Function at 0x14002aa50
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov qword [rsp + 0x50], rdx
mov rax, qword [0x140219028]
xor rax, rsp
mov qword [rsp + 0xb0], rax
cmp byte [rcx + 0x6c], 0
je 0x14002aeec
mov rbx, rcx
movabs r13, 0xfffffffffffffff
mov r14, qword [rcx + 0x18]
mov r12, qword [rcx + 0x20]
mov rdi, r12
movabs r15, 0xaaaaaaaaaaaaaaab
xorps xmm0, xmm0
movaps xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], 0
sub rdi, r14
je 0x14002ae9d
sar rdi, 3
imul rdi, r15
cmp rdi, r13
ja 0x14002af1e
shl rdi, 4
mov rcx, rdi
call fcn.14011d790
mov rsi, rax
mov qword [rsp + 0x80], rax
lea rbp, [rax + rdi]
mov qword [rsp + 0x90], rbp
test rdi, rdi
je 0x14002aeae
mov rcx, rsi
xor edx, edx
mov r8, rdi
call fcn.140122050
mov qword [rsp + 0x88], rbp
cmp r12, r14
je 0x14002ab6d
mov eax, 1
xor ecx, ecx
xor edx, edx
mov dword [rsi + rcx + 8], 0x10
mov rbp, qword [rbx + 0x18]
mov rbp, qword [rbp + rdx]
mov rdi, qword [rsp + 0x80]
mov qword [rdi + rcx], rbp
mov rbp, qword [rbx + 0x20]
sub rbp, qword [rbx + 0x18]
sar rbp, 3
imul rbp, r15
cmp rax, rbp
jae 0x14002ab6d
mov rsi, qword [rsp + 0x80]
add rdx, 0x18
inc rax
add rcx, 0x10
jmp 0x14002ab26
mov r12, qword [rbx]
mov r14, qword [rbx + 8]
mov rsi, r14
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
sub rsi, r12
je 0x14002aea4
sar rsi, 3
imul rsi, r15
cmp rsi, r13
ja 0x14002af2b
shl rsi, 4
mov rcx, rsi
call fcn.14011d790
mov r13, rax
mov qword [rsp + 0x60], rax
lea rdi, [rax + rsi]
mov qword [rsp + 0x70], rdi
test rsi, rsi
je 0x14002aeb6
mov rcx, r13
xor edx, edx
mov r8, rsi
call fcn.140122050
mov qword [rsp + 0x68], rdi
cmp r14, r12
je 0x14002ac28
xor eax, eax
xor ecx, ecx
xor edx, edx
mov dword [r13 + rax + 8], 0
mov rbp, qword [rbx]
mov rbp, qword [rbp + rcx]
mov rdi, qword [rsp + 0x60]
mov qword [rdi + rax], rbp
inc rdx
mov rbp, qword [rbx + 8]
sub rbp, qword [rbx]
sar rbp, 3
imul rbp, r15
mov r13, qword [rsp + 0x60]
add rcx, 0x18
add rax, 0x10
cmp rdx, rbp
jb 0x14002abe5
mov rdi, qword [rsp + 0x68]
mov qword [rsp + 0x58], 0
mov r15, qword [rsp + 0x80]
mov r8, qword [rsp + 0x88]
mov al, byte [rbx + 0x6e]
cmp r15, r8
jne 0x14002ac52
cmp r13, rdi
je 0x14002af35
sub rdi, r13
shr rdi, 4
sub r8, r15
shr r8, 4
movzx edx, al
mov rcx, qword [rbx + 0x48]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, r15
call qword [sym.imp.ADVAPI32.dll_CreateRestrictedToken]
test eax, eax
je 0x14002aef6
mov r12, qword [rsp + 0x58]
test r12, r12
je 0x14002ae95
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp r12, 0xffffffffffffffff
je 0x14002aed7
call fcn.1400d3890
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [rbx + 0x6e], 0
je 0x14002ad39
cmp byte [rbx + 0x6f], 0
je 0x14002ad39
lea r8, [rsp + 0xa4]
mov dword [r8 + 8], 0
mov qword [r8], 0
mov dword [r8 - 4], 1
lea rdx, str.SeChangeNotifyPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x14002aedf
lea r8, [rsp + 0xa0]
mov dword [r8 + 0xc], 4
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov rcx, r12
xor edx, edx
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x14002aedf
cmp byte [rbx + 0x6d], 0
je 0x14002af03
mov rcx, r12
call fcn.14002b3d0
test al, al
je 0x14002aedf
mov rbp, qword [rbx + 0x30]
mov rsi, qword [rbx + 0x38]
cmp rbp, rsi
je 0x14002ad81
mov r8d, dword [rbp + 0x18]
mov r9d, dword [rbp + 0x1c]
mov rcx, r12
mov rdx, rbp
call fcn.14002bb70
test al, al
je 0x14002aedf
add rbp, 0x20
jmp 0x14002ad5b
mov rcx, r12
mov edx, 0x10000000
call fcn.14002b0c0
test al, al
je 0x14002aedf
mov edx, dword [rbx + 0x68]
mov rcx, r12
call fcn.14002af70
test eax, eax
jne 0x14002aee5
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbp, [rsp + 0xa0]
mov qword [rbp], rax
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rdi
mov rsi, rax
call rdi
xor ebx, ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 0xf01ff
mov rcx, rax
mov rdx, r12
mov r8, rsi
mov r9, rbp
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x14002aedf
mov rsi, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0x50]
cmp qword [rdi], rsi
je 0x14002ae3d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x14002aebe
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14002ae35
mov qword [rdi], rsi
call fcn.1400d3890
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rax, [r12 + 1]
cmp rax, 2
jb 0x14002ae55
call fcn.1400d3890
mov rcx, r12
call fcn.140101910
test r13, r13
je 0x14002ae62
mov rcx, r13
call fcn.14011d780
test r15, r15
je 0x14002ae6f
mov rcx, r15
call fcn.14011d780
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14011fe20
mov eax, ebx
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor r12d, r12d
jmp 0x14002acc9
xor esi, esi
jmp 0x14002ab18
xor edi, edi
xor r13d, r13d
jmp 0x14002abda
mov rbp, rsi
jmp 0x14002ab10
mov rdi, r13
jmp 0x14002abd5
call fcn.1400d3890
mov rcx, qword [rdi]
call fcn.140101910
mov qword [rdi], 0
jmp 0x14002ae23
xor r12d, r12d
jmp 0x14002acc1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x14002ae3d
mov ebx, 0x3f0
jmp 0x14002ae6f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x14002ae55
mov rcx, r12
mov edx, 0xa
xor r8d, r8d
mov r9d, 0x10000000
call fcn.14019c4e0
jmp 0x14002ad4b
lea rcx, [rsp + 0x80]
call fcn.140152a60
lea rcx, [rsp + 0x60]
call fcn.140152a60
test al, al
mov al, 1
jne 0x14002ac52
mov rcx, qword [rbx + 0x48]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov edx, 0xf01ff
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
jmp 0x14002ac94