Function at 0x14000748c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
xor r12d, r12d
mov rsi, rcx
mov dword [rax + 8], r12d
mov r14d, r12d
mov qword [rax + 0x10], r12
mov edi, r12d
test rcx, rcx
je 0x140007527
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rcx + rbx*2], r12w
jne 0x1400074c0
lea rbp, [rbx + 1]
cmp rbp, rbx
jb 0x140007527
mov eax, 2
mul rbp
test rdx, rdx
jne 0x140007527
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov rdi, rax
mov rcx, rax
test rax, rax
je 0x140007527
mov r9, rbx
mov r8, rsi
mov rdx, rbp
call fcn.140009edc
lea rcx, [rsp + 0x70]
mov ebx, 1
call qword [sym.imp.iertutil.dll_Ordinal_34]
nop dword [rax + rax]
test eax, eax
jns 0x14000752a
jmp 0x140007628
mov ebx, r12d
cmp dword [rsp + 0x70], r12d
je 0x140007551
lea rcx, [rsp + 0x78]
call fcn.140008380
mov r14, qword [rsp + 0x78]
test eax, eax
js 0x140007628
test r14, r14
je 0x140007628
test ebx, ebx
je 0x1400076f8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp ebp, 0xffffffff
jne 0x1400075d0
lea ecx, [rax - 2]
cmp ecx, 1
ja 0x1400075cb
mov rcx, rdi
call fcn.140010640
test eax, eax
jne 0x1400075cb
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rdi + rdx*2], r12w
jne 0x140007593
mov rcx, rdi
call fcn.140010858
test eax, eax
js 0x1400075cb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp ebp, 0xffffffff
je 0x14000757b
cmp ebp, 0xffffffff
je 0x1400075f0
test bpl, 0x10
jne 0x1400075f0
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rdi + rdx*2], r12w
jne 0x1400075da
mov rcx, rdi
call fcn.140010858
test eax, eax
js 0x140007628
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], 0x2000000
xor r8d, r8d
mov edx, 0x20000
mov dword [rsp + 0x20], 3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x140007630
mov ebx, r12d
jmp 0x1400076f8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
nop dword [rax + rax]
mov esi, eax
test eax, eax
je 0x140007684
mov ecx, esi
add rcx, rcx
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov rbp, rax
test rax, rax
je 0x140007684
xor r9d, r9d
mov r8d, esi
mov rdx, rax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
nop dword [rax + rax]
mov esi, eax
test eax, eax
jne 0x140007689
mov ebx, r12d
jmp 0x1400076e9
inc esi
cmp esi, 8
jb 0x1400076e9
mov rcx, rbp
call fcn.140007de8
mov ebx, eax
test eax, eax
je 0x1400076b2
cmp dword [rsp + 0x70], r12d
je 0x1400076b2
mov rdx, r14
mov rcx, rbp
call fcn.140007ef0
mov ebx, eax
mov rcx, rbp
call fcn.140010640
test eax, eax
jne 0x1400076e9
test ebx, ebx
je 0x1400076e9
mov edx, esi
mov rcx, rbp
call fcn.140010858
test eax, eax
mov ebx, r12d
setns bl
or rsi, 0xffffffffffffffff
inc rsi
cmp word [rbp + rsi*2], r12w
jne 0x1400076d8
inc esi
test ebx, ebx
jne 0x14000768b
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test r14, r14
je 0x14000770c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
test rdi, rdi
je 0x140007720
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
lea r11, [rsp + 0x40]
mov eax, ebx
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret