Function at 0x1400bdf70
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x3f8]
sub rsp, 0x4e0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14028e6b0]
xor rax, rsp
mov qword [rbp + 0x3d0], rax
mov rdi, rcx
mov qword [rsp + 0x40], rcx
mov byte [rcx], 0
mov byte [rcx + 8], 0
xor r15d, r15d
mov qword [rcx + 0xc], r15
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov rbx, rax
test rax, rax
je 0x1400bdffd
lea edx, [r15 + 0x58]
mov rcx, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [rdi + 0xc], eax
lea edx, [r15 + 0x5a]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [rdi + 0x10], eax
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov qword [rdi + 0x18], r15
mov qword [rdi + 0x20], r15
mov qword [rdi + 0x28], r15
mov qword [rdi + 0x30], r15
mov qword [rdi + 0x38], r15
mov qword [rdi + 0x40], r15
mov qword [rdi + 0x48], r15
mov qword [rdi + 0x50], r15
mov qword [rdi + 0x58], r15
mov qword [rdi + 0x60], r15
mov qword [rdi + 0x68], r15
mov qword [rdi + 0x70], r15
mov qword [rdi + 0x78], r15
mov qword [rdi + 0x80], r15
mov qword [rdi + 0x88], r15
mov qword [rdi + 0x90], r15
lea rcx, [rdi + 0x98]
call fcn.1400bdc30
nop
lea rax, [rdi + 0x870]
mov qword [rsp + 0x30], rax
mov word [rax], 0x101
mov dword [rax + 4], 4
mov dword [rax + 8], 1
mov dword [rax + 0xc], 0x10101
mov word [rax + 0x10], 0
mov qword [rax + 0x18], r15
mov qword [rax + 0x20], r15
mov qword [rax + 0x28], r15
mov qword [rax + 0x30], r15
mov word [rax + 0x38], 0
mov dword [rax + 0x3c], 2
mov dword [rax + 0x40], 0x1000000
mov dword [rdi + 0xbd8], r15d
mov dword [rdi + 0xcd0], r15d
mov dword [rdi + 0xcd4], 0xa
mov byte [rdi + 0xcd8], 0
mov dword [rdi + 0xcdc], 0xffffffff
lea rax, [rdi + 0xce0]
mov qword [rsp + 0x30], rax
mov byte [rax], 0
mov dword [rax + 4], 0xa
mov dword [rax + 8], 0xa
mov dword [rax + 0xc], 0xa
mov dword [rax + 0x10], 0xa
mov qword [rax + 0x18], r15
mov qword [rax + 0x20], r15
mov qword [rax + 0x28], r15
mov qword [rax + 0x30], r15
mov qword [rax + 0x38], r15
mov qword [rax + 0x40], r15
mov qword [rax + 0x48], r15
mov qword [rax + 0x50], r15
mov qword [rax + 0x58], r15
mov qword [rax + 0x60], r15
mov qword [rax + 0x68], r15
mov qword [rax + 0x70], r15
mov dword [rax + 0x78], 0x1010000
mov word [rax + 0x7c], 0x100
mov byte [rax + 0x7e], 0
mov dword [rax + 0x80], r15d
mov dword [rax + 0x84], 1
mov qword [rax + 0x88], 0x96
mov byte [rdi + 0xe60], 0
mov qword [rdi + 0xe80], 7
mov qword [rdi + 0xe78], r15
mov word [rdi + 0xe68], r15w
mov qword [rdi + 0xea0], 7
mov qword [rdi + 0xe98], r15
mov word [rdi + 0xe88], r15w
mov qword [rdi + 0xf98], r15
mov byte [rdi + 0xfa0], 0
mov qword [rdi + 0xfa4], r15
mov dword [rdi + 0xfac], r15d
mov dword [rdi + 0xfb0], 0x55
mov dword [rdi + 0xfb4], 0xffffffff
lea rbx, [rdi + 0xfb8]
mov qword [rsp + 0x30], rbx
lea rax, [0x1400764a0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400739d0]
mov edx, 0x7e8
mov r8d, 0x64
mov rcx, rbx
call fcn.140168a80
nop
mov dword [rbx + 0x316a0], r15d
lea rbx, [rdi + 0x32660]
mov qword [rsp + 0x30], rbx
lea rax, [fcn.1400471e0]
mov qword [rsp + 0x20], rax
lea r9, [0x140074970]
mov edx, 0x40
lea r8d, [rdx - 0x22]
mov rcx, rbx
call fcn.140168a80
nop
mov dword [rbx + 0x780], r15d
mov qword [rdi + 0x32de8], r15
mov qword [rdi + 0x32df0], r15
mov qword [rdi + 0x32df8], r15
mov qword [rdi + 0x32e00], r15
mov qword [rdi + 0x32e08], r15
mov qword [rdi + 0x32e10], r15
lea rax, [rdi + 0x32e18]
mov qword [rsp + 0x30], rax
mov qword [rax], r15
mov qword [rax + 8], r15
mov qword [rax + 0x10], r15
mov qword [rdi + 0x32e30], r15
mov qword [rdi + 0x32e38], r15
mov qword [rdi + 0x32e40], r15
mov word [rdi + 0x32e49], 0
mov qword [rdi + 0x32e50], r15
mov qword [rdi + 0x32e58], r15
mov qword [rdi + 0x32e60], r15
mov qword [rdi + 0x32e68], r15
mov qword [rdi + 0x32e70], r15
mov qword [rdi + 0x32e78], r15
mov qword [rdi + 0x32e80], r15
mov qword [rdi + 0x32e88], r15
mov qword [rdi + 0x32e90], r15
mov qword [rdi + 0x32e98], r15
mov qword [rdi + 0x32ea0], r15
mov qword [rdi + 0x32ea8], r15
mov qword [rdi + 0x32eb0], r15
mov qword [rdi + 0x32eb8], r15
mov qword [rdi + 0x32ec0], r15
mov qword [rdi + 0x32ec8], r15
mov qword [rdi + 0x32ed0], r15
mov qword [rdi + 0x32ed8], r15
mov qword [rdi + 0x32ee0], r15
mov qword [rdi + 0x32ee8], r15
mov qword [rdi + 0x32ef0], r15
mov qword [rdi + 0x32ef8], r15
mov qword [rdi + 0x32f00], r15
mov qword [rdi + 0x32f08], r15
lea rax, [rdi + 0x32f10]
mov qword [rsp + 0x30], rax
mov qword [rax], r15
mov qword [rax + 8], r15
mov qword [rax + 0x10], r15
mov qword [rax + 0x30], 7
mov qword [rax + 0x28], r15
mov word [rax + 0x18], r15w
mov qword [rax + 0x50], InitCommonControls
mov qword [rax + 0x48], r15
mov byte [rax + 0x38], 0
mov qword [rdi + 0x32f80], 7
mov qword [rdi + 0x32f78], r15
mov word [rdi + 0x32f68], r15w
mov word [rdi + 0x32f88], 0
lea rax, [rdi + 0x32f90]
mov qword [rsp + 0x30], rax
mov qword [rax], r15
mov qword [rax + 8], r15
mov qword [rax + 0x10], r15
mov qword [rax + 0x30], 7
mov qword [rax + 0x28], r15
mov word [rax + 0x18], r15w
mov qword [rdi + 0x32fc8], r15
mov qword [rdi + 0x32fd0], r15
mov qword [rdi + 0x32fd8], r15
lea rax, [rdi + 0x32fe0]
mov qword [rsp + 0x30], rax
mov qword [rax], r15
mov qword [rax + 8], r15
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], r15
mov qword [rax + 0x20], r15
mov qword [rax + 0x28], r15
mov qword [rax + 0x30], r15
mov qword [rax + 0x38], r15
mov qword [rax + 0x40], r15
mov qword [rdi + 0x33040], 7
mov qword [rdi + 0x33038], r15
mov word [rdi + 0x33028], r15w
mov qword [rdi + 0x33060], 7
mov qword [rdi + 0x33058], r15
mov word [rdi + 0x33048], r15w
mov qword [rdi + 0x33080], 7
mov qword [rdi + 0x33078], r15
mov word [rdi + 0x33068], r15w
mov qword [rdi + 0x330a0], 7
mov qword [rdi + 0x33098], r15
mov word [rdi + 0x33088], r15w
mov qword [rdi + 0x330c0], 7
mov qword [rdi + 0x330b8], r15
mov word [rdi + 0x330a8], r15w
mov qword [rdi + 0x330e0], 7
mov qword [rdi + 0x330d8], r15
mov word [rdi + 0x330c8], r15w
mov qword [rdi + 0x33100], 7
mov qword [rdi + 0x330f8], r15
mov word [rdi + 0x330e8], r15w
lea rbx, [rdi + 0x33108]
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r15
mov word [rbx], r15w
mov qword [rdi + 0x33140], 7
mov qword [rdi + 0x33138], r15
mov word [rdi + 0x33128], r15w
mov qword [rdi + 0x33160], 7
mov qword [rdi + 0x33158], r15
mov word [rdi + 0x33148], r15w
mov qword [rdi + 0x33180], 7
mov qword [rdi + 0x33178], r15
mov word [rdi + 0x33168], r15w
mov qword [rdi + 0x331a0], 7
mov qword [rdi + 0x33198], r15
mov word [rdi + 0x33188], r15w
lea rcx, [rdi + 0x331a8]
lea rax, [fcn.1400037f0]
mov qword [rsp + 0x20], rax
lea r9, [fcn.14006d220]
mov edx, 0x20
lea r8d, [rdx - 0x1d]
call fcn.140168a80
nop
mov qword [rdi + 0x33208], r15
mov qword [rdi + 0x33210], r15
mov qword [rdi + 0x33218], r15
lea rax, [rdi + 0x33230]
mov qword [rsp + 0x30], rax
mov qword [rax + 0x18], 7
mov qword [rax + 0x10], r15
mov word [rax], r15w
mov qword [rax + 0x38], 7
mov qword [rax + 0x30], r15
mov word [rax + 0x20], r15w
mov qword [rax + 0x58], 7
mov qword [rax + 0x50], r15
mov word [rax + 0x40], r15w
mov qword [rax + 0x78], 7
mov qword [rax + 0x70], r15
mov word [rax + 0x60], r15w
mov byte [rdi + 0x332b0], 0
mov qword [rdi + 0x332c0], r15
mov qword [rdi + 0x332e8], 7
mov qword [rdi + 0x332e0], r15
mov word [rdi + 0x332d0], r15w
mov qword [rdi + 0x33308], 7
mov qword [rdi + 0x33300], r15
mov word [rdi + 0x332f0], r15w
mov qword [rdi + 0x33328], 7
mov qword [rdi + 0x33320], r15
mov word [rdi + 0x33310], r15w
mov qword [rdi + 0x33348], 7
mov qword [rdi + 0x33340], r15
mov word [rdi + 0x33330], r15w
mov word [rdi + 0x33350], 0
mov rcx, rdi
call fcn.1400d26c0
mov dword [rdi + 0x332b4], eax
mov r8d, 0x104
lea rdx, [rbp - 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp - 0x50]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
cmp word [rbp - 0x50], 0
jne 0x1400be676
mov r8, r15
jmp 0x1400be68b
lea rax, [rbp - 0x50]
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x1400be680
lea rdx, [rbp - 0x50]
lea rcx, [rdi + 0x330a8]
call fcn.140006f10
lea rdx, [rbp + 0x1c0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
cmp word [rbp + 0x1c0], 0
jne 0x1400be6bc
mov r8, r15
jmp 0x1400be6db
lea rax, [rbp + 0x1c0]
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400be6d0
lea rdx, [rbp + 0x1c0]
lea rcx, [rdi + 0x33188]
call fcn.140006f10
mov qword [rbx + 0x10], r15
cmp qword [rbx + 0x18], 8
jb 0x1400be6fc
mov rbx, qword [rbx]
mov word [rbx], r15w
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r15
mov word [rsp + 0x48], r15w
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rdi + 0x330a8]
lea rcx, [rsp + 0x48]
call fcn.140006dd0
nop
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x80], 7
mov qword [rsp + 0x78], r15
mov word [rsp + 0x68], r15w
mov r8d, InitCommonControls
lea rdx, str.asNotepad.xml
lea rcx, [rsp + 0x68]
call fcn.140006f10
nop
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x78]
call fcn.140028400
mov r8, qword [rbp - 0x60]
cmp r8, 8
jb 0x1400be798
inc r8
mov rdx, qword [rbp - 0x78]
lea rcx, [rbp - 0x78]
call fcn.140007680
mov qword [rbp - 0x60], 7
mov qword [rbp - 0x68], r15
mov word [rbp - 0x78], r15w
mov r8, qword [rbp - 0x80]
cmp r8, 8
jb 0x1400be7c5
inc r8
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x68]
call fcn.140007680
mov qword [rbp - 0x80], 7
mov qword [rsp + 0x78], r15
mov word [rsp + 0x68], r15w
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
sete al
mov byte [rdi + 0x332b0], al
mov rcx, rdi
call fcn.1400d2bb0
mov rcx, rdi
call fcn.1400d2db0
nop
mov r8, qword [rsp + 0x60]
cmp r8, 8
jb 0x1400be829
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.140007680
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r15
mov word [rsp + 0x48], r15w
mov rax, rdi
mov rcx, qword [rbp + 0x3d0]
xor rcx, rsp
call fcn.140168660
lea r11, [rsp + 0x4e0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret