Function at 0x18002a1b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4f8]
sub rsp, 0x5c0
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1800c5470]
xor rax, rsp
mov qword [rbp + 0x4b0], rax
mov rsi, rdx
mov rdi, rcx
mov r8d, 4
lea rdx, [0x180089d10]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_wcsncmp]
mov ebx, 2
xor r13d, r13d
test eax, eax
je 0x18002a31c
mov r8d, ebx
lea rdx, [0x180089d1c]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_wcsncmp]
test eax, eax
jne 0x18002a31c
mov dword [rdi + 0x14], ebx
xor r8d, r8d
lea rcx, [rbp + 0x10]
call fcn.18002039c
nop
lea r15, vtable.CFileTypeParser.0
mov qword [rbp + 0x10], r15
mov dword [rbp + 0x30], ebx
test rsi, rsi
je 0x18002a265
lea r8d, [rbx - 1]
mov rdx, rsi
lea rcx, [rbp + 0x10]
call fcn.180025d60
jmp 0x18002a268
mov eax, r13d
test eax, eax
je 0x18002a30f
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x10]
call fcn.180023434
nop
mov rax, qword [rax]
mov ebx, dword [rax - 0x10]
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
or r14, 0xffffffffffffffff
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x18002a2aa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test ebx, ebx
je 0x18002a2f4
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x10]
call fcn.180023434
nop
lea rcx, [rdi + 0xe8]
mov r8, qword [rdi + 8]
mov rdx, qword [rax]
call fcn.180025ce0
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x18002a30f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x18002a30f
test rsi, rsi
je 0x18002a30f
lea rcx, [rdi + 0xe8]
mov r8d, 1
mov rdx, rsi
call fcn.180025d60
nop
mov qword [rbp + 0x10], r15
lea rcx, [rbp + 0x10]
jmp 0x18002a547
mov r12d, ILClone
test rsi, rsi
je 0x18002a551
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18002a551
test r12b, al
jne 0x18002a551
or r14, 0xffffffffffffffff
mov rax, r14
inc rax
cmp word [rsi + rax*2], r13w
jne 0x18002a34d
mov r8d, eax
mov rdx, rsi
lea rcx, [rdi + 8]
call fcn.180005498
xor r8d, r8d
lea rcx, [rbp - 0x70]
call fcn.18002039c
nop
lea r15, vtable.CFileTypeParser.0
mov qword [rbp - 0x70], r15
mov dword [rbp - 0x50], ebx
mov r8d, 1
mov rdx, rsi
lea rcx, [rbp - 0x70]
call fcn.180025d60
test eax, eax
je 0x18002a43f
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x70]
call fcn.180023434
nop
mov rax, qword [rax]
mov ebx, dword [rax - 0x10]
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x18002a3d1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test ebx, ebx
je 0x18002a41e
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x70]
call fcn.180023434
nop
lea rbx, [rdi + 0xe8]
mov r8, qword [rdi + 8]
mov rdx, qword [rax]
mov rcx, rbx
call fcn.180025ce0
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x18002a436
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x18002a436
lea rbx, [rdi + 0xe8]
mov r8d, 1
mov rdx, rsi
mov rcx, rbx
call fcn.180025d60
mov dword [rdi + 0x14], 2
jmp 0x18002a446
lea rbx, [rdi + 0xe8]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r13
lea r8, [rsp + 0x38]
mov rdx, qword [rbp - 0x38]
mov rcx, rbx
call fcn.1800201cc
mov r14, qword [rsp + 0x38]
mov rax, r14
mov rbx, qword [rsp + 0x40]
cmp r14, rbx
je 0x18002a4a3
cmp dword [rax], 1
je 0x18002a485
add rax, 4
cmp rax, rbx
jne 0x18002a477
cmp rax, rbx
je 0x18002a4a3
lea rcx, [rdi + 0x20]
mov rdx, rsi
call fcn.18001d65c
test eax, eax
je 0x18002a4a3
mov eax, dword [rdi + 0xa0]
mov dword [rdi + 0x14], eax
mov rax, r14
cmp r14, rbx
je 0x18002a4be
cmp dword [rax], 8
je 0x18002a4b9
add rax, 4
cmp rax, rbx
jne 0x18002a4ab
cmp rax, rbx
jne 0x18002a4d9
mov rax, r14
cmp r14, rbx
je 0x18002a4f3
cmp dword [rax], 3
je 0x18002a4d4
add rax, 4
cmp rax, rbx
jne 0x18002a4c6
cmp rax, rbx
je 0x18002a4f3
lea rcx, [rdi + 0xb8]
mov rdx, rsi
call fcn.18001ecf4
test eax, eax
je 0x18002a4f3
mov dword [rdi + 0x14], 8
test r14, r14
je 0x18002a53f
mov rdx, qword [rsp + 0x48]
sub rdx, r14
and rdx, 0xfffffffffffffffc
mov rax, r14
cmp rdx, 0x1000
jb 0x18002a529
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002a919
mov rcx, r14
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r13
mov qword [rbp - 0x70], r15
lea rcx, [rbp - 0x70]
call fcn.180020588
jmp 0x18002a885
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x18002a85e
lea rcx, [rdi + 8]
or r14, 0xffffffffffffffff
test rsi, rsi
jne 0x18002a574
mov eax, r13d
jmp 0x18002a581
mov rax, r14
inc rax
cmp word [rsi + rax*2], r13w
jne 0x18002a577
mov r8d, eax
mov rdx, rsi
call fcn.180005498
mov dword [rdi + 0x14], 0x20
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.180005348
nop
mov rcx, qword [rsp + 0x28]
add rcx, 2
lea rdx, [rbp + 0x78]
call qword [sym.imp.ole32.dll_IIDFromString]
test eax, eax
jne 0x18002a5e2
mov dword [rdi + 0x14], 0x10020
mov rdx, qword [rsp + 0x28]
add rdx, 2
lea rcx, [rdi + 0x128]
call fcn.1800275e4
jmp 0x18002a83b
lea r8, str.desktop.ini
mov rdx, rsi
lea rcx, [rbp + 0xa0]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
mov r15, rax
call fcn.18000a7ac
mov rcx, rax
test rax, rax
je 0x18002a91f
mov rax, qword [rax]
call qword [rax + ILCombine]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x20], rbx
test r15, r15
je 0x18002a64e
lea rcx, [rbp + 0xa0]
mov rax, r14
inc rax
cmp word [rcx + rax*2], r13w
jne 0x18002a62b
mov r8d, eax
lea rdx, [rbp + 0xa0]
lea rcx, [rsp + 0x20]
call fcn.180005498
mov rbx, qword [rsp + 0x20]
test rbx, rbx
je 0x18002a81e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18002a81e
test r12b, al
jne 0x18002a81e
lea rcx, [rbp - 0x28]
call fcn.18001f1c0
nop
mov rdx, rbx
lea rcx, [rbp - 0x28]
call fcn.18001ecf4
test eax, eax
je 0x18002a80d
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x28]
call fcn.18001f3e4
nop
lea rdx, str.0AFACED1_E828_11D1_9187_B532F1E9575D
mov rcx, qword [rax]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
sete bl
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x18002a6d5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r15d, 0x20020
test bl, bl
je 0x18002a77f
lea r8, str.target.lnk
mov rdx, rsi
lea rcx, [rbp + 0xa0]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
mov rsi, rax
call fcn.18000a7ac
mov rcx, rax
test rax, rax
je 0x18002a90e
mov rax, qword [rax]
call qword [rax + ILCombine]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
test rsi, rsi
je 0x18002a74f
lea rcx, [rbp + 0xa0]
mov rax, r14
inc rax
cmp word [rcx + rax*2], r13w
jne 0x18002a72c
mov r8d, eax
lea rdx, [rbp + 0xa0]
lea rcx, [rsp + 0x30]
call fcn.180005498
mov rbx, qword [rsp + 0x30]
lea rcx, [rdi + 0x20]
mov rdx, rbx
call fcn.18001d65c
test eax, eax
je 0x18002a763
mov dword [rdi + 0x14], r15d
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x18002a77f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x28]
call fcn.18001f3e4
nop
mov rax, qword [rax]
mov ebx, dword [rax - 0x10]
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x18002a7b5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test ebx, ebx
je 0x18002a806
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x28]
call fcn.18001f3e4
nop
lea rcx, [rdi + 0x128]
mov rdx, qword [rax]
call fcn.1800275e4
mov ebx, eax
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
mov ecx, r14d
lock xadd dword [rdx + 0x10], ecx
add ecx, r14d
test ecx, ecx
jg 0x18002a7f8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test ebx, ebx
je 0x18002a806
cmp dword [rdi + 0x14], r15d
je 0x18002a806
mov dword [rdi + 0x14], r12d
mov rbx, qword [rsp + 0x20]
jmp 0x18002a814
mov dword [rdi + 0x14], 0x40020
lea rcx, [rbp - 0x28]
call fcn.18001f7b4
nop
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x18002a83b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x18002a885
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x18002a885
lea rdx, [rbp + 0x88]
mov rcx, rsi
call qword [sym.imp.ole32.dll_IIDFromString]
test eax, eax
jne 0x18002a885
mov dword [rdi + 0x14], r12d
lea rcx, [rdi + 0x128]
mov rdx, rsi
call fcn.1800275e4
xor edx, edx
lea r8d, [rdx + 0x24]
lea rcx, [rbp + 0x50]
call sub.msvcrt.dll_memset
lea r8, [rbp + 0x50]
xor edx, edx
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x18002a8cb
mov rax, qword [rbp + 0x5c]
mov qword [rdi + 0x168], rax
mov eax, dword [rbp + 0x50]
cmp eax, 0xffffffff
je 0x18002a8cb
test al, 6
je 0x18002a8c3
or dword [rdi + 0x10], 1
test al, 1
je 0x18002a8cb
or dword [rdi + 0x10], 4
lea rcx, [rdi + 0xe8]
call fcn.180026378
test eax, eax
je 0x18002a8df
or dword [rdi + 0x10], 8
mov eax, 1
mov rcx, qword [rbp + 0x4b0]
xor rcx, rsp
call fcn.1800782d0
mov rbx, qword [rsp + 0x610]
add rsp, 0x5c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.18000a540
nop
call fcn.180070720
nop
mov ecx, 0x80004005
call fcn.18000a540
int3