Function at 0x18000e680
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x1c8]
sub rsp, 0x2b0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov rax, qword [0x180064138]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x70]
call fcn.180027560
mov edx, 0x104
lea rcx, [rbp - 0x70]
call fcn.180009320
mov rdi, 0xffffffffffffffff
test eax, eax
je 0x18000ea36
lea rcx, [rbp - 0x70]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18000ea36
call fcn.180007b50
mov rcx, rax
test rax, rax
je 0x18000eb23
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
call fcn.180007b50
mov rcx, rax
test rax, rax
je 0x18000eb2e
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
lea rax, [rbp - 0x70]
xor r12d, r12d
cmp rax, 0x10000
lea rax, [rbp - 0x70]
jae 0x18000e76a
movzx edx, ax
lea rcx, [rsp + 0x30]
call fcn.18000cc80
mov rbx, qword [rsp + 0x30]
jmp 0x18000e892
mov rsi, rdi
nop dword [rax]
inc rsi
cmp word [rax + rsi*2], r12w
jne 0x18000e770
test esi, esi
jne 0x18000e7d8
lea rdx, [rbx - 0x18]
mov rsi, qword [rdx]
cmp dword [rdx + 8], r12d
je 0x18000e892
cmp dword [rdx + 0x10], r12d
jge 0x18000e7ac
cmp dword [rbx - 0xc], r12d
jl 0x18000eb39
mov dword [rbx - 0x10], r12d
mov word [rbx], r12w
jmp 0x18000e892
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000e7c1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
jmp 0x18000e892
mov r15d, dword [rbx - 0x10]
lea r14, [rbp - 0x70]
sub r14, rbx
sar r14, 1
test esi, esi
js 0x18000eb44
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, esi
or eax, ecx
jge 0x18000e810
mov edx, esi
lea rcx, [rsp + 0x30]
call fcn.18000fc40
mov rbx, qword [rsp + 0x30]
movsxd rax, esi
cmp r14, r15
ja 0x18000e867
lea rdx, [rbx + r14*2]
lea r14, [rax + rax]
test r14, r14
je 0x18000e881
test rdx, rdx
jne 0x18000e83c
call fcn.18002ce14
mov dword [rax], 0x16
call fcn.180029c34
jmp 0x18000e881
movsxd rax, dword [rbx - 0xc]
add rax, rax
cmp rax, r14
jae 0x18000e85a
call fcn.18002ce14
mov dword [rax], 0x22
call fcn.180029c34
jmp 0x18000e881
mov r8, r14
mov rcx, rbx
call fcn.180027100
jmp 0x18000e881
lea r14, [rax + rax]
movsxd rdx, dword [rbx - 0xc]
add rdx, rdx
mov r9, r14
lea r8, [rbp - 0x70]
mov rcx, rbx
call fcn.18000fed0
cmp esi, dword [rbx - 0xc]
jg 0x18000eb18
mov dword [rbx - 0x10], esi
mov word [r14 + rbx], r12w
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.18000c2a0
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000e8bb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x50]
cmp dword [rbx - 0x10], 0
je 0x18000ea1d
lea rdx, str.3.5.0.2278
mov rcx, rbx
call fcn.180017fb0
test eax, eax
js 0x18000ea1d
call fcn.180007b50
mov rcx, rax
test rax, rax
je 0x18000eb4f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rdx, str.uninstall_donothing
cmp rdx, 0x10000
jae 0x18000e920
movzx edx, dx
lea rcx, [rsp + 0x40]
call fcn.18000cc80
jmp 0x18000e93b
mov rax, rdi
inc rax
cmp word [rdx + rax*2], 0
jne 0x18000e923
mov r8d, eax
lea rcx, [rsp + 0x40]
call fcn.18000fcf0
nop
call fcn.180007b50
mov rcx, rax
test rax, rax
je 0x18000eb5a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rdx, str.LDSShellExt
cmp rdx, 0x10000
jae 0x18000e97a
movzx edx, dx
lea rcx, [rsp + 0x38]
call fcn.18000cc80
jmp 0x18000e998
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x18000e980
mov r8d, eax
lea rcx, [rsp + 0x38]
call fcn.18000fcf0
nop
call fcn.18000c770
mov rcx, rax
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x38]
call fcn.180017910
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000e9d7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000e9f6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x18000ea13
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov eax, 1
jmp 0x18000eae8
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000ea36
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
call fcn.180007b50
mov rcx, rax
test rax, rax
je 0x18000eb65
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rdx, str.OnCommand_LudashiUninstall
cmp rdx, 0x10000
jae 0x18000ea75
movzx edx, dx
lea rcx, [rsp + 0x48]
call fcn.18000cc80
jmp 0x18000ea98
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x18000ea80
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.18000fcf0
nop
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x60]
call fcn.18000b530
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x18000eac4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rdx, str.real_uninstall
lea rcx, [rsp + 0x60]
call fcn.18000b860
call fcn.18000f300
mov ebx, eax
lea rcx, [rsp + 0x60]
call fcn.18000b6c0
mov eax, ebx
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.18001e0c0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov ecx, 0x80070057
call fcn.180008e40
nop
mov ecx, 0x80004005
call fcn.180008e40
nop
mov ecx, 0x80004005
call fcn.180008e40
nop
mov ecx, 0x80070057
call fcn.180008e40
int3
mov ecx, 0x80070057
call fcn.180008e40
nop
mov ecx, 0x80004005
call fcn.180008e40
nop
mov ecx, 0x80004005
call fcn.180008e40
nop
mov ecx, 0x80004005
call fcn.180008e40
int3