Function at 0x140258880
Capabilities:
Check if file exists

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xf0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x1405420e0]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov r15, r8
mov r14, rdx
mov r12, rcx
lea rsi, [rdx + 0x20]
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x1402588c8
mov rcx, qword [rsi]
call qword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathFileExistsW]
nop dword [rax + rax]
xor edi, edi
movdqa xmm0, xmmword [0x140420310]
test eax, eax
jne 0x140258955
movdqu xmmword [rbp - 0x69], xmm0
mov word [rbp - 0x79], di
lea rdx, str.Remediation_has_not_occurred_since_the_file
lea rcx, [rbp - 0x79]
call fcn.140055574
nop
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x140258909
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
lea rcx, [rbp - 0x79]
call fcn.140068814
mov r8d, reloc.OLEAUT32.dll_SafeArrayUnlock
lea rdx, str._does_no_longer_exist
lea rcx, [rbp - 0x79]
call fcn.140068814
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x79]
mov r8, rsi
mov ebx, 0x80070002
mov edx, ebx
call fcn.140256154
nop
lea rcx, [rbp - 0x79]
call fcn.140055f70
mov eax, ebx
jmp 0x140258b7f
movdqu xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x38], di
lea r8, [rsp + 0x38]
mov rdx, rsi
call fcn.140258ba4
mov ebx, eax
cmp eax, 5
jne 0x1402589c1
call fcn.1400550c0
mov rcx, qword [rax + 8]
cmp dword [rcx], 4
jbe 0x140258b73
lea rax, str.The_check_if_the_sha1_of_the_file_has_been_changed_was_skipped_since_there_was_access_denied_error_when_trying_to_read_the_file_hash
mov qword [rbp - 0x59], rax
mov qword [rbp - 0x51], MsiSourceListAddMediaDiskW
lea rax, [rbp - 0x79]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140485c4f]
call fcn.140001208
jmp 0x140258b73
test ebx, ebx
jns 0x1402589da
mov r9, r15
mov r8, rsi
mov edx, ebx
mov rcx, r12
call fcn.140255e6c
jmp 0x140258b71
add r14, 0x40
xor r8d, r8d
mov rdx, r14
lea rcx, [rbp - 0x79]
call fcn.14006d604
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x79]
call fcn.1400c9ad4
mov ebx, eax
lea rcx, [rbp - 0x79]
call fcn.140055f70
test ebx, ebx
je 0x140258b73
movdqa xmm0, xmmword [0x140420310]
movdqu xmmword [rbp - 0x69], xmm0
mov word [rbp - 0x79], di
lea rdx, str.Remediation_has_not_occurred_since_the_file
lea rcx, [rbp - 0x79]
call fcn.140055574
nop
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x140258a3d
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
lea rcx, [rbp - 0x79]
call fcn.140068814
mov r8d, reloc.OLEAUT32.dll_SafeArrayAccessData
lea rdx, str._sha1_has_been_changed
lea rcx, [rbp - 0x79]
call fcn.140068814
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x79]
mov r8, rsi
mov ebx, 0x80073bc5
mov edx, ebx
mov rcx, r12
call fcn.140255f00
call fcn.1400550c0
mov r10, qword [rax + 8]
cmp dword [r10], 3
jbe 0x140258b68
lea rax, [rbp - 0x79]
cmp qword [rbp - 0x61], 8
cmovae rax, qword [rbp - 0x79]
lea rdx, [0x1403cb630]
mov r8, rdx
mov rcx, rdi
or r9, 0xffffffffffffffff
test rax, rax
je 0x140258ac1
mov r8, rax
mov rcx, r9
inc rcx
cmp word [rax + rcx*2], di
jne 0x140258ab8
mov qword [rbp - 0x21], r8
lea eax, [rcx*2 + 2]
mov dword [rbp - 0x19], eax
mov dword [rbp - 0x15], edi
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
mov r8, rdx
mov rax, rdi
test rcx, rcx
je 0x140258afd
mov r8, rcx
mov rax, r9
inc rax
cmp word [rcx + rax*2], di
jne 0x140258af4
mov qword [rbp - 0x11], r8
lea eax, [rax*2 + 2]
mov dword [rbp - 9], eax
mov dword [rbp - 5], edi
cmp qword [r14 + 0x18], 8
jb 0x140258b18
mov r14, qword [r14]
mov rax, rdi
test r14, r14
je 0x140258b30
mov rdx, r14
mov rax, r9
inc rax
cmp word [r14 + rax*2], di
jne 0x140258b26
mov qword [rbp - 1], rdx
lea eax, [rax*2 + 2]
mov dword [rbp + 7], eax
mov dword [rbp + 0xb], edi
lea rax, [rbp - 0x41]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 5
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140485d1e]
mov rcx, r10
call fcn.140001208
nop
lea rcx, [rbp - 0x79]
call fcn.140055f70
mov edi, ebx
lea rcx, [rsp + 0x38]
call fcn.140055f70
mov eax, edi
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.140356560
add rsp, 0xf0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret