]
test rax, rax
je 0x14004df10
movzx eax, word [rsi + rcx]
test ax, ax
je 0x14004df10
mov word [rcx], ax
add rcx, 2
sub rdx, r13
jne 0x14004deef
test rdx, rdx
jne 0x14004df1e
sub rcx, 2
mov ebx, 0x8007007a
mov word [rcx], r12w
test ebx, ebx
js 0x14004e03c
movzx r9d, word [rbp + 0x370]
lea r8, [rbp + 0x372]
shr r9, 1
lea rcx, [rbp + 0x160]
call fcn.14004e34c
mov ebx, eax
test eax, eax
js 0x14004e03c
lea r8, str.System_Volume_InformationFVE2.e40ad34d_dae9_4bc7_95bd_b16218c10f72.X
mov rdx, rdi
lea rcx, [rbp + 0x160]
call fcn.14004daf0
mov ebx, eax
test eax, eax
js 0x14004e03c
mov rax, rdi
lea rcx, [rbp + 0x160]
mov ebx, r12d
cmp word [rcx], r12w
je 0x14004df8e
add rcx, 2
sub rax, r13
jne 0x14004df7f
test rax, rax
je 0x14004e037
sub rdi, rax
je 0x14004e03c
lea rdx, [rsp + 0x48]
call fcn.14004dbb8
mov ebx, eax
test eax, eax
js 0x14004e005
mov esi, 0x31
mov ebx, esi
lea rcx, [rsp + 0x50]
mov word [rsp + r14*2 + 0x4e], bx
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14004dff9
lea rcx, [rbp + 0x160]
mov word [rbp + rdi*2 + 0x15e], bx
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14004dff9
add bx, r13w
movzx eax, bx
sub ax, si
cmp ax, 3
jb 0x14004dfb7
jmp 0x14004dffc
mov r15d, r13d
test r15d, r15d
mov ebx, r12d
sete bl
mov rdi, qword [rsp + 0x48]
cmp rdi, 0xffffffffffffffff
je 0x14004e03c
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_SetThreadToken]
test eax, eax
jne 0x14004e027
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
jmp 0x14004e03c
test rdi, rdi
je 0x14004e03c
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0x14004e03c
mov ebx, 0x80070057
mov eax, ebx
mov rcx, qword [rbp + 0x580]
xor rcx, rsp
call fcn.14004eb20
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret