Function at 0x14001cb80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
lea rbp, [r11 - 0x158]
sub rsp, 0x240
mov rax, qword [0x140106b98]
xor rax, rsp
mov qword [rbp + 0x110], rax
mov qword [r11 + 0x18], rbx
mov qword [r11 - 0x20], r12
mov r12, rcx
mov qword [r11 - 0x28], r13
xor r13d, r13d
mov qword [r11 - 0x30], r14
mov esi, r13d
mov dword [rsp + 0x7c], r13d
mov edi, r13d
mov dword [rsp + 0x78], r13d
mov r14, rdx
mov dword [rsp + 0x74], r13d
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
mov qword [r11 - 0x38], r15
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14001d09f
test al, 0x50
jne 0x14001d09f
call fcn.14001c230
cmp eax, 1
je 0x14001cc0b
lea esi, [r13 + 0x7e]
jmp 0x14001d0a4
mov qword [rsp + 0x50], r13
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rax
mov r9d, 2
lea rax, [rsp + 0x60]
mov r8d, 0x400
mov qword [rsp + 0x40], rax
mov rdx, r12
lea rax, [rsp + 0x74]
mov qword [rsp + 0x38], rax
lea ecx, [r9 - 1]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x28], rax
mov rax, qword [0x140109290]
mov dword [rsp + 0x20], r13d
call qword [0x1400d7670]
mov edi, eax
test eax, eax
jne 0x14001cc7a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14001d0a4
mov ecx, 0x23f0
call fcn.1400186f0
test eax, eax
jne 0x14001cf6c
mov rcx, r12
call fcn.1400183d0
test eax, eax
je 0x14001cf6c
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp + 0x100], rax
mov r15d, r13d
mov dword [rbp + 0x108], eax
mov rax, qword [0x1401092b0]
movups xmmword [rbp + 0xf0], xmm0
test rax, rax
jne 0x14001cce2
xor edx, edx
lea rcx, str.Advapi32.dll
call fcn.140018930
mov qword [0x1401092b0], rax
test rax, rax
je 0x14001ce47
cmp qword [0x1401092d8], rsi
jne 0x14001cd12
lea rdx, [0x1400db790]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401092d8], rax
test rax, rax
je 0x14001ce47
mov rax, qword [0x1401092b0]
cmp qword [0x1401092e0], rsi
jne 0x14001cd42
lea rdx, [0x1400db7a0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401092e0], rax
test rax, rax
je 0x14001ce47
mov rax, qword [0x1401092b0]
cmp qword [0x1401092f0], rsi
jne 0x14001cd72
lea rdx, str.QueryServiceStatus
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401092f0], rax
test rax, rax
je 0x14001ce47
mov rax, qword [0x1401092b0]
cmp qword [0x1401092f8], rsi
jne 0x14001cd9b
lea rdx, [0x1400db7c8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401092f8], rax
test rax, rax
je 0x14001ce47
mov rax, qword [0x1401092d8]
xor edx, edx
xor ecx, ecx
mov r8d, 0x80000000
call qword [0x1400d7670]
mov rdi, rax
test rax, rax
je 0x14001ce3e
mov rcx, rax
lea rdx, str.CryptSvc
mov rax, qword [0x1401092e0]
mov r8d, 4
call qword [0x1400d7670]
mov rbx, rax
test rax, rax
je 0x14001ce2e
mov rcx, rax
lea rdx, [rbp + 0xf0]
mov rax, qword [0x1401092f0]
call qword [0x1400d7670]
test eax, eax
je 0x14001ce1e
mov ecx, dword [rbp + 0xf4]
sub ecx, 4
je 0x14001ce18
sub ecx, 1
je 0x14001ce18
sub ecx, 1
je 0x14001ce18
cmp ecx, 1
jne 0x14001ce1e
mov r15d, 1
mov rax, qword [0x1401092f8]
mov rcx, rbx
call qword [0x1400d7670]
mov rax, qword [0x1401092f8]
mov rcx, rdi
call qword [0x1400d7670]
test r15d, r15d
jne 0x14001cf6c
mov rdi, qword [rsp + 0x68]
lea rax, [rsp + 0x70]
mov rsi, qword [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rax, qword [0x140109288]
mov rcx, rdi
lea edx, [r9 + 6]
call qword [0x1400d7670]
test eax, eax
jne 0x14001ce8e
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14001cf57
mov edx, dword [rsp + 0x70]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
jne 0x14001cebb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14001cf57
xor r8d, r8d
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov rax, qword [0x140109288]
mov rcx, rdi
lea edx, [r8 + 6]
call qword [0x1400d7670]
test eax, eax
je 0x14001cea5
movups xmm0, xmmword [rbx + 8]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
mov r9d, 0xb0000
mov rax, qword [0x140109280]
xor r8d, r8d
movaps xmmword [rbp + 0x50], xmm0
mov edx, 0x10001
movups xmm1, xmmword [rbx + 0x18]
mov rcx, rsi
movups xmmword [rbp + 0x28], xmm1
call qword [0x1400d7670]
mov rdi, rax
test rax, rax
je 0x14001cea5
test r14, r14
je 0x14001cf3b
mov rcx, rax
call fcn.140018350
mov dword [r14], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [0x140109278]
mov rcx, rdi
call qword [0x1400d7670]
mov edi, r13d
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, 1
mov esi, r13d
jmp 0x14001d0a4
xorps xmm1, xmm1
mov qword [rbp], 0x20
xor eax, eax
movaps xmmword [rbp - 0x40], xmm1
movups xmmword [rbp - 0x70], xmm1
mov qword [rbp - 0x30], rax
mov ecx, 0x23f0
movups xmmword [rbp - 0x60], xmm1
mov qword [rbp + 8], r12
movups xmmword [rbp - 0x80], xmm1
mov dword [rbp - 0x80], 0x58
movups xmmword [rbp - 0x50], xmm1
mov dword [rbp - 0x50], 1
psrldq xmm1, 8
xorps xmm0, xmm0
movd eax, xmm1
movdqu xmmword [rbp + 0x10], xmm0
mov dword [rbp - 0x68], 2
bts eax, 0xc
mov dword [rbp - 0x64], 1
mov dword [rbp - 0x38], eax
lea rax, [rbp]
mov qword [rbp - 0x58], rax
mov dword [rbp - 0x60], 1
call fcn.1400186f0
mov r8, qword [rsp + 0x68]
mov r9, r14
mov rdx, qword [rsp + 0x60]
lea rcx, [rbp - 0x80]
test eax, eax
jne 0x14001d013
call fcn.1400197b0
mov edi, eax
test eax, eax
jne 0x14001d0a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14001d0a4
xorps xmm0, xmm0
mov dword [rbp - 4], r13d
lea rax, [rbp - 0x20]
mov qword [rbp - 0x20], 0x20
movdqu xmmword [rbp - 0x14], xmm0
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x18], 3
call fcn.1400197b0
mov edi, eax
test eax, eax
jne 0x14001d0a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ebx, 1
mov rax, qword [rbp - 0x30]
cmp dword [rax + 0xc], ebx
jb 0x14001d0a4
nop word [rax + rax]
mov qword [rbp - 0x48], r13
lea rcx, [rbp - 0x80]
mov dword [rbp - 0x50], 1
mov r9, r14
mov dword [rax + 4], ebx
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
call fcn.1400197b0
mov edi, eax
test eax, eax
jne 0x14001d0a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
inc ebx
mov rax, qword [rbp - 0x30]
cmp ebx, dword [rax + 0xc]
jbe 0x14001d060
jmp 0x14001d0a4
mov esi, 2
mov rcx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x220]
mov r14, qword [rsp + 0x228]
mov r13, qword [rsp + 0x230]
mov r12, qword [rsp + 0x238]
mov rbx, qword [rsp + 0x270]
test rcx, rcx
je 0x14001d0e5
mov rax, qword [0x140109270]
xor edx, edx
call qword [0x1400d7670]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14001d0fc
mov rax, qword [0x140109268]
call qword [0x1400d7670]
test edi, edi
jne 0x14001d104
mov ecx, esi
jmp 0x14001d106
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.14006b950
add rsp, 0x240
pop rdi
pop rsi
pop rbp
ret