Function at 0x7ff3444bc98
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rsi, r8
mov r12, rdx
mov r13, rcx
mov r15d, 1
mov dword [rsp + 0x34], r15d
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
mov rax, qword [str.lCH4]
mov qword [r11 - 0x48], rax
mov qword [r11 - 0x40], rbx
mov byte [rsp + 0xb0], bl
mov byte [rsp + 0xa8], bl
mov rbp, rbx
cmp rdx, rbx
je 0x7ff3444bd07
movzx eax, word [rdx]
neg ax
sbb rcx, rcx
and r12, rcx
cmp r8, rbx
je 0x7ff3444bd19
movzx eax, word [r8]
neg ax
sbb rcx, rcx
and rsi, rcx
cmp r12, rbx
jne 0x7ff3444bd50
cmp rsi, rbx
jne 0x7ff3444bd50
lea rdx, [0x7ff3444173c]
mov rcx, r13
call fcn.7ff3444d284
lea rcx, [r13 + 0x10]
mov rdx, r13
call fcn.7ff3444d20c
lea rcx, [r13 + 0x20]
mov rdx, r13
call fcn.7ff3444d20c
nop
jmp 0x7ff3444c1e3
lea rcx, [r13 + 0x10]
mov rdx, rsi
call fcn.7ff3444d284
mov qword [rsp + 0x20], rsi
mov r9, r12
lea r8, [0x7ff34441748]
mov edx, 9
lea rcx, [0x7ff3444177c]
call fcn.7ff3444bb30
or rcx, 0xffffffffffffffff
cmp r12, rbx
jne 0x7ff3444bf73
mov ecx, 0x208
call qword [sym.imp.msvcrt.dll_malloc]
mov rcx, rax
mov qword [rsp + 0x38], rax
cmp rax, rbx
je 0x7ff3444c198
mov rbp, rsi
mov rdi, rsi
mov dword [rsp + 0xb8], ebx
cmp word [rsi], 0x22
jne 0x7ff3444bdf2
mov dword [rsp + 0x34], ebx
lea rdi, [rsi + 2]
mov r15, rdi
movzx eax, word [rdi]
cmp ax, bx
je 0x7ff3444be21
cmp ax, 0x22
je 0x7ff3444bde2
add rdi, 2
mov rbp, rdi
mov ax, word [rdi]
cmp ax, bx
jne 0x7ff3444bdcb
jmp 0x7ff3444be21
mov rbp, rdi
mov dword [rsp + 0xb8], 2
jmp 0x7ff3444be21
mov r15, rsi
movzx eax, word [rdi]
cmp ax, bx
je 0x7ff3444be21
mov edx, 9
cmp ax, 0x20
je 0x7ff3444be1e
cmp ax, dx
je 0x7ff3444be1e
add rdi, 2
mov rbp, rdi
mov ax, word [rdi]
cmp ax, bx
jne 0x7ff3444be02
jmp 0x7ff3444be21
mov rbp, rdi
movzx r14d, word [rbp]
mov word [rbp], bx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r9d, 0x104
lea r8, [0x7ff34441788]
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SearchPathW]
mov r12d, eax
add r12d, r12d
je 0x7ff3444be88
cmp r12d, 0x208
jae 0x7ff3444be7a
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x7ff3444be76
test al, 0x10
jne 0x7ff3444be88
add r12d, 2
cmp r12d, ebx
je 0x7ff3444be88
cmp r12d, 0x208
jb 0x7ff3444beb5
mov word [rbp], r14w
cmp word [rdi], bx
je 0x7ff3444bee0
cmp dword [rsp + 0x34], ebx
je 0x7ff3444bee0
add rdi, 2
mov rbp, rdi
mov eax, 1
mov byte [rsp + 0xb0], al
mov rcx, qword [rsp + 0x38]
jmp 0x7ff3444bdf2
mov rdi, rbp
sub rdi, r15
sar rdi, 1
mov r12d, dword [rsp + 0xb8]
add edi, r12d
mov word [rbp], r14w
mov r12, qword [rsp + 0x38]
mov r15b, byte [rsp + 0xa8]
jmp 0x7ff3444c02f
mov r12d, dword [rsp + 0xb8]
cmp r12d, ebx
jne 0x7ff3444bf3a
mov rdi, rsi
cmp rsi, rbx
je 0x7ff3444bf09
lea rdx, [0x7ff34441838]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_wcsspn]
lea rdi, [rsi + rax*2]
mov rbp, rdi
cmp word [rdi], bx
je 0x7ff3444bf42
mov eax, 9
cmp word [rbp], 0x20
je 0x7ff3444bf2f
cmp word [rbp], ax
je 0x7ff3444bf2f
add rbp, 2
cmp word [rbp], bx
jne 0x7ff3444bf16
jmp 0x7ff3444bf42
mov r14w, word [rbp]
mov word [rbp], bx
jmp 0x7ff3444bf42
lea rdi, [rsi + 2]
mov word [rbp], bx
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.7ff3444d284
mov word [rbp], r14w
mov rax, rbp
sub rax, rdi
sar rax, 1
lea edi, [r12 + rax]
mov r12, qword [rsp + 0x50]
mov r15b, byte [rsp + 0xa8]
jmp 0x7ff3444c03c
cmp rsi, rbx
je 0x7ff3444c01c
cmp word [rsi], bx
je 0x7ff3444c01c
xor eax, eax
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
sub rcx, r15
mov r14, rcx
movsxd rdi, ecx
mov r8, rdi
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.msvcrt.dll__wcsnicmp]
cmp eax, ebx
jne 0x7ff3444bfcc
movzx ecx, word [rsi + rdi*2]
cmp cx, bx
je 0x7ff3444bfbf
call qword [sym.imp.msvcrt.dll_iswspace]
cmp eax, ebx
je 0x7ff3444bfcc
mov edi, r14d
mov r15b, bpl
mov eax, 1
jmp 0x7ff3444c038
cmp word [rsi], 0x22
jne 0x7ff3444c010
lea rdx, [rsi + 2]
mov r8, rdi
mov rcx, r12
call qword [sym.imp.msvcrt.dll__wcsnicmp]
cmp eax, ebx
jne 0x7ff3444c010
cmp word [rsi + rdi*2 + 2], 0x22
jne 0x7ff3444c010
movzx ecx, word [rsi + rdi*2 + 4]
cmp cx, bx
je 0x7ff3444c002
call qword [sym.imp.msvcrt.dll_iswspace]
cmp eax, ebx
je 0x7ff3444c010
lea edi, [r14 + 2]
mov r15b, bpl
mov eax, 1
jmp 0x7ff3444c038
mov edi, ebx
mov r15b, dil
mov eax, 1
jmp 0x7ff3444c038
mov rsi, r12
xor eax, eax
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
sub rcx, r15
mov edi, ecx
mov eax, 1
cmp eax, ebx
je 0x7ff3444c03c
mov dword [rsp + 0x30], eax
mov rdx, r12
mov rcx, r13
call fcn.7ff3444d284
lea r14, [r13 + 0x20]
mov eax, edi
lea rdx, [rsi + rax*2]
mov rcx, r14
call fcn.7ff3444d284
mov rcx, r14
call fcn.7ff3444cf84
mov r12, qword [r14]
movzx ecx, word [r12]
call qword [sym.imp.msvcrt.dll_iswspace]
cmp eax, ebx
je 0x7ff3444c086
add r12, 2
movzx ecx, word [r12]
call qword [sym.imp.msvcrt.dll_iswspace]
cmp eax, ebx
jne 0x7ff3444c073
mov rcx, qword [r14]
cmp r12, rcx
je 0x7ff3444c0b3
mov rax, r12
sub rax, rcx
sar rax, 1
mov edi, dword [rcx - 8]
sub edi, eax
lea eax, [rdi + 1]
movsxd r8, eax
add r8, r8
mov rdx, r12
call sub.msvcrt.dll_memmove
mov rdx, qword [r14]
mov dword [rdx - 8], edi
cmp r15b, bl
jne 0x7ff3444c0e1
mov r15b, byte [rsp + 0xb0]
cmp r15b, bl
je 0x7ff3444c0ca
cmp rbp, rbx
jne 0x7ff3444c0e9
lea rdx, [r13 + 0x10]
lea rcx, [r13 + 0x40]
call fcn.7ff3444d20c
mov rcx, qword [rsp + 0x38]
jmp 0x7ff3444c198
mov r15b, byte [rsp + 0xb0]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
add ecx, 2
movsxd r12, ecx
lea rcx, [r12 + r12]
call qword [sym.imp.msvcrt.dll_malloc]
mov rdi, rax
cmp rax, rbx
jne 0x7ff3444c11b
mov dword [rsp + 0x30], ebx
mov rcx, qword [rsp + 0x38]
jmp 0x7ff3444c198
lea r8, [0x7ff34441794]
mov rdx, r12
mov rcx, rax
call fcn.7ff3444bb58
cmp r15b, bl
je 0x7ff3444c13d
movzx r14d, word [rbp]
mov word [rbp], bx
jmp 0x7ff3444c146
mov r14w, word [rsp + 0xa8]
mov r8, rsi
mov rdx, r12
mov rcx, rdi
call fcn.7ff3444bbcc
lea r8, [0x7ff34441794]
mov rdx, r12
mov rcx, rdi
call fcn.7ff3444bbcc
cmp r15b, bl
je 0x7ff3444c17e
mov word [rbp], r14w
mov r8, rbp
mov rdx, r12
mov rcx, rdi
call fcn.7ff3444bbcc
lea rcx, [r13 + 0x40]
mov rdx, rdi
call fcn.7ff3444d284
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.msvcrt.dll_free]
mov rax, qword [r13 + 0x10]
mov qword [rsp + 0x20], rax
mov r9, qword [r13]
lea r8, [0x7ff34441798]
mov edi, 9
mov edx, edi
lea rcx, [0x7ff3444177c]
call fcn.7ff3444bb30
mov r9, qword [r13 + 0x20]
lea r8, [0x7ff344417d0]
mov edx, edi
lea rcx, [0x7ff3444177c]
call fcn.7ff3444bb30
nop
mov ebx, dword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.7ff3444cfe4
mov eax, ebx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret