Function at 0x14008c580
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2c8]
sub rsp, 0x3a0
mov rax, qword [0x140477ad0]
xor rax, rsp
mov qword [rbp + 0x290], rax
mov rsi, rcx
lea rdx, [0x1403604e0]
lea rcx, [rbp + 0x150]
call fcn.14008e2a0
lea r13, vtable.sense::CommonTelemetry::ExtractFilesFromCommandLineActionActivity.0
mov qword [rbp + 0x150], r13
lea rcx, [rbp + 0x150]
call fcn.14008cb7c
nop
call fcn.1400a4e1c
mov r8, rax
lea rbx, [rsi + 0x50]
cmp dword [rax], 5
jbe 0x14008c680
mov cl, byte [rsi + 0x7a]
mov byte [rsp + 0x50], cl
mov cl, byte [rsi + 0x79]
mov byte [rsp + 0x51], cl
mov cl, byte [rsi + 0x78]
mov byte [rsp + 0x52], cl
mov rcx, qword [rsi + 0x70]
mov qword [rbp - 0x70], rcx
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x14008c627
mov rax, qword [rbx]
mov qword [rbp - 0x80], rax
lea rax, str.ExtractFilesFromCommandLineAction::Execute_is_called
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x51]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x52]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea rdx, [0x1403ed768]
mov rcx, r8
call fcn.140007084
lea rdx, [0x140360510]
lea rcx, [rbp + 0x10]
call fcn.14008e2a0
lea rax, vtable.sense::CommonTelemetry::GetFileNamesFromCommandLineActivity.0
mov qword [rbp + 0x10], rax
lea rcx, [rbp + 0x10]
call fcn.14008cc00
nop
mov r8b, byte [rsi + 0x7a]
mov rdx, rbx
lea rcx, [rbp - 0x30]
call fcn.14008d55c
nop
xor edx, edx
lea rcx, [rbp + 0x10]
call fcn.14008e194
call fcn.1400af90c
lea rdx, [rbp - 0x50]
mov rcx, rax
call fcn.14008e37c
nop
mov rbx, qword [rbp - 0x50]
test rbx, rbx
jne 0x14008c6e1
call fcn.14007ec1c
mov rcx, qword [rbp + 0x2c8]
test rbx, rbx
jne 0x14008c703
mov r9d, 0x80004003
lea r8, str.amcorewcd_source_behaviormonitor_srcextractfilesfromcommandlineaction.cpp
lea edx, [rbx + 0x54]
call fcn.14010271c
int3
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
xor edi, edi
mov qword [rsp + 0x78], rdi
mov r12, qword [rbp - 0x28]
mov rdx, r12
mov r14, qword [rbp - 0x30]
sub rdx, r14
sar rdx, 5
test rdx, rdx
je 0x14008c75c
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jbe 0x14008c74d
lea rcx, str.vector_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
nop dword [rax + rax]
int3
lea rcx, [rsp + 0x68]
call fcn.140203e34
mov rdi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
cmp r14, r12
je 0x14008c8c6
lea rax, [rsi + 0x70]
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1402039a8
nop
mov rcx, r14
call fcn.1400cf444
test al, al
jne 0x14008c7a9
mov rcx, r14
cmp qword [r14 + 0x18], 8
jb 0x14008c794
mov rcx, qword [r14]
call qword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathFileExistsW]
nop dword [rax + rax]
test eax, eax
je 0x14008c7a9
mov r15b, 1
jmp 0x14008c7ac
xor r15b, r15b
mov r13, qword [rbp - 0x80]
test r15b, r15b
je 0x14008c84b
mov rdx, r14
lea rcx, [rbp - 0x18]
call fcn.1400a68d8
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x60], xmm0
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x40]
call fcn.1400713d4
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x38], 0
mov byte [rsp + 0x30], 0
lea rcx, [rbp - 0x60]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x58]
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x70]
call fcn.1400a9070
mov rax, qword [rbp - 0x70]
test byte [rax + 0x120], 0x10
je 0x14008c822
xor r15b, r15b
jmp 0x14008c82f
lea rcx, [r13 + 0x70]
lea rdx, [rbp - 0x70]
call fcn.14006ffbc
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x14008c83d
call fcn.14007e8c0
lea rcx, [rbp - 0x18]
call fcn.14007a7c0
test r15b, r15b
jne 0x14008c870
mov dword [r13 + 0x80], 2
lea rcx, [r13 + 0x88]
mov rdx, r14
call fcn.14007da00
test r15b, r15b
jne 0x14008c870
cmp byte [rsi + 0x79], r15b
je 0x14008c8a0
lea r8, [rbp - 0x80]
mov rdx, rbx
cmp rdi, rbx
je 0x14008c88c
call fcn.140090acc
add rbx, 0x10
mov qword [rsp + 0x70], rbx
jmp 0x14008c8a0
lea rcx, [rsp + 0x68]
call fcn.14009092c
mov rdi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x14008c8ae
call fcn.14007e8c0
add r14, 0x20
cmp r14, r12
lea rax, [rsi + 0x70]
jne 0x14008c76e
lea r13, vtable.sense::CommonTelemetry::ExtractFilesFromCommandLineActionActivity.0
mov r14, qword [rsp + 0x68]
cmp r14, rbx
jne 0x14008c939
cmp byte [rsi + 0x78], 0
je 0x14008c939
lea rdx, [rsi + 0x70]
lea rcx, [rsp + 0x58]
call fcn.1402039a8
nop
mov rax, qword [rsp + 0x58]
mov dword [rax + 0x80], SafeArrayLock
lea r8, [rsp + 0x58]
mov rdx, rbx
cmp rdi, rbx
je 0x14008c911
call fcn.140090acc
add rbx, 0x10
mov qword [rsp + 0x70], rbx
jmp 0x14008c92a
lea rcx, [rsp + 0x68]
call fcn.14009092c
mov rdi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14008c939
call fcn.14007e8c0
call fcn.1400af90c
lea rdx, [rbp - 0x60]
mov rcx, rax
call fcn.14008cf48
nop
mov r12, qword [rbp - 0x60]
test r12, r12
jne 0x14008c959
call fcn.14007ec1c
mov r15, r14
cmp r14, rbx
je 0x14008c9d1
lea r8, [rsi + 8]
mov rdx, r15
lea rcx, [rbp - 0x40]
call fcn.1401f4a68
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
mov rcx, qword [rax]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rax + 8]
mov qword [rsp + 0x60], rcx
and qword [rax], 0
and qword [rax + 8], 0
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x14008c9a2
call fcn.14007e8c0
mov rax, qword [r12]
lea rdx, [rsp + 0x58]
mov rcx, r12
mov rax, qword [rax + 0x28]
call qword [case.0x1401147b6.0]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14008c9c8
call fcn.14007e8c0
add r15, 0x10
cmp r15, rbx
jne 0x14008c961
xor edx, edx
lea rcx, [rbp + 0x150]
call fcn.14008e194
nop
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x14008c9ef
call fcn.14007e8c0
nop
test r14, r14
je 0x14008ca12
mov rdx, rbx
mov rcx, r14
call fcn.140075704
sub rdi, r14
and rdi, 0xfffffffffffffff0
mov rdx, rdi
mov rcx, r14
call fcn.14007ebd0
nop
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x14008ca21
call fcn.14007e8c0
nop
lea rcx, [rbp - 0x30]
call fcn.1400a3dbc
nop
lea rax, vtable.sense::CommonTelemetry::GetFileNamesFromCommandLineActivity.0
mov qword [rbp + 0x10], rax
lea rcx, [rbp + 0x10]
call fcn.14008cadc
lea rcx, [rbp + 0x140]
call fcn.14008e13c
lea rcx, [rbp + 0x48]
call fcn.14008e348
cmp dword [rbp + 0x30], 0
je 0x14008ca64
lea rcx, [rbp + 0x18]
call fcn.140105678
nop
mov qword [rbp + 0x150], r13
lea rcx, [rbp + 0x150]
call fcn.14008cadc
lea rcx, [rbp + 0x280]
call fcn.14008e13c
lea rcx, [rbp + 0x188]
call fcn.14008e348
cmp dword [rbp + 0x170], 0
je 0x14008caa4
lea rcx, [rbp + 0x158]
call fcn.140105678
mov rcx, qword [rbp + 0x290]
xor rcx, rsp
call fcn.140123570
lea r11, [rsp + 0x3a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret