Function at 0x14005c040
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x280], rax
lea rcx, [rsp + 0x40]
lea rbx, [0x140000000]
mov rsi, rdx
mov rax, qword [rbx + 0x2e2460]
xor edx, edx
mov qword [rcx], rax
mov rax, qword [rbx + 0x2e2468]
lea r8d, [rdx + 0x2c]
mov qword [rcx + 8], rax
mov eax, dword [rbx + 0x2e2470]
mov dword [rcx + 0x10], eax
lea rcx, [rsp + 0x54]
call sub.ntdll.dll_memset
mov rax, qword [rbx + 0x2e2440]
lea r11, [rsp + 0x80]
mov qword [r11], rax
mov rax, qword [rbx + 0x2e2448]
lea rcx, [rsp + 0xc0]
mov qword [r11 + 8], rax
mov rax, qword [rbx + 0x2e2450]
xor edx, edx
mov qword [r11 + 0x10], rax
movzx eax, word [rbx + 0x2e2458]
lea r8d, [rdx + 0x2c]
mov word [r11 + 0x18], ax
xor eax, eax
mov qword [rsp + 0x9a], rax
mov qword [rsp + 0xa2], rax
mov qword [rsp + 0xaa], rax
mov qword [rsp + 0xb2], rax
mov dword [rsp + 0xba], eax
mov word [rsp + 0xbe], ax
mov rax, qword [rbx + 0x2e2428]
mov qword [rcx], rax
mov rax, qword [rbx + 0x2e2430]
mov qword [rcx + 8], rax
mov eax, dword [rbx + 0x2e2438]
mov dword [rcx + 0x10], eax
movzx eax, word [rbx + 0x2e243c]
mov word [rcx + 0x14], ax
xor eax, eax
lea rcx, [rsp + 0x100]
mov qword [rsp + 0xd6], rax
mov qword [rsp + 0xde], rax
mov qword [rsp + 0xe6], rax
mov qword [rsp + 0xee], rax
mov qword [rsp + 0xf6], rax
mov word [rsp + 0xfe], ax
mov rax, qword [rbx + 0x2e2410]
mov qword [rcx], rax
mov rax, qword [rbx + 0x2e2418]
mov qword [rcx + 8], rax
mov eax, dword [rbx + 0x2e2420]
mov dword [rcx + 0x10], eax
lea rcx, [rsp + 0x114]
call sub.ntdll.dll_memset
mov rax, qword [rbx + 0x2e23f0]
lea r11, [rsp + reloc.MFC80U.DLL_Ordinal_320]
mov qword [r11], rax
mov rax, qword [rbx + 0x2e23f8]
mov qword [r11 + 8], rax
mov rax, qword [rbx + 0x2e2400]
mov qword [r11 + 0x10], rax
movzx eax, word [rbx + 0x2e2408]
mov word [r11 + 0x18], ax
xor eax, eax
xor ebp, ebp
mov ebx, ebp
mov qword [rsp + 0x15a], rax
mov qword [rsp + 0x162], rax
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_362], rax
mov qword [rsp + 0x172], rax
mov dword [rsp + 0x17a], eax
mov word [rsp + 0x17e], ax
lea rcx, [rsp + 0x182]
xor edx, edx
mov r8d, 0xfe
mov word [rsp + 0x180], bp
call sub.ntdll.dll_memset
movsxd r11, ebx
shl r11, 6
lea rdx, str._sSystem32_s
lea rcx, [rsp + 0x180]
lea r9, [rsp + r11 + 0x40]
mov r8, rsi
call qword [sym.imp.MSVCR80.dll__swprintf]
xor r9d, r9d
mov qword [rsp + 0x30], rbp
lea rcx, [rsp + 0x180]
lea r8d, [r9 + 3]
mov edx, 0x80000000
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x14005c2b7
cmp rdi, 0xffffffffffffffff
jne 0x14005c2ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14005c2f1
cmp eax, 3
je 0x14005c2f1
cmp eax, 0x3ed
je 0x14005c2f1
cmp eax, 0x570
je 0x14005c2f1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add ebx, 1
cmp ebx, 5
jl 0x14005c210
mov eax, 1
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140161080
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
xor eax, eax
jmp 0x14005c2c8