Function at 0x1400098c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x198]
sub rsp, 0x298
mov rax, qword [0x1400390f8]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0x210]
xor r14d, r14d
mov rbx, qword [0x14003fb98]
or r15, 0xffffffffffffffff
mov r12, qword [rbp + 0x200]
mov rsi, rdx
mov qword [rsp + 0x40], rax
mov r13d, r14d
mov rax, qword [rbp + 0x218]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r12
test rbx, rbx
je 0x1400099f5
lea rcx, str.COPYCMD
call fcn.14000d2d8
mov rcx, rax
call fcn.14000d340
mov r12, rax
test rax, rax
je 0x140009974
lea edx, [r14 + 0x20]
mov rcx, rax
call qword [sym.imp.msvcrt.dll_wcsrchr]
test rax, rax
jne 0x1400196e2
mov r14, r15
nop word [rax + rax]
inc r14
cmp word [r12 + r14*2], r13w
jne 0x140009980
mov rdi, r15
nop dword [rax]
inc rdi
cmp word [rbx + rdi*2], r13w
jne 0x140009990
test edi, edi
je 0x1400099e5
nop
cmp dword [0x140039834], r13d
jne 0x1400099e0
mov r8d, r14d
mov rdx, rbx
mov rcx, r12
mov esi, r14d
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
je 0x140009cc1
lea eax, [rdi + 1]
lea rbx, [rbx + rax*2]
mov rax, r15
nop dword [rax]
inc rax
cmp word [rbx + rax*2], r13w
jne 0x1400099d0
mov edi, eax
test eax, eax
jne 0x1400099a0
mov rsi, qword [rsp + 0x28]
mov rcx, r12
call fcn.14000f250
mov r12, qword [rsp + 0x30]
xor r14d, r14d
mov rdx, rsi
mov rcx, r13
call fcn.140009d44
mov rcx, qword [rsp + 0x38]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 0x78]
call fcn.14000d920
mov rdx, rsi
mov rcx, rax
mov rdi, rax
call fcn.140009d44
test eax, eax
je 0x140009a31
movzx ecx, word [rdi]
add rdi, 2
test cx, cx
jne 0x140009a25
mov rax, r15
inc rax
cmp word [rdi + rax*2], 0
jne 0x140009a34
test eax, eax
je 0x1400196eb
mov esi, eax
mov eax, 0x7fe7
cmp rsi, rax
jae 0x1400196f6
mov rcx, rdi
call fcn.140011c70
mov rdx, r15
inc rdx
cmp word [rdi + rdx*2], 0
jne 0x140009a61
inc rdx
mov r8, rax
mov rcx, rdi
call fcn.140011620
mov rcx, rdi
call fcn.1400145a8
mov r13, qword [rsp + 0x40]
mov qword [r13], rax
cmp rax, 1
je 0x140019701
mov ebx, 0x104
mov qword [rbp + 0x168], r14
mov r8d, ebx
mov byte [rbp + 0x170], 1
xor edx, edx
mov qword [rbp + 0x178], rbx
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
cmp byte [rbp + 0x170], 0
lea rcx, [rsp + 0x60]
mov eax, 0x7fe7
cmovne ebx, eax
mov edx, ebx
call fcn.1400104d0
test eax, eax
js 0x14001970d
lea rbx, [rsi + 1]
cmp word [rdi + rbx*2], 0
lea rbx, [rdi + rbx*2]
je 0x140019718
mov rax, r15
nop word [rax + rax]
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140009b00
cmp word [rbx + rax*2 + 2], 0
jne 0x140019771
mov rax, r15
nop dword [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140009b20
mov esi, 0x7fe7
cmp eax, esi
ja 0x14001977c
mov rcx, rbx
call fcn.140011c70
mov rdx, r15
inc rdx
cmp word [rbx + rdx*2], 0
jne 0x140009b42
inc rdx
mov r8, rax
mov rcx, rbx
call fcn.140011620
movzx eax, word [rbx + 2]
cmp ax, 0x3a
jne 0x140019787
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.140010630
mov rsi, qword [rsp + 0x48]
mov r8, rdi
movsxd rdi, dword [rsp + 0x20]
mov rcx, rsi
mov edx, edi
call fcn.140012fc4
test eax, eax
jne 0x140019841
mov rcx, qword [r13]
mov rax, qword [rcx + 0x30]
test byte [rax], 0x10
jne 0x140009c07
test rsi, rsi
je 0x14001984c
mov edx, 0x5c
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov rcx, qword [r13]
mov rbx, rax
test rax, rax
je 0x14001984c
add rbx, 2
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x140009be8
mov edx, 0x5c
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov r8, rax
test rax, rax
jne 0x140009bf0
mov rax, qword [r13]
mov r8, qword [rax + 0x20]
mov rax, rbx
mov rdx, rdi
sub rax, rsi
mov rcx, rbx
sar rax, 1
sub rdx, rax
call fcn.140011620
mov r8, qword [rbp + 0x168]
test r8, r8
je 0x140019854
movsxd rdi, dword [rbp + 0x208]
mov rcx, r12
mov edx, edi
call fcn.140012fc4
test eax, eax
jne 0x14001985e
xor ecx, ecx
mov dword [0x1400502f8], r14d
mov ebx, r14d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov r13, qword [rsp + 0x50]
mov rcx, r12
mov dword [r13], r14d
call fcn.140012130
cmp word [rax], 0x5c
je 0x140019869
mov rcx, r12
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140009cd9
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [0x1400502f8], eax
test eax, 0xfffffffc
jne 0x140019894
cmp eax, 1
je 0x140019894
test ebx, ebx
jne 0x140009ce5
mov rcx, qword [rbp + 0x168]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
xor eax, eax
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.1400173b0
add rsp, 0x298
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp word [rbx + rsi*2], 0x3d
lea rax, [rbx + rsi*2]
jne 0x1400099c3
lea r13, [rax + 2]
jmp 0x1400099e0
test al, 0x10
je 0x140009c8b
mov dword [r13], 1
test rsi, rsi
je 0x140009cfb
mov edx, 0x5c
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov r14, rax
mov rcx, r15
nop
inc rcx
cmp word [r12 + rcx*2], 0
jne 0x140009d00
nop dword [rax + rax]
cmp word [r14 + r15*2 + 2], 0
lea r15, [r15 + 1]
jne 0x140009d10
lea rax, [r15 + 1]
add rax, rcx
cmp rax, 0x7fe7
ja 0x140019889
mov rdx, rdi
mov r8, r14
mov rcx, r12
call fcn.140011540
jmp 0x140009c8f
mov word [rax], r14w
jmp 0x140009974
mov ecx, 0x232a
call fcn.1400271f8
int3
mov ecx, 0x232e
call fcn.1400271f8
int3
mov ecx, dword [0x1400502f8]
call fcn.1400271f8
int3
mov ecx, 0x2374
call fcn.1400271f8
int3
mov rax, qword [rbp + 0x168]
lea rdx, [rsp + 0x60]
test rax, rax
cmovne rdx, rax
mov rax, qword [0x1400502f0]
movzx ecx, word [rax]
mov word [rdx], cx
lea rcx, [rsp + 0x60]
mov rax, qword [rbp + 0x168]
test rax, rax
cmovne rcx, rax
mov eax, 0x3a
mov word [rcx + 2], ax
lea rcx, [rsp + 0x60]
mov rax, qword [rbp + 0x168]
test rax, rax
cmovne rcx, rax
mov word [rcx + 4], r14w
jmp 0x140009b75
mov ecx, 0x232a
call fcn.1400271f8
int3
mov ecx, 0x232e
call fcn.1400271f8
int3
cmp word [rbx], 0x5c
jne 0x140019797
cmp ax, 0x5c
je 0x140009b68
mov rax, qword [rbp + 0x168]
lea rdx, [rsp + 0x60]
test rax, rax
cmovne rdx, rax
mov rax, qword [0x1400502f0]
movzx ecx, word [rax]
mov word [rdx], cx
lea rcx, [rsp + 0x60]
mov rax, qword [rbp + 0x168]
lea rdx, [rsp + 0x60]
test rax, rax
cmovne rcx, rax
mov eax, 0x3a
mov word [rcx + 2], ax
lea rcx, [rsp + 0x60]
mov rax, qword [rbp + 0x168]
test rax, rax
cmovne rcx, rax
mov word [rcx + 4], r14w
mov rcx, r15
mov rax, qword [rbp + 0x168]
test rax, rax
cmovne rdx, rax
inc rcx
cmp word [rdx + rcx*2], 0
jne 0x140019801
mov rax, r15
inc rax
cmp word [rbx + rax*2], 0
jne 0x14001980e
inc rax
add rax, rcx
cmp rax, rsi
jbe 0x14001982e
mov ecx, 0x232e
call fcn.1400271f8
int3
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.140010578
nop
jmp 0x140009b75
mov ecx, 0x232e
call fcn.1400271f8
int3
mov rbx, rsi
jmp 0x140009bcc
lea r8, [rsp + 0x60]
jmp 0x140009c17
mov ecx, 0x232e
call fcn.1400271f8
int3
mov ebx, 1
mov rax, r15
cmp word [r12 + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140019871
mov word [r12 + rax*2 - 2], r14w
jmp 0x140009c5d
mov ecx, 0x232e
call fcn.1400271f8
int3
mov ecx, eax
call fcn.1400271f8
int3