Function at 0x18001e720
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2c8]
sub rsp, 0x3a0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x1800a11a0]
xor rax, rsp
mov qword [rbp + 0x270], rax
mov r15, qword [0x1800a6cf8]
mov edi, 0x104
mov r8d, edi
xor edx, edx
lea rcx, [rbp + 0x50]
call fcn.180051b50
xor r9d, r9d
lea r8d, [r9 + 0x1a]
lea rdx, [rbp + 0x50]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
xor r12d, r12d
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], r12b
lea rax, [rbp + 0x50]
mov rsi, 0xffffffffffffffff
mov r8, rsi
inc r8
cmp byte [rax + r8], r12b
jne 0x18001e7b0
lea rdx, [rbp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.18001e3a0
nop
mov r8d, 0x11
lea rdx, str.XiaomiCloudlogs
lea rcx, [rsp + 0x20]
call fcn.180015970
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [0x1800a2068]
cmp rdx, 0x10
jb 0x18001e836
mov rcx, qword [0x1800a2050]
inc rdx
cmp rdx, 0x1000
jb 0x18001e831
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18001efeb
mov rcx, r8
call fcn.180032af0
movups xmmword [0x1800a2050], xmm6
movups xmmword [0x1800a2060], xmm7
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x18001e881
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001e87c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001efe5
call fcn.180032af0
mov rcx, rdi
lea rax, [rbp + 0x50]
cmp byte [rax], 0
je 0x18001e896
inc rax
sub rcx, 1
jne 0x18001e888
mov r14d, 0x7ffffffe
test rcx, rcx
je 0x18001e8fc
mov rax, rdi
sub rax, rcx
test rcx, rcx
cmove rax, r12
mov rdx, rdi
sub rdx, rax
lea rcx, [rbp + 0x50]
lea rcx, [rcx + rax]
je 0x18001e8ee
mov eax, r14d
lea r9, str.XiaomiCloudlogs_
sub r9, rcx
nop dword [rax + rax]
test rax, rax
je 0x18001e8ee
movzx r8d, byte [rcx + r9]
test r8b, r8b
je 0x18001e8ee
mov byte [rcx], r8b
inc rcx
dec rax
sub rdx, 1
jne 0x18001e8d0
lea rax, [rcx - 1]
test rdx, rdx
cmovne rax, rcx
mov byte [rax], 0
lea r9, [0x1800a2070]
cmp qword [0x1800a2088], 0x10
cmovae r9, qword [0x1800a2070]
mov rcx, rdi
lea rax, [rbp + 0x50]
nop word [rax + rax]
cmp byte [rax], 0
je 0x18001e92e
inc rax
sub rcx, 1
jne 0x18001e920
test rcx, rcx
je 0x18001e982
mov rax, rdi
sub rax, rcx
test rcx, rcx
cmove rax, r12
mov rdx, rdi
sub rdx, rax
lea rcx, [rbp + 0x50]
lea rcx, [rcx + rax]
je 0x18001e974
mov rax, r14
sub r9, rcx
test rax, rax
je 0x18001e974
movzx r8d, byte [rcx + r9]
test r8b, r8b
je 0x18001e974
mov byte [rcx], r8b
inc rcx
dec rax
sub rdx, 1
jne 0x18001e956
lea rax, [rcx - 1]
test rdx, rdx
cmovne rax, rcx
mov byte [rax], 0
lea rax, [rbp + 0x50]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18001e990
lea rdx, [rbp + 0x50]
lea rcx, [0x1800a2030]
call fcn.18001e3a0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], rax
lea rax, vtable.el::base::threading::ThreadSafe.0
mov qword [rbp - 0x50], rax
mov edx, 0x102
lea rcx, [rbp - 0x48]
call fcn.180031948
mov qword [rbp + 8], r12
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x10], xmm0
lea r13, vtable.el::Configurations.0
mov qword [rbp - 0x50], r13
movdqa xmm0, xmmword [0x180090280]
movdqa xmmword [rbp + 0x30], xmm0
mov byte [rbp + 0x20], 0
mov byte [rbp + 0x40], 0
lea rcx, [rbp - 0x50]
call fcn.180003810
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
mov r8d, 8
lea rdx, str.10485760
lea rcx, [rsp + 0x20]
call fcn.18001e3a0
nop
xor r9d, r9d
lea r8, [rsp + 0x20]
mov edx, pe_nt_image_headers64
lea rcx, [rbp - 0x50]
call fcn.180005d00
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x18001eaa4
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001ea9f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001eff1
call fcn.180032af0
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
mov r8d, 4
lea rdx, str.true
lea rcx, [rsp + 0x20]
call fcn.18001e3a0
nop
xor r9d, r9d
lea r8, [rsp + 0x20]
lea edx, [r9 + 2]
lea rcx, [rbp - 0x50]
call fcn.180005d00
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x18001eb22
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001eb1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001eff7
call fcn.180032af0
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
mov r8d, 5
lea rdx, str.false
lea rcx, [rsp + 0x20]
call fcn.18001e3a0
nop
xor r9d, r9d
lea r8, [rsp + 0x20]
lea edx, [r9 + 4]
lea rcx, [rbp - 0x50]
call fcn.180005d00
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x18001eba0
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001eb9b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001effd
call fcn.180032af0
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
lea rax, [rbp + 0x50]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18001ebc0
lea rdx, [rbp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.18001e3a0
nop
xor r9d, r9d
lea r8, [rsp + 0x20]
lea edx, [r9 + 0x10]
lea rcx, [rbp - 0x50]
call fcn.180005d00
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x18001ec2c
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001ec27
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001f003
call fcn.180032af0
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
mov r8d, 0x1f
lea rdx, str._datetime__level___logger___msg
lea rcx, [rsp + 0x20]
call fcn.18001e3a0
nop
lea rcx, [rbp - 0x50]
mov rax, qword [rbp - 0x50]
call qword [rax + 0x10]
mov rbx, rax
mov qword [rsp + 0x60], rax
mov rcx, rax
call fcn.180031978
test eax, eax
jne 0x18001f009
lea r9, [rsp + 0x20]
lea edx, [rax + 4]
lea r8d, [rax + 8]
lea rcx, [rbp - 0x50]
call fcn.180005c10
nop
mov rcx, rbx
call fcn.18003199c
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x18001ecd6
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001ecd1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001f011
call fcn.180032af0
mov r8, rdi
xor edx, edx
lea rcx, [rbp + 0x160]
call fcn.180051b50
mov r8d, edi
lea rdx, [rbp + 0x160]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x5c
lea rcx, [rbp + 0x160]
call fcn.180051498
mov byte [rax + 1], 0
mov rcx, rdi
lea rax, [rbp + 0x160]
nop dword [rax]
cmp byte [rax], 0
je 0x18001ed2e
inc rax
sub rcx, 1
jne 0x18001ed20
test rcx, rcx
je 0x18001ed89
mov rax, rdi
sub rax, rcx
test rcx, rcx
cmove rax, r12
sub rdi, rax
lea rcx, [rbp + 0x160]
lea rcx, [rcx + rax]
je 0x18001ed7b
lea rdx, str.log.conf
sub rdx, rcx
nop word [rax + rax]
test r14, r14
je 0x18001ed7b
movzx eax, byte [rcx + rdx]
test al, al
je 0x18001ed7b
mov byte [rcx], al
inc rcx
dec r14
sub rdi, 1
jne 0x18001ed60
lea rax, [rcx - 1]
test rdi, rdi
cmovne rax, rcx
mov byte [rax], 0
lea rcx, [rbp + 0x160]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x18001ee2a
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
lea rax, [rbp + 0x160]
nop dword [rax + rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x18001edc0
mov r8, rsi
lea rdx, [rbp + 0x160]
lea rcx, [rsp + 0x20]
call fcn.18001e3a0
nop
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x50]
call fcn.180003390
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x18001ee2a
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001ee25
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001f017
call fcn.180032af0
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
mov r8d, 7
lea rdx, str.default
lea rcx, [rsp + 0x20]
call fcn.18001e3a0
nop
mov r8b, 1
lea rdx, [rsp + 0x20]
mov rcx, qword [0x1800a6f08]
mov rcx, qword [rcx + 0x60]
call fcn.18000c7b0
test rax, rax
je 0x18001ee7f
lea rdx, [rbp - 0x50]
mov rcx, rax
call fcn.1800068c0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x18001eebc
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001eeb7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001f01d
call fcn.180032af0
mov rax, qword [0x1800a6f08]
or dword [rax + 0x68], 8
lea rax, vtable.std::_Func_impl_no_alloc_void____cdecl___char_const____ptr64__unsigned_long_long_unsigned___int64____void__char_const____ptr64__unsigned_long_long_unsigned___int64__.0
mov qword [rsp + 0x20], rax
lea rax, [0x18001fcf0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x58], rax
mov rbx, qword [0x1800a6f08]
mov qword [rbp - 0x58], r12
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x20]
call qword [vtable.std::_Func_impl_no_alloc_void____cdecl___char_const____ptr64__unsigned_long_long_unsigned___int64____void__char_const____ptr64__unsigned_long_long_unsigned___int64__.0]
mov qword [rbp - 0x58], rax
lea rdx, [rbx + 0xe8]
lea rcx, [rsp + 0x70]
call fcn.180020d30
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x18001ef34
mov rax, qword [rcx]
lea rdx, [rsp + 0x70]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x18001ef50
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
nop
mov qword [rbp - 0x50], r13
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x18001ef8b
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001ef86
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001efdf
call fcn.180032af0
movdqa xmm0, xmmword [0x180090280]
movdqa xmmword [rbp + 0x30], xmm0
mov byte [rbp + 0x20], 0
lea rcx, [rbp - 0x50]
call fcn.1800122f0
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.180032aa0
lea r11, [rsp + 0x3a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.180056698
int3
call fcn.180056698
nop
call fcn.180056698
nop
call fcn.180056698
int3
call fcn.180056698
int3
call fcn.180056698
int3
call fcn.180056698
nop
mov ecx, eax
call fcn.180030b0c
nop
call fcn.180056698
int3
call fcn.180056698
int3
call fcn.180056698
int3