Function at 0x18000ce10
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x3a8]
sub rsp, 0x490
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x180064138]
xor rax, rsp
mov qword [rbp + 0x380], rax
mov esi, ecx
xor r14d, r14d
mov edi, r14d
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x170]
call fcn.180027560
lea edx, [r14 + 1]
lea rcx, [rbp + 0x170]
call fcn.1800094b0
test eax, eax
je 0x18000cf17
mov ecx, 0x104
lea rax, [rbp + 0x170]
cmp word [rax], di
je 0x18000ce96
add rax, 2
sub rcx, 1
jne 0x18000ce87
mov eax, 0x104
sub rax, rcx
mov r8, r14
test rcx, rcx
cmovne r8, rax
je 0x18000cf03
mov edx, 0x104
sub rdx, r8
lea rcx, [rbp + 0x170]
lea rcx, [rcx + r8*2]
je 0x18000cef4
lea rax, [rdx + 0x7ffffefa]
add rax, r8
lea r9, str..service.dll
sub r9, rcx
test rax, rax
je 0x18000cef4
movzx r8d, word [r9 + rcx]
test r8w, r8w
je 0x18000cef4
mov word [rcx], r8w
add rcx, 2
dec rax
sub rdx, 1
jne 0x18000ced3
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r14w
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x170]
call fcn.180009de0
mov rdi, rax
mov rcx, rdi
call fcn.18000d5e0
mov ebx, r14d
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call fcn.180027560
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.180009320
test eax, eax
je 0x18000cfd3
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18000cfd3
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdx, str.birdsrv.exe
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18000cf98
lea rdx, str...360wpsrv.exe
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rax, str._changedynwp
lea r9, str._changewpshell
test esi, esi
cmovne r9, rax
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r14
lea r8, [rsp + 0x60]
mov rdx, qword [str.RunAs]
mov rcx, rdi
call fcn.18000a120
cmp eax, 0x20
setae bl
test esi, esi
je 0x18000d0f1
lea rax, str.changedynwp_succeed
lea rdi, str.changedynwp_fail
test ebx, ebx
cmovne rdi, rax
call fcn.180007b50
mov rcx, rax
test rax, rax
je 0x18000d257
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov rbx, 0xffffffffffffffff
cmp rdi, 0x10000
jae 0x18000d02e
movzx edx, di
lea rcx, [rsp + 0x38]
call fcn.18000cc80
jmp 0x18000d04c
mov rax, rbx
inc rax
cmp word [rdi + rax*2], 0
jne 0x18000d031
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.18000fcf0
nop
call fcn.180007b50
mov rcx, rax
test rax, rax
je 0x18000d262
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rdx, str.LDSShellExt
cmp rdx, 0x10000
jae 0x18000d08b
movzx edx, dx
lea rcx, [rsp + 0x30]
call fcn.18000cc80
jmp 0x18000d0a8
mov rax, rbx
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x18000d090
mov r8d, eax
lea rcx, [rsp + 0x30]
call fcn.18000fcf0
nop
call fcn.18000c770
mov rcx, rax
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x30]
call fcn.180017910
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000d0e7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x38]
jmp 0x18000d20c
lea rax, str.changewp_succeed
lea rdi, str.changewp_fail
test ebx, ebx
cmovne rdi, rax
call fcn.180007b50
mov rcx, rax
test rax, rax
je 0x18000d26d
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
mov rbx, 0xffffffffffffffff
cmp rdi, 0x10000
jae 0x18000d144
movzx edx, di
lea rcx, [rsp + 0x48]
call fcn.18000cc80
jmp 0x18000d16b
mov rax, rbx
nop word [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x18000d150
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.18000fcf0
nop
call fcn.180007b50
mov rcx, rax
test rax, rax
je 0x18000d24c
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rdx, str.LDSShellExt
cmp rdx, 0x10000
jae 0x18000d1aa
movzx edx, dx
lea rcx, [rsp + 0x40]
call fcn.18000cc80
jmp 0x18000d1c8
mov rax, rbx
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x18000d1b0
mov r8d, eax
lea rcx, [rsp + 0x40]
call fcn.18000fcf0
nop
call fcn.18000c770
mov rcx, rax
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x40]
call fcn.180017910
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000d207
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x18000d223
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xor eax, eax
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.18001e0c0
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov ecx, 0x80004005
call fcn.180008e40
nop
mov ecx, 0x80004005
call fcn.180008e40
nop
mov ecx, 0x80004005
call fcn.180008e40
nop
mov ecx, 0x80004005
call fcn.180008e40
int3