Function at 0x1400212f4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov r12, rdx
mov r15, rcx
xor edx, edx
mov qword [rbp - 0x28], rdx
mov esi, edx
mov qword [rbp - 0x40], rdx
mov qword [rbp - 0x20], rdx
mov edi, edx
mov qword [rbp + 0x50], rdx
mov ebx, edx
mov qword [rbp - 0x38], rdx
test r9, r9
jne 0x14002135c
mov r12d, 0x80070057
mov r14d, r12d
mov ecx, r12d
call fcn.140025d30
jmp 0x140021868
test r12, r12
je 0x14002141c
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
mov r14d, eax
cmp eax, 0xffffffff
je 0x140021386
shr r14d, 4
and r14d, 1
jmp 0x140021389
xor r14d, r14d
xor ecx, ecx
call fcn.140025d50
xor ecx, ecx
call fcn.140025d50
test r14d, r14d
je 0x140021346
lea r13, [r15 + 0x68]
mov r14, qword [r13]
test r14, r14
je 0x1400213d6
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
lea r8, [r14 - 4]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.140025d50
and qword [r13], 0
lea rdx, [rbp + 0x58]
mov rcx, r12
call fcn.140029fcc
mov r14d, eax
test eax, eax
js 0x1400213fe
mov r8, r13
mov edx, dword [rbp + 0x58]
mov rcx, r12
call fcn.140028308
mov r14d, eax
test eax, eax
jns 0x140021405
mov ecx, eax
call fcn.140025d30
mov ecx, r14d
call fcn.140025d50
xor edx, edx
test r14d, r14d
jns 0x14002141c
mov ecx, r14d
jmp 0x140021352
lea rcx, [r15 + 0x78]
and qword [rbp - 0x18], 0
mov qword [rbp - 0x10], rdx
mov r14d, edx
mov r12d, 0x80070057
test rcx, rcx
jne 0x140021444
mov r14d, r12d
mov ecx, r12d
call fcn.140025d30
jmp 0x14002144d
lea rdx, [rbp - 0x18]
call fcn.140024fe0
mov ecx, r14d
call fcn.140025d50
nop
xor edx, edx
lea rcx, [rbp - 0x18]
call fcn.140027c4c
nop
mov r13, qword [rbp - 0x10]
test r13, r13
je 0x14002148c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
mov r8, r13
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
nop
test r14d, r14d
js 0x140021414
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor edx, edx
mov r9d, 0x20000000
lea r8d, [rdx + 3]
mov rcx, qword [rbp + 0x48]
call fcn.140053420
mov rbx, rax
mov qword [rbp - 0x38], rax
test rax, rax
jne 0x1400214ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x1400214d8
mov r14d, 0x80004005
jmp 0x140021414
movzx r14d, ax
or r14d, 0x80070000
test eax, eax
cmovle r14d, eax
jmp 0x140021414
lea r13, [r15 + 0x70]
mov r14, qword [r13]
test r14, r14
je 0x140021528
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
lea r8, [r14 - 4]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.140025d50
and qword [r13], 0
lea rdx, [rbp + 0x58]
mov rcx, qword [rbp + 0x48]
call fcn.140029fcc
mov r14d, eax
test eax, eax
js 0x140021552
mov r8, r13
mov edx, dword [rbp + 0x58]
mov rcx, qword [rbp + 0x48]
call fcn.140028308
mov r14d, eax
test eax, eax
jns 0x140021559
mov ecx, eax
call fcn.140025d30
mov ecx, r14d
call fcn.140025d50
test r14d, r14d
js 0x140021414
lea r14, [r15 + 0x98]
xor edx, edx
mov r8d, 0x230
mov rcx, r14
call sub.msvcrt.dll_memset
mov rdx, r14
mov rcx, rbx
call fcn.140053c3c
test eax, eax
je 0x1400214bd
lea r13, [r15 + 0x2d0]
and dword [r13], 0
lea r14, [r15 + 0x90]
mov rcx, qword [r14]
test rcx, rcx
je 0x1400215bf
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
and qword [r14], 0
mov r8, r13
mov rdx, r14
mov rcx, rbx
call fcn.14005677c
test eax, eax
je 0x1400214bd
mov rcx, rbx
call fcn.140053a38
xor ebx, ebx
mov qword [rbp - 0x38], rbx
lea r13, [r15 + 0x2c8]
test r13, r13
je 0x1400215f7
mov rcx, r13
call fcn.14002f75c
mov r8d, dword [r15 + 0x2d0]
test r13, r13
je 0x140021613
mov rdx, qword [r14]
mov rcx, r13
call fcn.14002f658
mov r14d, eax
jmp 0x140021616
mov r14d, r12d
test r14d, r14d
js 0x140021414
and dword [r15 + 0x2d8], ebx
mov r13d, 1
mov dword [rbp + 0x58], r13d
mov eax, dword [r15 + 0x2b0]
cmp eax, r13d
jb 0x140021857
xor r14d, r14d
test r13d, r13d
je 0x14002165a
cmp r13d, eax
jbe 0x14002165a
mov r14d, r12d
mov ecx, r12d
call fcn.140025d30
jmp 0x140021661
mov dword [r15 + 0x2d4], r13d
mov ecx, r14d
call fcn.140025d50
test r14d, r14d
js 0x140021414
test rsi, rsi
je 0x1400216a3
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
lea r8, [rsi - 4]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.140025d50
and qword [rbp - 0x40], rbx
lea rdx, [rbp - 0x40]
mov rcx, r15
call fcn.1400264d4
mov r14d, eax
mov rsi, qword [rbp - 0x40]
test eax, eax
js 0x14002170a
or ecx, 0xffffffff
mov dword [rsp + 0x28], ecx
lea rax, str.WindowsPE
mov qword [rsp + 0x20], rax
mov r9d, ecx
mov r8, rsi
lea edx, [rcx + 2]
mov ecx, 0x409
call qword [sym.imp.KERNEL32.dll_CompareStringW]
nop dword [rax + rax]
mov edx, r13d
cmp eax, 2
lea rcx, [r15 + 0x58]
je 0x1400216f7
lea rcx, [r15 + 0x48]
call fcn.140027b94
mov r14d, eax
test eax, eax
jns 0x140021715
mov ecx, eax
jmp 0x140021352
cmp eax, 0x80070490
jne 0x140021909
test rdi, rdi
je 0x140021748
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
lea r8, [rdi - 4]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.140025d50
xor edi, edi
mov qword [rbp + 0x50], rdi
mov edx, dword [r15 + 0x2d4]
test edx, edx
jne 0x140021764
mov eax, 0x8000000a
mov r13d, eax
mov ecx, eax
call fcn.140025d30
jmp 0x14002178e
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
lea r8, str.WIMIMAGE__WINDOWSINSTALLATIONTYPE
mov rcx, r15
call fcn.140029964
mov r13d, eax
test eax, eax
jns 0x14002178a
mov ecx, eax
call fcn.140025d30
mov rdi, qword [rbp + 0x50]
mov ecx, r13d
call fcn.140025d50
test r13d, r13d
jns 0x1400217a3
mov ecx, r13d
call fcn.140025d30
mov ecx, r13d
call fcn.140025d50
test r13d, r13d
js 0x140021825
or r14d, 0xffffffff
mov dword [rsp + 0x28], r14d
lea rax, str.Server
mov qword [rsp + 0x20], rax
mov r9d, r14d
mov r8, rdi
lea edx, [r14 + 2]
mov r13d, 0x409
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_CompareStringW]
nop dword [rax + rax]
cmp eax, 2
je 0x140021818
mov dword [rsp + 0x28], r14d
lea rax, str.Server_Core
mov qword [rsp + 0x20], rax
mov r9d, r14d
mov r8, rdi
lea edx, [r14 + 2]
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_CompareStringW]
nop dword [rax + rax]
cmp eax, 2
jne 0x14002183c
mov dword [r15 + 0x2d8], 1
jmp 0x14002183c
xor r14d, r14d
cmp r13d, 0x80070490
cmovne r14d, r13d
test r14d, r14d
js 0x140021414
mov r13d, dword [rbp + 0x58]
inc r13d
mov dword [rbp + 0x58], r13d
mov eax, dword [r15 + 0x2b0]
cmp r13d, eax
jbe 0x140021640
and dword [r15 + 0x2d4], ebx
xor ecx, ecx
call fcn.140025d50
xor r14d, r14d
mov ecx, r14d
call fcn.140025d50
nop
test rbx, rbx
je 0x140021883
mov rcx, rbx
call fcn.140053a38
and qword [rbp - 0x38], 0
test rdi, rdi
je 0x1400218b5
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
lea r8, [rdi - 4]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.140025d50
and qword [rbp + 0x50], 0
test rsi, rsi
je 0x1400218e7
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
lea r8, [rsi - 4]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.140025d50
and qword [rbp - 0x40], 0
mov eax, r14d
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, eax
call fcn.140025d30
mov rsi, qword [rbp - 0x40]
jmp 0x140021868