Function at 0x140040c8c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x578]
sub rsp, 0x650
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rbp + 0x540], rax
mov rdi, rcx
lea rdx, str.SeBackupPrivilege
xor esi, esi
lea rcx, [rbp + 0x228]
mov ebx, esi
mov dword [rsp + 0x50], ebx
movaps xmm0, xmmword [str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList]
movaps xmm1, xmmword [0x14014dcf0]
movzx eax, word [0x14014dd50]
movaps xmmword [rbp + 0x4c0], xmm0
movaps xmm0, xmmword [0x14014dd00]
movaps xmmword [rbp + 0x4e0], xmm0
movaps xmm0, xmmword [0x14014dd20]
movaps xmmword [rbp + 0x4d0], xmm1
movaps xmm1, xmmword [0x14014dd10]
movaps xmmword [rbp + 0x500], xmm0
movaps xmm0, xmmword [0x14014dd40]
movaps xmmword [rbp + 0x4f0], xmm1
movaps xmm1, xmmword [0x14014dd30]
movaps xmmword [rbp + 0x520], xmm0
movaps xmmword [rbp + 0x510], xmm1
mov word [rbp + 0x530], ax
call fcn.1400a9f94
lea rdx, str.SeRestorePrivilege
lea rcx, [rbp + 0x208]
call fcn.1400a9f94
xor r9d, r9d
lea r8, [rbp + 0x4c0]
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x2a0]
call fcn.14005e690
lea r14d, [rsi + 1]
lea r13d, [rsi + 0x32]
lea r15, str..._.._chrome_installer_setup_user_hive_visitor.cc
lea r12d, [rsi + 2]
mov rcx, qword [rbp + 0x2a0]
test rcx, rcx
je 0x140040dab
mov eax, r14d
cmp dword [rbp + reloc.SHELL32.dll_IsUserAnAdmin], esi
jge 0x140040dad
mov eax, esi
test al, al
je 0x14004154b
mov rdx, r13
mov rcx, r15
call fcn.140067ff0
cmp eax, r14d
jl 0x140040e0a
or r9d, 0xffffffff
lea rcx, [rbp - 0x70]
mov rdx, r15
or ebx, r14d
lea r8d, [r9 + 0x78]
call fcn.1400681c0
lea rdx, str.Checking_for_pre_loaded_hive_for_local_account__
lea rcx, [rax + 8]
call fcn.14002bcb4
mov rcx, rax
lea rdx, [rbp + 0x2ac]
call fcn.140068e50
mov rcx, rax
lea rdx, [0x14014d05c]
call fcn.14002bcb4
test r14b, bl
je 0x140040e1b
and ebx, 0xfffffffe
lea rcx, [rbp - 0x70]
call fcn.140068220
mov r9d, 0xf003f
mov qword [rsp + 0x30], rsi
lea r8, [rbp + 0x2ac]
mov dword [rsp + 0x38], esi
mov rdx, 0xffffffff80000003
mov qword [rsp + 0x40], rsi
lea rcx, [rsp + 0x30]
call fcn.14005d790
test eax, eax
jne 0x140040e53
mov al, r14b
jmp 0x140040f43
cmp eax, r12d
jne 0x140040ec5
mov rdx, r13
mov rcx, r15
call fcn.140067ff0
cmp eax, r14d
jl 0x140040eae
or r9d, 0xffffffff
lea rcx, [rbp - 0x70]
mov rdx, r15
bts ebx, 7
lea r8d, [r9 + 0x62]
call fcn.1400681c0
lea rdx, str.Hive_is_not_loaded_for_user__
lea rcx, [rax + 8]
call fcn.14002bcb4
mov rcx, rax
lea rdx, [rbp + 0x2ac]
call fcn.140068e50
mov rcx, rax
lea rdx, [0x14014d05c]
call fcn.14002bcb4
test bl, bl
jns 0x140040f40
btr ebx, 7
lea rcx, [rbp - 0x70]
call fcn.140068220
jmp 0x140040f40
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [0x14017c080], r12d
jg 0x140040f2a
bts ebx, 8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, r12d
lea rcx, [rbp + 0x98]
mov r8d, 0x65
mov dword [rsp + 0x20], eax
mov rdx, r15
call fcn.140068d00
lea rdx, str.Failed_opening_hive_for_user__
lea rcx, [rax + 0x10]
call fcn.14002bcb4
mov rcx, rax
lea rdx, [rbp + 0x2ac]
call fcn.140068e50
mov rcx, rax
lea rdx, [0x14014d05c]
call fcn.14002bcb4
bt ebx, 8
jae 0x140040f40
btr ebx, 8
lea rcx, [rbp + 0x98]
call fcn.140068d80
mov al, sil
test al, al
je 0x140040fec
mov rdx, r13
mov rcx, r15
call fcn.140067ff0
cmp eax, r14d
jl 0x140040fa0
or r9d, 0xffffffff
lea rcx, [rbp - 0x70]
mov rdx, r15
or ebx, r12d
lea r8d, [r9 + 0x7c]
call fcn.1400681c0
lea rdx, str.Found_loaded_hive_for_sid__
lea rcx, [rax + 8]
call fcn.14002bcb4
mov rcx, rax
lea rdx, [rbp + 0x2ac]
call fcn.140068e50
mov rcx, rax
lea rdx, [0x14014d05c]
call fcn.14002bcb4
test r12b, bl
je 0x140040fb1
and ebx, 0xfffffffd
lea rcx, [rbp - 0x70]
call fcn.140068220
mov rcx, qword [rdi]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x50]
lea rax, [rbp + 0x2ac]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x60]
mov rax, qword [rcx + 8]
call rax
lea rcx, [rsp + 0x30]
test al, al
je 0x14004153f
jmp 0x1400414e1
mov qword [rbp + 0x1c0], 7
mov qword [rbp + 0x1b8], rsi
mov word [rbp + 0x1a8], si
cmp word [rbp + 0x4c0], si
jne 0x140041013
mov r8, rsi
jmp 0x140041028
lea rax, [rbp + 0x4c0]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], si
jne 0x14004101e
lea rdx, [rbp + 0x4c0]
lea rcx, [rbp + 0x1a8]
call fcn.140029c40
mov r8d, 0x5c
lea rcx, [rbp + 0x1a8]
mov rdx, r14
call fcn.140030b20
cmp word [rbp + 0x2ac], si
jne 0x14004105e
mov r8, rsi
jmp 0x140041073
lea rcx, [rbp + 0x2ac]
or r8, 0xffffffffffffffff
inc r8
cmp word [rcx + r8*2], si
jne 0x140041069
lea rdx, [rbp + 0x2ac]
mov rcx, rax
call fcn.140029e90
cmp qword [rbp + 0x1c0], 8
lea r8, [rbp + 0x1a8]
mov r9d, r14d
lea rcx, [rsp + 0x30]
cmovae r8, qword [rbp + 0x1a8]
mov rdx, 0xffffffff80000002
call fcn.14005d790
test eax, eax
je 0x140041146
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [0x14017c080], r12d
jg 0x140041129
or ebx, 4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, r12d
lea rcx, [rbp + 0x98]
mov r8d, 0x88
mov dword [rsp + 0x20], eax
mov rdx, r15
call fcn.140068d00
lea rdx, str.Failed_opening_profile_key__
lea rcx, [rax + 0x10]
call fcn.14002bcb4
cmp qword [rbp + 0x1c0], 8
lea rdx, [rbp + 0x1a8]
mov rcx, rax
cmovae rdx, qword [rbp + 0x1a8]
call fcn.140068e50
lea rdx, [0x14014d05c]
mov rcx, rax
call fcn.14002bcb4
test bl, 4
je 0x1400414ca
and ebx, 0xfffffffb
lea rcx, [rbp + 0x98]
call fcn.140068d80
jmp 0x1400414ca
lea r8, [rbp + 0x1e8]
mov qword [rbp + 0x200], 7
lea rdx, str.ProfileImagePath
mov qword [rbp + 0x1f8], rsi
lea rcx, [rsp + 0x30]
mov word [rbp + 0x1e8], si
call fcn.14005db50
test eax, eax
je 0x140041207
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [0x14017c080], r12d
jg 0x1400411f3
or ebx, 8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, r12d
lea rcx, [rbp + 0x98]
mov r8d, 0x90
mov dword [rsp + 0x20], eax
mov rdx, r15
call fcn.140068d00
lea rdx, str.Failed_reading_ProfileImagePath_value_of__
lea rcx, [rax + 0x10]
call fcn.14002bcb4
cmp qword [rbp + 0x1c0], 8
lea rdx, [rbp + 0x1a8]
mov rcx, rax
cmovae rdx, qword [rbp + 0x1a8]
call fcn.140068e50
lea rdx, [0x14014d05c]
mov rcx, rax
call fcn.14002bcb4
test bl, 8
je 0x140041207
and ebx, 0xfffffff7
lea rcx, [rbp + 0x98]
call fcn.140068d80
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140041220
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x38], esi
mov rcx, qword [rbp + 0x1f8]
test rcx, rcx
je 0x1400414b8
cmp qword [rbp + 0x200], 8
lea rax, str.ntuser.dat
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x60]
mov qword [rbp - 0x78], rcx
lea rax, [rbp + 0x1e8]
cmovae rax, qword [rbp + 0x1e8]
lea rcx, [rbp + 0x280]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x78], 0xa
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x50], xmm0
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rsp + 0x60], xmm0
call fcn.140059940
mov rcx, rax
lea r8, [rsp + 0x50]
lea rdx, [rbp + 0x1c8]
call fcn.14005add0
lea rcx, [rbp + 0x280]
call fcn.1400599c0
mov rdx, r13
mov rcx, r15
call fcn.140067ff0
cmp eax, r14d
jl 0x140041311
or r9d, 0xffffffff
lea rcx, [rbp - 0x70]
mov r8d, 0x99
mov rdx, r15
or ebx, 0x10
call fcn.1400681c0
lea rdx, str.Falling_back_to_opening__
lea rcx, [rax + 8]
call fcn.14002bcb4
cmp qword [rbp + 0x1e0], 8
lea rdx, [rbp + 0x1c8]
mov rcx, rax
cmovae rdx, qword [rbp + 0x1c8]
call fcn.140068e50
lea rdx, [0x14014d05c]
mov rcx, rax
call fcn.14002bcb4
test bl, 0x10
je 0x140041322
and ebx, 0xffffffef
lea rcx, [rbp - 0x70]
call fcn.140068220
cmp qword [rbp + 0x1e0], 8
lea rcx, [rbp + 0x1c8]
cmovae rcx, qword [rbp + 0x1c8]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400413d9
mov rdx, r13
mov rcx, r15
call fcn.140067ff0
cmp eax, r14d
jl 0x1400413bc
or ebx, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
or r9d, 0xffffffff
lea rcx, [rbp + 0x98]
mov r8d, 0x9b
mov dword [rsp + 0x20], eax
mov rdx, r15
call fcn.140068d00
lea rdx, str.Hive_file_not_found_or_inaccessible__
lea rcx, [rax + 0x10]
call fcn.14002bcb4
cmp qword [rbp + 0x1e0], 8
lea rdx, [rbp + 0x1c8]
mov rcx, rax
cmovae rdx, qword [rbp + 0x1c8]
call fcn.140068e50
lea rdx, [0x14014d05c]
mov rcx, rax
call fcn.14002bcb4
test bl, 0x20
je 0x1400414ac
and ebx, 0xffffffdf
lea rcx, [rbp + 0x98]
call fcn.140068d80
jmp 0x1400414ac
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp + 0x248]
call fcn.14004082c
cmp qword [rbp + 0x268], rsi
je 0x1400414a0
mov rdx, r13
mov rcx, r15
call fcn.140067ff0
cmp eax, r14d
jl 0x140041450
or r9d, 0xffffffff
lea rcx, [rbp - 0x70]
mov r8d, 0xa1
mov rdx, r15
or ebx, 0x40
call fcn.1400681c0
lea rdx, str.Loaded_and_opened_hive_for_sid__
lea rcx, [rax + 8]
call fcn.14002bcb4
mov rcx, rax
lea rdx, [rbp + 0x2ac]
call fcn.140068e50
mov rcx, rax
lea rdx, [0x14014d05c]
call fcn.14002bcb4
test bl, 0x40
je 0x140041461
and ebx, 0xffffffbf
lea rcx, [rbp - 0x70]
call fcn.140068220
mov rax, qword [rbp + 0x268]
lea r8, [rsp + 0x60]
neg rax
lea rdx, [rsp + 0x50]
lea rax, [rbp + 0x268]
sbb rcx, rcx
and rcx, rax
lea rax, [rbp + 0x2ac]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rdi]
mov qword [rsp + 0x50], rax
mov rax, qword [rcx + 8]
call rax
test al, al
je 0x1400414fe
lea rcx, [rbp + 0x248]
call fcn.140040b7c
lea rcx, [rbp + 0x1c8]
call fcn.1400599c0
xor r8d, r8d
lea rcx, [rbp + 0x1e8]
mov dl, r14b
call fcn.140029bc0
xor r8d, r8d
lea rcx, [rbp + 0x1a8]
mov dl, r14b
call fcn.140029bc0
lea rcx, [rsp + 0x30]
call fcn.14005d610
sub dword [rbp + reloc.SHELL32.dll_IsUserAnAdmin], r14d
lea rcx, [rbp + 0x2a0]
call fcn.14005e620
jmp 0x140040d94
lea rcx, [rbp + 0x248]
call fcn.140040b7c
lea rcx, [rbp + 0x1c8]
call fcn.1400599c0
xor r8d, r8d
lea rcx, [rbp + 0x1e8]
mov dl, r14b
call fcn.140029bc0
xor r8d, r8d
lea rcx, [rbp + 0x1a8]
mov dl, r14b
call fcn.140029bc0
lea rcx, [rsp + 0x30]
call fcn.14005d610
mov rcx, qword [rbp + 0x2a0]
test rcx, rcx
je 0x140041556
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [rbp + 0x208], sil
je 0x14004158d
cmp dword [rbp + 0x218], esi
je 0x14004158d
mov rcx, qword [rbp + 0x210]
lea r8, [rbp + 0x218]
mov qword [rsp + 0x28], rsi
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
lea rcx, [rbp + 0x210]
call fcn.1400337b0
cmp byte [rbp + 0x228], sil
je 0x1400415d0
cmp dword [rbp + 0x238], esi
je 0x1400415d0
mov rcx, qword [rbp + 0x230]
lea r8, [rbp + 0x238]
mov qword [rsp + 0x28], rsi
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
lea rcx, [rbp + 0x230]
call fcn.1400337b0
mov rcx, qword [rbp + 0x540]
xor rcx, rsp
call fcn.140111850
lea r11, [rsp + 0x650]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret