Function at 0x18000f160
Capabilities:
Check if file exists
Get file attributes
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x120
mov rax, qword [0x18009a918]
xor rax, rsp
mov qword [rsp + 0x118], rax
mov r13, r9
movzx r15d, dl
mov rbx, rcx
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x88], rax
mov rcx, qword [rsp + 0x180]
mov qword [rsp + 0x80], rcx
mov rcx, qword [rsp + 0x190]
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x98], rcx
xor edx, edx
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0xa8], rdx
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0xa0], rdx
test rbx, rbx
je 0x18000fd13
cmp qword [rbx + 8], rdx
je 0x18000fd13
test r9, r9
jne 0x18000f20c
mov eax, 0xc00000f0
jmp 0x18000fd18
test rax, rax
jne 0x18000f21b
mov eax, 0xc00000f1
jmp 0x18000fd18
mov r12d, dword [rsp + 0x178]
test r12d, r12d
jne 0x18000f232
mov eax, 0xc00000f2
jmp 0x18000fd18
test rcx, rcx
jne 0x18000f241
mov eax, 0xc00000f3
jmp 0x18000fd18
mov r14d, dword [rsp + 0x188]
cmp r14d, 0x200
jae 0x18000f25c
mov eax, 0xc00000f4
jmp 0x18000fd18
lea rdi, [rsp + 0x108]
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov qword [rsp + 0xc0], rdx
mov qword [rsp + 0x100], rdx
mov qword [rsp + 0xb0], rdx
mov byte [rsp + 0x60], al
mov qword [rsp + 0xb8], rdx
mov dword [rsp + 0x64], edx
lea rdx, [rsp + 0x78]
mov rcx, rbx
cmp r15b, 1
jne 0x18000f2a9
lea r8d, [rax + 1]
jmp 0x18000f2ac
xor r8d, r8d
call fcn.18001e910
mov dword [rsp + 0x64], eax
mov edi, eax
test eax, eax
js 0x18000fb15
lea rdx, [rsp + 0xc0]
mov rcx, qword [rsp + 0x78]
call fcn.180024960
mov edi, eax
mov dword [rsp + 0x64], eax
test eax, eax
jns 0x18000f32b
lea rbx, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rbx
je 0x18000fb1c
test byte [rcx + 0x1c], 1
je 0x18000fb1c
cmp byte [rcx + 0x19], 2
jb 0x18000fb1c
mov edx, 0x3b
mov dword [rsp + 0x20], eax
lea r9, str.TrfInvToNative
lea r8, [0x180090de8]
mov rcx, qword [rcx + 0x10]
call fcn.1800012d0
jmp 0x18000fb1c
mov r8d, 0x68f
lea rsi, str.E:_buildsARK23181_2_trufos_dllhiddenContent.c
mov r9, rsi
mov rdx, rbx
lea rcx, [rsp + 0xb0]
call fcn.18004aa10
mov dword [rsp + 0x64], eax
mov dword [rsp + 0xc8], 0x30
xor edi, edi
mov qword [rsp + 0xd0], rdi
mov dword [rsp + 0xe0], 0x40
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0xd8], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xe8], xmm0
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x60000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rdi + 7]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x68], rax
cmp rax, 0xffffffffffffffff
jne 0x18000f4ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rbx, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rbx
je 0x18000f408
test byte [rcx + 0x1c], 1
je 0x18000f408
cmp byte [rcx + 0x19], 3
jb 0x18000f408
mov edx, 0x3d
mov r9d, eax
lea r8, [0x180090de8]
mov rcx, qword [rcx + 0x10]
call fcn.180001270
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0x200008
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x108]
lea r8, [rsp + 0xc8]
mov edx, 0x60081
lea rcx, [rsp + 0xa8]
mov rax, qword [0x18009b478]
call qword [0x18007d538]
mov dword [rsp + 0x64], eax
test eax, eax
jns 0x18000f4bc
mov rcx, qword [0x18009b358]
cmp rcx, rbx
je 0x18000f4ac
test byte [rcx + 0x1c], 1
je 0x18000f4ac
cmp byte [rcx + 0x19], 2
jb 0x18000f4ac
mov edx, 0x3e
mov dword [rsp + 0x20], eax
lea r9, str.ZwCreateFile_through_trufos
lea r8, [0x180090de8]
mov rcx, qword [rcx + 0x10]
call fcn.1800012d0
mov byte [rsp + 0x60], 0
xor edi, edi
mov dword [rsp + 0x64], edi
jmp 0x18000fb23
cmp edi, 5
je 0x18000f4d6
cmp edi, 0x20
je 0x18000f4d6
mov byte [rsp + 0x60], 1
xor edi, edi
mov dword [rsp + 0x64], edi
jmp 0x18000fb23
mov byte [rsp + 0x60], 0
add edi, 0xe8f00000
mov dword [rsp + 0x64], edi
jmp 0x18000fb23
mov r8d, 0x6e3
mov rdx, rsi
mov ecx, 1
call fcn.180023b70
test al, al
je 0x18000f516
mov edi, 0xe8030001
mov dword [rsp + 0x64], edi
lea rbx, [0x18009b358]
jmp 0x18000fb23
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x18000f577
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rbx, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rbx
je 0x18000f76d
test byte [rcx + 0x1c], 1
je 0x18000f76d
cmp byte [rcx + 0x19], 3
jb 0x18000f76d
mov edx, 0x3f
mov r9d, eax
lea r8, [0x180090de8]
mov rcx, qword [rcx + 0x10]
call fcn.180001270
jmp 0x18000f76d
bt eax, 0xe
jae 0x18000f766
mov qword [rsp + 0xb8], rdi
mov dword [rsp + 0x70], edi
lea r9, [rsp + 0x70]
lea r8, [rsp + 0xb8]
mov edx, 0x1a
lea rcx, str.SystemrootTrfDefData.tmp
call fcn.180024190
mov edi, eax
mov dword [rsp + 0x64], eax
test eax, eax
jns 0x18000f605
lea rbx, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rbx
je 0x18000fb23
test byte [rcx + 0x1c], 1
je 0x18000fb23
cmp byte [rcx + 0x19], 2
jb 0x18000fb23
mov edx, 0x40
lea r9, str.TrfNormalizePath
mov dword [rsp + 0x20], eax
lea r8, [0x180090de8]
mov rcx, qword [rcx + 0x10]
call fcn.1800012d0
jmp 0x18000fb23
mov rcx, qword [rsp + 0xb8]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rcx + rdx*2], 0
jne 0x18000f614
lea r8, [rsp + 0x70]
call fcn.180024510
mov edi, eax
mov dword [rsp + 0x64], eax
test eax, eax
jns 0x18000f66b
lea rbx, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rbx
je 0x18000fb23
test byte [rcx + 0x1c], 1
je 0x18000fb23
cmp byte [rcx + 0x19], 2
jb 0x18000fb23
mov edx, 0x41
lea r9, str.TrfConvertPathToDosDevice
jmp 0x18000f5ec
mov rdx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xb0]
call fcn.180002300
mov edi, eax
mov dword [rsp + 0x64], eax
test eax, eax
jns 0x18000f6cc
lea rbx, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rbx
je 0x18000f6d3
test byte [rcx + 0x1c], 1
je 0x18000f6d3
cmp byte [rcx + 0x19], 3
jb 0x18000f6d3
mov edx, 0x42
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0xb0]
lea r8, [0x180090de8]
mov rcx, qword [rcx + 0x10]
call fcn.180001180
jmp 0x18000f6d3
lea rbx, [0x18009b358]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x4200008
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x60081
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa8], rax
cmp rax, 0xffffffffffffffff
jne 0x18000f7fc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x18009b358]
cmp rcx, rbx
je 0x18000fb23
test byte [rcx + 0x1c], 1
je 0x18000fb23
cmp byte [rcx + 0x19], 2
jb 0x18000fb23
mov edx, 0x43
mov dword [rsp + 0x20], eax
lea r9, str.CreateFile
lea r8, [0x180090de8]
mov rcx, qword [rcx + 0x10]
call fcn.1800012d0
jmp 0x18000fb23
lea rbx, [0x18009b358]
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x40], 0x200008
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x108]
lea r8, [rsp + 0xc8]
mov edx, 0x60081
lea rcx, [rsp + 0xa8]
mov rax, qword [0x18009b478]
call qword [0x18007d538]
mov edi, eax
mov dword [rsp + 0x64], eax
test eax, eax
jns 0x18000f7fc
mov rcx, qword [0x18009b358]
cmp rcx, rbx
je 0x18000fb23
test byte [rcx + 0x1c], 1
je 0x18000fb23
cmp byte [rcx + 0x19], 2
jb 0x18000fb23
mov edx, 0x44
lea r9, str.ZwCreateFile
jmp 0x18000f5ec
mov r8d, 0x731
mov rdx, rsi
mov ecx, 1
call fcn.180023b70
test al, al
je 0x18000f821
mov edi, 0xe8030001
mov dword [rsp + 0x64], edi
jmp 0x18000fb23
lea rdx, [rsp + 0xf8]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x18000f88a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [0x18009b358]
cmp rcx, rbx
je 0x18000f87b
test byte [rcx + 0x1c], 1
je 0x18000f87b
cmp byte [rcx + 0x19], 2
jb 0x18000f87b
mov edx, 0x45
lea r9, [0x180090d40]
mov dword [rsp + 0x20], edi
lea r8, [0x180090de8]
mov rcx, qword [rcx + 0x10]
call fcn.1800012d0
add edi, 0xe8f00000
mov dword [rsp + 0x64], edi
jmp 0x18000fb23
cmp qword [rsp + 0xf8], 0
jne 0x18000f8cd
mov rcx, qword [0x18009b358]
cmp rcx, rbx
je 0x18000f8c2
test byte [rcx + 0x1c], 1
je 0x18000f8c2
cmp byte [rcx + 0x19], 5
jb 0x18000f8c2
mov edx, 0x46
lea r8, [0x180090de8]
mov rcx, qword [rcx + 0x10]
call fcn.180001070
xor edi, edi
mov dword [rsp + 0x64], edi
jmp 0x18000fb23
cmp dword [0x18009b37c], 0
je 0x18000f933
lea rdx, [rsp + 0xf8]
mov rcx, qword [rsp + 0xa8]
call fcn.18000e240
mov dword [rsp + 0x64], eax
test eax, eax
jns 0x18000f933
mov rcx, qword [0x18009b358]
cmp rcx, rbx
je 0x18000f8c2
test byte [rcx + 0x1c], 1
je 0x18000f8c2
cmp byte [rcx + 0x19], 4
jb 0x18000f8c2
mov edx, 0x47
mov r9, qword [rsp + 0xb0]
lea r8, [0x180090de8]
mov rcx, qword [rcx + 0x10]
call fcn.180001110
xor edi, edi
mov dword [rsp + 0x64], edi
jmp 0x18000fb23
lea rdx, [rsp + 0x100]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x18000f990
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x18009b358]
cmp rcx, rbx
je 0x18000f980
test byte [rcx + 0x1c], 1
je 0x18000f980
cmp byte [rcx + 0x19], 3
jb 0x18000f980
mov edx, 0x48
mov r9d, eax
lea r8, [0x180090de8]
mov rcx, qword [rcx + 0x10]
call fcn.180001270
mov byte [rsp + 0x60], 1
xor edi, edi
mov dword [rsp + 0x64], edi
jmp 0x18000fb23
mov rax, qword [rsp + 0x100]
mov r9, qword [rsp + 0xf8]
cmp rax, r9
je 0x18000f9e0
mov rcx, qword [0x18009b358]
cmp rcx, rbx
je 0x18000f980
test byte [rcx + 0x1c], 1
je 0x18000f980
cmp byte [rcx + 0x19], 3
jb 0x18000f980
mov edx, 0x49
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx + 0x10]
call fcn.18000c480
mov byte [rsp + 0x60], 1
xor edi, edi
mov dword [rsp + 0x64], edi
jmp 0x18000fb23
mov r8d, 0x769
mov rdx, rsi
mov ecx, 1
call fcn.180023b70
test al, al
je 0x18000fa05
mov edi, 0xe8030001
mov dword [rsp + 0x64], edi
jmp 0x18000fb23
lea r9, [rsp + 0xa0]
mov r8d, r14d
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0xf8]
call fcn.18000ffc0
mov edi, eax
test eax, eax
je 0x18000fa60
mov rcx, qword [0x18009b358]
cmp rcx, rbx
je 0x18000f87b
test byte [rcx + 0x1c], 1
je 0x18000f87b
cmp byte [rcx + 0x19], 2
jb 0x18000f87b
mov edx, 0x4a
lea r9, str.CreateValidZonesArray_failed
jmp 0x18000f867
test r15b, r15b
jne 0x18000fa8d
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0xa8]
call fcn.18000fd50
test eax, eax
je 0x18000fa8d
lea edi, [rax - 0x17100000]
mov dword [rsp + 0x64], edi
jmp 0x18000fb23
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov r9, r13
mov r8, qword [rsp + 0x88]
mov r14, qword [rsp + 0x68]
mov rdx, r14
mov rcx, qword [rsp + 0xa8]
call fcn.180010240
mov edi, eax
mov dword [rsp + 0x64], eax
test eax, eax
jns 0x18000fb0d
mov rcx, qword [0x18009b358]
cmp rcx, rbx
je 0x18000fb28
test byte [rcx + 0x1c], 1
je 0x18000fb28
cmp byte [rcx + 0x19], 2
jb 0x18000fb28
mov edx, 0x4b
mov dword [rsp + 0x20], eax
lea r9, str.ReadAndCompareFiles
lea r8, [0x180090de8]
mov rcx, qword [rcx + 0x10]
call fcn.1800012d0
jmp 0x18000fb28
xor edi, edi
mov dword [rsp + 0x64], edi
jmp 0x18000fb28
lea rbx, [0x18009b358]
lea rsi, str.E:_buildsARK23181_2_trufos_dllhiddenContent.c
mov r14, qword [rsp + 0x68]
mov rdx, qword [rsp + 0xa0]
test rdx, rdx
je 0x18000fbe1
mov rcx, qword [rsp + 0xa8]
call fcn.18000fe80
test eax, eax
je 0x18000fb82
mov rcx, qword [0x18009b358]
cmp rcx, rbx
je 0x18000fb82
test byte [rcx + 0x1c], 1
je 0x18000fb82
cmp byte [rcx + 0x19], 2
jb 0x18000fb82
mov edx, 0x4c
mov dword [rsp + 0x20], eax
lea r9, str.RemoveFileLocks
lea r8, [0x180090de8]
mov rcx, qword [rcx + 0x10]
call fcn.1800012d0
mov r8, qword [rsp + 0xa0]
test r8, r8
je 0x18000fbe1
cmp byte [0x18009b380], 0
je 0x18000fbbf
mov r9d, 0x7a2
mov qword [rsp + 0x20], rsi
mov r8d, 0x4348543a
lea rdx, [rsp + 0xa0]
lea rcx, [0x18009cc40]
call fcn.18004be40
jmp 0x18000fbd5
xor edx, edx
mov rcx, qword [0x18009ccf0]
mov rax, qword [0x18009b440]
call qword [0x18007d538]
mov qword [rsp + 0xa0], 0
lea rax, [r14 - 1]
cmp rax, 0xfffffffffffffffd
ja 0x18000fc36
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x18000fc36
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x18009b358]
cmp rcx, rbx
je 0x18000fc36
test byte [rcx + 0x1c], 1
je 0x18000fc36
cmp byte [rcx + 0x19], 2
jb 0x18000fc36
mov edx, 0x4d
mov dword [rsp + 0x20], eax
lea r9, [0x180090d78]
lea r8, [0x180090de8]
mov rcx, qword [rcx + 0x10]
call fcn.1800012d0
mov rcx, qword [rsp + 0xa8]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x18000fc55
mov rax, qword [0x18009b4c8]
call qword [0x18007d538]
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x18000fc67
mov rcx, rax
call fcn.18001ee30
cmp qword [rsp + 0xc0], 0
je 0x18000fc87
mov edx, 0x7c3
mov r8, rsi
lea rcx, [rsp + 0xc0]
call fcn.18004a470
test edi, edi
js 0x18000fc9a
movzx eax, byte [rsp + 0x60]
mov rcx, qword [rsp + 0x90]
mov byte [rcx], al
cmp qword [rsp + 0xb0], 0
je 0x18000fcba
mov edx, 0x7ce
mov r8, rsi
lea rcx, [rsp + 0xb0]
call fcn.18004afd0
mov r8, qword [rsp + 0xb8]
test r8, r8
je 0x18000fd0f
cmp byte [0x18009b380], 0
je 0x18000fcf9
mov r9d, 0x7d3
mov qword [rsp + 0x20], rsi
mov r8d, 0x4843573a
lea rdx, [rsp + 0xb8]
lea rcx, [0x18009cc40]
call fcn.18004be40
mov eax, edi
jmp 0x18000fd18
xor edx, edx
mov rcx, qword [0x18009ccf0]
mov rax, qword [0x18009b440]
call qword [0x18007d538]
mov eax, edi
jmp 0x18000fd18
mov eax, 0xc00000ef
mov rcx, qword [rsp + 0x118]
xor rcx, rsp
call fcn.18005e1d0
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret