Function at 0x14001b460
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x3a8
movaps xmmword [rsp + 0x390], xmm7
movaps xmmword [rsp + 0x380], xmm6
mov r12, r9
mov rbp, r8
mov rbx, rdx
mov r15, rcx
mov r13, qword [rsp + 0x418]
mov rax, qword [0x14015e028]
xor rax, rsp
mov qword [rsp + 0x378], rax
movzx eax, byte [rcx + 0x17]
test al, al
jns 0x14001b4b5
mov rax, qword [r15 + 8]
mov edi, 0x80070057
test r13, r13
je 0x14001ba6b
mov r14d, dword [rsp + 0x410]
test r14d, r14d
je 0x14001ba6b
test rax, rax
je 0x14001ba6b
movzx eax, byte [rbx + 0x17]
mov rcx, rax
test al, al
jns 0x14001b4ec
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14001b51c
xorps xmm0, xmm0
movaps xmmword [rsp + 0x220], xmm0
mov rcx, rbx
test al, al
jns 0x14001b506
mov rcx, qword [rbx]
lea rdx, [rsp + 0x220]
call qword [sym.imp.ole32.dll_IIDFromString]
test eax, eax
js 0x14001ba69
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x220]
mov qword [rdi + 0x10], rax
movaps xmm6, xmmword [0x1401399e0]
movaps xmmword [rdi], xmm6
movzx eax, byte [rbp + 0x17]
test al, al
mov rcx, qword [rbp]
cmovns rcx, rbp
lea rdx, [rsp + 0x1b0]
mov qword [rdx], rcx
cmovs rax, qword [rbp + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x1d0]
mov rcx, rsi
call fcn.14002d190
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0xd0]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
mov rcx, rdi
call fcn.14002d230
cmp byte [rsi + 0x17], 0
jns 0x14001b5aa
mov rcx, qword [rsp + 0x1d0]
call fcn.14009c364
lea rcx, [rsp + 0x220]
call fcn.14002d590
mov edi, 0x80070057
test al, al
je 0x14001b5ea
xorps xmm0, xmm0
movaps xmmword [rsp + 0x1d0], xmm0
cmp byte [r12 + 0x17], 0
mov rcx, r12
jns 0x14001b5da
mov rcx, qword [r12]
lea rdx, [rsp + 0x1d0]
call qword [sym.imp.ole32.dll_IIDFromString]
mov edi, eax
lea rcx, [rsp + 0x220]
call fcn.14002d210
test edi, edi
js 0x14001ba6b
lea rcx, [rsp + 0xd0]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rcx + 0x40], rax
movaps xmmword [rcx + 0x30], xmm6
movaps xmmword [rcx + 0x20], xmm6
movaps xmmword [rcx + 0x10], xmm6
movaps xmmword [rcx], xmm6
xor edx, edx
call fcn.140027cb0
movzx ecx, byte [rbx + 0x17]
mov rax, rcx
test cl, cl
jns 0x14001b63a
mov rax, qword [rbx + 8]
test rax, rax
je 0x14001b692
test cl, cl
jns 0x14001b646
mov rbx, qword [rbx]
lea rsi, [rsp + 0xc0]
mov qword [rsi], rbx
mov qword [rsi + 8], rax
lea rdx, str.appguid
lea rdi, [rsp + 0x220]
mov rcx, rdi
call fcn.1400cd630
lea rcx, [rsp + 0xd0]
mov rdx, rdi
mov r8, rsi
call fcn.140028a80
cmp byte [rdi + 0x17], 0
jns 0x14001b692
mov rcx, qword [rsp + 0x220]
call fcn.14009c364
movzx eax, byte [rbp + 0x17]
test al, al
mov rcx, qword [rbp]
cmovns rcx, rbp
lea rsi, [rsp + 0xb0]
mov qword [rsi], rcx
cmovs rax, qword [rbp + 8]
mov qword [rsi + 8], rax
lea rdx, str.browser_version
lea rdi, [rsp + 0x220]
mov rcx, rdi
call fcn.1400cd630
lea rcx, [rsp + 0xd0]
mov rdx, rdi
mov r8, rsi
call fcn.140028a80
cmp byte [rdi + 0x17], 0
jns 0x14001b6f1
mov rcx, qword [rsp + 0x220]
call fcn.14009c364
movzx eax, byte [r12 + 0x17]
test al, al
mov rcx, qword [r12]
cmovns rcx, r12
lea rsi, [rsp + 0xa0]
mov qword [rsi], rcx
cmovs rax, qword [r12 + 8]
mov qword [rsi + 8], rax
lea rdx, str.sessionid
lea rdi, [rsp + 0x220]
mov rcx, rdi
call fcn.1400cd630
lea rcx, [rsp + 0xd0]
mov rdx, rdi
mov r8, rsi
call fcn.140028a80
cmp byte [rdi + 0x17], 0
movabs rbp, 0xaaaaaaaaaaaaaaaa
jns 0x14001b75d
mov rcx, qword [rsp + 0x220]
call fcn.14009c364
lea rdx, str.system
lea rsi, [rsp + 0x220]
mov rcx, rsi
call fcn.1400cd630
lea rcx, [rsp + 0xd0]
mov rdx, rsi
call fcn.140028a20
cmp byte [rsi + 0x17], 0
jns 0x14001b797
mov rcx, qword [rsp + 0x220]
call fcn.14009c364
lea rsi, [rsp + 0x80]
mov qword [rsi + 0x10], rbp
movaps xmmword [rsi], xmm6
mov rcx, rsi
call fcn.14006e1a0
mov rcx, rsi
call fcn.14001b330
test eax, eax
js 0x14001baa1
lea rax, str.ChromeRecovery.exe
lea rdx, [rsp + 0x58]
mov qword [rdx], rax
mov qword [rdx + 8], 0x12
lea rcx, [rsp + 0x68]
call fcn.14006e220
mov ecx, 0x20
call fcn.14009c328
mov r12, rax
mov qword [rsp + 0x38], rax
add rax, 0x20
mov qword [rsp + 0x48], rax
movups xmm0, xmmword [0x14013d59e]
movups xmmword [r12], xmm0
movups xmm0, xmmword [0x14013d5ae]
movups xmmword [r12 + 0x10], xmm0
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x54], 2
lea rcx, [rsp + 0x140]
movaps xmmword [rcx], xmm6
xor edi, edi
xor edx, edx
call fcn.140071970
call qword [sym.imp.ole32.dll_CoImpersonateClient]
test eax, eax
js 0x14001baa8
lea rsi, [rsp + 0x1d0]
mov qword [rsi], rbp
mov ecx, 0x28
call fcn.14009c328
mov rbx, rax
lea rdx, [0x14001c440]
lea r8, [0x14001c450]
mov rcx, rax
call fcn.14006d760
lea rdx, [rsp + 0x1b0]
mov qword [rdx], rbx
mov rcx, rsi
call fcn.14006d6d0
lea rsi, [rsp + 0x220]
mov rcx, rsi
mov edx, r14d
mov r8d, 0x40
call fcn.1400ec550
lea rbx, [rsp + 0x140]
mov rcx, rbx
mov rdx, rsi
call fcn.140071a20
mov rcx, rsi
call fcn.1400719f0
mov rcx, rbx
call fcn.140071ad0
test al, al
jne 0x14001b8df
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov edi, 0x80004005
cmovne edi, ecx
lea r14, [rsp + 0x1d0]
mov rcx, r14
call fcn.14006d700
test edi, edi
js 0x14001c1e2
lea rcx, [rsp + 0x120]
mov qword [rcx + 0x10], rbp
movaps xmmword [rcx], xmm6
call fcn.1400ea610
lea rsi, [rsp + 0x1b0]
mov qword [rsi + 0x10], rbp
movaps xmmword [rsi], xmm6
mov rcx, rsi
call fcn.1400ea610
lea rdx, [rsp + 0x80]
mov rcx, rsi
call fcn.1400ea730
test al, al
je 0x14001baaf
lea rsi, [rsp + 0x190]
mov qword [rsi + 0x10], rbp
movaps xmmword [rsi], xmm6
lea rcx, [rsp + 0x1b0]
call fcn.1400c7fe0
lea rcx, str.ChromeRecoveryCRX.crx
lea r8, [rsp + 0x180]
mov qword [r8], rcx
mov qword [r8 + 8], 0x15
mov rcx, rax
mov rdx, rsi
call fcn.14006ece0
lea rcx, [rsp + 0x168]
mov rdx, r15
call fcn.14006e1c0
lea rcx, [rsp + 0x220]
movaps xmmword [rcx + 0x20], xmm6
movaps xmmword [rcx + 0x10], xmm6
movaps xmmword [rcx], xmm6
call fcn.14002ace0
call qword [sym.imp.ole32.dll_CoImpersonateClient]
test eax, eax
js 0x14001bad0
lea rsi, [rsp + 0x1d0]
mov qword [rsi], rbp
mov ecx, 0x28
call fcn.14009c328
mov rdi, rax
lea rdx, [0x14001c440]
lea r8, [0x14001c450]
mov rcx, rax
call fcn.14006d760
lea rdx, [rsp + 0x150]
mov qword [rdx], rdi
mov rcx, rsi
call fcn.14006d6d0
lea rsi, [rsp + 0x220]
lea rdx, [rsp + 0x168]
mov rcx, rsi
mov r8d, 0x80021
call fcn.14002ad70
mov rcx, rsi
call fcn.140071850
test al, al
je 0x14001bad7
lea rcx, [rsp + 0x220]
call fcn.14002e020
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov edi, 0x80070057
cmp eax, 1
jne 0x14001baf3
lea rcx, [rsp + 0x220]
call fcn.14002e2a0
dec rax
xor ecx, ecx
cmp rax, 0x98967f
mov edi, 0x80070057
cmovb edi, ecx
jmp 0x14001baf3
mov edi, eax
mov rcx, qword [rsp + 0x378]
xor rcx, rsp
call fcn.14009d180
mov eax, edi
movaps xmm6, xmmword [rsp + 0x380]
movaps xmm7, xmmword [rsp + 0x390]
add rsp, 0x3a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov edi, eax
jmp 0x14001c206
mov edi, eax
jmp 0x14001c1e2
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov edi, 0x80004005
cmovne edi, ecx
jmp 0x14001bf94
mov edi, eax
jmp 0x14001bc38
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov edi, 0x80004005
cmovne edi, ecx
lea rcx, [rsp + 0x1d0]
call fcn.14006d700
test edi, edi
js 0x14001bc38
lea rsi, [rsp + 0x1d0]
movaps xmmword [rsi + 0x20], xmm6
movaps xmmword [rsi + 0x10], xmm6
movaps xmmword [rsi], xmm6
mov rcx, rsi
call fcn.14002ace0
lea rdx, [rsp + 0x190]
mov rcx, rsi
mov r8d, 0x80048
call fcn.14002ad70
mov rcx, rsi
call fcn.140071850
test al, al
je 0x14001bbcc
mov esi, 0x10000
mov ecx, 0x10000
call fcn.14009c328
mov rbx, rax
mov r8d, 0x10000
mov rcx, rax
xor edx, edx
call fcn.14009fa40
dec rsi
jne 0x14001bb6b
xor r14d, r14d
lea rsi, [rsp + 0x220]
lea r15, [rsp + 0x1d0]
mov rcx, rsi
mov rdx, rbx
mov r8d, 0x10000
call fcn.14002e030
test eax, eax
js 0x14001bbea
mov ebp, eax
test eax, eax
je 0x14001bc08
mov eax, ebp
add r14, rax
cmp r14, 0x989680
ja 0x14001bc0c
mov rcx, r15
mov rdx, rbx
mov r8d, ebp
call fcn.14002e170
test eax, eax
js 0x14001bbea
cmp eax, ebp
mov eax, 0x8000ffff
cmovne edi, eax
je 0x14001bb83
jmp 0x14001bc11
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov edi, 0x80004005
cmovne edi, ecx
jmp 0x14001bc2b
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov edi, 0x80004005
cmovne edi, ecx
jmp 0x14001bc11
xor edi, edi
jmp 0x14001bc11
mov edi, 0x80070057
mov rcx, rbx
call fcn.14009c364
movabs rbp, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x1d0]
lea rcx, [rsp + 0x1d0]
call fcn.14006e150
lea rcx, [rsp + 0x220]
call fcn.14006e150
lea rcx, [rsp + 0x168]
call fcn.14006e320
test edi, edi
js 0x14001bf87
xorps xmm7, xmm7
movaps xmmword [rsp + 0x1d0], xmm7
xor edi, edi
mov qword [rsp + 0x1e0], rdi
mov qword [rsp + 0x230], rdi
movaps xmmword [rsp + 0x220], xmm7
mov qword [rsp + 0x370], rdi
movaps xmmword [rsp + 0x360], xmm7
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov ebx, 0
sub rsi, rbp
je 0x14001bce9
test rsi, rsi
js 0x14001c250
mov rcx, rsi
call fcn.14009c328
mov rdi, rax
mov qword [rsp + 0x368], rax
mov qword [rsp + 0x360], rax
lea rbx, [rax + rsi]
mov qword [rsp + 0x370], rbx
mov rcx, rax
mov rdx, rbp
mov r8, rsi
call fcn.14009f630
mov qword [rsp + 0x368], rbx
mov r15, r14
mov ecx, 0x18
call fcn.14009c328
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x150], rax
lea r14, [rax + 0x18]
mov qword [rsp + 0x160], r14
movups xmmword [rax], xmm7
mov qword [rax + 0x10], 0
sub rbx, rdi
je 0x14001bd54
mov rbp, rax
test rbx, rbx
js 0x14001c25d
mov rcx, rbx
call fcn.14009c328
mov qword [rbp], rax
lea rsi, [rax + rbx]
mov qword [rbp + 0x10], rsi
mov rcx, rax
mov rdx, rdi
mov r8, rbx
call fcn.14009f630
mov qword [rbp + 8], rsi
lea rdi, [rsp + 0x150]
mov qword [rdi + 8], r14
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], r15
lea rcx, [rsp + 0x190]
lea rdx, [rsp + 0x54]
lea r9, [rsp + 0x220]
mov r8, rdi
call fcn.140031170
mov ebx, eax
mov rsi, qword [rdi]
test rsi, rsi
movabs rbp, 0xaaaaaaaaaaaaaaaa
je 0x14001be47
mov rdi, qword [rsp + 0x158]
cmp rdi, rsi
je 0x14001be37
lea rbp, [rdi - 0x18]
mov rcx, qword [rdi - 0x18]
test rcx, rcx
je 0x14001bdc9
mov qword [rdi - 0x10], rcx
call fcn.14009c364
cmp rbp, rsi
je 0x14001be23
lea rbp, [rdi - 0x30]
mov rcx, qword [rdi - 0x30]
test rcx, rcx
je 0x14001bde4
mov qword [rdi - 0x28], rcx
call fcn.14009c364
cmp rbp, rsi
je 0x14001be23
lea rbp, [rdi - 0x48]
mov rcx, qword [rdi - 0x48]
test rcx, rcx
je 0x14001bdff
mov qword [rdi - 0x40], rcx
call fcn.14009c364
cmp rbp, rsi
je 0x14001be23
lea rbp, [rsi + 0x48]
mov rcx, qword [rdi - 0x60]
test rcx, rcx
je 0x14001be1a
mov qword [rdi - 0x58], rcx
call fcn.14009c364
add rdi, 0xffffffffffffffe8
cmp rbp, rdi
jne 0x14001be08
mov rcx, qword [rsp + 0x150]
movabs rbp, 0xaaaaaaaaaaaaaaaa
jmp 0x14001be3a
mov rcx, rsi
mov qword [rsp + 0x158], rsi
call fcn.14009c364
mov rcx, qword [rsp + 0x360]
test rcx, rcx
je 0x14001be61
mov qword [rsp + 0x368], rcx
call fcn.14009c364
mov rcx, qword [rsp + 0x220]
test rcx, rcx
je 0x14001be7b
mov qword [rsp + 0x228], rcx
call fcn.14009c364
mov edi, 0x80092009
test ebx, ebx
jne 0x14001bf70
lea rcx, [rsp + 0x1b0]
call fcn.1400c7fe0
lea rcx, [rsp + 0x190]
mov rdx, rax
call fcn.1400ed440
mov edi, 0x8000ffff
test al, al
je 0x14001bf70
mov ecx, 1
call fcn.14006fcf0
test al, al
je 0x14001befc
lea rcx, [rsp + 0x190]
call fcn.14002d6a0
test al, al
jne 0x14001befc
lea rdx, str..._.._chrome_elevation_service_elevated_recovery_impl.cc
lea rsi, [rsp + 0x220]
mov rcx, rsi
mov r8d, 0xbe
mov r9d, 1
call fcn.14002b550
mov rcx, rsi
call fcn.14002b9f0
mov ecx, 1
call fcn.14006fcf0
xor edi, edi
test al, al
je 0x14001bf70
lea rcx, [rsp + 0x1b0]
lea rsi, [rsp + 0x150]
mov rdx, rsi
call fcn.1400ea620
lea rcx, [rsp + 0x120]
mov rdx, rsi
call fcn.1400ea7e0
test al, al
jne 0x14001bf63
lea rdx, str..._.._chrome_elevation_service_elevated_recovery_impl.cc
lea rsi, [rsp + 0x220]
mov rcx, rsi
mov r8d, 0xc0
mov r9d, 1
call fcn.14002b550
mov rcx, rsi
call fcn.14002b9f0
lea rcx, [rsp + 0x150]
call fcn.14006e320
cmp byte [rsp + 0x1e7], 0
jns 0x14001bf87
mov rcx, qword [rsp + 0x1d0]
call fcn.14009c364
lea rcx, [rsp + 0x190]
call fcn.14006e320
lea rcx, [rsp + 0x1b0]
call fcn.1400ea700
test edi, edi
js 0x14001c1d5
lea rsi, [rsp + 0x1b0]
mov qword [rsi + 0x10], rbp
movaps xmmword [rsi], xmm6
lea rcx, [rsp + 0x120]
call fcn.1400c7fe0
lea r8, [rsp + 0x68]
mov rcx, rax
mov rdx, rsi
call fcn.14002ae90
lea rdi, [rsp + 0x1d0]
mov qword [rdi + 0x40], rbp
movaps xmmword [rdi + 0x30], xmm6
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
movaps xmmword [rdi], xmm6
mov rcx, rdi
mov rdx, rsi
call fcn.140027d10
xor ebp, ebp
lea rdx, [rsp + 0xd0]
mov rcx, rdi
xor r8d, r8d
call fcn.1400e9fb0
lea rsi, [rsp + 0x220]
mov r8d, 0x98
mov rcx, rsi
mov dl, 0xaa
call fcn.14009fa40
mov rcx, rsi
call fcn.14002d0e0
mov byte [rsi + 0x21], 1
lea rcx, [rsp + 0x228]
call fcn.14002d830
lea rbx, [rsp + 0x190]
movaps xmmword [rbx], xmm6
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.14002e740
mov rcx, rbx
call fcn.140071ad0
test al, al
je 0x14001c0f9
lea rsi, [rsp + 0x168]
mov qword [rsi], 0
lea rcx, [rsp + 0x140]
call fcn.140071af0
mov rdi, rax
lea rcx, [rsp + 0x190]
call fcn.140071af0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 0x101000
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x14001c0f9
mov rbx, qword [rsp + 0x168]
test rbx, rbx
je 0x14001c225
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
xor edi, edi
cmp rbx, 0xffffffffffffffff
je 0x14001c249
call fcn.14006fce0
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14001c117
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov edi, 0x80004005
cmovne edi, ecx
xor ebx, ebx
lea rcx, [rsp + 0x190]
call fcn.1400719f0
lea rcx, [rsp + 0x220]
call fcn.14002d150
test edi, edi
js 0x14001c1a4
lea rcx, [rsp + 0x120]
lea rsi, [rsp + 0x220]
mov rdx, rsi
call fcn.1400ea620
mov rcx, rsi
call fcn.14001c270
mov rcx, rsi
call fcn.14006e320
lea rsi, [rbx + 1]
cmp rsi, 2
jb 0x14001c16c
call fcn.14006fce0
cmp qword [r13], rbx
je 0x14001c1a2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [r13]
inc rax
cmp rax, 2
jae 0x14001c22e
cmp rsi, 2
jb 0x14001c19a
mov qword [r13], rbx
call fcn.14006fce0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
lea rax, [rbx + 1]
cmp rax, 2
jb 0x14001c1bb
call fcn.14006fce0
mov rcx, rbx
call fcn.140071fe0
lea rcx, [rsp + 0x1d0]
call fcn.140027eb0
lea rcx, [rsp + 0x1b0]
call fcn.14006e320
lea rcx, [rsp + 0x120]
call fcn.1400ea700
lea rcx, [rsp + 0x140]
call fcn.1400719f0
test r12, r12
je 0x14001c1fc
mov rcx, r12
call fcn.14009c364
lea rcx, [rsp + 0x68]
call fcn.14006e320
lea rcx, [rsp + 0x80]
call fcn.14006e320
lea rcx, [rsp + 0xd0]
call fcn.140027eb0
jmp 0x14001ba6b
xor ebx, ebx
xor edi, edi
jmp 0x14001c117
call fcn.14006fce0
mov rcx, qword [r13]
call fcn.140071fe0
mov qword [r13], 0
jmp 0x14001c18b
xor ebx, ebx
jmp 0x14001c0ef
lea rcx, [rsp + 0x360]
call fcn.1400c86e0
mov rcx, rbp
call fcn.1400c86e0
int3