Function at 0x1400dccd4
Capabilities:
Check if file exists

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x418]
sub rsp, 0x518
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov rax, qword [0x14015d3e0]
xor rax, rsp
mov qword [rbp + 0x400], rax
mov dword [rsp + 0x38], r9d
mov qword [rsp + 0x68], r8
mov r15, rdx
mov qword [rsp + 0x60], rdx
mov rbx, rcx
mov qword [rsp + 0x70], rcx
xor r13d, r13d
mov edi, r13d
lea esi, [r13 + 1]
lea rcx, str.AsrPerformBackup
call fcn.1400ed218
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
xor edx, edx
mov r8d, 0x228
lea rcx, [rbp - 0x40]
call sub.msvcrt.dll_memset
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x60], xmm0
mov qword [rsp + 0x58], r13
mov dword [rsp + 0x78], r13d
mov qword [rbp - 0x80], r13
mov dword [rbp - 0x78], r13d
mov qword [rbp - 0x70], r13
mov eax, r13d
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x50], rax
mov r12d, r13d
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1f0]
call sub.msvcrt.dll_memset
lea r14, [0x14013c0c8]
xor eax, eax
test rbx, rbx
jne 0x1400dceb8
mov esi, eax
lea edi, [rbx + 0x57]
lea rbx, section..data
mov rcx, qword [section..data]
cmp rcx, rbx
je 0x1400dcdec
test byte [rcx + 0x1c], 8
je 0x1400dcdec
lea edx, [rax + 0x11]
lea rax, str.ppwszXmlDocOut
mov r9d, edi
mov r8, r14
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx + 0x10]
call fcn.1400d9dd4
xor r14d, r14d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, r12
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, r13
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov edx, edi
call fcn.1400eb428
test eax, eax
jne 0x1400dce51
mov rcx, qword [section..data]
cmp rcx, rbx
je 0x1400dce51
test byte [rcx + 0x1c], 8
je 0x1400dce51
lea edx, [rax + 0x25]
mov r9d, edi
lea r8, [0x14013c0c8]
mov rcx, qword [rcx + 0x10]
call fcn.1400da014
lea rcx, str.AsrPerformBackup
call fcn.1400ed25c
mov ecx, edi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
nop
lea rcx, [rsp + 0x78]
call fcn.1400dbc18
nop
cmp qword [rsp + 0x58], r14
je 0x1400dce89
lea rcx, [rsp + 0x58]
call fcn.1400db2b8
nop
lea rcx, [rbp - 0x60]
call fcn.1400e1b20
mov eax, esi
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.1400164a0
add rsp, 0x518
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400eb2e0
nop
call fcn.1400ecf24
xor ebx, ebx
test eax, eax
jne 0x1400dcf24
mov esi, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
lea rbx, section..data
mov rax, qword [section..data]
cmp rax, rbx
je 0x1400dcdec
test byte [rax + 0x1c], 8
je 0x1400dcdec
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r9d, eax
mov edx, 0x12
lea rax, str.GetLastError__
mov r8, r14
mov rcx, qword [section..data]
jmp 0x1400dcdde
lea rcx, [rsp + 0x40]
call fcn.1400eb848
test eax, eax
jne 0x1400dcf98
mov esi, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
lea rbx, section..data
mov rax, qword [section..data]
cmp rax, rbx
je 0x1400dcf8e
test byte [rax + 0x1c], 8
je 0x1400dcf8e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r9d, eax
mov edx, 0x13
lea rax, str.GetLastError__
mov qword [rsp + 0x20], rax
mov r8, r14
mov rcx, qword [section..data]
mov rcx, qword [rcx + 0x10]
call fcn.1400d9dd4
mov r13, qword [rsp + 0x40]
jmp 0x1400dcdec
mov r13, qword [rsp + 0x40]
or r14, 0xffffffffffffffff
mov rax, r14
inc rax
cmp word [r13 + rax*2], bx
jne 0x1400dcfa4
cmp rax, 2
ja 0x1400dcff8
mov esi, ebx
mov r9d, reloc.VssTrace.DLL_Ordinal_11
mov edi, r9d
lea rbx, section..data
mov rcx, qword [section..data]
cmp rcx, rbx
je 0x1400dcdec
test byte [rcx + 0x1c], 8
je 0x1400dcdec
lea edx, [r9 + 9]
lea rax, str.ERROR_BAD_FORMAT
lea r8, [0x14013c0c8]
jmp 0x1400dcdde
mov rax, r14
inc rax
cmp word [r13 + rax*2], bx
jne 0x1400dcffb
cmp word [r13 + rax*2 - 2], 0x5c
jne 0x1400dd023
mov rax, r14
inc rax
cmp word [r13 + rax*2], bx
jne 0x1400dd012
mov word [r13 + rax*2 - 2], bx
mov eax, 0x3f
mov word [r13 + 2], ax
lea rbx, section..data
mov rcx, qword [section..data]
cmp rcx, rbx
je 0x1400dd05c
test byte [rcx + 0x1c], 2
je 0x1400dd05c
lea edx, [rax - 0x2a]
mov r9, r13
lea r8, [0x14013c0c8]
mov rcx, qword [rcx + 0x10]
call fcn.1400d9f2c
mov rdx, r13
mov rcx, r15
call fcn.1400ec698
xor ecx, ecx
test eax, eax
jne 0x1400dd0be
mov esi, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
mov rax, qword [section..data]
cmp rax, rbx
je 0x1400dcdec
test byte [rax + 0x1c], 8
je 0x1400dcdec
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r9d, eax
mov edx, 0x16
lea rax, str.MwszStringAppend_ppmwszSelectedCriticalVolumes__pwszBootVolGuidName_
lea r8, [0x14013c0c8]
jmp 0x1400dcf18
lea rcx, [rsp + 0x48]
call fcn.1400eba40
mov r12, qword [rsp + 0x48]
xor ecx, ecx
test eax, eax
jne 0x1400dd14a
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r15d, eax
call fcn.1400e2a40
cmp eax, 2
je 0x1400dd242
xor r14d, r14d
mov esi, r14d
mov r12d, 0x80042416
mov ecx, r12d
call fcn.1400ed2a0
mov edi, eax
mov rcx, qword [section..data]
cmp rcx, rbx
je 0x1400dd140
test byte [rcx + 0x1c], 8
je 0x1400dd140
lea edx, [r14 + 0x17]
mov dword [rsp + 0x28], r15d
lea rax, str.VSS_E_ASRERROR_SYSTEM_PARTITION_HIDDEN
mov qword [rsp + 0x20], rax
mov r9d, r12d
lea r8, [0x14013c0c8]
mov rcx, qword [rcx + 0x10]
call fcn.1400dcb38
mov r12, qword [rsp + 0x48]
jmp 0x1400dcdef
mov rax, r14
inc rax
cmp word [r12 + rax*2], cx
jne 0x1400dd14d
cmp rax, 2
ja 0x1400dd18b
mov esi, ecx
mov r9d, reloc.VssTrace.DLL_Ordinal_11
mov edi, r9d
mov rcx, qword [section..data]
cmp rcx, rbx
je 0x1400dcdec
test byte [rcx + 0x1c], 8
je 0x1400dcdec
lea edx, [r9 + 0xd]
jmp 0x1400dcfe5
mov rax, r14
inc rax
cmp word [r12 + rax*2], cx
jne 0x1400dd18e
cmp word [r12 + rax*2 - 2], 0x5c
jne 0x1400dd1b4
mov rax, r14
inc rax
cmp word [r12 + rax*2], cx
jne 0x1400dd1a4
mov word [r12 + rax*2 - 2], cx
mov eax, 0x3f
mov word [r12 + 2], ax
mov rcx, qword [section..data]
cmp rcx, rbx
je 0x1400dd1e7
test byte [rcx + 0x1c], 2
je 0x1400dd1e7
lea edx, [rax - 0x26]
mov r9, r12
lea r8, [0x14013c0c8]
mov rcx, qword [rcx + 0x10]
call fcn.1400d9f2c
mov rdx, r12
mov rcx, r15
call fcn.1400ec698
xor ecx, ecx
test eax, eax
jne 0x1400dd242
mov esi, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
mov rax, qword [section..data]
cmp rax, rbx
je 0x1400dcdec
test byte [rax + 0x1c], 8
je 0x1400dcdec
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r9d, eax
mov edx, 0x1a
lea rax, str.MwszStringAppend_ppmwszSelectedCriticalVolumes__pwszSysVolGuidName_
jmp 0x1400dd0b2
lea rcx, [rbp + 0x1f0]
call fcn.1400eea50
mov r15d, eax
xor edx, edx
test eax, eax
je 0x1400dd37a
cmp word [rbp + 0x1f0], dx
je 0x1400dd37a
lea rax, [rbp + 0x1f0]
inc r14
cmp word [rax + r14*2], dx
jne 0x1400dd26f
cmp r14d, 2
ja 0x1400dd2ad
mov esi, edx
mov r9d, reloc.VssTrace.DLL_Ordinal_11
mov edi, r9d
mov rcx, qword [section..data]
cmp rcx, rbx
je 0x1400dcdec
test byte [rcx + 0x1c], 8
je 0x1400dcdec
lea edx, [r9 + 0x10]
jmp 0x1400dcfe5
lea ecx, [r14 - 1]
add rcx, rcx
cmp word [rbp + rcx + 0x1f0], 0x5c
jne 0x1400dd2d4
cmp rcx, 0x208
jae 0x1400dd374
mov word [rbp + rcx + 0x1f0], dx
mov eax, 0x3f
mov word [rbp + 0x1f2], ax
mov rcx, qword [section..data]
cmp rcx, rbx
je 0x1400dd30c
test byte [rcx + 0x1c], 2
je 0x1400dd30c
lea edx, [rax - 0x23]
lea r9, [rbp + 0x1f0]
lea r8, [0x14013c0c8]
mov rcx, qword [rcx + 0x10]
call fcn.1400d9f2c
lea rdx, [rbp + 0x1f0]
mov r14, qword [rsp + 0x60]
mov rcx, r14
call fcn.1400ec698
xor ecx, ecx
test eax, eax
jne 0x1400dd41e
mov esi, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
mov rax, qword [section..data]
cmp rax, rbx
je 0x1400dcdec
test byte [rax + 0x1c], 8
je 0x1400dcdec
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r9d, eax
mov edx, 0x1d
lea rax, str.MwszStringAppend__ppmwszSelectedCriticalVolumes__wszWinReVolumeGuid__
jmp 0x1400dd0b2
call fcn.1400167c8
int3
mov rax, qword [section..data]
cmp rax, rbx
je 0x1400dd3b7
test byte [rax + 0x1c], 2
je 0x1400dd3b7
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r9d, eax
mov edx, 0x1e
lea r8, [0x14013c0c8]
mov rcx, qword [section..data]
mov rcx, qword [rcx + 0x10]
call fcn.1400da014
test r15d, r15d
jne 0x1400dd419
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
lea r9d, [r15 + 0xe]
cmp eax, r9d
jne 0x1400dd419
xor r14d, r14d
mov esi, r14d
mov edi, r9d
mov rcx, qword [section..data]
cmp rcx, rbx
je 0x1400dcdef
test byte [rcx + 0x1c], 8
je 0x1400dcdef
lea edx, [r15 + 0x1f]
lea rax, str.ERROR_OUTOFMEMORY
mov qword [rsp + 0x20], rax
lea r8, [0x14013c0c8]
mov rcx, qword [rcx + 0x10]
call fcn.1400d9dd4
jmp 0x1400dcdef
mov r14, qword [rsp + 0x60]
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x20], eax
mov r15, qword [rsp + 0x68]
mov r9, r15
mov r8, r14
mov edx, esi
lea rcx, [rbp - 0x60]
call fcn.1400eabcc
xor ecx, ecx
test eax, eax
jne 0x1400dd48c
mov esi, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
mov rax, qword [section..data]
cmp rax, rbx
je 0x1400dcdec
test byte [rax + 0x1c], 8
je 0x1400dcdec
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edx, 0x20
mov r9d, eax
lea rax, str.GetLastError__
jmp 0x1400dd0b2
lea rcx, [rsp + 0x58]
call fcn.1400f4204
xor ecx, ecx
test eax, eax
jne 0x1400dd4d9
mov esi, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
mov rax, qword [section..data]
cmp rax, rbx
je 0x1400dcdec
test byte [rax + 0x1c], 8
je 0x1400dcdec
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edx, 0x21
jmp 0x1400dd47d
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x20], eax
mov r9, r15
mov r8, qword [r14]
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x78]
call fcn.1400dc480
xor ecx, ecx
test eax, eax
jne 0x1400dd545
mov esi, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
mov rax, qword [section..data]
cmp rax, rbx
je 0x1400dcdec
test byte [rax + 0x1c], 8
je 0x1400dcdec
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r9d, eax
mov edx, 0x22
lea rax, str.asr_ldm.InitializeForBackup__asr_sys__ppmwszSelectedCriticalVolumes__rgIncludedDisks__cIncludedDisks__
jmp 0x1400dd0b2
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x60]
call fcn.1400dd63c
xor ecx, ecx
test eax, eax
jne 0x1400dd5c9
mov esi, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
mov rax, qword [section..data]
cmp rax, rbx
je 0x1400dd5bc
test byte [rax + 0x1c], 8
je 0x1400dd5bc
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r9d, eax
mov edx, 0x23
lea rax, str.GetLastError__
mov qword [rsp + 0x20], rax
lea r8, [0x14013c0c8]
mov rcx, qword [section..data]
mov rcx, qword [rcx + 0x10]
call fcn.1400d9dd4
mov rcx, qword [rsp + 0x50]
xor r14d, r14d
jmp 0x1400dcdf4
call fcn.1400ee908
xor r14d, r14d
test eax, eax
jne 0x1400dd5fa
mov rcx, qword [section..data]
cmp rcx, rbx
je 0x1400dd5fa
test byte [rcx + 0x1c], 4
je 0x1400dd5fa
lea edx, [rax + 0x24]
lea r8, [0x14013c0c8]
mov rcx, qword [rcx + 0x10]
call fcn.1400d9da8
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rcx, r14
jmp 0x1400dcdf4