Function at 0x14003fc20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4f]
sub rsp, 0xa0
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r14d, r9d
mov r15d, r8d
mov r12, rdx
mov r13, rcx
mov rcx, qword [rcx]
or rsi, 0xffffffffffffffff
cmp rcx, rsi
je 0x14003fc6d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r13], rsi
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov edi, eax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
xor dl, dl
movzx edi, dl
test ebx, ebx
mov ebx, 1
cmovne edi, ebx
mov qword [rsp + 0x30], 0
mov eax, dword [rbp + 0x7f]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp + 0x77]
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov r8d, r14d
mov edx, r15d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x14003fef2
test dil, dil
jne 0x14003fee7
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rbp + 0x57], rdi
test r12, r12
je 0x14003fd42
test r12, 0xffffffffffff0000
jne 0x14003fd2f
movzx ebx, r12w
xor edx, edx
mov ecx, ebx
call fcn.1400017e0
test rax, rax
je 0x14003fd59
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp + 0x57]
call fcn.140001f70
mov rdi, qword [rbp + 0x57]
jmp 0x14003fd59
xor eax, eax
mov rcx, rsi
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
dec rcx
jmp 0x14003fd44
xor ecx, ecx
mov r8d, ecx
mov rdx, r12
lea rcx, [rbp + 0x57]
call fcn.140001e80
mov rdi, qword [rbp + 0x57]
jmp 0x14003fd5e
mov ebx, 1
xor r15d, r15d
mov qword [rbp - 0x21], r15
mov qword [rbp - 0x39], r15
cmp dword [rdi - 8], 1
jle 0x14003fd7f
mov edx, dword [rdi - 0x10]
lea rcx, [rbp + 0x57]
call fcn.140001930
mov rdi, qword [rbp + 0x57]
lea rax, [rbp - 0x21]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
lea rax, [rbp - 0x39]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8d, [r9 + 4]
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x31], rbx
lea rdx, str.S_1_5_32_545
test rdx, 0xffffffffffff0000
jne 0x14003fdfa
movzx r12d, dx
xor edx, edx
mov ecx, r12d
call fcn.1400017e0
test rax, rax
je 0x14003fe0d
mov r8d, r12d
mov rdx, rax
lea rcx, [rbp - 0x31]
call fcn.140001f70
jmp 0x14003fe09
mov r8d, Ordinal_17
lea rcx, [rbp - 0x31]
call fcn.140001e80
mov rbx, qword [rbp - 0x31]
mov qword [rbp - 0x29], r15
lea rdx, [rbp - 0x29]
mov rcx, rbx
call sub.ADVAPI32.dll_ConvertStringSidToSidW
mov dword [rbp - 0x11], 0x1f01ff
mov ecx, 1
mov dword [rbp - 0xd], ecx
mov dword [rbp - 9], 3
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov dword [rbp + 0xf], 5
mov rax, qword [rbp - 0x29]
mov qword [rbp + 0x17], rax
lea r9, [rbp - 0x39]
mov r8, qword [rbp - 0x39]
lea rdx, [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
mov qword [rsp + 0x30], r15
mov rax, qword [rbp - 0x39]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea edx, [r9 + 1]
lea r8d, [r9 + 4]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x14003fe92
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x14003fea1
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x14003feb0
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14003fecb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x57]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x14003fee7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov qword [r13], r14
mov eax, 1
jmp 0x14003fef4
xor eax, eax
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret