Function at 0x14001a400
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push r13
push r14
sub rsp, 0x38
mov r14, rcx
xor r13d, r13d
xor ecx, ecx
mov esi, r13d
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r14, r14
je 0x14001aa6c
mov rdi, 0xffffffffffffffff
mov edx, r13d
mov rax, rdi
inc rax
cmp word [r14 + rax*2], dx
jne 0x14001a432
test rax, rax
je 0x14001a474
mov rcx, r13
nop dword [rax]
nop dword [rax + rax]
movzx r8d, word [r14 + rcx*2]
cmp r8w, 0x5c
je 0x14001aa6c
cmp r8w, 0x2f
je 0x14001aa6c
inc edx
mov ecx, edx
cmp rcx, rax
jb 0x14001a450
mov qword [rsp + 0x60], rbx
mov rcx, r14
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x30], r15
call fcn.14001aa90
mov r15, rax
test rax, rax
je 0x14001a75f
call fcn.14001b830
mov r12, rax
test rax, rax
je 0x14001aa53
mov r8d, r13d
mov rcx, rdi
inc rcx
cmp word [r15 + rcx*2], si
jne 0x14001a4b3
test rcx, rcx
je 0x14001a4f4
mov rax, r13
nop word [rax + rax]
movzx edx, word [r15 + rax*2]
cmp dx, 0x5c
je 0x14001a5bd
cmp dx, 0x2f
je 0x14001a5bd
inc r8d
mov eax, r8d
cmp rax, rcx
jb 0x14001a4d0
mov rcx, rdi
nop word [rax + rax]
inc rcx
cmp word [r12 + rcx*2], si
jne 0x14001a500
nop word [rax + rax]
inc rdi
cmp word [r15 + rdi*2], si
jne 0x14001a510
test rcx, rcx
je 0x14001a539
cmp word [r12 + rcx*2 - 2], 0x5c
je 0x14001a539
test rdi, rdi
je 0x14001a539
cmp word [r15], 0x5c
mov ebx, 1
jne 0x14001a53c
mov ebx, r13d
mov eax, ebx
add rax, rdi
add rax, rcx
mov ecx, 0x40
lea rdi, [rax*2 + 2]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x14001a5b5
mov r8, r12
mov rdx, rdi
mov rcx, rax
call fcn.1400190e0
test eax, eax
js 0x14001a5a6
test ebx, ebx
je 0x14001a591
lfence
lea r8, [0x1400db2b0]
mov rdx, rdi
mov rcx, rsi
call fcn.140019020
test eax, eax
js 0x14001a5a6
lfence
mov r8, r15
mov rdx, rdi
mov rcx, rsi
call fcn.140019020
test eax, eax
jns 0x14001a5b5
lfence
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rsi, r13
mov rcx, r12
jmp 0x14001aa4d
lea rax, str.system32_
mov qword [rsp + 0x20], rax
lea r14, [rsp + 0x20]
lea rax, str.SystemRoot_system32_
mov qword [rsp + 0x28], rax
nop word [rax + rax]
mov rdx, qword [r14]
mov rbx, rdi
inc rbx
cmp word [rdx + rbx*2], si
jne 0x14001a5e6
mov r8, rbx
mov rcx, r15
call fcn.140096c08
test eax, eax
je 0x14001a611
add r14, 8
lea rax, [rsp + 0x30]
cmp r14, rax
jb 0x14001a5e0
jmp 0x14001a705
lea rbp, [r15 + rbx*2]
mov rcx, rdi
nop dword [rax + rax]
inc rcx
cmp word [r12 + rcx*2], si
jne 0x14001a620
test rbp, rbp
jne 0x14001a660
lea rbx, [rcx + 1]
lea rdx, [rbx + rbx]
lea ecx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x14001a702
mov r8, r12
mov rdx, rbx
mov rcx, rax
call fcn.1400192a0
jmp 0x14001a6f2
inc rdi
cmp word [rbp + rdi*2], si
jne 0x14001a660
test rcx, rcx
je 0x14001a689
cmp word [r12 + rcx*2 - 2], 0x5c
je 0x14001a689
test rdi, rdi
je 0x14001a689
cmp word [rbp], 0x5c
mov ebx, 1
jne 0x14001a68c
mov ebx, r13d
mov eax, ebx
add rax, rdi
add rax, rcx
mov ecx, 0x40
lea rdi, [rax*2 + 2]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x14001a705
mov r8, r12
mov rdx, rdi
mov rcx, rax
call fcn.1400190e0
test eax, eax
js 0x14001a6f6
test ebx, ebx
je 0x14001a6e1
lfence
lea r8, [0x1400db2b0]
mov rdx, rdi
mov rcx, rsi
call fcn.140019020
test eax, eax
js 0x14001a6f6
lfence
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
call fcn.140019020
test eax, eax
jns 0x14001a705
lfence
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rsi, r13
lea rax, [rsp + 0x30]
cmp r14, rax
jne 0x14001a5b5
movzx eax, word [r15]
cmp eax, 0x5c
je 0x14001a751
cmp eax, 0x2f
je 0x14001a751
mov ecx, eax
call fcn.1400961e0
test eax, eax
je 0x14001a5b5
cmp word [r15 + 2], 0x3a
jne 0x14001a5b5
movzx eax, word [r15 + 4]
cmp ax, 0x5c
je 0x14001a751
cmp ax, 0x2f
jne 0x14001a5b5
mov rsi, r15
mov rcx, r12
mov r15, r13
jmp 0x14001aa4d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7e
jne 0x14001a916
mov r11, rdi
cmp word [r14 + r11*2 + 2], si
lea r11, [r11 + 1]
jne 0x14001a771
mov rcx, r14
call fcn.140016530
mov rcx, rdi
nop dword [rax + rax]
inc rcx
cmp word [rax + rcx*2], si
jne 0x14001a790
test rcx, rcx
je 0x14001a8c1
cmp rcx, 1
je 0x14001a7f3
mov rbx, rdi
nop dword [rax + rax]
inc rbx
cmp word [r14 + rbx*2], si
jne 0x14001a7b0
inc rbx
mov ecx, 0x40
lea rdx, [rbx + rbx]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r15, rax
test rax, rax
je 0x14001a916
mov r8, r14
mov rdx, rbx
mov rcx, rax
call fcn.1400192a0
test eax, eax
jns 0x14001a89e
jmp 0x14001a88f
lea r12, [r11 - 1]
test r12, r12
js 0x14001a916
lfence
mov rbx, rdi
inc rbx
cmp word [r14 + rbx*2], si
jne 0x14001a806
cmp r12, rbx
mov ecx, 0x40
cmovb rbx, r12
inc rbx
lea rdx, [rbx + rbx]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r15, rax
test rax, rax
je 0x14001a916
lea rax, [rbx - 1]
cmp rax, 0x7ffffffe
ja 0x14001a886
cmp r12, 0x7ffffffe
ja 0x14001a88b
sub r12, rbx
mov rcx, r15
sub r14, r15
lea rax, [r12 + rbx]
test rax, rax
je 0x14001a873
movzx eax, word [r14 + rcx]
test ax, ax
je 0x14001a873
mov word [rcx], ax
add rcx, 2
sub rbx, 1
jne 0x14001a853
test rbx, rbx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r13w
jne 0x14001a89e
jmp 0x14001a88f
test rbx, rbx
je 0x14001a88f
mov word [r15], r13w
lfence
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r15, r13
test r15, r15
je 0x14001a916
mov ecx, 0x37e4
call fcn.1400186f0
test eax, eax
je 0x14001a94b
xor ecx, ecx
call fcn.14001b390
jmp 0x14001a950
lea rbx, [r11*2 + 0xa]
mov ecx, 0x40
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r15, rax
test rax, rax
je 0x14001a916
mov r8, r14
mov rdx, rbx
mov rcx, rax
call fcn.1400190e0
lfence
mov rcx, r15
test eax, eax
js 0x14001a910
lea r8, str..dll
mov rdx, rbx
call fcn.140019020
test eax, eax
jns 0x14001a8a3
lfence
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14001a929
lea ecx, [rax + 0x7e]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r15, qword [rsp + 0x30]
mov rax, rsi
mov r12, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x38
pop r14
pop r13
pop rdi
pop rsi
ret
call fcn.14001b830
mov rbp, rax
test rax, rax
je 0x14001aa53
mov rcx, rdi
nop
inc rcx
cmp word [rbp + rcx*2], si
jne 0x14001a960
nop word [rax + rax]
inc rdi
cmp word [r15 + rdi*2], si
jne 0x14001a970
test rcx, rcx
je 0x14001a998
cmp word [rbp + rcx*2 - 2], 0x5c
je 0x14001a998
test rdi, rdi
je 0x14001a998
cmp word [r15], 0x5c
mov ebx, 1
jne 0x14001a99b
mov ebx, r13d
mov eax, ebx
add rax, rdi
add rax, rcx
mov ecx, 0x40
lea rdi, [rax*2 + 2]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x14001aa14
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call fcn.1400190e0
test eax, eax
jns 0x14001a9d8
lfence
jmp 0x14001aa3e
test ebx, ebx
je 0x14001a9fa
lfence
lea r8, [0x1400db2b0]
mov rdx, rdi
mov rcx, rsi
call fcn.140019020
test eax, eax
jns 0x14001a9fa
lfence
jmp 0x14001aa3e
lfence
mov r8, r15
mov rdx, rdi
mov rcx, rsi
call fcn.140019020
test eax, eax
jns 0x14001aa14
lfence
jmp 0x14001aa3e
test rsi, rsi
je 0x14001aa4a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14001aa2b
test al, 0x50
je 0x14001aa4a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x14001aa3e
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rsi, r13
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rsi, rsi
je 0x14001a916
xor ecx, ecx
jmp 0x14001a923
mov ecx, 0xa0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x38
pop r14
pop r13
pop rdi
pop rsi
ret