Function at 0x1400b0d20
Capabilities:
Check if file exists

Disassembly:
push rdi
sub rsp, 0x60
mov rax, qword [0x1403a0088]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, rcx
lea rdx, [rcx + 8]
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
mov r8d, 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b0f2e
mov rcx, qword [rsp + 0x50]
lea r8, [0x140336500]
mov qword [rsp + 0x78], rbx
lea rbx, [rdi + 0x210]
mov rdx, rbx
call fcn.14005f970
mov rcx, qword [rsp + 0x50]
lea r8, [0x140334948]
mov rdx, rbx
mov qword [rdi + 0x428], rax
call fcn.14005f970
mov rcx, qword [rsp + 0x50]
lea r8, [0x140336520]
mov rdx, rbx
mov qword [rdi + 0x458], rax
call fcn.14005f970
mov rcx, qword [rsp + 0x50]
lea r8, [0x140336550]
mov rdx, rbx
mov qword [rdi + 0x430], rax
call fcn.14005f970
mov rcx, qword [rsp + 0x50]
lea r8, [0x140336830]
mov rdx, rbx
mov qword [rdi + 0x440], rax
call fcn.14005f970
mov rcx, qword [rsp + 0x50]
lea r8, [0x140336850]
mov rdx, rbx
mov qword [rdi + 0x448], rax
call fcn.14005f970
mov edx, 1
mov qword [rdi + 0x450], rax
mov rcx, rdi
call fcn.1400b0150
mov qword [rdi + 0x480], rax
test rax, rax
je 0x1400b0f1e
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400b0f1e
mov rbx, qword [rdi + 0x480]
test rbx, rbx
je 0x1400b0f1e
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
jne 0x1400b0f1e
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400b0f1e
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400b0e75
cmp rax, 2
jbe 0x1400b0f1e
mov r8d, 1
lea rdx, str._HOMEDRIVE___USERPROFILE___HOMEPATH___temp___PATH___SystemDrive___APPDATA___ProgramFiles_x86____ProgramFiles___windir___windir___systemroot___systemroot____systemroot____systemroot__:_Recycle.Bin_:_Recycle.Bin_:Windows_:Windows_:Users_:Documents_and_Settings_:ProgramData_:ProgramDataPackages_:ProgramDataPackages_:ProgramDataPackage_Cache_:Program_Files__x86__:Program_Files__x86_Microsoft_:Program_Files__x86_Microsoft_:Program_Files__x86_Microsoft_:Program_Files__x86_Microsoft_:Program_Files__x86_Windows_:Program_Files__x86_Windows_:Program_Files__x86_Windows_:Program_Files__x86_Windows_:Program_Files__x86_Common_Files_:Program_Files__x86_Common_Files_:Program_Files_:Program_FilesMicrosoft_:Program_FilesMicrosoft_:Program_FilesMicrosoft_:Program_FilesMicrosoft_:Program_FilesWindows_:Program_FilesWindows_:Program_FilesWindows_:Program_FilesWindows_:Program_FilesWindowsCommon_Files_:Program_FilesWindowsCommon_Files_:Program_FilesWindowsApps_:Program_FilesWindowsApps_:UsersAppDataLocal_:UsersAppDataLocalOneDrive_:UsersAppDataLocalOneDrive_:UsersAppDataLocalPackages_:UsersAppDataLocalPackages_:UsersAppDataLocalMicrosoft_:UsersAppDataLocalMicrosoft_:UsersAppDataLocalMicrosoft_:UsersAppDataLocalMicrosoft_:UsersAppDataLocalLow_:UsersAppDataLocalLowMicrosoft_:UsersAppDataLocalLowMicrosoft_:UsersAppDataLocalLowMicrosoft_:UsersAppDataLocalLowMicrosoft_:UsersAppDataRoaming_:UsersAppDataRoamingMicrosoft_:UsersAppDataRoamingMicrosoft_:UsersAppDataRoamingMicrosoft_:UsersAppDataRoamingMicrosoft_:UsersAppData_:UsersDocuments_:UsersDesktop_:UsersDesktop_:UsersOneDrive_:UsersOneDrive_
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecExW]
test eax, eax
je 0x1400b0f1e
cmp dword [rdi + 0x4a0], 0
jne 0x1400b0f1e
lea rdx, [0x1404580f0]
lea rcx, [rsp + 0x38]
call fcn.1400b2500
mov rcx, qword [rdi + 0x480]
mov rdx, rax
call fcn.1400b0bb0
mov dword [rdi + 0x490], eax
test eax, eax
jne 0x1400b0f1e
lea rdx, [0x140458040]
lea rcx, [rsp + 0x38]
call fcn.1400b2500
mov rdx, rax
mov rcx, rdi
call fcn.1400afe40
mov qword [rdi + 0x494], rax
test rax, rax
je 0x1400b0f0a
mov dword [rdi + 0x490], 1
jmp 0x1400b0f1e
mov edx, 1
mov rcx, rdi
call fcn.1400b08c0
mov qword [rdi + 0x488], rax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140125a70
add rsp, 0x60
pop rdi
ret