Function at 0x180006400
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2d0
mov rax, qword [0x1800b2220]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov r15d, r8d
mov dword [rsp + 0x30], r15d
mov r14, rdx
mov rbx, rcx
xor r12d, r12d
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
test rcx, rcx
je 0x18002cf46
mov ecx, 0x8001
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetErrorMode]
nop dword [rax + rax]
mov esi, eax
mov dword [rsp + 0x24], eax
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x180006767
mov rcx, rbx
call fcn.180006ef0
test rax, rax
je 0x1800066f0
cmp word [rax], r12w
je 0x1800066f0
mov r9d, 1
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x38]
mov rcx, rax
call fcn.180006d88
test eax, eax
je 0x1800066f0
or rsi, 0xffffffffffffffff
mov rdi, rsi
inc rdi
cmp word [rbx + rdi*2], r12w
jne 0x1800064bf
inc edi
call qword [sym.imp.KERNELBASE.dll_KernelBaseGetGlobalData]
nop dword [rax + rax]
mov edx, dword [rax]
mov r12d, edi
mov qword [rsp + 0x58], r12
lea r8, [rdi + rdi]
add edx, 0x200000
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x180006798
mov r9d, r12d
mov r8, rbx
mov edx, r12d
mov rdi, rax
mov rcx, rax
call fcn.180007094
mov rax, qword [rsp + 0x38]
sub rax, rbx
sar rax, 1
lea rcx, [rdi + rax*2]
mov qword [rsp + 0x38], rcx
mov rax, qword [rsp + 0x48]
sub rax, rbx
sar rax, 1
lea r12, [rdi + rax*2]
mov qword [rsp + 0x48], r12
mov r13, r14
mov qword [rsp + 0x50], r14
xor edx, edx
test r15d, r15d
je 0x180006586
test r14, r14
je 0x180006586
cmp r14, rbx
jb 0x180006745
mov rax, qword [rsp + 0x58]
lea rax, [rbx + rax*2]
cmp r14, rax
jb 0x1800067b5
cmp r14, rbx
jb 0x180006745
mov r15, qword [rsp + 0x28]
mov qword [rsp + 0x60], r15
mov edi, edx
mov dword [rsp + 0x20], edx
mov rax, rcx
sub rax, r15
sar rax, 1
test eax, eax
je 0x1800065d1
add edi, eax
mov dword [rsp + 0x20], edi
cmp dword [rsp + 0x30], edi
jbe 0x1800065d1
test r14, r14
je 0x1800065d1
mov ebx, eax
add rbx, rbx
mov r8, rbx
mov rdx, r15
mov rcx, r13
call sym.KERNEL32.dll_RtlMoveMemory
add r13, rbx
mov qword [rsp + 0x50], r13
xor edx, edx
movzx ebx, word [r12]
mov word [r12], dx
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileW]
nop dword [rax + rax]
mov word [r12], bx
cmp rax, rsi
je 0x180006757
mov rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
nop dword [rax + rax]
lea rcx, [rsp + 0x2a4]
mov rax, rsi
xor edx, edx
inc rax
cmp word [rcx + rax*2], dx
jne 0x18000661b
test eax, eax
je 0x180006732
lea rcx, [rsp + 0x2a4]
mov qword [rsp + 0x38], rcx
add edi, eax
mov dword [rsp + 0x20], edi
cmp dword [rsp + 0x30], edi
jbe 0x180006667
test r14, r14
je 0x180006667
mov ebx, eax
add rbx, rbx
mov r8, rbx
mov rdx, rcx
mov rcx, r13
call sym.KERNEL32.dll_RtlMoveMemory
add r13, rbx
mov qword [rsp + 0x50], r13
xor edx, edx
mov r15, r12
mov qword [rsp + 0x60], r12
cmp word [r12], dx
je 0x1800066eb
mov r9d, 1
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x38]
mov rcx, r12
call fcn.180006d88
xor r12d, r12d
test eax, eax
jne 0x180006829
test edi, edi
je 0x1800066e2
inc rsi
cmp word [r15 + rsi*2], r12w
jne 0x18000669d
add edi, esi
mov dword [rsp + 0x20], edi
cmp dword [rsp + 0x30], edi
jbe 0x180006842
test r14, r14
je 0x180006842
lea eax, [rsi + 1]
mov r8d, eax
add r8, r8
mov rdx, r15
mov rcx, r13
call sym.KERNEL32.dll_RtlMoveMemory
mov rdx, qword [rsp + 0x40]
test rdx, rdx
jne 0x18000683a
mov esi, dword [rsp + 0x24]
jmp 0x18000684d
xor r12d, r12d
jmp 0x180006699
or rsi, 0xffffffffffffffff
inc rsi
cmp word [rbx + rsi*2], r12w
jne 0x1800066f4
mov rdi, rsi
mov dword [rsp + 0x20], edi
cmp r15d, esi
jbe 0x180006842
test r14, r14
je 0x180006842
cmp r14, rbx
je 0x1800066e2
lea eax, [rsi + 1]
mov rdx, rbx
mov r8d, eax
add r8, r8
mov rcx, r14
call sym.KERNEL32.dll_RtlMoveMemory
jmp 0x1800066e2
mov rax, r12
mov rcx, qword [rsp + 0x38]
sub rax, rcx
sar rax, 1
jmp 0x180006639
mov rdi, r15
lea rax, [r14 + r15*2]
cmp rax, rbx
jb 0x180006586
jmp 0x1800067b8
xor r12d, r12d
mov edi, r12d
mov dword [rsp + 0x20], r12d
jmp 0x180006699
mov rcx, qword gs:[0x60]
test rcx, rcx
je 0x18000678b
mov rax, qword gs:[0x60]
test byte [rax + 0x2c8], 1
jne 0x18000647d
mov edi, r12d
mov dword [rsp + 0x20], r12d
jmp 0x18000684d
mov ecx, 8
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
mov edi, dword [rsp + 0x20]
xor r12d, r12d
jmp 0x1800066e2
mov rdi, r15
call qword [sym.imp.KERNELBASE.dll_KernelBaseGetGlobalData]
nop dword [rax + rax]
mov edx, dword [rax]
lea r8, [rdi + rdi]
add edx, 0x200000
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov qword [rsp + 0x40], rax
xor r12d, r12d
test rax, rax
jne 0x18000680e
lea ecx, [rax + 8]
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
mov edi, dword [rsp + 0x20]
jmp 0x1800066e2
mov r13, qword [rsp + 0x40]
mov qword [rsp + 0x50], r13
mov r12, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
xor edx, edx
jmp 0x180006586
mov r12, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
xor edx, edx
jmp 0x180006596
lea eax, [rdi + 1]
jmp 0x180006722
inc edi
mov dword [rsp + 0x20], edi
jmp 0x1800066e2
cmp qword [rsp + 0x40], r12
jne 0x18002cf5e
cmp qword [rsp + 0x28], r12
je 0x180006883
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0x28]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov edi, dword [rsp + 0x20]
mov ecx, esi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetErrorMode]
nop dword [rax + rax]
mov eax, edi
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.180024680
add rsp, 0x2d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x57
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
xor eax, eax
jmp 0x180006893
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0x40]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov edi, dword [rsp + 0x20]
jmp 0x180006858