Function at 0x180014550
Capabilities:
Check if file exists
Get file attributes
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r15
lea rbp, [rsp - 0x1f0]
sub rsp, 0x2f0
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov rax, qword [0x1800e7b20]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
mov r12, r9
mov dword [rsp + 0x68], r8d
mov rsi, rdx
mov qword [rbp - 0x50], rcx
mov r15, qword [rbp + 0x258]
mov rax, qword [rbp + 0x260]
mov qword [rsp + 0x78], rax
mov rax, qword [rbp + 0x268]
mov qword [rbp - 0x58], rax
mov rax, qword [rbp + 0x278]
mov qword [rsp + 0x70], rax
mov rbx, qword [rbp + 0x280]
xor edi, edi
mov r13d, edi
test rdx, rdx
je 0x180014a04
test r8d, r8d
je 0x180014a04
test r9, r9
je 0x180014a04
call fcn.1800136d0
test eax, eax
je 0x1800145f4
lea eax, [rdi + 1]
jmp 0x180014a2b
cmp dword [rbp + 0x250], edi
je 0x180014628
call fcn.18002cad0
test eax, eax
je 0x180014628
mov ecx, 0x28
call fcn.180039e84
mov qword [rbp - 0x80], rax
test rax, rax
je 0x180014625
mov rcx, rax
call fcn.1800044d0
mov r13, rax
jmp 0x180014628
mov r13, rdi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x180014664
cmp dword [0x1801030e0], 0
je 0x1800149ee
lea r9, str.COCPFClientHlp::Start_err2
lea r8, str.OCPFrame
or edx, eax
lea rcx, [0x1801027f8]
call fcn.180072a80
jmp 0x1800149ee
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.18001aa60
nop
mov rcx, qword [rsp + 0x50]
cmp dword [rcx - 8], 0
je 0x180014688
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1800146ac
call fcn.1800043f0
mov rbx, rax
call fcn.180001320
mov r8, rax
mov r9, rbx
lea rdx, [0x1800b2048]
lea rcx, [rsp + 0x50]
call fcn.180019070
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1800146dc
call fcn.180001320
mov r8, rax
lea r9, str.rundll32.exe
lea rdx, [0x1800b2048]
lea rcx, [rsp + 0x50]
call fcn.180019070
mov rax, qword [0x1800b77b8]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x20], r12
mov r12d, dword [rsp + 0x68]
mov r9d, r12d
mov r8, rsi
lea rdx, str._server:_s___port:_d___dll:_s_
lea rcx, [rsp + 0x58]
call fcn.180019070
mov rbx, qword [rsp + 0x70]
test rbx, rbx
je 0x18001477a
lea r8, str.__sock:
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x80]
call fcn.18001ad50
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.18001ad50
nop
lea r8, [0x1800b270c]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.18001ad50
nop
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1800181d0
nop
lea rcx, [rsp + 0x70]
call fcn.1800180c0
nop
lea rcx, [rbp - 0x60]
call fcn.1800180c0
nop
lea rcx, [rbp - 0x80]
call fcn.1800180c0
mov rax, qword [0x1800b77b8]
mov qword [rsp + 0x60], rax
cmp dword [rbp + 0x250], 0
je 0x18001479f
call fcn.18002cad0
test eax, eax
lea r9, str.ocpframe64.dll
jne 0x1800147a6
lea r9, str.ocpframe32.dll
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r8, qword [rsp + 0x50]
lea rdx, str._s__s_OFSRunServer__s
lea rcx, [rsp + 0x60]
call fcn.180019070
lea rbx, str.WinSta0Default
mov rax, qword [rbp - 0x58]
test rax, rax
cmovne rbx, rax
cmp dword [0x1801030e0], 0
je 0x180014812
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], r15
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, str.COCPFClientHlp::Start_1___s____08x____s_
lea r8, str.OCPFrame
or edx, 0xffffffff
lea rcx, [0x1801027f8]
call fcn.180072a80
mov qword [rbp - 0x78], rdi
xor eax, eax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
test r15, r15
je 0x180014861
lea rax, [rbp - 0x78]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], edi
mov eax, dword [rbp + 0x270]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov r8, qword [rsp + 0x60]
xor edx, edx
mov rcx, r15
call fcn.18006b600
mov ebx, eax
jmp 0x1800148bd
or ecx, 0xffffffff
call fcn.180067210
mov r12, rax
test rax, rax
je 0x1800149a7
lea rax, [rbp - 0x78]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], edi
mov ecx, dword [rbp + 0x270]
mov dword [rsp + 0x28], ecx
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov r8, qword [rsp + 0x60]
xor edx, edx
mov rcx, r12
call fcn.18006b600
mov ebx, eax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12d, dword [rsp + 0x68]
test ebx, ebx
je 0x1800149a7
mov ebx, edi
mov rcx, rsi
call fcn.180011e20
test eax, eax
jne 0x180014942
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0xa
jl 0x1800148c7
cmp dword [0x1801030e0], 0
je 0x18001490b
lea r9, str.COCPFClientHlp::Start_err4
lea r8, str.OCPFrame
or edx, 0xffffffff
lea rcx, [0x1801027f8]
call fcn.180072a80
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x180014927
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x60]
call fcn.1800180c0
nop
lea rcx, [rsp + 0x58]
call fcn.1800180c0
nop
jmp 0x1800149e4
mov dword [rbp - 0x40], edi
xor edx, edx
mov r8d, 0x214
lea rcx, [rbp - 0x3c]
call fcn.180038130
mov r8d, 0x103
mov rdx, rsi
lea rcx, [rbp - 0x38]
call fcn.1800380a0
mov dword [rbp - 0x40], r12d
mov rax, qword [rbp - 0x78]
mov qword [rbp + 0x1d0], rax
mov r8d, 1
lea rdx, [rbp - 0x40]
mov rcx, qword [rbp - 0x50]
call fcn.180013aa0
mov edi, 1
lea rcx, [rsp + 0x60]
call fcn.1800180c0
nop
lea rcx, [rsp + 0x58]
call fcn.1800180c0
nop
jmp 0x1800149e4
cmp dword [0x1801030e0], 0
je 0x1800149ce
lea r9, str.COCPFClientHlp::Start_err3
lea r8, str.OCPFrame
or edx, 0xffffffff
lea rcx, [0x1801027f8]
call fcn.180072a80
nop
lea rcx, [rsp + 0x60]
call fcn.1800180c0
nop
lea rcx, [rsp + 0x58]
call fcn.1800180c0
nop
lea rcx, [rsp + 0x50]
call fcn.1800180c0
test r13, r13
je 0x180014a29
mov r8, qword [r13]
mov edx, 1
mov rcx, r13
call qword [r8]
jmp 0x180014a29
cmp dword [0x1801030e0], edi
je 0x180014a29
lea r9, str.COCPFClientHlp::Start_err1
lea r8, str.OCPFrame
or edx, 0xffffffff
lea rcx, [0x1801027f8]
call fcn.180072a80
mov eax, edi
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.180038100
add rsp, 0x2f0
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret