Function at 0x14000fdc8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x14003b0f8]
xor rax, rsp
mov qword [rbp + 0x178], rax
mov rcx, qword [rcx + 0x70]
xor r13d, r13d
movsxd r14, r8d
mov r12d, r13d
mov dword [rsp + 0x34], r14d
mov edi, r13d
mov rsi, rdx
call fcn.140011130
mov rbx, rax
test rax, rax
je 0x14000fe38
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], r13w
jne 0x14000fe21
cmp rdi, 0x7fe7
jae 0x14001d082
cmp byte [0x140043aa5], r13b
je 0x14000fe68
test rax, rax
je 0x14001d091
mov r8d, 4
lea rdx, str.cmd
mov rcx, rax
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
je 0x14001d091
mov r15d, 0x104
mov qword [rbp + 0x158], r13
mov r8d, r15d
mov byte [rbp + 0x160], 1
xor edx, edx
mov qword [rbp + 0x168], r15
lea rcx, [rsp + 0x50]
call sub.msvcrt.dll_memset
mov al, byte [rbp + 0x160]
lea rcx, [rsp + 0x50]
neg al
sbb rdx, rdx
and edx, 0x7ee3
add rdx, r15
call fcn.14000c130
test eax, eax
js 0x14001d0b8
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.14000abcc
mov rax, qword [rbp + 0x158]
lea rcx, [rsp + 0x50]
test rax, rax
mov ebx, 0x5c
cmovne rcx, rax
test rcx, rcx
je 0x14000fef6
mov edx, 0x2f
call qword [sym.imp.msvcrt.dll_wcschr]
test rax, rax
jne 0x1400105e1
mov rax, qword [rbp + 0x158]
lea rcx, [rsp + 0x50]
test rax, rax
mov dword [rbp + 0x170], 0x3a005c
lea rdx, [rbp + 0x170]
mov word [rbp + 0x174], r13w
cmovne rcx, rax
call fcn.140012b74
mov rcx, qword [rbp + 0x158]
mov word [rbp + 0x172], r13w
cmp rax, rdi
jae 0x1400104c8
test rcx, rcx
lea rax, [rsp + 0x50]
mov r15d, 1
cmovne rax, rcx
mov dword [rsp + 0x30], r15d
test rax, rax
je 0x14001d0e5
mov edx, ebx
mov rcx, rax
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov rcx, qword [rbp + 0x158]
mov rbx, rax
test rax, rax
je 0x14001d0e5
add rbx, 2
cmp word [rbx], r13w
je 0x14001d1d9
movzx edx, word [rbx]
movzx eax, word [0x140032420]
sub edx, eax
jne 0x14000ffa6
movzx edx, word [rbx + 2]
movzx eax, word [0x140032422]
sub edx, eax
test edx, edx
je 0x14001d1d9
movzx edx, word [rbx]
movzx eax, word [0x140032418]
sub edx, eax
jne 0x14000ffd8
movzx edx, word [rbx + 2]
movzx eax, word [0x14003241a]
sub edx, eax
jne 0x14000ffd8
movzx edx, word [rbx + 4]
movzx eax, word [0x14003241c]
sub edx, eax
test edx, edx
je 0x14001d1d9
mov ecx, 0x1ff9c
call fcn.14000c480
mov rdi, rax
test rax, rax
je 0x14001d0b8
mov rax, qword [rbp + 0x158]
lea r8, [rsp + 0x50]
test rax, rax
mov qword [rsp + 0x38], r14
mov rdx, r14
mov rcx, rsi
cmovne r8, rax
call fcn.1400106e0
mov rax, qword [rbp + 0x158]
lea rcx, [rsp + 0x50]
test rax, rax
lea r8, [0x140032420]
mov rdx, r14
cmovne rcx, rax
mov rax, rbx
sub rax, rcx
mov rcx, rsi
sar rax, 1
mov word [rsi + rax*2], r13w
call fcn.140010600
mov r14d, 0xffce
mov r8, rsi
mov edx, r14d
mov rcx, rdi
call fcn.14001222c
test eax, eax
jne 0x14001d11b
mov rcx, rdi
call fcn.1400117a4
mov ecx, 0x5c
cmp word [rax], cx
je 0x14001008c
lea r8, [0x140032568]
mov edx, r14d
mov rcx, rdi
call fcn.140010600
mov r8, rbx
mov rdx, r14
mov rcx, rdi
call fcn.140010600
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rdi + rdx*2], r13w
jne 0x14001009e
lea rdx, [rdx*2 + 2]
mov rcx, rdi
call fcn.14000a754
mov r14, rax
test rax, rax
je 0x14001d0b8
mov edx, 0x5c
mov rcx, rax
call qword [sym.imp.msvcrt.dll_wcsrchr]
xor ebx, ebx
mov word [rax], bx
lea r13, [rax + 2]
test r15d, r15d
je 0x1400104e1
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_processenvironment_l1_2_0.dll_NeedCurrentDirectoryForExePathW]
mov r15d, eax
test eax, eax
je 0x14001d165
or rcx, 0xffffffffffffffff
inc rcx
cmp word [r14 + rcx*2], bx
jne 0x1400100fc
add rcx, 2
lea edi, [rcx + 2]
test r12, r12
jne 0x1400104b3
lea ecx, [rdi + rdi]
call fcn.14000c480
mov rbx, rax
xor eax, eax
test rbx, rbx
je 0x14001d16d
movsxd rdi, edi
test r15d, r15d
je 0x140010168
lea r8, [0x1400324b8]
mov rdx, rdi
mov rcx, rbx
call fcn.140010600
mov r8, r14
mov rdx, rdi
mov rcx, rbx
call fcn.140010600
lea r8, [0x1400324b8]
mov rdx, rdi
mov rcx, rbx
call fcn.140010600
xor eax, eax
lea r14, [0x1400324a8]
cmp dword [rsp + 0x30], eax
je 0x1400104f5
mov rcx, rbx
call fcn.140011d50
mov r8d, 1
mov rdx, r14
mov rcx, rbx
call fcn.14000cef0
or r12, 0xffffffffffffffff
mov r15, rax
xor ebx, ebx
inc r12
cmp word [r13 + r12*2], bx
jne 0x14001019b
inc r12
cmp byte [0x140043aa5], bl
je 0x14001d18a
lea rcx, str.PATHEXT
call fcn.14000fbc0
mov r10, rax
test rax, rax
je 0x14001d18a
mov rcx, rax
call fcn.140011d50
mov r8d, 1
mov rdx, r14
mov rcx, r10
call fcn.14000cef0
mov qword [rsp + 0x40], rax
xor r14d, r14d
or rdi, 0xffffffffffffffff
inc rdi
cmp word [r15 + rdi*2], r14w
jne 0x1400101f2
mov rcx, r15
call fcn.140011130
movsxd rdx, edi
mov r8, rax
inc rdx
mov rcx, r15
call fcn.1400106e0
or rdx, 0xffffffffffffffff
inc rdx
cmp word [r15 + rdx*2], r14w
jne 0x140010219
mov rcx, r15
call fcn.1400117a4
mov ecx, 0x5c
lea ebx, [rdi + 1]
movzx r14d, word [rax]
lea eax, [rdx + 1]
cmp r14w, cx
cmove eax, edx
cmove ebx, edi
xor edx, edx
cmp word [r15], dx
je 0x140010593
mov qword [rsp + 0x48], rax
lea edi, [rbx + 1]
add rax, r12
cmp rax, 0x7fe7
ja 0x14001d196
mov rdx, qword [rsp + 0x38]
mov r8, r15
mov rcx, rsi
call fcn.1400106e0
mov ecx, 0x5c
cmp r14w, cx
cmove ebx, edi
movsxd rax, ebx
mov rbx, qword [rsp + 0x38]
lea r15, [r15 + rax*2]
je 0x1400102a3
lea r8, [rbp + 0x170]
mov rdx, rbx
mov rcx, rsi
call fcn.140010600
mov r8, r13
mov rdx, rbx
mov rcx, rsi
call fcn.140010600
mov rcx, rsi
call fcn.140011130
mov r8, rax
mov rdx, rbx
mov rcx, rsi
call fcn.1400106e0
or rdi, 0xffffffffffffffff
xor r14d, r14d
inc rdi
cmp word [rsi + rdi*2], r14w
jne 0x1400102ce
mov eax, 0x3a
cmp word [rsi + 2], ax
jne 0x1400102f3
movzx ecx, word [rsi]
call fcn.140011cf0
test eax, eax
je 0x1400101ee
test r13, r13
je 0x14001033b
mov edx, 0x2e
mov rcx, r13
call qword [sym.imp.msvcrt.dll_wcsrchr]
test rax, rax
jne 0x1400103fc
mov edx, 0x2a
mov rcx, r13
call qword [sym.imp.msvcrt.dll_wcschr]
test rax, rax
jne 0x14001d1b6
lea edx, [rax + 0x3f]
mov rcx, r13
call qword [sym.imp.msvcrt.dll_wcschr]
test rax, rax
jne 0x14001d1b6
mov r14, qword [rsp + 0x40]
lea r9, [0x140032510]
mov edx, dword [rsp + 0x34]
mov r8d, edi
and dword [rsp + 0x20], 0
mov rcx, rsi
mov rbx, r14
call fcn.140012094
xor ecx, ecx
test eax, eax
je 0x1400101eb
cmp word [r14], cx
je 0x1400101eb
mov r14, qword [rsp + 0x48]
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], cx
jne 0x14001037b
add rax, r14
add rax, r12
cmp rax, 0x7fe7
ja 0x140010556
mov edx, dword [rsp + 0x34]
mov r9, rbx
mov r8d, edi
mov dword [rsp + 0x20], 1
mov rcx, rsi
call fcn.140012094
xor ecx, ecx
test eax, eax
je 0x140010547
lea rdx, str..BAT
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
xor edi, edi
test eax, eax
je 0x14001d1c6
lea rdx, str..CMD
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x14001d1c6
mov rcx, qword [rbp + 0x158]
mov qword [rbp + 0x158], rdi
jmp 0x140010479
cmp word [rax + 2], r14w
je 0x14001030f
mov edx, dword [rsp + 0x34]
mov r8d, 1
mov rcx, rsi
call fcn.1400120dc
test eax, eax
je 0x140010570
mov edx, 0x2e
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov rbx, rax
test rax, rax
je 0x140010577
lea rdx, str..CMD
mov rcx, rax
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x140010524
lea rdx, str..BAT
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
mov rcx, qword [rbp + 0x158]
mov qword [rbp + 0x158], r14
test eax, eax
je 0x140010532
test rcx, rcx
je 0x140010484
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov eax, 1
mov rcx, qword [rbp + 0x178]
xor rcx, rsp
call fcn.1400182e0
mov rbx, qword [rsp + 0x2d8]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
or rax, 0xffffffffffffffff
inc rax
cmp word [r12 + rax*2], bx
jne 0x1400104b7
add edi, eax
jmp 0x140010116
test rcx, rcx
mov dword [rsp + 0x30], r13d
lea rbx, [rsp + 0x50]
mov r15d, r13d
cmovne rbx, rcx
jmp 0x14000ff81
lea rcx, [0x140032608]
call fcn.14000fbc0
mov r12, rax
jmp 0x1400100e4
test r12, r12
je 0x140010179
test r15d, r15d
je 0x140010511
mov r8, r14
mov rdx, rdi
mov rcx, rbx
call fcn.140010600
mov r8, r12
mov rdx, rdi
mov rcx, rbx
call fcn.140010600
jmp 0x140010179
mov rcx, qword [rbp + 0x158]
mov qword [rbp + 0x158], r14
test rcx, rcx
je 0x14001053d
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov eax, 2
jmp 0x140010489
mov eax, dword [0x140043b28]
cmp eax, 2
jne 0x14001d1a9
movzx eax, word [rbx]
add rbx, 2
test ax, ax
jne 0x140010556
cmp word [rbx], cx
jne 0x140010377
jmp 0x1400101eb
cmp dword [rsp + 0x30], r14d
jne 0x1400105d1
mov eax, dword [0x140043b28]
cmp eax, 2
je 0x14001030f
test eax, eax
jne 0x1400101ee
jmp 0x14001030f
cmp dword [rsp + 0x30], edx
jne 0x1400105c3
mov dword [0x140043b28], 0x2331
mov rcx, qword [rbp + 0x158]
mov qword [rbp + 0x158], rdx
test rcx, rcx
je 0x1400105bc
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
xor eax, eax
jmp 0x140010489
test dword [0x140043b28], 0xfffffffd
je 0x140010599
jmp 0x1400105a3
mov eax, dword [0x140043b28]
cmp eax, 5
jne 0x14001057d
jmp 0x140010421
mov word [rax], bx
lea rcx, [rax + 2]
jmp 0x14000fedd
mov dword [0x140043b28], 0x233f
jmp 0x1400105bc
lea rcx, str.COMSPEC
call fcn.14000fbc0
mov rbx, rax
test rax, rax
jne 0x14000fe68
mov dword [0x140043b28], 0x400023d2
jmp 0x1400105bc
mov dword [0x140043b28], 8
mov rcx, qword [rbp + 0x158]
mov qword [rbp + 0x158], r13
test rcx, rcx
je 0x14001d0db
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov eax, 3
jmp 0x140010489
test rcx, rcx
lea rax, [rsp + 0x50]
cmovne rax, rcx
test rax, rax
jne 0x14001d0fe
mov rbx, r13
jmp 0x14000ff7d
mov edx, 0x3a
mov rcx, rax
call qword [sym.imp.msvcrt.dll_wcschr]
mov rcx, qword [rbp + 0x158]
mov rbx, rax
jmp 0x14000ff7d
cmp byte [0x140043aa5], r13b
je 0x14001d20a
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14001d20a
test al, 0x10
je 0x14001d20a
mov rcx, qword [rbp + 0x158]
mov qword [rbp + 0x158], r13
test rcx, rcx
je 0x14001d15b
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov eax, 5
jmp 0x140010489
mov rcx, rbx
jmp 0x14001010a
mov rcx, qword [rbp + 0x158]
mov qword [rbp + 0x158], rax
mov dword [0x140043b28], 8
jmp 0x14001d0d0
lea r10, str..COM_.EXE_.BAT_.CMD_.VBS_.JS_.WS_.MSC
jmp 0x1400101d5
cmp r14w, cx
cmove ebx, edi
movsxd rax, ebx
lea r15, [r15 + rax*2]
jmp 0x1400101eb
test eax, eax
jne 0x1400101eb
jmp 0x140010556
mov rcx, qword [rbp + 0x158]
mov qword [rbp + 0x158], r14
jmp 0x14001d218
mov rcx, qword [rbp + 0x158]
mov qword [rbp + 0x158], rdi
jmp 0x140010532
cmp byte [0x140043aa5], r13b
je 0x14001d211
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001d13a
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x15
jne 0x14001d20a
mov dword [0x140043b28], eax
jmp 0x14001d0c2
mov rcx, qword [rbp + 0x158]
mov qword [rbp + 0x158], r13
mov dword [0x140043b28], 0x2331
jmp 0x1400105b1