Function at 0x1400091f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x198
movaps xmmword [rsp + 0x180], xmm7
movaps xmmword [rsp + 0x170], xmm6
mov rsi, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x168], rax
lea rcx, str.EnforceNoExecutableFileHandles
call fcn.14015db70
mov dil, 1
test al, al
je 0x1400092ef
mov ecx, 4
call fcn.1401cbbc4
mov rdi, rax
mov dword [rax], 6
movabs rbp, 0xaaaaaaaaaaaaaaaa
lea rcx, [rsp + 0x70]
mov qword [rcx + 0x10], rbp
movaps xmm6, xmmword [0x14029ca60]
movaps xmmword [rcx], xmm6
mov rdx, rsi
call fcn.14003af30
xorps xmm7, xmm7
lea rbx, [rsp + 0x50]
movaps xmmword [rbx], xmm7
mov qword [rbx + 0x10], 0
xor r12d, r12d
lea r14, [rsp + 0x100]
jmp 0x140009359
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x58], r14
call fcn.1401cbbbc
cmp byte [rsp + 0x87], 0
jns 0x1400092bd
mov rcx, qword [rsp + 0x70]
call fcn.1401cbbbc
test rdi, rdi
je 0x1400092e5
mov eax, 4
test rax, rax
je 0x1400092dd
add rax, 0xfffffffffffffffc
mov rcx, rdi
add rcx, rax
jne 0x1400092c7
jmp 0x140009867
mov rcx, rdi
call fcn.1401cbbbc
test bl, bl
je 0x1400096a9
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.1401ce5b0
mov eax, edi
movaps xmm6, xmmword [rsp + 0x170]
movaps xmm7, xmmword [rsp + 0x180]
add rsp, 0x198
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rbx
mov rdx, r14
call fcn.140061360
mov r15, rax
mov qword [rsp + 0x58], r15
cmp byte [rsp + 0x117], 0
jns 0x14000934f
mov rcx, qword [rsp + 0x100]
call fcn.1401cbbbc
add r12, 4
cmp r12, 4
je 0x1400093a3
mov ecx, dword [rdi + r12]
movaps xmmword [rsp + 0x100], xmm7
mov qword [rsp + 0x110], 0
mov rdx, r14
call fcn.140026680
test al, al
je 0x140009338
mov r15, qword [rsp + 0x58]
cmp r15, qword [rsp + 0x60]
jae 0x140009325
test r15, r15
je 0x14000986a
mov rcx, r15
mov rdx, r14
call fcn.1401ad220
add r15, 0x18
jmp 0x140009333
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x14000959e
lea r14, [rsp + 0xc0]
movaps xmmword [r14 + 0x30], xmm6
movaps xmmword [r14 + 0x20], xmm6
movaps xmmword [r14 + 0x10], xmm6
movaps xmmword [r14], xmm6
lea rdx, str.GetSecureSystemTemp
lea r8, str.file_util_win.cc
lea rbx, [rsp + 0x100]
mov rcx, rbx
mov r9d, 0x2d4
call fcn.140158eb0
mov rcx, r14
xor edx, edx
xor r8d, r8d
call fcn.1401a26e0
test byte [0x1402d90d0], 0x19
jne 0x140009994
xorps xmm0, xmm0
lea rdx, [rsp + 0xa0]
movaps xmmword [rdx], xmm0
mov qword [rdx + 0x10], 0
mov ecx, 0x65
call fcn.140026680
test al, al
je 0x140009889
lea rax, str.SystemTemp
lea r8, [rsp + 0x90]
mov qword [r8], rax
mov qword [r8 + 8], 0xa
lea rbx, [rsp + 0xa0]
lea rdx, [rsp + 0x100]
mov rcx, rbx
call fcn.140041260
cmp byte [rbx + 0x17], 0
jns 0x140009488
mov rcx, qword [rsp + 0xa0]
call fcn.1401cbbbc
lea r15, [rsp + 0x100]
mov rax, qword [r15 + 0x10]
mov qword [rsp + 0xb0], rax
movups xmm0, xmmword [r15]
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [r15 + 0x30], xmm6
movaps xmmword [r15 + 0x20], xmm6
movaps xmmword [r15 + 0x10], xmm6
movaps xmmword [r15], xmm6
lea rdx, str.PathExists
lea r8, str.file_util_win.cc
lea r14, [rsp + 0x148]
mov rcx, r14
mov r9d, 0x226
call fcn.140158eb0
mov rcx, r15
xor edx, edx
xor r8d, r8d
call fcn.1401a26e0
test byte [0x1402d90d0], 0x19
jne 0x1400099b0
cmp byte [rsp + 0xb7], 0
jns 0x14000950b
mov rbx, qword [rsp + 0xa0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
lea rcx, [rsp + 0x100]
call fcn.140181760
cmp ebx, 0xffffffff
je 0x140009889
lea rcx, [rsp + 0xa0]
call fcn.1400610b0
test al, al
je 0x140009889
lea rcx, [rsp + 0x30]
lea rbx, [rsp + 0xa0]
mov rdx, rbx
call fcn.1401ad2f0
cmp byte [rbx + 0x17], 0
jns 0x140009569
mov rcx, qword [rsp + 0xa0]
call fcn.1401cbbbc
lea rcx, [rsp + 0xc0]
call fcn.140181760
mov r14, qword [rsp + 0x58]
cmp r14, qword [rsp + 0x60]
jae 0x1400095a5
test r14, r14
je 0x14000985e
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.1401ad220
add r14, 0x18
jmp 0x1400095b7
mov r14, qword [rsp + 0x58]
jmp 0x1400095bc
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x30]
call fcn.140061360
mov r14, rax
mov qword [rsp + 0x58], r14
mov r15, qword [rsp + 0x50]
cmp r15, r14
je 0x1400095d5
lea r12, [rsp + 0x100]
lea r13, [rsp + 0x70]
jmp 0x1400095f6
mov bl, 1
jmp 0x140009630
mov rcx, qword [rsp + 0x100]
call fcn.1401cbbbc
add r15, 0x18
cmp r15, r14
sete al
or al, bl
cmp al, 1
je 0x14000962d
mov qword [rsp + 0x110], rbp
movaps xmmword [rsp + 0x100], xmm6
mov rcx, r12
mov rdx, r15
call fcn.14003af30
mov rcx, r12
mov rdx, r13
xor r8d, r8d
call fcn.140017360
mov ebx, eax
cmp byte [rsp + 0x117], 0
js 0x1400095d9
jmp 0x1400095e6
xor bl, 1
cmp byte [rsp + 0x47], 0
jns 0x140009641
mov rcx, qword [rsp + 0x30]
call fcn.1401cbbbc
mov r14, qword [rsp + 0x50]
test r14, r14
je 0x1400092a9
mov r15, qword [rsp + 0x58]
mov rcx, r14
cmp r15, r14
je 0x14000929f
add r15, 0xffffffffffffffe8
jmp 0x14000967e
mov rcx, qword [r15]
call fcn.1401cbbbc
lea rax, [r15 - 0x18]
cmp r15, r14
mov r15, rax
je 0x14000929a
test r15, r15
je 0x14000985b
cmp byte [r15 + 0x17], 0
js 0x140009666
jmp 0x14000966e
mov rcx, qword [rsp + 0x158]
mov qword [rax + 0x10], rcx
movups xmm0, xmmword [rsp + 0x148]
movups xmmword [rax], xmm0
jmp 0x140009716
movaps xmmword [rsp + 0x110], xmm6
movaps xmmword [rsp + 0x100], xmm6
lea rdx, [0x1402a9248]
lea rcx, [rsp + 0x148]
call fcn.140207340
mov ecx, 0x18
call fcn.1401cbbc4
mov qword [rsp + 0xc0], rax
lea rbx, [rax + 0x18]
mov qword [rsp + 0xd0], rbx
test rax, rax
je 0x1400099cc
cmp byte [rsp + 0x15f], 0
jns 0x140009690
mov rdx, qword [rsp + 0x148]
mov r8, qword [rsp + 0x150]
mov rcx, rax
call fcn.1400179f0
lea rdi, [rsp + 0xc0]
mov qword [rdi + 8], rbx
lea rcx, [rsp + 0x100]
mov rdx, rdi
call fcn.14003e350
mov rdi, qword [rdi]
test rdi, rdi
je 0x14000978a
mov rbx, qword [rsp + 0xc8]
mov rcx, rdi
cmp rbx, rdi
je 0x14000977d
add rbx, 0xffffffffffffffe8
jmp 0x140009764
mov rcx, qword [rbx]
call fcn.1401cbbbc
lea rax, [rbx - 0x18]
cmp rbx, rdi
mov rbx, rax
je 0x140009775
test rbx, rbx
je 0x140009991
cmp byte [rbx + 0x17], 0
jns 0x140009758
jmp 0x140009750
mov rcx, qword [rsp + 0xc0]
mov qword [rsp + 0xc8], rdi
call fcn.1401cbbbc
cmp byte [rsp + 0x15f], 0
jns 0x1400097a1
mov rcx, qword [rsp + 0x148]
call fcn.1401cbbbc
cmp byte [rsp + 0x118], 0
je 0x140009861
mov dword [rsp + 0x28], 2
mov byte [rsp + 0x20], 0
lea rbx, [rsp + 0x100]
mov rcx, rsi
mov rdx, rbx
mov r8d, 0x20
xor r9d, r9d
call fcn.140036180
mov edi, eax
cmp byte [rbx + 0x18], 0
je 0x1400092ef
mov rsi, qword [rsp + 0x100]
test rsi, rsi
je 0x1400092ef
mov rbx, qword [rsp + 0x108]
mov rcx, rsi
cmp rbx, rsi
je 0x140009849
add rbx, 0xffffffffffffffe8
test rbx, rbx
je 0x1400099cf
mov rcx, qword [rbx]
test rcx, rcx
je 0x140009835
mov rax, qword [rbx + 8]
mov rdx, rax
sub rdx, rcx
dec rax
cmp rdx, rax
ja 0x140009864
mov qword [rbx + 8], rcx
call fcn.1401cbbbc
lea rax, [rbx - 0x18]
cmp rbx, rsi
mov rbx, rax
jne 0x140009809
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x108], rsi
call fcn.1401cbbbc
jmp 0x1400092ef
int3
int3
int3
int3
int3
int3
lea rdx, [rsp + 0x140]
mov qword [rdx], r14
lea rcx, str.ScopedBlockingCall
call fcn.1402380c0
jmp 0x140009924
cmp byte [rsp + 0xb7], 0
jns 0x1400098a0
mov rcx, qword [rsp + 0xa0]
call fcn.1401cbbbc
xorps xmm0, xmm0
lea rbx, [rsp + 0xa0]
movaps xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov ecx, 0x67
mov rdx, rbx
call fcn.140026680
test al, al
je 0x140009968
lea r15, [rsp + 0x100]
movaps xmmword [r15 + 0x30], xmm6
movaps xmmword [r15 + 0x20], xmm6
movaps xmmword [r15 + 0x10], xmm6
movaps xmmword [r15], xmm6
lea rdx, str.PathExists
lea r8, str.file_util_win.cc
lea r14, [rsp + 0x148]
mov rcx, r14
mov r9d, 0x226
call fcn.140158eb0
mov rcx, r15
xor edx, edx
xor r8d, r8d
call fcn.1401a26e0
test byte [0x1402d90d0], 0x19
jne 0x14000986d
cmp byte [rsp + 0xb7], 0
jns 0x140009936
mov rbx, qword [rsp + 0xa0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
lea rcx, [rsp + 0x100]
call fcn.140181760
cmp ebx, 0xffffffff
je 0x140009968
lea rcx, [rsp + 0xa0]
call fcn.1400610b0
test al, al
jne 0x140009541
cmp byte [rsp + 0xb7], 0
jns 0x14000997f
mov rcx, qword [rsp + 0xa0]
call fcn.1401cbbbc
lea rcx, [rsp + 0xc0]
call fcn.140181760
jmp 0x14000959e
int3
lea rdx, [rsp + 0x148]
mov qword [rdx], rbx
lea rcx, str.ScopedBlockingCall
call fcn.1402380c0
jmp 0x14000941b
lea rdx, [rsp + 0x140]
mov qword [rdx], r14
lea rcx, str.ScopedBlockingCall
call fcn.1402380c0
jmp 0x1400094f9
int3
int3