Function at 0x18000e9c0
Capabilities:
Check if file exists
Delete file
Get file size
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x10b0
call fcn.180188080
sub rsp, rax
mov qword [rsp + 0xe8], 0xfffffffffffffffe
mov rax, qword [0x180295a70]
xor rax, rsp
mov qword [rsp + 0x10a0], rax
mov edi, r9d
mov ebp, r8d
mov r13d, edx
mov rsi, rcx
mov r12, qword [rsp + 0x1118]
mov rbx, qword [rsp + 0x1120]
lea rdx, str.Default
lea rcx, [rsp + 0x130]
call fcn.180038590
nop
test rbx, rbx
je 0x18000ea4a
cmp word [rbx], 0
je 0x18000ea4a
mov r8d, dword [rsp + 0x1128]
mov rdx, rbx
lea rcx, [rsp + 0x130]
call fcn.180037e10
lea r14, [0x1802886b8]
mov rcx, r14
mov rax, qword [0x1802886b8]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x78], rax
mov r8d, dword [rsi + 0x10]
lea rbx, [0x18018c1a0]
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.1800051e8
mov rcx, r14
mov rax, qword [0x1802886b8]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x68], rax
mov r8d, dword [rsi + 0x14]
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.1800051e8
mov rcx, r14
mov rax, qword [0x1802886b8]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x58], rax
mov r8d, dword [rsi + 0x2c]
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.1800051e8
mov rcx, r14
mov rax, qword [0x1802886b8]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x48], rax
mov r8d, dword [rsi + 0x28]
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.1800051e8
mov rcx, r14
mov rax, qword [0x1802886b8]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov r8d, r13d
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.1800051e8
mov rcx, r14
mov rax, qword [0x1802886b8]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x60], rax
mov r8d, dword [rsp + 0x1110]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.1800051e8
mov rcx, r14
mov rax, qword [0x1802886b8]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x70], rax
mov r8d, ebp
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.1800051e8
mov rcx, r14
mov rax, qword [0x1802886b8]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x88], rax
mov r8d, edi
mov rdx, rbx
lea rcx, [rsp + 0x88]
call fcn.1800051e8
lea rcx, [0x18018c19c]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0x108], rax
test rax, rax
jne 0x18000ebbf
mov ecx, 0x8007000e
call fcn.180001000
nop
mov rdx, rax
lea rcx, [rsp + 0x130]
call fcn.1800368b0
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rsi, qword [rsp + 0x88]
or r13, 0xffffffffffffffff
test r12, r12
je 0x18000f08a
cmp word [r12], 0
je 0x18000f08a
test ebp, ebp
je 0x18000f08a
test edi, edi
je 0x18000f08a
mov rcx, qword [rsp + 0x78]
test rcx, rcx
jne 0x18000ec20
xor ebx, ebx
mov qword [rsp + 0xa8], rbx
jmp 0x18000ec41
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0xa8], rax
test rax, rax
jne 0x18000ec41
mov ecx, 0x8007000e
call fcn.180001000
nop
mov edx, r13d
lea rcx, str.screenshotTypeId
call fcn.180003cd8
mov rdi, rax
mov qword [rsp + 0xd0], rax
test rax, rax
jne 0x18000ec6b
mov ecx, 0x8007000e
call fcn.180001000
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x130]
call fcn.1800358b0
mov ebp, eax
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test ebp, ebp
js 0x18000f08f
mov rcx, qword [rsp + 0x68]
test rcx, rcx
jne 0x18000ecb1
xor ebx, ebx
mov qword [rsp + 0xa0], rbx
jmp 0x18000ecd2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0xa0], rax
test rax, rax
jne 0x18000ecd2
mov ecx, 0x8007000e
call fcn.180001000
nop
mov edx, r13d
lea rcx, str.triggerId
call fcn.180003cd8
mov rdi, rax
mov qword [rsp + 0x128], rax
test rax, rax
jne 0x18000ecfc
mov ecx, 0x8007000e
call fcn.180001000
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x130]
call fcn.1800358b0
mov ebp, eax
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test ebp, ebp
js 0x18000f08f
mov rcx, qword [rsp + 0x58]
test rcx, rcx
jne 0x18000ed42
xor ebx, ebx
mov qword [rsp + 0xc0], rbx
jmp 0x18000ed63
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0xc0], rax
test rax, rax
jne 0x18000ed63
mov ecx, 0x8007000e
call fcn.180001000
nop
mov edx, r13d
lea rcx, str.sessionId
call fcn.180003cd8
mov rdi, rax
mov qword [rsp + 0xf8], rax
test rax, rax
jne 0x18000ed8d
mov ecx, 0x8007000e
call fcn.180001000
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x130]
call fcn.1800358b0
mov ebp, eax
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test ebp, ebp
js 0x18000f08f
mov rcx, qword [rsp + 0x48]
test rcx, rcx
jne 0x18000edd3
xor ebx, ebx
mov qword [rsp + 0xb0], rbx
jmp 0x18000edf4
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0xb0], rax
test rax, rax
jne 0x18000edf4
mov ecx, 0x8007000e
call fcn.180001000
nop
mov edx, r13d
lea rcx, str.sequenceId
call fcn.180003cd8
mov rdi, rax
mov qword [rsp + 0x118], rax
test rax, rax
jne 0x18000ee1e
mov ecx, 0x8007000e
call fcn.180001000
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x130]
call fcn.1800358b0
mov ebp, eax
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test ebp, ebp
js 0x18000f08f
mov rcx, qword [rsp + 0x40]
test rcx, rcx
jne 0x18000ee64
xor ebx, ebx
mov qword [rsp + 0x98], rbx
jmp 0x18000ee85
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0x98], rax
test rax, rax
jne 0x18000ee85
mov ecx, 0x8007000e
call fcn.180001000
nop
mov edx, r13d
lea rcx, str.screenshotFormatId
call fcn.180003cd8
mov rdi, rax
mov qword [rsp + 0xd8], rax
test rax, rax
jne 0x18000eeaf
mov ecx, 0x8007000e
call fcn.180001000
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x130]
call fcn.1800358b0
mov ebp, eax
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test ebp, ebp
js 0x18000f08f
mov rcx, qword [rsp + 0x60]
test rcx, rcx
jne 0x18000eef5
xor ebx, ebx
mov qword [rsp + 0x90], rbx
jmp 0x18000ef16
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0x90], rax
test rax, rax
jne 0x18000ef16
mov ecx, 0x8007000e
call fcn.180001000
nop
mov edx, r13d
lea rcx, str.bitDepth
call fcn.180003cd8
mov rdi, rax
mov qword [rsp + 0xe0], rax
test rax, rax
jne 0x18000ef40
mov ecx, 0x8007000e
call fcn.180001000
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x130]
call fcn.1800358b0
mov ebp, eax
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test ebp, ebp
js 0x18000f08f
mov rcx, qword [rsp + 0x70]
test rcx, rcx
jne 0x18000ef86
xor ebx, ebx
mov qword [rsp + 0xb8], rbx
jmp 0x18000efa7
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0xb8], rax
test rax, rax
jne 0x18000efa7
mov ecx, 0x8007000e
call fcn.180001000
nop
mov edx, r13d
lea rcx, str.width
call fcn.180003cd8
mov rdi, rax
mov qword [rsp + 0xf0], rax
test rax, rax
jne 0x18000efd1
mov ecx, 0x8007000e
call fcn.180001000
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x130]
call fcn.1800358b0
mov ebp, eax
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test ebp, ebp
js 0x18000f08f
test rsi, rsi
jne 0x18000f012
xor ebx, ebx
mov qword [rsp + 0xc8], rbx
jmp 0x18000f036
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0xc8], rax
test rax, rax
jne 0x18000f036
mov ecx, 0x8007000e
call fcn.180001000
nop
mov edx, r13d
lea rcx, str.height
call fcn.180003cd8
mov rdi, rax
mov qword [rsp + 0x100], rax
test rax, rax
jne 0x18000f060
mov ecx, 0x8007000e
call fcn.180001000
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x130]
call fcn.1800358b0
mov ebp, eax
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x18000f08f
mov ebp, 0x80070057
mov rdi, r13
test ebp, ebp
js 0x18000f0da
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, r13
jne 0x18000f0da
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
xor r14d, r14d
test ebp, ebp
js 0x18000f0fa
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, eax
mov eax, 0x80004005
test r14d, r14d
cmove ebp, eax
xor r13d, r13d
test ebp, ebp
js 0x18000f157
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, r14d
lea edx, [r13 + 8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, rax
and dword [rsp + 0x80], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x80]
mov r8d, r14d
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18000f157
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
and qword [rsp + 0x50], 0
test ebp, ebp
js 0x18000f21b
lea r8, [rsp + 0x50]
mov edx, r14d
mov rcx, r13
call fcn.180037210
mov ebp, eax
test eax, eax
js 0x18000f221
or r14, 0xffffffffffffffff
mov edx, r14d
lea rcx, str.image
call fcn.180003cd8
mov rbx, rax
mov qword [rsp + 0x110], rax
test rax, rax
jne 0x18000f1ad
mov ecx, 0x8007000e
call fcn.180001000
nop
mov r8, qword [rsp + 0x50]
mov rdx, rax
lea rcx, [rsp + 0x130]
call fcn.1800358b0
mov ebp, eax
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test ebp, ebp
js 0x18000f225
mov edx, r14d
lea rcx, str.captureTimestamp
call fcn.180003cd8
mov rbx, rax
mov qword [rsp + 0x120], rax
test rax, rax
jne 0x18000f1fb
mov ecx, 0x8007000e
call fcn.180001000
nop
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x130]
call fcn.180037b50
mov ebp, eax
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x18000f225
or r14, 0xffffffffffffffff
jmp 0x18000f225
or r14, 0xffffffffffffffff
test r13, r13
je 0x18000f23e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, r13
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp rdi, r14
je 0x18000f24c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12, r12
je 0x18000f270
cmp word [r12], 0
je 0x18000f270
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18000f270
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
lea rdx, [rsi - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x18000f299
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x18000f2bb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x18000f2dd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x18000f2ff
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x18000f321
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x18000f343
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x18000f365
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x18000f387
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x130]
call fcn.1800357f0
mov eax, ebp
mov rcx, qword [rsp + 0x10a0]
xor rcx, rsp
call fcn.1801604e0
add rsp, 0x10b0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret