Function at 0x1400271a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
jmp 0x1400271a0
mov r11, rsp
push rbp
push rsi
push rdi
lea rbp, [r11 - 0x158]
sub rsp, 0x240
mov rax, qword [0x140187788]
xor rax, rsp
mov qword [rbp + 0x110], rax
mov qword [r11 + 0x18], rbx
mov qword [r11 - 0x20], r12
mov r12, rcx
mov qword [r11 - 0x28], r13
xor r13d, r13d
mov qword [r11 - 0x30], r14
mov esi, r13d
mov dword [rsp + 0x7c], r13d
mov edi, r13d
mov dword [rsp + 0x78], r13d
mov r14, rdx
mov dword [rsp + 0x74], r13d
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
mov qword [r11 - 0x38], r15
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14002765f
test al, 0x50
jne 0x14002765f
call fcn.140004b83
cmp eax, 1
je 0x14002722b
lea esi, [r13 + 0x7e]
jmp 0x140027664
mov qword [rsp + 0x50], r13
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rax
mov r9d, 2
lea rax, [rsp + 0x60]
mov r8d, 0x400
mov qword [rsp + 0x40], rax
mov rdx, r12
lea rax, [rsp + 0x74]
mov qword [rsp + 0x38], rax
lea ecx, [r9 - 1]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
call qword [0x140189350]
mov edi, eax
test eax, eax
jne 0x140027293
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140027664
mov ecx, 0x23f0
call fcn.140022120
test eax, eax
jne 0x140027535
mov rcx, r12
call fcn.140021da0
test eax, eax
je 0x140027535
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp + 0x100], rax
mov r15d, r13d
mov dword [rbp + 0x108], eax
mov rax, qword [0x140189370]
movups xmmword [rbp + 0xf0], xmm0
test rax, rax
jne 0x1400272fb
xor edx, edx
lea rcx, str.Advapi32.dll
call fcn.1400223e0
mov qword [0x140189370], rax
test rax, rax
je 0x140027425
cmp qword [0x140189398], rsi
jne 0x14002732b
lea rdx, str.OpenSCManagerW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140189398], rax
test rax, rax
je 0x140027425
mov rax, qword [0x140189370]
cmp qword [0x1401893a0], rsi
jne 0x14002735b
lea rdx, str.OpenServiceW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401893a0], rax
test rax, rax
je 0x140027425
mov rax, qword [0x140189370]
cmp qword [0x1401893b0], rsi
jne 0x14002738b
lea rdx, str.QueryServiceStatus
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401893b0], rax
test rax, rax
je 0x140027425
mov rax, qword [0x140189370]
cmp qword [0x1401893b8], rsi
jne 0x1400273b0
lea rdx, str.CloseServiceHandle
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401893b8], rax
test rax, rax
je 0x140027425
xor edx, edx
xor ecx, ecx
mov r8d, 0x80000000
call qword [0x140189398]
mov rdi, rax
test rax, rax
je 0x14002741c
mov r8d, 4
lea rdx, str.CryptSvc
mov rcx, rax
call qword [0x1401893a0]
mov rbx, rax
test rax, rax
je 0x140027413
lea rdx, [rbp + 0xf0]
mov rcx, rax
call qword [0x1401893b0]
test eax, eax
je 0x14002740a
mov ecx, dword [rbp + 0xf4]
add ecx, 0xfffffffc
cmp ecx, 3
setbe r15b
mov rcx, rbx
call qword [0x1401893b8]
mov rcx, rdi
call qword [0x1401893b8]
test r15d, r15d
jne 0x140027535
mov r15, qword [rsp + 0x68]
lea rax, [rsp + 0x70]
mov r12, qword [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, r15
mov rdi, r13
mov ebx, r13d
lea edx, [r9 + 6]
call qword [0x140189348]
test eax, eax
jne 0x140027463
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x140027509
mov edx, dword [rsp + 0x70]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
jne 0x140027487
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x140027509
xor r8d, r8d
lea rax, [rsp + 0x70]
mov r9, rsi
mov qword [rsp + 0x20], rax
mov rcx, r15
lea edx, [r8 + 6]
call qword [0x140189348]
test eax, eax
jne 0x1400274b2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x140027509
movups xmm0, xmmword [rsi + 8]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], r13
mov r9d, 0xb0000
mov qword [rsp + 0x20], rax
movaps xmmword [rbp + 0x50], xmm0
xor r8d, r8d
movups xmm1, xmmword [rsi + 0x18]
mov edx, 0x10001
mov rcx, r12
movups xmmword [rbp + 0x28], xmm1
call qword [0x140189340]
mov rdi, rax
test rax, rax
jne 0x1400274f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x140027509
test r14, r14
je 0x140027509
mov rcx, rax
call fcn.140021d00
mov dword [r14], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rdi, rdi
je 0x140027520
mov rcx, rdi
call qword [0x140189338]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, 1
mov esi, r13d
jmp 0x140027664
xorps xmm1, xmm1
mov qword [rbp], 0x20
xor eax, eax
movaps xmmword [rbp - 0x40], xmm1
movups xmmword [rbp - 0x70], xmm1
mov qword [rbp - 0x30], rax
mov ecx, 0x23f0
movups xmmword [rbp - 0x60], xmm1
mov qword [rbp + 8], r12
movups xmmword [rbp - 0x80], xmm1
mov dword [rbp - 0x80], 0x58
movups xmmword [rbp - 0x50], xmm1
mov dword [rbp - 0x50], 1
psrldq xmm1, 8
xorps xmm0, xmm0
movd eax, xmm1
movdqu xmmword [rbp + 0x10], xmm0
mov dword [rbp - 0x68], 2
bts eax, 0xc
mov dword [rbp - 0x64], 1
mov dword [rbp - 0x38], eax
lea rax, [rbp]
mov qword [rbp - 0x58], rax
mov dword [rbp - 0x60], 1
call fcn.140022120
mov r8, qword [rsp + 0x68]
mov r9, r14
mov rdx, qword [rsp + 0x60]
lea rcx, [rbp - 0x80]
test eax, eax
jne 0x1400275dc
call fcn.1400052b3
mov edi, eax
test eax, eax
jne 0x140027664
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140027664
xorps xmm0, xmm0
mov dword [rbp - 4], r13d
lea rax, [rbp - 0x20]
mov qword [rbp - 0x20], 0x20
movdqu xmmword [rbp - 0x14], xmm0
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x18], 3
call fcn.1400052b3
mov edi, eax
test eax, eax
jne 0x140027664
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ebx, 1
mov rax, qword [rbp - 0x30]
cmp dword [rax + 0xc], ebx
jb 0x140027664
mov qword [rbp - 0x48], r13
lea rcx, [rbp - 0x80]
mov dword [rbp - 0x50], 1
mov r9, r14
mov dword [rax + 4], ebx
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
call fcn.1400052b3
mov edi, eax
test eax, eax
jne 0x140027664
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
inc ebx
mov rax, qword [rbp - 0x30]
cmp ebx, dword [rax + 0xc]
jbe 0x140027620
jmp 0x140027664
mov esi, 2
mov rcx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x220]
mov r14, qword [rsp + 0x228]
mov r13, qword [rsp + 0x230]
mov r12, qword [rsp + 0x238]
mov rbx, qword [rsp + 0x270]
test rcx, rcx
je 0x14002769e
xor edx, edx
call qword [0x140189330]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400276ae
call qword [0x140189328]
test edi, edi
jne 0x1400276b6
mov ecx, esi
jmp 0x1400276b8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.140002cde
add rsp, 0x240
pop rdi
pop rsi
pop rbp
ret