Function at 0x1400787a0
Capabilities:
Check if file exists

Disassembly:
push rbx
push rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4a0
mov rax, qword [0x1400db748]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov ebx, dword [rsp + 0x500]
mov rax, rdx
mov r15d, dword [rsp + 0x508]
mov r13d, ecx
mov qword [rsp + 0x70], rdx
mov edi, 1
mov edx, edi
mov rcx, rax
mov r14d, r9d
mov r12d, r8d
mov rbp, 0xffffffffffffffff
call fcn.140042350
mov qword [rsp + 0x68], rax
mov eax, r14d
and eax, 3
cmp al, 3
jne 0x140078b28
cmp ebx, 3
je 0x14007881f
lea rcx, str._s:_must_open_with_OPEN_EXISTING_n
jmp 0x140078b2f
bt r15d, 0x1a
jae 0x140078832
lea rcx, str._s:_FILE_FLAG_DELETE_ON_CLOSE_disallowed_n
jmp 0x140078b2f
lea rdx, str.authd.forceUseForStandaloneVMX
mov dword [rsp + 0x50], 0
xor ecx, ecx
or r14d, 4
call fcn.140013090
test al, al
jne 0x1400788ee
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x60]
mov edx, 0x2000a
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x14007888c
call fcn.140013250
mov r8, rax
lea rdx, str.Cant_get_our_own_token.__s._n
xor ecx, ecx
call fcn.140030510
mov rbx, rax
jmp 0x1400788d6
mov rcx, qword [rsp + 0x60]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x58]
mov edx, edi
call fcn.1400220e0
mov rcx, qword [rsp + 0x60]
test al, al
jne 0x140078a09
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, qword [rsp + 0x58]
lea rdx, str.An_error_occurred_while_checking_group_membership:_n_n_s_n
xor ecx, ecx
call fcn.140030510
mov rcx, qword [rsp + 0x58]
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdx, rbx
lea rcx, [0x140084fdc]
call fcn.14001dba0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsp + 0x498], rsi
xor esi, esi
xor ebx, ebx
nop word [rax + rax]
mov edx, 0x1388
lea rcx, str..pipe_vmware_authdpipe
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x140078a74
mov qword [rsp + 0x30], 0
lea rcx, str..pipe_vmware_authdpipe
mov dword [rsp + 0x28], 0x40000000
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x12008b
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140078a74
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
jne 0x14007896c
inc ebx
cmp ebx, 3
jl 0x140078900
lea rax, [rsp + 0x58]
mov r9d, r13d
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x80]
mov rax, qword [rsp + 0x70]
mov r8, rsi
mov dword [rsp + 0x40], r15d
mov edx, 0x400
mov dword [rsp + 0x38], 3
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
call fcn.140078510
mov edi, eax
test eax, eax
jne 0x1400789ba
mov rbp, qword [rsp + 0x58]
test rsi, rsi
je 0x1400789c8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x498]
test edi, edi
je 0x140078b3b
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140078afb
sub edi, 1
je 0x140078af0
sub edi, 1
je 0x140078ae9
cmp edi, 2
je 0x140078ae2
lea ecx, [rax + 0x1f]
jmp 0x140078af5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x50], 0
je 0x1400788ee
lea eax, [r13 - 0x86b]
cmp eax, edi
ja 0x140078b6c
mov rcx, qword [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov r8d, r14d
mov dword [rsp + 0x28], r15d
mov edx, r12d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x140078b3b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1400788ee
jmp 0x140078b3b
test rsi, rsi
jne 0x14007896c
call fcn.140013250
mov rbx, rax
call fcn.140030270
mov r9, rax
mov qword [rsp + 0x28], rbx
lea rax, str.the_VMware_Authorization_Service
mov edx, 0x400
lea r8, str._s_could_not_connect_to__s_for_the_following_reason:__s_n
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x80]
call fcn.140030680
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x140078aca
lea edi, [rsi + 2]
jmp 0x1400789c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
mov ecx, 4
cmove edi, ecx
jmp 0x1400789c8
mov ecx, 0xaa
jmp 0x140078af5
mov ecx, 5
jmp 0x140078af5
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x80]
mov ebx, eax
lea rcx, [0x140084fdc]
call fcn.14001bf60
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbp, 0xffffffffffffffff
jmp 0x140078b3b
lea rcx, str._s:_must_open_with_share_read_write_n
lea rdx, str.W32Auth_OpenSecurable
call fcn.14001dba0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, rbp
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.14006a480
add rsp, 0x4a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret
mov r8d, 0xbf
lea rdx, str.boralibwin32authwin32auth.c
lea rcx, str.NOT_IMPLEMENTED__s:_d_n
call fcn.14002b900
int3