Function at 0x1400b3040
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x128
movaps xmmword [rsp + 0x110], xmm6
mov rsi, rcx
mov rax, qword [0x14022f038]
xor rax, rsp
mov qword [rsp + 0x108], rax
test r8, r8
je 0x1400b3337
mov rdi, r8
lea r13, [r8 + 0xffff]
and r13, 0xffffffffffff0000
cmp r13, r8
jb 0x1400b3337
mov rax, r13
shr rax, 0x1f
jne 0x1400b3337
mov ebx, edx
test edx, edx
je 0x1400b3341
movabs r12, 0xaaaaaaaaaaaaaaaa
lea rcx, [rsp + 0xc0]
mov qword [rcx], r12
mov qword [rsp + 0xb0], r12
movaps xmm6, xmmword [0x14020b860]
movaps xmmword [rsp + 0xa0], xmm6
movaps xmmword [rsp + 0x90], xmm6
mov edx, 8
mov r8d, 2
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x1400b3337
lea rcx, [rsp + 0x90]
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x1400b3337
lea r14, [rsp + 0x90]
lea r8, [rsp + 0xc0]
mov rcx, r14
mov edx, 1
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x1400b3337
xorps xmm0, xmm0
movaps xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], 0
call fcn.140113180
cmp eax, 5
jle 0x1400b3344
movaps xmmword [rsp + 0xe0], xmm6
mov qword [rsp + 0xf0], r12
mov dword [rsp + 0xe0], SafeArrayCopy
mov qword [rsp + 0xe8], r14
mov dword [rsp + 0xf0], 0
movzx eax, byte [rsp + 0x87]
test al, al
jns 0x1400b319e
mov rcx, qword [rsp + 0x78]
jmp 0x1400b31a3
mov ecx, eax
and ecx, 0x7f
test rcx, rcx
jne 0x1400b3415
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
lea rdx, [rsp + 0xe0]
xor ebp, ebp
mov rcx, 0xffffffffffffffff
mov r8d, 4
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test rax, rax
je 0x1400b32ea
mov r14, rax
lea r15, [rsp + 0xc8]
mov qword [r15], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 7
mov rcx, rax
mov rdx, r14
mov r8, rax
mov r9, r15
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ebp, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
je 0x1400b32ea
mov r14, qword [rsp + 0xc8]
test r14, r14
je 0x1400b32ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
lea rax, [r14 + 1]
cmp rax, 2
jb 0x1400b332f
call fcn.140100430
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1400b3432
lea r15, [rsp + 0xc8]
mov rcx, r15
call fcn.14010d580
mov qword [rsp + 0x40], 0
test r14, r14
je 0x1400b32b6
cmp r14, 0xffffffffffffffff
je 0x1400b343f
call fcn.140100430
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov qword [rsp + 0x40], r14
call fcn.140100430
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsp + 0x20], r15
lea rdx, [rsp + 0x40]
mov rcx, rsi
mov r8d, ebx
mov r9, rdi
call fcn.140113360
xor r14d, r14d
lea rax, [r14 + 1]
cmp rax, 2
jb 0x1400b32f2
call fcn.140100430
mov rcx, r14
call fcn.140112e70
jmp 0x1400b32f2
mov rcx, rsi
call fcn.14009cbb0
cmp byte [rsp + 0x87], 0
js 0x1400b3423
mov rcx, qword [rsp + 0x108]
xor rcx, rsp
call fcn.14014ced0
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x110]
add rsp, 0x128
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor r14d, r14d
jmp 0x1400b3256
mov rcx, rsi
call fcn.14009cbb0
jmp 0x1400b3300
int3
lea r15, [rsp + 0xe0]
movaps xmmword [r15 + 0x10], xmm6
movaps xmmword [r15], xmm6
mov edx, 0x20
mov rcx, r15
call fcn.140113440
movaps xmm0, xmmword [r15 + 0x10]
mov r8, qword [r15]
mov r9, qword [r15 + 8]
movups xmmword [rsp + 0x20], xmm0
lea rdx, str.CrSharedMem__016llx_016llx_016llx_016llx
lea r15, [rsp + 0x48]
mov rcx, r15
call fcn.14010a7a0
movzx eax, byte [r15 + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [r15]
cmovns rax, r15
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
cmovs rcx, qword [r15 + 8]
mov qword [rdx + 8], rcx
lea rcx, [rsp + 0xc8]
call fcn.14010bdb0
cmp byte [rsp + 0x87], 0
jns 0x1400b33cc
mov rcx, qword [rsp + 0x70]
call fcn.14014c3ec
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x80], rax
movups xmm0, xmmword [rsp + 0xc8]
movaps xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0xdf], 0
mov word [rsp + 0xc8], 0
cmp byte [rsp + 0x5f], 0
jns 0x1400b315d
mov rcx, qword [rsp + 0x48]
call fcn.14014c3ec
jmp 0x1400b315d
test al, al
jns 0x1400b344c
mov rax, qword [rsp + 0x70]
jmp 0x1400b31ae
mov rcx, qword [rsp + 0x70]
call fcn.14014c3ec
jmp 0x1400b3300
mov rcx, rsi
call fcn.14009cbb0
jmp 0x1400b32d1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
jmp 0x1400b32ae
lea rax, [rsp + 0x70]
jmp 0x1400b31ae