Function at 0x140158040
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc0
mov rdi, r9
mov rsi, r8
mov r15d, edx
mov rbx, rcx
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0xb8], rax
lea rdx, [rsp + 0xb0]
mov qword [rdx], 0
lea rcx, str.NtCreateLowBoxToken
call fcn.140014700
call fcn.1400d90a0
mov ebp, pe_nt_image_headers64
cmp eax, 5
jge 0x1401580bd
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.1400f32c0
mov eax, ebp
add rsp, 0xc0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ebp, 0x57
cmp r15d, 1
ja 0x140158099
mov r12, qword [rsp + 0x128]
test r12, r12
je 0x140158099
test rbx, rbx
je 0x140158206
xor r14d, r14d
mov eax, dword [rsp + 0x120]
movaps xmm0, xmmword [0x1401c8a80]
lea r9, [rsp + 0x80]
movaps xmmword [r9], xmm0
movaps xmmword [r9 + 0x10], xmm0
mov dword [r9], 0x30
xorps xmm0, xmm0
movups xmmword [r9 + 8], xmm0
mov dword [r9 + 0x18], 0
movaps xmmword [r9 + 0x20], xmm0
lea rcx, [rsp + 0x78]
xor edx, edx
test eax, eax
cmove rdi, rdx
mov qword [rcx], 0
mov rdx, qword [rsi]
mov rbp, qword [rsi + 8]
mov esi, dword [rsi + 0x10]
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdx
mov rdx, rbx
mov r8d, 0xf01ff
call qword [rsp + 0xb0]
test eax, eax
js 0x140158271
mov rdi, qword [rsp + 0x78]
test rdi, rdi
je 0x14015837d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp rdi, 0xffffffffffffffff
je 0x140158419
call fcn.1400c18d0
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp r15d, 1
jne 0x14015829a
lea rbx, [rdi + 1]
cmp rbx, 2
jb 0x1401581af
call fcn.1400c18d0
cmp qword [r12], rdi
je 0x1401581e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rax, qword [r12]
inc rax
cmp rax, 2
jae 0x1401583fe
cmp rbx, 2
jb 0x1401581dd
mov qword [r12], rdi
call fcn.1400c18d0
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
xor ebp, ebp
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14015827a
call fcn.1400c18d0
mov rcx, rdi
call fcn.1400def50
jmp 0x14015827a
lea rbx, [rsp + 0x80]
mov qword [rbx], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xf01ff
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140158360
mov r14, qword [rsp + 0x80]
test r14, r14
je 0x1401583e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp r14, 0xffffffffffffffff
je 0x140158420
call fcn.1400c18d0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x80]
jmp 0x1401580e1
mov ecx, eax
call fcn.140125460
mov ebp, eax
lea rax, [r14 + 1]
cmp rax, 2
jb 0x140158099
call fcn.1400c18d0
mov rcx, r14
call fcn.1400def50
jmp 0x140158099
lea rax, [rsp + 0x70]
mov qword [rax], 0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 2
mov rcx, rdi
mov edx, 0xf01ff
xor r8d, r8d
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x140158370
mov rbx, qword [rsp + 0x70]
test rbx, rbx
je 0x1401583ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp rbx, 0xffffffffffffffff
je 0x140158428
call fcn.1400c18d0
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xorps xmm0, xmm0
lea r8, [rsp + 0x50]
movaps xmmword [r8], xmm0
xor eax, eax
mov qword [r8 + 0x10], rax
lea r9, [rsp + 0x48]
mov qword [r9], rax
mov rcx, rdi
mov edx, 4
call fcn.140044410
test eax, eax
je 0x140158384
mov ebp, eax
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140158340
mov qword [rsp + 0x58], rcx
call fcn.1400f0498
lea rax, [rbx + 1]
cmp rax, 2
jb 0x1401581e9
call fcn.1400c18d0
mov rcx, rbx
call fcn.1400def50
jmp 0x1401581e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
xor r14d, r14d
jmp 0x14015827a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
jmp 0x1401581e9
xor edi, edi
jmp 0x140158196
mov r8, qword [rsp + 0x48]
mov rcx, rbx
mov edx, 4
call qword [sym.imp.ADVAPI32.dll_SetKernelObjectSecurity]
test eax, eax
je 0x1401583f3
lea rbp, [rbx + 1]
cmp rbp, 2
jb 0x1401583aa
call fcn.1400c18d0
cmp qword [r12], rbx
je 0x1401583dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rax, qword [r12]
inc rax
cmp rax, 2
jae 0x14015842f
cmp rbp, 2
jb 0x1401583d4
mov qword [r12], rbx
call fcn.1400c18d0
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
xor ebp, ebp
jmp 0x14015832c
xor ebx, ebx
jmp 0x1401580de
xor ebx, ebx
jmp 0x1401582ff
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14015832a
call fcn.1400c18d0
mov rcx, qword [r12]
call fcn.1400def50
mov qword [r12], 0
jmp 0x1401581ce
xor edi, edi
jmp 0x14015818e
xor r14d, r14d
jmp 0x14015825c
xor ebx, ebx
jmp 0x1401582f7
call fcn.1400c18d0
mov rcx, qword [r12]
call fcn.1400def50
mov qword [r12], 0
jmp 0x1401583c5