Function at 0x14001c638
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rbp
push r12
push r14
push r15
sub rsp, 0x280
mov rax, qword [0x14012a5e8]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor r12d, r12d
mov r15d, r9d
test byte [rcx + 0x58], 4
mov r14, r8
mov rbx, rcx
mov qword [rsp + 0x40], r12
mov ebp, r12d
je 0x14000bcc6
mov eax, 0xfffff019
jmp 0x14000bd8d
mov qword [rcx + 0xe8], rdx
mov rcx, r14
mov qword [rsp + 0x278], rsi
mov qword [rsp + 0x270], rdi
call fcn.140001d30
mov qword [rbx + 0x60], rax
test rax, rax
je 0x14000c03c
mov eax, dword [rbx + 0x58]
test al, 4
jne 0x14000bd0a
or eax, 4
mov dword [rbx + 0x58], eax
test al, 8
je 0x14000bd0a
mov rax, qword [rbx + 8]
inc dword [rax + 8]
mov dword [rsp + 0x28], r12d
mov r9d, 0xffffffff
mov r8, r14
mov qword [rsp + 0x20], r12
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add eax, eax
movsxd rsi, eax
je 0x14000c03c
mov rcx, rsi
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x14000c03c
shr rsi, 1
mov r9d, 0xffffffff
mov dword [rsp + 0x28], esi
mov r8, r14
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x14000bdad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140016510
mov rsi, qword [rsp + 0x278]
mov rdi, qword [rsp + 0x270]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400f3170
add rsp, 0x280
pop r15
pop r14
pop r12
pop rbp
pop rbx
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000bf7d
mov rcx, rdi
test al, 0x10
je 0x14000be2b
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
movsxd r14, eax
test eax, eax
je 0x14000be26
mov rcx, r14
add rcx, rcx
je 0x14000c03c
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x14000c03c
mov r8d, r14d
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x14000be1e
movsxd rcx, eax
mov word [rsi + rcx*2], r12w
mov rcx, rdi
call fcn.140001da0
mov rdi, rsi
jmp 0x14000be8f
mov rcx, rsi
call fcn.140001da0
mov rsi, rdi
jmp 0x14000be8f
mov r8d, 0x104
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea rsi, [rsp + 0x50]
mov rcx, rdi
test eax, eax
lea r8, [rbx + 0xf0]
lea rdx, [rsp + 0x40]
cmove rsi, r12
call fcn.14000ba70
test eax, eax
jne 0x14000bf7d
lea r8, [rbx + 0xf8]
xor edx, edx
mov rcx, rsi
call fcn.14000ba70
test eax, eax
jne 0x14000bf7d
mov rbp, qword [rsp + 0x40]
mov rcx, rdi
mov rsi, rbp
call fcn.140001da0
mov rdi, r12
xor r9d, r9d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x42000000
mov rcx, rsi
mov dword [rsp + 0x20], 3
lea edx, [r9 + 1]
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 0xd8], rax
test rbp, rbp
je 0x14000becc
mov rcx, rbp
call fcn.140001da0
mov rcx, qword [rbx + 0xd8]
cmp rcx, 0xffffffffffffffff
je 0x14000bf7d
mov rdx, qword [rbx + 8]
xor r9d, r9d
mov r8, rbx
mov rdx, qword [rdx + 0x38]
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test rax, rax
je 0x14000bf7d
mov rax, qword [rbx + 0x108]
test rax, rax
jne 0x14000bf21
mov ecx, 0x1000
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rbx + 0x108], rax
test rax, rax
je 0x14000c03c
lea rax, [rbx + 0xa8]
mov qword [rsp + 0x38], r12
xor ecx, ecx
mov qword [rsp + 0x30], rax
mov qword [rax], rcx
mov r8d, 0x1000
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov rdx, qword [rbx + 0x108]
mov rcx, qword [rbx + 0xd8]
shr r15d, 2
and r15d, 1
mov qword [rsp + 0x28], r12
mov r9d, r15d
mov dword [rsp + 0x20], 0x17f
call qword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
test eax, eax
jne 0x14000c024
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [rbx + 0x60]
test rcx, rcx
je 0x14000bf97
call fcn.140001da0
mov qword [rbx + 0x60], r12
mov rcx, qword [rbx + 0xf0]
test rcx, rcx
je 0x14000bfaf
call fcn.140001da0
mov qword [rbx + 0xf0], r12
mov rcx, qword [rbx + 0xf8]
test rcx, rcx
je 0x14000bfc7
call fcn.140001da0
mov qword [rbx + 0xf8], r12
mov rcx, rdi
call fcn.140001da0
mov rcx, qword [rbx + 0xd8]
cmp rcx, 0xffffffffffffffff
je 0x14000bfed
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0xd8], 0xffffffffffffffff
mov rcx, qword [rbx + 0x108]
test rcx, rcx
je 0x14000c005
call fcn.140001da0
mov qword [rbx + 0x108], r12
mov eax, dword [rbx + 0x58]
test al, 4
je 0x14000c01d
and eax, 0xfffffffb
mov dword [rbx + 0x58], eax
test al, 8
je 0x14000c01d
mov rax, qword [rbx + 8]
dec dword [rax + 8]
mov ecx, esi
jmp 0x14000bd78
mov qword [rbx + 0x100], rdi
xor eax, eax
mov dword [rbx + 0xe0], 1
jmp 0x14000bd7d
lea rdx, str.uv__malloc
mov ecx, ntohs
call fcn.140016450
int3
mov r8, qword [rcx + 0x10]
lea rdx, [0x14001c5dc]
mov rcx, qword [rcx + 0x28]
xor r9d, r9d
jmp 0x14000bc80