Function at 0x1400300b0
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
mov dword [rax + 0x20], r9d
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x298
mov ebx, r9d
lea r8, [0x1400f1b90]
lea rdx, str.NTDLL.DLL
lea r9, [rsp + 0x70]
lea rcx, str.RtlCreateUnicodeString
xor r12d, r12d
mov qword [rsp + 0x70], r12
call fcn.140046024
lea r9, [rsp + 0x70]
lea r8, [0x1400f1b98]
lea rdx, str.NTDLL.DLL
lea rcx, str.RtlFreeUnicodeString
call fcn.140046024
mov r15d, dword [rsp + 0x320]
mov r8, qword [0x1400f19d8]
xor eax, eax
and r15d, 0x10
mov word [rsp + 0x40], r12w
mov qword [rsp + 0x42], rax
mov dword [rsp + 0x4a], eax
mov word [rsp + 0x4e], ax
mov dword [rsp + 0x68], r12d
cmp r8, r12
jne 0x14003015c
mov eax, 3
jmp 0x1400307ff
mov rsi, qword [rsp + 0x310]
cmp r15d, r12d
je 0x14003018b
cmp rsi, r12
je 0x14003018b
movzx eax, word [rsi]
cmp ax, 0x41
jb 0x14003018b
cmp ax, 0x5a
ja 0x14003018b
or ax, 0x20
mov word [rsi], ax
mov r8, qword [0x1400f19d8]
lea rdx, str.DeviceImDiskCtl
lea rcx, [rsp + 0x40]
call r8
mov r13d, 0xc0000000
lea rcx, [rsp + 0x40]
mov edx, r13d
call qword [0x1400f1df8]
or rdi, 0xffffffffffffffff
jmp 0x1400301e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x14003023c
lea rcx, str.ImDisk
call qword [0x1400f1e18]
cmp eax, r12d
je 0x140030206
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x40]
mov edx, r13d
call qword [0x1400f1df8]
mov rbp, rax
cmp rax, rdi
je 0x1400301b4
mov rcx, rax
call fcn.14001682c
cmp eax, r12d
jne 0x140030252
mov edi, 5
jmp 0x1400306f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x14003022e
cmp eax, 3
jbe 0x140030224
cmp eax, 0x422
je 0x140030224
cmp eax, 0x424
jne 0x14003022e
mov eax, 4
jmp 0x1400307ff
lea rcx, str.Error_loading_ImDisk_Virtual_Disk_Driver:
call fcn.1400167b0
jmp 0x140030224
lea rcx, str.Error_controlling_the_ImDisk_Virtual_Disk_Driver:
call fcn.1400167b0
mov eax, 6
jmp 0x1400307ff
mov edx, r12d
mov ecx, r12d
mov eax, r12d
mov r14d, ebx
mov r13d, ebx
and r14d, 0xf000
and r13d, 0xf00
cmp r14d, 0x1000
sete dl
cmp r13d, 0x100
sete cl
cmp r13d, r12d
sete al
or ecx, eax
test edx, ecx
je 0x1400304da
lea rdx, str.DeviceAWEAlloc
lea rcx, [rsp + 0x58]
call qword [0x1400f19d8]
jmp 0x1400302d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140030312
lea rcx, str.AWEAlloc
call qword [0x1400f1e18]
cmp eax, r12d
je 0x140030473
lea rcx, str.AWEAlloc_driver_was_loaded_into_the_kernel.
call fcn.1400baba8
lea rcx, [rsp + 0x58]
mov edx, 0xc0000000
call qword [0x1400f1df8]
mov rbx, rax
cmp rax, rdi
je 0x1400302a7
lea r8, [0x1400f1ba0]
lea rdx, str.NTDLL.DLL
lea rcx, str.NtClose
xor r9d, r9d
call fcn.140046024
mov rcx, rbx
call qword [0x1400f1ba0]
mov r12, qword [rsp + 0x300]
test r12, r12
jne 0x14003059b
lea rcx, [rsp + 0x40]
xor edx, edx
call qword [0x1400f19d8]
xor r14d, r14d
movzx edx, word [rsp + 0x40]
lea rcx, [rsp + 0x50]
lea edx, [rdx + rdx + 0x38]
call fcn.14004bc80
mov rbx, qword [rsp + 0x50]
movzx r8d, word [rsp + 0x40]
add r8, 0x38
mov rcx, rbx
xor edx, edx
call fcn.1400b93b0
mov r12d, 0x3a
cmp rsi, r14
je 0x14003039e
cmp r15d, r14d
jne 0x14003039e
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 2
jne 0x140030384
cmp word [rsi + 2], r12w
je 0x140030397
cmp eax, 3
jne 0x14003039e
cmp word [rsi + 2], r12w
jne 0x14003039e
cmp word [rsi + 4], 0x5c
jne 0x14003039e
movzx eax, word [rsi]
mov word [rbx + 0x2c], ax
mov rcx, qword [rsp + 0x2e8]
mov rdi, qword [rsp + 0x2e0]
mov eax, dword [rdi]
mov dword [rbx], eax
mov rax, qword [rcx]
mov qword [rbx + 8], rax
mov rax, qword [rcx + 8]
mov qword [rbx + 0x10], rax
mov rax, qword [rcx + 0x10]
mov qword [rbx + 0x18], rax
mov rax, qword [rsp + 0x2f0]
mov rax, qword [rax]
mov qword [rbx + 0x20], rax
mov eax, dword [rsp + 0x2f8]
mov dword [rbx + 0x28], eax
movzx eax, word [rsp + 0x40]
mov word [rbx + 0x2e], ax
movzx eax, word [rsp + 0x40]
cmp ax, r14w
je 0x140030413
mov rdx, qword [rsp + 0x48]
lea rcx, [rbx + 0x30]
movzx r8d, ax
call fcn.1400ba0e0
lea rcx, [rsp + 0x40]
call qword [0x1400f1b98]
movzx r9d, word [rbx + 0x2e]
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
add r9d, 0x38
mov r8, rbx
mov dword [rsp + 0x28], r9d
mov edx, 0x8372e004
mov rcx, rbp
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, r14d
jne 0x140030709
lea rcx, str.Error_creating_virtual_disk:
call fcn.1400167b0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x50]
call fcn.140044f24
jmp 0x140030152
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x1400304c4
cmp eax, 3
jbe 0x1400304b6
cmp eax, 0x422
je 0x1400304a8
cmp eax, 0x424
jne 0x1400304c4
call fcn.1400ba598
lea rcx, str.The_AWEAlloc_driver_is_not_installed._r_nPlease_re_install_ImDisk._r_n
lea rdx, [rax + 0x60]
call fcn.1400baa18
jmp 0x1400304d0
call fcn.1400ba598
lea rcx, str.The_AWEAlloc_driver_is_disabled._r_n
jmp 0x14003049d
call fcn.1400ba598
lea rcx, str.Cannot_load_AWEAlloc_driver._r_nPlease_re_install_ImDisk._r_n
jmp 0x14003049d
lea rcx, str.Error_loading_AWEAlloc_driver:
call fcn.1400167b0
mov edi, 7
jmp 0x1400306f9
cmp r14d, 0x2000
mov ecx, r12d
mov eax, r12d
sete cl
or ecx, edx
cmp r13d, 0x300
sete al
test eax, ecx
je 0x140030312
lea rbx, str..PIPEImDskSvc
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
cmp eax, r12d
jne 0x140030312
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140030312
lea rcx, str.ImDskSvc
call qword [0x1400f1e18]
cmp eax, r12d
jne 0x140030586
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x140030560
cmp eax, 3
jbe 0x1400304d0
cmp eax, 0x422
je 0x1400304d0
cmp eax, 0x424
je 0x1400304d0
lea rcx, str.Error_starting_ImDisk_Virtual_Disk_Driver_Helper_Service:
jmp 0x1400304cb
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140030312
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
cmp eax, r12d
je 0x14003056c
jmp 0x140030312
cmp dword [rsp + 0x308], 0
je 0x1400305bb
lea rcx, [rsp + 0x40]
mov rdx, r12
call qword [0x1400f1b90]
xor r14d, r14d
jmp 0x1400306f0
xor ecx, ecx
cmp r14d, 0x3000
sete cl
xor r14d, r14d
cmp r13d, 0x300
mov eax, r14d
sete al
xor r9d, r9d
test eax, ecx
je 0x1400306c2
mov qword [rsp + 0x30], r14
lea r8d, [r14 + 1]
lea rcx, str._Global
xor edx, edx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, r14d
cmp eax, 2
mov ecx, r14d
lea r13, str.BaseNamedObjects_
sete dl
cmp rbx, rdi
lea rax, str.BaseNamedObjectsGlobal_
sete cl
test ecx, edx
cmove r13, rax
cmp rbx, rdi
je 0x140030647
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, r12
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x58]
lea edx, [rax + rbx + 2]
call fcn.14004bedc
mov rbx, qword [rsp + 0x58]
cmp rbx, r14
jne 0x140030688
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x58]
call fcn.140044f24
jmp 0x140030702
mov rdx, r13
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x40]
mov rdx, rbx
call qword [0x1400f1b90]
cmp eax, r14d
je 0x140030673
lea rcx, [rsp + 0x58]
call fcn.140044f24
jmp 0x140030333
lea r8, [0x1400f1b88]
lea rdx, str.NTDLL.DLL
lea rcx, str.RtlDosPathNameToNtPathName_U
call fcn.140046024
lea rdx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
call qword [0x1400f1b88]
cmp eax, r14d
jne 0x140030333
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x1400307ff
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r11d, dword [rbx]
mov dword [rdi], r11d
cmp rsi, r14
je 0x1400307dc
mov r9d, dword [rbx]
lea r8, str.DeviceImDisk_u
lea rcx, [rsp + 0x80]
mov edx, 0x103
mov word [rsp + 0x80], r14w
call fcn.1400ba930
mov word [rsp + 0x286], r14w
cmp word [rbx + 0x2c], r14w
jne 0x1400307be
lea rdx, [rsp + 0x80]
mov rcx, rsi
call qword [0x1400f1e20]
cmp eax, r14d
jne 0x1400307dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 1
je 0x1400307b8
sub eax, 0x56
je 0x1400307b8
sub eax, r12d
je 0x1400307b8
sub eax, 0x7a
je 0x1400307b8
sub eax, 0x101b
je 0x1400307b8
cmp eax, 2
je 0x1400307a0
lea rcx, str.Error_creating_mount_point:
call fcn.1400167b0
jmp 0x1400307b8
call fcn.1400ba598
lea rdx, str.Invalid_mount_point_path:__1_ws__n
mov r8, rsi
lea rcx, [rax + 0x60]
call fcn.140016728
mov word [rsi], r14w
jmp 0x1400307dc
lea rcx, [rsp + 0x80]
mov r9d, 1
xor r8d, r8d
mov rdx, rsi
mov byte [rsp + 0x20], r14b
call fcn.1400512c8
mov r8, qword [rsp + 0x318]
cmp r8, r14
je 0x1400307f3
mov ecx, dword [rbx]
mov rdx, rsi
call fcn.140024d40
lea rcx, [rsp + 0x50]
call fcn.140044f24
xor eax, eax
add rsp, 0x298
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret