Function at 0x1401eac34
Capabilities:
Check if file exists

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x1403f04b0]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov r14, r8
mov rbx, rdx
mov r15, rcx
mov rcx, rdx
cmp qword [rdx + 0x18], 8
jb 0x1401eac78
mov rcx, qword [rdx]
cmp qword [rdx + 0x10], 4
jne 0x1401eaf1c
mov r9d, 4
lea rax, str.file
sub rcx, rax
movzx edx, word [rcx + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x1401eacaf
add rax, 2
sub r9, 1
jne 0x1401eac93
xor eax, eax
jmp 0x1401eacb6
sbb eax, eax
and eax, 0xfffffffe
inc eax
test eax, eax
jne 0x1401eaf1c
cmp qword [rbx + 0x50], 0
je 0x1401eaf1c
call fcn.1402113a8
cmp byte [rax + 0xa0], 0
jne 0x1401eace5
lea r8, [rbx + 0x20]
mov ebx, 0x8007023f
jmp 0x1401eaf25
lea rdi, [rbx + 0x20]
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x1401eacf6
mov rcx, qword [rdi]
call qword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathFileExistsW]
test eax, eax
jne 0x1401ead6d
lea rdx, str.Remediation_has_not_occurred_since_the_file
lea rcx, [rsp + 0x58]
call fcn.140048750
nop
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x1401ead1f
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
lea rcx, [rsp + 0x58]
call fcn.140054efc
mov r8d, reloc.OLEAUT32.dll_SafeArrayUnlock
lea rdx, str._does_no_longer_exist
lea rcx, [rsp + 0x58]
call fcn.140054efc
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x58]
mov r8, rdi
mov ebx, 0x80070002
mov edx, ebx
call fcn.1401e8a94
nop
lea rcx, [rsp + 0x58]
call fcn.1400492c0
jmp 0x1401eaf32
call fcn.14004e8c8
mov rcx, rax
lea rdx, [rsp + 0x30]
call fcn.140077efc
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
lea r9, [rbp - 0x20]
lea r8, [rsp + 0x40]
mov rdx, rdi
mov rax, qword [rax + 8]
call qword [str.__v__]
mov esi, eax
cmp eax, 5
jne 0x1401eadfc
call fcn.140048a14
mov rcx, qword [rax + 8]
cmp dword [rcx], 4
jbe 0x1401eadf5
lea rax, str.The_check_if_the_sha1_of_the_file_has_been_changed_was_skipped_since_there_was_access_denied_error_when_trying_to_read_the_file_hash
mov qword [rbp + 0x60], rax
mov dword [rbp + 0x68], 0x10a
and dword [rbp + 0x6c], 0
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14034f02d]
call fcn.140001078
xor esi, esi
jmp 0x1401eaecf
test eax, eax
jns 0x1401eae15
mov r9, r14
mov r8, rdi
mov edx, eax
mov rcx, r15
call fcn.1401e882c
jmp 0x1401eaecf
xor r9d, r9d
lea r8d, [r9 + 0x14]
lea rdx, [rbp + 1]
lea rcx, [rbp - 0x48]
call fcn.140079858
nop
xor r8d, r8d
lea rdx, [rbx + 0x40]
lea rcx, [rbp - 0x68]
call fcn.140059288
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x68]
call fcn.1400a5bc4
mov ebx, eax
lea rcx, [rbp - 0x68]
call fcn.1400492c0
test ebx, ebx
je 0x1401eaec3
lea rdx, str.Remediation_has_not_occurred_since_the_file
lea rcx, [rsp + 0x78]
call fcn.140048750
nop
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x1401eae75
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
lea rcx, [rsp + 0x78]
call fcn.140054efc
mov r8d, reloc.OLEAUT32.dll_SafeArrayAccessData
lea rdx, str._sha1_has_been_changed
lea rcx, [rsp + 0x78]
call fcn.140054efc
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x78]
mov r8, rdi
mov esi, 0x80073bc5
mov edx, esi
mov rcx, r15
call fcn.1401e88a4
nop
lea rcx, [rsp + 0x78]
call fcn.1400492c0
jmp 0x1401eaec5
xor esi, esi
lea rcx, [rbp - 0x48]
call fcn.1400492c0
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1401eaf18
or edi, 0xffffffff
mov eax, edi
lock xadd dword [rcx + 8], eax
add eax, edi
jne 0x1401eaf18
mov rbx, qword [rsp + 0x38]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [str.__v__]
mov ecx, edi
lock xadd dword [rbx + 0xc], ecx
add ecx, edi
jne 0x1401eaf18
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx]
mov rax, qword [rdx + 8]
call qword [str.__v__]
mov eax, esi
jmp 0x1401eaf34
lea r8, [rbx + 0x20]
mov ebx, 0x80070057
mov r9, r14
mov edx, ebx
mov rcx, r15
call fcn.1401e882c
mov eax, ebx
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.14027a710
add rsp, 0x180
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret