Function at 0x180028f90
Capabilities:
Check if file exists

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x7b0
mov rax, qword [0x180048040]
xor rax, rsp
mov qword [rsp + 0x7a0], rax
mov r12, r9
mov r13, r8
mov r14, rdx
mov r15, rcx
xor esi, esi
mov qword [rsp + 0xd0], rsi
mov ebx, 0x20a
mov r8d, ebx
xor edx, edx
lea rcx, [rsp + 0x380]
call sub.ucrtbase.dll_memset
mov r8d, ebx
xor edx, edx
lea rcx, [rsp + 0x170]
call sub.ucrtbase.dll_memset
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], rax
lea rdi, [rsp + 0xd0]
mov qword [rsp + 0xa0], rdi
lea eax, [rsi + 1]
mov byte [rsp + 0xa8], al
mov rcx, qword [rsp + 0x7e8]
cmp qword [r14 + 8], rsi
je 0x1800295e3
mov r8d, eax
xor edx, edx
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
mov qword [rsp + 0x160], rax
mov rcx, qword [rsp + 0x7e8]
test rax, rax
je 0x1800295ee
mov rsi, qword [rsp + 0x7e8]
mov r8d, 0x104
lea rdx, [rsp + 0x380]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1800295f3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x18
lea r8, [rsp + 0xb0]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov rcx, qword [rsp + 0x7e8]
test eax, eax
je 0x1800295fb
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x104
mov qword [rsp + 0x38], rdx
lea rax, [rsp + 0x170]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x170]
mov qword [rsp + 0x20], rax
mov r9d, 2
lea r8, [rsp + 0x380]
xor edx, edx
call qword [sym.imp.dbghelp.dll_SymGetSymbolFileW]
test eax, eax
jne 0x180029500
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x7e8]
cmp eax, 2
jne 0x180029600
xor edx, edx
mov r8d, 0x20a
lea rcx, [rsp + 0x590]
call sub.ucrtbase.dll_memset
mov rsi, qword [rsp + 0x7e8]
mov r8d, 0x104
lea rdx, [rsp + 0x590]
lea rcx, [0x180000000]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x180029607
mov edx, 0x104
lea rcx, [rsp + 0x590]
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchRemoveFileSpec]
mov rcx, qword [rsp + 0x7e8]
xor esi, esi
test eax, eax
js 0x18002960f
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x90], xmm1
mov r8d, 4
lea rdx, str.SRV
lea rcx, [rsp + 0x80]
call fcn.180009de8
nop
lea rdx, [rsp + 0x590]
lea rcx, [rsp + 0x80]
call fcn.180009410
xorps xmm0, xmm0
movups xmmword [rsp + 0xd8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xe8], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xd8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xe8], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rdx, str._symbolshttp:__msdl.microsoft.com_download_symbols
lea rcx, [rsp + 0xd8]
call fcn.180009410
xorps xmm0, xmm0
movups xmmword [rsp + 0xf8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x108], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xf8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x108], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rcx, [rsp + 0xd8]
call fcn.18000ad10
nop
lea rcx, [rsp + 0x80]
call fcn.18000ad10
call qword [sym.imp.dbghelp.dll_SymGetOptions]
bts eax, 0x1f
mov ecx, eax
call qword [sym.imp.dbghelp.dll_SymSetOptions]
mov dword [rsp + 0xc8], eax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0xd8], xmm0
mov qword [rsp + 0xe8], rax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xe0], r15
mov byte [rsp + 0xe8], 1
lea rsi, [r15 + 0x10]
xor ecx, ecx
mov qword [rsp + 0x78], rcx
mov r8, qword [r13 + 0x38]
xor r13d, r13d
mov r9d, r13d
test r8, r8
je 0x1800292f2
mov rax, qword [r8]
lea rdx, [rsp + 0x40]
mov rcx, r8
call qword [rax]
mov rcx, rax
mov qword [rsp + 0x78], rax
mov r9, rax
lea rax, [rsp + 0x40]
cmp r9, rax
je 0x180029314
cmp qword [rsi + 0x38], rsi
je 0x180029314
mov rcx, qword [rsi + 0x38]
mov qword [rsp + 0x78], rcx
mov qword [rsi + 0x38], r9
jmp 0x18002942e
mov r8, r13
mov qword [rsp + reloc.COMCTL32.dll_Ordinal_344], r13
test r9, r9
je 0x180029382
lea rax, [rsp + 0x40]
cmp r9, rax
jne 0x18002936f
mov rax, qword [r9]
lea rdx, [rsp + 0x120]
mov rcx, r9
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8, rax
mov qword [rsp + reloc.COMCTL32.dll_Ordinal_344], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x180029382
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov r8, qword [rsp + reloc.COMCTL32.dll_Ordinal_344]
jmp 0x18002937a
mov r8, r9
mov qword [rsp + reloc.COMCTL32.dll_Ordinal_344], r9
mov rcx, r13
mov qword [rsp + 0x78], rcx
mov r9, qword [rsi + 0x38]
test r9, r9
je 0x1800293e0
mov rcx, r9
cmp r9, rsi
jne 0x1800293d7
mov rax, qword [r9]
lea rdx, [rsp + 0x40]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, rax
mov qword [rsp + 0x78], rax
mov r8, qword [rsi + 0x38]
test r8, r8
je 0x1800293cd
mov rax, qword [r8]
cmp r8, rsi
setne dl
mov rcx, r8
call qword [rax + 0x20]
mov rcx, qword [rsp + 0x78]
mov r8, qword [rsp + reloc.COMCTL32.dll_Ordinal_344]
jmp 0x1800293dc
mov r8, qword [rsp + reloc.COMCTL32.dll_Ordinal_344]
jmp 0x1800293e0
mov qword [rsp + 0x78], rcx
mov qword [rsi + 0x38], r13
test r8, r8
je 0x18002942e
lea rax, [rsp + 0x120]
cmp r8, rax
jne 0x18002942a
mov rax, qword [r8]
mov rdx, rsi
mov rcx, r8
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rsi + 0x38], rax
mov rcx, qword [rsp + reloc.COMCTL32.dll_Ordinal_344]
test rcx, rcx
je 0x180029423
mov rax, qword [rcx]
lea rdx, [rsp + 0x120]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov rcx, qword [rsp + 0x78]
jmp 0x18002942e
mov qword [rsi + 0x38], r8
test rcx, rcx
je 0x180029444
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
lea rcx, [r15 + 0x50]
mov r8, qword [r14 + 8]
mov rdx, qword [r14]
call fcn.180009c50
lea rsi, [rsp + 0xf8]
cmp qword [rsp + 0x110], 7
cmova rsi, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0x104
mov qword [rsp + 0x38], rdx
lea rcx, [rsp + 0x170]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rdx
lea rcx, [rsp + 0x170]
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, [rsp + 0x380]
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.dbghelp.dll_SymGetSymbolFileW]
mov rcx, qword [rsp + 0x7e8]
test eax, eax
je 0x180029617
mov ecx, dword [rsp + 0xc8]
call qword [sym.imp.dbghelp.dll_SymSetOptions]
lea rsi, [r15 + 0x10]
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x1800294f1
mov rax, qword [rcx]
cmp rcx, rsi
setne dl
call qword [rax + 0x20]
mov qword [rsi + 0x38], r13
lea rcx, [rsp + 0xf8]
call fcn.18000ad10
jmp 0x180029503
xor r13d, r13d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x380]
xor edx, edx
call qword [sym.imp.dbghelp.dll_SymLoadModuleExW]
mov rsi, rax
mov qword [rsp + 0xd0], rax
mov rcx, qword [rsp + 0x7e8]
test rax, rax
je 0x18002961d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x20], r12
lea r9, [0x18002962c]
xor r8d, r8d
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.dbghelp.dll_SymEnumSymbols]
mov rcx, qword [rsp + 0x7e8]
test eax, eax
je 0x180029622
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
mov rbx, qword [rdi]
test rbx, rbx
je 0x1800295b5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.dbghelp.dll_SymUnloadModule64]
mov qword [rdi], r13
xor eax, eax
jmp 0x1800295c0
mov rcx, qword [rsp + 0x7a0]
xor rcx, rsp
call fcn.18002dc90
add rsp, 0x7b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov edx, 0x80070057
call fcn.18000acc8
nop
call fcn.18000a874
mov rcx, rsi
call fcn.18000a874
call fcn.18000a874
mov edx, eax
call fcn.180022388
mov rcx, rsi
call fcn.18000a874
mov edx, eax
call fcn.18000acc8
nop
call fcn.18000a874
nop
call fcn.18000a874
call fcn.18000a874
int3