Function at 0x1400e6a70
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x448]
sub rsp, 0x510
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x14016b400]
xor rax, rsp
mov qword [rbp + 0x400], rax
mov dword [rsp + 0x58], r9d
mov qword [rsp + 0x68], r8
mov r15, rdx
mov qword [rsp + 0x60], rdx
mov rbx, rcx
mov qword [rsp + 0x70], rcx
xor r13d, r13d
mov edi, r13d
lea esi, [r13 + 1]
lea rcx, str.AsrPerformBackup
call fcn.140029428
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
xor edx, edx
mov r8d, 0x228
lea rcx, [rbp - 0x40]
call sub.msvcrt.dll_memset
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x60], xmm0
mov qword [rsp + 0x50], r13
mov dword [rsp + 0x78], r13d
mov qword [rbp - 0x80], r13
mov dword [rbp - 0x78], r13d
mov qword [rbp - 0x70], r13
mov eax, r13d
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x48], rax
mov r12d, r13d
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1f0]
call sub.msvcrt.dll_memset
lea r14, [0x14013da08]
xor eax, eax
test rbx, rbx
jne 0x1400e6c46
mov esi, eax
lea edi, [rbx + 0x57]
lea rbx, section..data
mov rcx, qword [section..data]
cmp rcx, rbx
je 0x1400e6b8c
test byte [rcx + 0x1c], 8
je 0x1400e6b8c
lea edx, [rax + 0x11]
lea rax, str.ppwszXmlDocOut
mov r9d, edi
mov r8, r14
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx + 0x10]
call fcn.1400e4514
xor r14d, r14d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov rcx, r12
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov rcx, r13
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov edx, edi
call fcn.1400f17b4
test eax, eax
jne 0x1400e6bdf
mov rcx, qword [section..data]
cmp rcx, rbx
je 0x1400e6bdf
test byte [rcx + 0x1c], 8
je 0x1400e6bdf
lea edx, [rax + 0x25]
mov r9d, edi
lea r8, [0x14013da08]
mov rcx, qword [rcx + 0x10]
call fcn.1400e46a8
lea rcx, str.AsrPerformBackup
call fcn.140027f60
mov ecx, edi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop
lea rcx, [rsp + 0x78]
call fcn.1400e5b4c
nop
cmp qword [rsp + 0x50], r14
je 0x1400e6c11
lea rcx, [rsp + 0x50]
call fcn.1400e55f8
nop
lea rcx, [rbp - 0x60]
call fcn.1400eb4e4
mov eax, esi
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.1400321c0
mov rbx, qword [rsp + 0x560]
add rsp, 0x510
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400f169c
nop
call fcn.1400f2874
xor ebx, ebx
test eax, eax
jne 0x1400e6ca6
mov esi, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
lea rbx, section..data
mov rax, qword [section..data]
cmp rax, rbx
je 0x1400e6b8c
test byte [rax + 0x1c], 8
je 0x1400e6b8c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r9d, eax
mov edx, 0x12
lea rax, str.GetLastError__
mov r8, r14
mov rcx, qword [section..data]
jmp 0x1400e6b7e
lea rcx, [rsp + 0x38]
call fcn.14002a490
test eax, eax
jne 0x1400e6d0e
mov esi, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
lea rbx, section..data
mov rax, qword [section..data]
cmp rax, rbx
je 0x1400e6d04
test byte [rax + 0x1c], 8
je 0x1400e6d04
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r9d, eax
mov edx, 0x13
lea rax, str.GetLastError__
mov qword [rsp + 0x20], rax
mov r8, r14
mov rcx, qword [section..data]
mov rcx, qword [rcx + 0x10]
call fcn.1400e4514
mov r13, qword [rsp + 0x38]
jmp 0x1400e6b8c
mov r13, qword [rsp + 0x38]
or r14, 0xffffffffffffffff
mov rax, r14
inc rax
cmp word [r13 + rax*2], bx
jne 0x1400e6d1a
cmp rax, 2
ja 0x1400e6d6e
mov esi, ebx
mov r9d, reloc.VssTrace.DLL_Ordinal_11
mov edi, r9d
lea rbx, section..data
mov rcx, qword [section..data]
cmp rcx, rbx
je 0x1400e6b8c
test byte [rcx + 0x1c], 8
je 0x1400e6b8c
lea edx, [r9 + 9]
lea rax, str.ERROR_BAD_FORMAT
lea r8, [0x14013da08]
jmp 0x1400e6b7e
mov rax, r14
inc rax
cmp word [r13 + rax*2], bx
jne 0x1400e6d71
cmp word [r13 + rax*2 - 2], 0x5c
jne 0x1400e6d99
mov rax, r14
inc rax
cmp word [r13 + rax*2], bx
jne 0x1400e6d88
mov word [r13 + rax*2 - 2], bx
mov eax, 0x3f
mov word [r13 + 2], ax
lea rbx, section..data
mov rcx, qword [section..data]
cmp rcx, rbx
je 0x1400e6dd2
test byte [rcx + 0x1c], 2
je 0x1400e6dd2
lea edx, [rax - 0x2a]
mov r9, r13
lea r8, [0x14013da08]
mov rcx, qword [rcx + 0x10]
call fcn.1400e4650
mov rdx, r13
mov rcx, r15
call fcn.1400f22bc
xor ecx, ecx
test eax, eax
jne 0x1400e6e28
mov esi, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov rax, qword [section..data]
cmp rax, rbx
je 0x1400e6b8c
test byte [rax + 0x1c], 8
je 0x1400e6b8c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r9d, eax
mov edx, 0x16
lea rax, str.MwszStringAppend_ppmwszSelectedCriticalVolumes__pwszBootVolGuidName_
lea r8, [0x14013da08]
jmp 0x1400e6c9a
lea rcx, [rsp + 0x40]
call fcn.1400f1b6c
mov r12, qword [rsp + 0x40]
xor ecx, ecx
test eax, eax
jne 0x1400e6eae
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r15d, eax
call fcn.14002b310
cmp eax, 2
je 0x1400e6f9a
xor r14d, r14d
mov esi, r14d
mov r12d, 0x80042416
mov ecx, r12d
call fcn.1400f2b1c
mov edi, eax
mov rcx, qword [section..data]
cmp rcx, rbx
je 0x1400e6ea4
test byte [rcx + 0x1c], 8
je 0x1400e6ea4
lea edx, [r14 + 0x17]
mov dword [rsp + 0x28], r15d
lea rax, str.VSS_E_ASRERROR_SYSTEM_PARTITION_HIDDEN
mov qword [rsp + 0x20], rax
mov r9d, r12d
lea r8, [0x14013da08]
mov rcx, qword [rcx + 0x10]
call fcn.1400e7728
mov r12, qword [rsp + 0x40]
jmp 0x1400e6b8f
mov rax, r14
inc rax
cmp word [r12 + rax*2], cx
jne 0x1400e6eb1
cmp rax, 2
ja 0x1400e6eef
mov esi, ecx
mov r9d, reloc.VssTrace.DLL_Ordinal_11
mov edi, r9d
mov rcx, qword [section..data]
cmp rcx, rbx
je 0x1400e6b8c
test byte [rcx + 0x1c], 8
je 0x1400e6b8c
lea edx, [r9 + 0xd]
jmp 0x1400e6d5b
mov rax, r14
inc rax
cmp word [r12 + rax*2], cx
jne 0x1400e6ef2
cmp word [r12 + rax*2 - 2], 0x5c
jne 0x1400e6f18
mov rax, r14
inc rax
cmp word [r12 + rax*2], cx
jne 0x1400e6f08
mov word [r12 + rax*2 - 2], cx
mov eax, 0x3f
mov word [r12 + 2], ax
mov rcx, qword [section..data]
cmp rcx, rbx
je 0x1400e6f4b
test byte [rcx + 0x1c], 2
je 0x1400e6f4b
lea edx, [rax - 0x26]
mov r9, r12
lea r8, [0x14013da08]
mov rcx, qword [rcx + 0x10]
call fcn.1400e4650
mov rdx, r12
mov rcx, r15
call fcn.1400f22bc
xor ecx, ecx
test eax, eax
jne 0x1400e6f9a
mov esi, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov rax, qword [section..data]
cmp rax, rbx
je 0x1400e6b8c
test byte [rax + 0x1c], 8
je 0x1400e6b8c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r9d, eax
mov edx, 0x1a
lea rax, str.MwszStringAppend_ppmwszSelectedCriticalVolumes__pwszSysVolGuidName_
jmp 0x1400e6e1c
lea rcx, [rbp + 0x1f0]
call fcn.14002a7e8
mov r15d, eax
xor edx, edx
test eax, eax
je 0x1400e70c6
cmp word [rbp + 0x1f0], dx
je 0x1400e70c6
lea rax, [rbp + 0x1f0]
inc r14
cmp word [rax + r14*2], dx
jne 0x1400e6fc7
cmp r14d, 2
ja 0x1400e7005
mov esi, edx
mov r9d, reloc.VssTrace.DLL_Ordinal_11
mov edi, r9d
mov rcx, qword [section..data]
cmp rcx, rbx
je 0x1400e6b8c
test byte [rcx + 0x1c], 8
je 0x1400e6b8c
lea edx, [r9 + 0x10]
jmp 0x1400e6d5b
lea ecx, [r14 - 1]
add rcx, rcx
cmp word [rbp + rcx + 0x1f0], 0x5c
jne 0x1400e702c
cmp rcx, 0x208
jae 0x1400e70c0
mov word [rbp + rcx + 0x1f0], dx
mov eax, 0x3f
mov word [rbp + 0x1f2], ax
mov rcx, qword [section..data]
cmp rcx, rbx
je 0x1400e7064
test byte [rcx + 0x1c], 2
je 0x1400e7064
lea edx, [rax - 0x23]
lea r9, [rbp + 0x1f0]
lea r8, [0x14013da08]
mov rcx, qword [rcx + 0x10]
call fcn.1400e4650
lea rdx, [rbp + 0x1f0]
mov r14, qword [rsp + 0x60]
mov rcx, r14
call fcn.1400f22bc
xor ecx, ecx
test eax, eax
jne 0x1400e715e
mov esi, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov rax, qword [section..data]
cmp rax, rbx
je 0x1400e6b8c
test byte [rax + 0x1c], 8
je 0x1400e6b8c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r9d, eax
mov edx, 0x1d
lea rax, str.MwszStringAppend__ppmwszSelectedCriticalVolumes__wszWinReVolumeGuid__
jmp 0x1400e6e1c
call fcn.1400324a4
int3
mov rax, qword [section..data]
cmp rax, rbx
je 0x1400e70fd
test byte [rax + 0x1c], 2
je 0x1400e70fd
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r9d, eax
mov edx, 0x1e
lea r8, [0x14013da08]
mov rcx, qword [section..data]
mov rcx, qword [rcx + 0x10]
call fcn.1400e46a8
test r15d, r15d
jne 0x1400e7159
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
lea r9d, [r15 + 0xe]
cmp eax, r9d
jne 0x1400e7159
xor r14d, r14d
mov esi, r14d
mov edi, r9d
mov rcx, qword [section..data]
cmp rcx, rbx
je 0x1400e6b8f
test byte [rcx + 0x1c], 8
je 0x1400e6b8f
lea edx, [r15 + 0x1f]
lea rax, str.ERROR_OUTOFMEMORY
mov qword [rsp + 0x20], rax
lea r8, [0x14013da08]
mov rcx, qword [rcx + 0x10]
call fcn.1400e4514
jmp 0x1400e6b8f
mov r14, qword [rsp + 0x60]
mov r15d, dword [rsp + 0x58]
mov dword [rsp + 0x20], r15d
mov r9, qword [rsp + 0x68]
mov r8, r14
lea rcx, [rbp - 0x60]
call fcn.1400f0f80
xor ecx, ecx
test eax, eax
jne 0x1400e71bd
mov esi, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov rax, qword [section..data]
cmp rax, rbx
je 0x1400e6b8c
test byte [rax + 0x1c], 8
je 0x1400e6b8c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, 0x20
mov r9d, eax
lea rax, str.GetLastError__
jmp 0x1400e6e1c
lea rcx, [rsp + 0x50]
call fcn.1400f7238
xor ecx, ecx
test eax, eax
jne 0x1400e71fe
mov esi, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov rax, qword [section..data]
cmp rax, rbx
je 0x1400e6b8c
test byte [rax + 0x1c], 8
je 0x1400e6b8c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, 0x21
jmp 0x1400e71ae
mov dword [rsp + 0x20], r15d
mov r9, qword [rsp + 0x68]
mov r8, qword [r14]
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x78]
call fcn.1400e62fc
xor ecx, ecx
test eax, eax
jne 0x1400e725d
mov esi, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov rax, qword [section..data]
cmp rax, rbx
je 0x1400e6b8c
test byte [rax + 0x1c], 8
je 0x1400e6b8c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r9d, eax
mov edx, 0x22
lea rax, str.asr_ldm.InitializeForBackup__asr_sys__ppmwszSelectedCriticalVolumes__rgIncludedDisks__cIncludedDisks__
jmp 0x1400e6e1c
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x60]
call fcn.1400e7340
xor ecx, ecx
test eax, eax
jne 0x1400e72d5
mov esi, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov rax, qword [section..data]
cmp rax, rbx
je 0x1400e72c8
test byte [rax + 0x1c], 8
je 0x1400e72c8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r9d, eax
mov edx, 0x23
lea rax, str.GetLastError__
mov qword [rsp + 0x20], rax
lea r8, [0x14013da08]
mov rcx, qword [section..data]
mov rcx, qword [rcx + 0x10]
call fcn.1400e4514
mov rcx, qword [rsp + 0x48]
xor r14d, r14d
jmp 0x1400e6b94
call fcn.1400f3738
xor r14d, r14d
test eax, eax
jne 0x1400e7306
mov rcx, qword [section..data]
cmp rcx, rbx
je 0x1400e7306
test byte [rcx + 0x1c], 4
je 0x1400e7306
lea edx, [rax + 0x24]
lea r8, [0x14013da08]
mov rcx, qword [rcx + 0x10]
call fcn.1400e44f4
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rcx, r14
jmp 0x1400e6b94