Function at 0x180015400
Capabilities:
Check if file exists

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x950
mov qword [rsp + 0xd8], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x180071080]
xor rax, rsp
mov qword [rsp + 0x940], rax
mov rsi, rcx
and dword [rsp + 0x88], 0xfffffe00
xor ebp, ebp
mov qword [r11 - 0x8c8], rbp
mov qword [r11 - 0x8c0], rbp
mov qword [r11 - 0x8b8], rbp
lea rax, [rsp + 0x30]
mov qword [r11 - 0x888], rax
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], rbp
mov word [rsp + 0x60], bp
lea r8d, [rbp + 5]
lea rdx, [0x18005d590]
lea rcx, [rsp + 0x58]
call fcn.180005ca0
nop
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0xa8]
call fcn.180001390
nop
mov byte [rsp + 0x38], 4
bts dword [rsp + 0x38], 8
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rbp
mov rdx, qword [rax + 0x18]
cmp qword [rax + 0x20], 0x10
jb 0x1800154cd
mov rcx, qword [rax + 8]
jmp 0x1800154d1
lea rcx, [rax + 8]
call fcn.180029120
mov qword [rsp + 0x30], rax
lea r8, [0x18005d58f]
lea rdx, str.sr_type
lea rcx, [rsp + 0x80]
call fcn.18002aa7c
mov rdi, rax
movsx edx, byte [rax + 8]
movzx ecx, byte [rsp + 0x38]
mov byte [rax + 8], cl
mov byte [rsp + 0x38], dl
lea rax, [rsp + 0x30]
cmp rdi, rax
je 0x180015523
mov rcx, qword [rdi]
mov rdx, qword [rsp + 0x30]
mov qword [rdi], rdx
mov qword [rsp + 0x30], rcx
mov ecx, dword [rdi + 8]
mov edx, ecx
shr edx, 8
and edx, 1
mov eax, dword [rsp + 0x38]
xor eax, ecx
and eax, 0x100
xor eax, ecx
mov dword [rdi + 8], eax
shl edx, 8
mov eax, dword [rsp + 0x38]
xor edx, eax
and edx, 0x100
xor eax, edx
mov dword [rsp + 0x38], eax
lea rdx, [rdi + 0x10]
lea rax, [rsp + 0x40]
cmp rdx, rax
je 0x180015571
mov rcx, qword [rdx]
mov rax, qword [rsp + 0x40]
mov qword [rdx], rax
mov qword [rsp + 0x40], rcx
lea rdx, [rdi + 0x18]
lea rax, [rsp + 0x48]
cmp rdx, rax
je 0x18001558f
mov rcx, qword [rdx]
mov rax, qword [rsp + 0x48]
mov qword [rdx], rax
mov qword [rsp + 0x48], rcx
add rdi, 0x20
lea rax, [rsp + 0x50]
cmp rdi, rax
je 0x1800155ad
mov rcx, qword [rdi]
mov rax, qword [rsp + 0x50]
mov qword [rdi], rax
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
call fcn.180029ac8
nop
cmp qword [rsp + 0xc8], 0x10
jb 0x1800155d0
mov rcx, qword [rsp + 0xb0]
call fcn.18003c784
mov qword [rsp + 0xc8], 0xf
mov qword [rsp + 0xc0], rbp
mov byte [rsp + 0xb0], 0
cmp qword [rsp + 0x78], 8
jb 0x1800155fe
mov rcx, qword [rsp + 0x60]
call fcn.18003c784
lea rax, [rsp + 0x30]
mov qword [rsp + 0xd0], rax
cmp qword [rsi + 0x20], 8
jb 0x18001561b
lea rbx, [rsi + 8]
mov r8, qword [rbx]
jmp 0x180015622
lea rbx, [rsi + 8]
mov r8, rbx
lea rdx, [0x18005d5b0]
lea rcx, [rsp + 0xe0]
call fcn.180020c28
nop
cmp qword [rax + 0x20], 8
jb 0x180015644
mov rdx, qword [rax + 8]
jmp 0x180015648
lea rdx, [rax + 8]
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], rbp
mov word [rsp + 0x60], bp
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x58]
call fcn.180005ca0
nop
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0xa8]
call fcn.180001390
nop
mov byte [rsp + 0x38], 4
bts dword [rsp + 0x38], 8
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rbp
mov rdx, qword [rax + 0x18]
cmp qword [rax + 0x20], 0x10
jb 0x1800156b7
mov rcx, qword [rax + 8]
jmp 0x1800156bb
lea rcx, [rax + 8]
call fcn.180029120
mov qword [rsp + 0x30], rax
lea r8, [0x18005d5ab]
lea rdx, str.sr_overview
lea rcx, [rsp + 0x80]
call fcn.18002aa7c
mov rdi, rax
movsx edx, byte [rax + 8]
movzx ecx, byte [rsp + 0x38]
mov byte [rax + 8], cl
mov byte [rsp + 0x38], dl
lea rax, [rsp + 0x30]
cmp rdi, rax
je 0x18001570d
mov rcx, qword [rdi]
mov rdx, qword [rsp + 0x30]
mov qword [rdi], rdx
mov qword [rsp + 0x30], rcx
mov ecx, dword [rdi + 8]
mov edx, ecx
shr edx, 8
and edx, 1
mov eax, dword [rsp + 0x38]
xor eax, ecx
and eax, 0x100
xor eax, ecx
mov dword [rdi + 8], eax
shl edx, 8
mov eax, dword [rsp + 0x38]
xor edx, eax
and edx, 0x100
xor eax, edx
mov dword [rsp + 0x38], eax
lea rdx, [rdi + 0x10]
lea rax, [rsp + 0x40]
cmp rdx, rax
je 0x18001575b
mov rcx, qword [rdx]
mov rax, qword [rsp + 0x40]
mov qword [rdx], rax
mov qword [rsp + 0x40], rcx
lea rdx, [rdi + 0x18]
lea rax, [rsp + 0x48]
cmp rdx, rax
je 0x180015779
mov rcx, qword [rdx]
mov rax, qword [rsp + 0x48]
mov qword [rdx], rax
mov qword [rsp + 0x48], rcx
add rdi, 0x20
lea rax, [rsp + 0x50]
cmp rdi, rax
je 0x180015797
mov rcx, qword [rdi]
mov rax, qword [rsp + 0x50]
mov qword [rdi], rax
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
call fcn.180029ac8
nop
cmp qword [rsp + 0xc8], 0x10
jb 0x1800157ba
mov rcx, qword [rsp + 0xb0]
call fcn.18003c784
mov qword [rsp + 0xc8], 0xf
mov qword [rsp + 0xc0], rbp
mov byte [rsp + 0xb0], 0
cmp qword [rsp + 0x78], 8
jb 0x1800157e8
mov rcx, qword [rsp + 0x60]
call fcn.18003c784
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], rbp
mov word [rsp + 0x60], bp
cmp qword [rsp + 0x100], 8
jb 0x180015813
mov rcx, qword [rsp + 0xe8]
call fcn.18003c784
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0x80]
lea rcx, str.t_safety_risk_log
call fcn.180038db0
mov word [rsp + 0x110], bp
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x112]
call fcn.18003e8c0
mov r8d, 0x104
lea rdx, [rsp + 0x320]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1800158d4
lea rcx, [rsp + 0x320]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
lea rcx, [0x18005c980]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add edi, eax
cmp edi, 0x104
jge 0x1800158d4
lea rdx, [0x18005dd1c]
lea rcx, [rsp + 0x320]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [0x18005c980]
lea rcx, [rsp + 0x320]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov r8d, 0x104
lea rdx, [rsp + 0x320]
lea rcx, [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
lea rcx, [rsp + 0x110]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180015977
lea rcx, str.wfchost.exe
call fcn.18001cee8
nop
movsx eax, byte [rsp + 0x88]
cmp eax, 4
je 0x18001592b
add eax, 0xfffffffa
cmp eax, 1
ja 0x180015943
mov rdi, qword [rsp + 0x80]
test rdi, rdi
je 0x180015943
mov rcx, rdi
call fcn.18002e1e8
mov rcx, rdi
call fcn.18003c784
jmp 0x180015943
bt dword [rsp + 0x88], 8
jae 0x180015943
mov rcx, qword [rsp + 0x80]
call fcn.18003dd10
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x180015970
lea rdi, [rcx - 8]
lea r9, [0x1800294a0]
mov r8d, dword [rdi]
mov edx, 8
call fcn.18004bf1c
mov rcx, rdi
call fcn.18004bcec
xor al, al
jmp 0x180015a16
mov word [rsp + 0x530], bp
xor edx, edx
mov r8d, 0x40e
lea rcx, [rsp + 0x532]
call fcn.18003e8c0
cmp qword [rsi + 0x20], 8
jb 0x18001599e
mov rbx, qword [rbx]
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x110]
lea r8, str.__s___banshare___s_
mov edx, 0x208
lea rcx, [rsp + 0x530]
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
lea rcx, [rsp + 0x530]
call fcn.1800201fc
test rax, rax
je 0x1800159f2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x80]
call fcn.180029ac8
mov al, 1
jmp 0x180015a16
lea rdx, [rsp + 0x530]
lea rcx, str.PoExecuteActiveConsoleProcessAsUserW_failed:_s
call fcn.18001cee8
nop
lea rcx, [rsp + 0x80]
call fcn.180029ac8
xor al, al
mov rcx, qword [rsp + 0x940]
xor rcx, rsp
call fcn.18003c160
lea r11, [rsp + 0x950]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret