Function at 0x1400c6af0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm7
movaps xmmword [rsp + 0x2c0], xmm6
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov r15, rcx
mov rax, qword [0x14026c040]
xor rax, rsp
mov qword [rsp + 0x2b8], rax
movaps xmm6, xmmword [0x14023d9f0]
lea rcx, [rsp + 0xb0]
movaps xmmword [rcx], xmm6
xor edx, edx
call fcn.1400da630
call qword [sym.imp.ole32.dll_CoImpersonateClient]
test eax, eax
js 0x1400c6cd0
mov edx, dword [rsp + 0x360]
lea r14, [rsp + 0x140]
mov rcx, r14
mov r8d, 0x40
call fcn.1401cb700
lea r12, [rsp + 0xb0]
mov rcx, r12
mov rdx, r14
call fcn.1400da6e0
mov rcx, r14
call fcn.1400da6b0
mov rcx, r12
call fcn.140132a10
test al, al
jne 0x1400c6d21
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1400c6bcf
movzx r14d, ax
or r14d, 0x80070000
test eax, eax
cmovle r14d, eax
call qword [sym.imp.ole32.dll_CoRevertToSelf]
test r14d, r14d
jns 0x1400c6d27
jmp 0x1400c6cd3
call qword [sym.imp.ole32.dll_CoRevertToSelf]
mov r14d, 0x80004005
jmp 0x1400c6cd3
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov r14d, 0x80004005
cmovne r14d, ecx
xor esi, esi
lea rcx, [rsp + 0x120]
call fcn.1400da6b0
lea rcx, [rsp + 0x140]
call fcn.1400de4e0
test r14d, r14d
js 0x1400c6c93
mov rbx, qword [rsp + 0x368]
lea rcx, [rsp + 0x90]
lea rdi, [rsp + 0x140]
mov rdx, rdi
call fcn.1401ccc50
mov rcx, rdi
call fcn.1400c7510
mov rcx, rdi
call fcn.14013e3c0
lea r15, [rsi + 1]
cmp r15, 2
jb 0x1400c6c5e
call fcn.14013e120
cmp qword [rbx], rsi
je 0x1400c6c91
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rbx]
inc rax
cmp rax, 2
jae 0x1400c74e1
cmp r15, 2
jb 0x1400c6c89
mov qword [rbx], rsi
call fcn.14013e120
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
lea rax, [rsi + 1]
cmp rax, 2
jb 0x1400c6caa
call fcn.14013e120
mov rcx, rsi
call fcn.140131ec0
lea rcx, [rsp + 0x40]
call fcn.1400e7380
lea rcx, [rsp + 0x270]
call fcn.14013e3c0
lea rcx, [rsp + 0x90]
call fcn.1401ccd40
jmp 0x1400c6cd3
mov r14d, eax
lea rcx, [rsp + 0xb0]
call fcn.1400da6b0
mov rcx, qword [rsp + 0x2b8]
xor rcx, rsp
cmp rcx, qword [0x14026c040]
je 0x1400c6cfa
call fcn.140169190
int3
mov eax, r14d
movaps xmm6, xmmword [rsp + 0x2c0]
movaps xmm7, xmmword [rsp + 0x2d0]
add rsp, 0x2e8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.ole32.dll_CoRevertToSelf]
mov r14, qword [rsp + 0x350]
movabs rbp, 0xaaaaaaaaaaaaaaaa
lea rcx, [rsp + 0x90]
mov qword [rcx + 0x10], rbp
movaps xmmword [rcx], xmm6
call fcn.1401ccc40
lea r12, [rsp + 0x120]
mov qword [r12 + 0x10], rbp
movaps xmmword [r12], xmm6
mov rcx, r12
call fcn.1401ccc40
mov rcx, r12
mov rdx, r14
call fcn.1401ccd80
test al, al
jne 0x1400c6dab
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r14d, ax
or r14d, 0x80070000
test eax, eax
cmovle r14d, eax
jne 0x1400c7253
lea rcx, [rsp + 0x120]
call fcn.1401ccd40
mov r14d, 0x80004005
jmp 0x1400c6cc1
lea r14, [rsp + 0x100]
mov qword [r14 + 0x10], rbp
movaps xmmword [r14], xmm6
lea rcx, [rsp + 0x120]
call fcn.1401a3930
lea rcx, str.ChromeRecoveryCRX.crx
lea r8, [rsp + 0xf0]
mov qword [r8], rcx
mov qword [r8 + 8], 0x15
mov rcx, rax
mov rdx, r14
call fcn.14013ef30
lea rcx, [rsp + 0xd8]
mov rdx, r15
call fcn.14013e240
lea rcx, [rsp + 0x140]
movaps xmmword [rcx + 0x20], xmm6
movaps xmmword [rcx + 0x10], xmm6
movaps xmmword [rcx], xmm6
call fcn.1400e56d0
call qword [sym.imp.ole32.dll_CoImpersonateClient]
test eax, eax
js 0x1400c700b
lea r14, [rsp + 0x140]
lea rdx, [rsp + 0xd8]
mov rcx, r14
mov r8d, 0x80021
call fcn.1400e5760
mov rcx, r14
call fcn.140132ac0
test al, al
je 0x1400c6e96
lea rcx, [rsp + 0x140]
call fcn.1400d7770
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov r14d, 0x80070057
cmp eax, 1
jne 0x1400c6f97
lea rcx, [rsp + 0x140]
call fcn.1400db9e0
dec rax
cmp rax, 0x98967e
ja 0x1400c6f97
call qword [sym.imp.ole32.dll_CoRevertToSelf]
jmp 0x1400c6ec4
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1400c6f91
movzx r14d, ax
or r14d, 0x80070000
test eax, eax
cmovle r14d, eax
call qword [sym.imp.ole32.dll_CoRevertToSelf]
test r14d, r14d
js 0x1400c700e
lea r14, [rsp + 0x270]
movaps xmmword [r14 + 0x20], xmm6
movaps xmmword [r14 + 0x10], xmm6
movaps xmmword [r14], xmm6
mov rcx, r14
call fcn.1400e56d0
lea rdx, [rsp + 0x100]
mov rcx, r14
mov r8d, 0x80048
call fcn.1400e5760
mov rcx, r14
call fcn.140132ac0
test al, al
je 0x1400c6fde
mov ecx, 0x10000
call fcn.140167c6c
mov r15, rax
neg rax
xor ecx, ecx
cmp rax, rcx
je 0x1400c719d
mov byte [r15 + rcx], 0
inc rcx
cmp rcx, 0x10000
jne 0x1400c6f1a
xor r13d, r13d
lea r14, [rsp + 0x140]
lea r12, [rsp + 0x270]
mov rcx, r14
mov rdx, r15
mov r8d, 0x10000
call fcn.140132c10
test eax, eax
js 0x1400c6fa7
je 0x1400c6f8c
mov ebp, eax
mov eax, eax
add r13, rax
cmp r13, 0x989680
ja 0x1400c6f9f
mov rcx, r12
mov rdx, r15
mov r8d, ebp
call fcn.1400db8a0
test eax, eax
js 0x1400c6fa7
cmp eax, ebp
je 0x1400c6f47
mov r14d, 0x8000ffff
jmp 0x1400c6fc5
xor r14d, r14d
jmp 0x1400c6fc5
mov r14d, 0x80004005
call qword [sym.imp.ole32.dll_CoRevertToSelf]
jmp 0x1400c700e
mov r14d, 0x80070057
jmp 0x1400c6fc5
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov r14d, 0x80004005
cmovne r14d, ecx
test r15, r15
movabs rbp, 0xaaaaaaaaaaaaaaaa
je 0x1400c6ffc
mov rcx, r15
call fcn.140167ca8
jmp 0x1400c6ffc
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov r14d, 0x80004005
cmovne r14d, ecx
lea rcx, [rsp + 0x270]
call fcn.14013f920
jmp 0x1400c700e
mov r14d, eax
lea rcx, [rsp + 0x140]
call fcn.14013f920
lea rcx, [rsp + 0xd8]
call fcn.14013e3c0
test r14d, r14d
js 0x1400c7246
xorps xmm0, xmm0
movaps xmmword [rsp + 0x270], xmm0
xor r14d, r14d
mov qword [rsp + 0x280], r14
mov qword [rsp + 0x150], r14
movaps xmmword [rsp + 0x140], xmm0
mov qword [rsp + 0x2b0], r14
movaps xmmword [rsp + 0x2a0], xmm0
mov r15, qword [rbx]
mov r12, qword [rbx + 8]
mov ebx, 0
sub r12, r15
je 0x1400c70b3
js 0x1400c74fa
mov rcx, r12
call fcn.140167c6c
mov r14, rax
mov qword [rsp + 0x2a0], rax
lea rbx, [rax + r12]
mov qword [rsp + 0x2b0], rbx
mov rcx, rax
mov rdx, r15
mov r8, r12
call fcn.1401a2ec0
mov qword [rsp + reloc.SHELL32.dll_IsUserAnAdmin], rbx
mov ecx, 0x18
call fcn.140167c6c
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], rax
lea r12, [rax + 0x18]
mov qword [rsp + 0xd0], r12
test rax, rax
je 0x1400c719d
mov r15, rax
xorps xmm7, xmm7
movups xmmword [rax], xmm7
mov qword [rax + 0x10], 0
sub rbx, r14
je 0x1400c7127
js 0x1400c7507
mov rcx, rbx
call fcn.140167c6c
mov qword [r15], rax
mov qword [r15 + 8], rax
lea r13, [rax + rbx]
mov qword [r15 + 0x10], r13
mov rcx, rax
mov rdx, r14
mov r8, rbx
call fcn.1401a2ec0
mov qword [r15 + 8], r13
lea rbx, [rsp + 0xc0]
mov qword [rbx + 8], r12
movups xmmword [rsp + 0x28], xmm7
lea rax, [rsp + 0x270]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x100]
lea r9, [rsp + 0x140]
mov rdx, rdi
mov r8, rbx
call fcn.1400eb580
mov edi, eax
mov rbx, qword [rbx]
test rbx, rbx
je 0x1400c71c9
mov r14, qword [rsp + 0xc8]
mov rcx, rbx
cmp rbx, r14
je 0x1400c71bc
add r14, 0xffffffffffffffe8
test r14, r14
je 0x1400c719d
mov rcx, qword [r14]
test rcx, rcx
je 0x1400c71a8
mov rax, qword [r14 + 8]
mov rdx, rax
sub rdx, rcx
dec rax
cmp rdx, rax
jbe 0x1400c719f
ud2
mov qword [r14 + 8], rcx
call fcn.140167ca8
lea rax, [r14 - 0x18]
cmp r14, rbx
mov r14, rax
jne 0x1400c717e
mov rcx, qword [rsp + 0xc0]
mov qword [rsp + 0xc8], rbx
call fcn.140167ca8
mov rcx, qword [rsp + 0x2a0]
test rcx, rcx
je 0x1400c71f1
mov rax, qword [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
mov rdx, rax
sub rdx, rcx
dec rax
cmp rdx, rax
ja 0x1400c719d
call fcn.140167ca8
mov rcx, qword [rsp + 0x140]
test rcx, rcx
je 0x1400c7221
mov rax, qword [rsp + 0x148]
mov rdx, rax
sub rdx, rcx
dec rax
cmp rdx, rax
ja 0x1400c719d
mov qword [rsp + 0x148], rcx
call fcn.140167ca8
mov r14d, 0x80092009
test edi, edi
je 0x1400c73bf
cmp byte [rsp + 0x287], 0
jns 0x1400c7246
mov rcx, qword [rsp + 0x270]
call fcn.140167ca8
lea rcx, [rsp + 0x100]
call fcn.14013e3c0
lea rcx, [rsp + 0x120]
call fcn.1401ccd40
test r14d, r14d
js 0x1400c6cc1
mov rdi, qword [rsp + 0x358]
lea rbx, [rsp + 0x270]
mov qword [rbx + 0x10], rbp
movaps xmmword [rbx], xmm6
lea rcx, [rsp + 0x90]
call fcn.1401a3930
mov rcx, rax
mov rdx, rbx
mov r8, rdi
call fcn.1400e5230
lea rdi, [rsp + 0x40]
movaps xmmword [rdi + 0x40], xmm6
movaps xmmword [rdi + 0x30], xmm6
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
movaps xmmword [rdi], xmm6
mov rcx, rdi
mov rdx, rbx
call fcn.1400e6e70
xor ebp, ebp
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
call fcn.1401d1840
lea rsi, [rsp + 0x140]
mov r8d, 0x98
mov rcx, rsi
mov dl, 0xaa
call fcn.1401a3560
mov rcx, rsi
call fcn.1400de470
mov byte [rsi + 0x22], 1
lea rcx, [rsp + 0x148]
call fcn.1400dc680
lea rbx, [rsp + 0x120]
movaps xmmword [rbx], xmm6
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.1400da850
mov rcx, rbx
call fcn.140132a10
test al, al
je 0x1400c6be0
lea rsi, [rsp + 0x100]
mov qword [rsi], 0
lea rcx, [rsp + 0xb0]
call fcn.140132a30
mov rdi, rax
lea rcx, [rsp + 0x120]
call fcn.140132a30
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 0x101000
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x1400c6be0
mov rsi, qword [rsp + 0x100]
test rsi, rsi
je 0x1400c74d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
xor r14d, r14d
cmp rsi, 0xffffffffffffffff
je 0x1400c74da
call fcn.14013e120
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400c6c00
xorps xmm0, xmm0
lea rdi, [rsp + 0x40]
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
mov byte [rdi + 0x40], 0
lea rcx, [rsp + 0x120]
call fcn.1401a3930
lea rcx, [rsp + 0x100]
mov rdx, rax
mov r8, rdi
call fcn.1401d3180
mov r14d, 0x8000ffff
test al, al
je 0x1400c722f
mov ecx, 1
call fcn.14013ddf0
test al, al
je 0x1400c7452
lea rcx, [rsp + 0x100]
call fcn.1400dc0c0
test al, al
jne 0x1400c7452
lea rdx, str.....chromeelevation_serviceelevated_recovery_impl.cc
lea rdi, [rsp + 0x140]
mov rcx, rdi
mov r8d, 0xbc
mov r9d, 1
call fcn.1400e3120
mov rcx, rdi
call fcn.1400e3710
mov ecx, 1
call fcn.14013ddf0
xor r14d, r14d
test al, al
je 0x1400c722f
lea rcx, [rsp + 0x120]
lea rdi, [rsp + 0xc0]
mov rdx, rdi
call fcn.1401ccc50
lea rcx, [rsp + 0x90]
mov rdx, rdi
call fcn.1401cce00
test al, al
jne 0x1400c74be
lea rdx, str.....chromeelevation_serviceelevated_recovery_impl.cc
lea rdi, [rsp + 0x140]
mov rcx, rdi
mov r8d, 0xbe
mov r9d, 1
call fcn.1400e3120
mov rcx, rdi
call fcn.1400e3710
lea rcx, [rsp + 0xc0]
call fcn.14013e3c0
jmp 0x1400c722f
xor esi, esi
xor r14d, r14d
jmp 0x1400c6c00
xor esi, esi
jmp 0x1400c73b2
call fcn.14013e120
mov rcx, qword [rbx]
call fcn.140131ec0
mov qword [rbx], 0
jmp 0x1400c6c7b
lea rcx, [rsp + 0x2a0]
call fcn.1401a42e0
mov rcx, r15
call fcn.1401a42e0
int3