Function at 0x140028fc0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm7
movaps xmmword [rsp + 0x2c0], xmm6
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov r15, rcx
mov rax, qword [0x14018a040]
xor rax, rsp
mov qword [rsp + 0x2b8], rax
movaps xmm6, xmmword [0x14015feb0]
lea rcx, [rsp + 0xb0]
movaps xmmword [rcx], xmm6
xor edx, edx
call fcn.140036f10
call qword [sym.imp.ole32.dll_CoImpersonateClient]
test eax, eax
js 0x1400291a0
mov edx, dword [rsp + 0x360]
lea r14, [rsp + 0x140]
mov rcx, r14
mov r8d, 0x40
call fcn.1401030e0
lea r12, [rsp + 0xb0]
mov rcx, r12
mov rdx, r14
call fcn.140036fc0
mov rcx, r14
call fcn.140036f90
mov rcx, r12
call fcn.1400868f0
test al, al
jne 0x1400291f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002909f
movzx r14d, ax
or r14d, 0x80070000
test eax, eax
cmovle r14d, eax
call qword [sym.imp.ole32.dll_CoRevertToSelf]
test r14d, r14d
jns 0x1400291f7
jmp 0x1400291a3
call qword [sym.imp.ole32.dll_CoRevertToSelf]
mov r14d, 0x80004005
jmp 0x1400291a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov r14d, 0x80004005
cmovne r14d, ecx
xor esi, esi
lea rcx, [rsp + 0x120]
call fcn.140036f90
lea rcx, [rsp + 0x140]
call fcn.14003ac40
test r14d, r14d
js 0x140029163
mov rbx, qword [rsp + 0x368]
lea rcx, [rsp + 0x90]
lea rdi, [rsp + 0x140]
mov rdx, rdi
call fcn.140103b80
mov rcx, rdi
call fcn.1400299e0
mov rcx, rdi
call fcn.14008b1f0
lea r15, [rsi + 1]
cmp r15, 2
jb 0x14002912e
call fcn.14008b040
cmp qword [rbx], rsi
je 0x140029161
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rbx]
inc rax
cmp rax, 2
jae 0x1400299b1
cmp r15, 2
jb 0x140029159
mov qword [rbx], rsi
call fcn.14008b040
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14002917a
call fcn.14008b040
mov rcx, rsi
call fcn.140086370
lea rcx, [rsp + 0x40]
call fcn.14003f200
lea rcx, [rsp + 0x270]
call fcn.14008b1f0
lea rcx, [rsp + 0x90]
call fcn.140103c70
jmp 0x1400291a3
mov r14d, eax
lea rcx, [rsp + 0xb0]
call fcn.140036f90
mov rcx, qword [rsp + 0x2b8]
xor rcx, rsp
cmp rcx, qword [0x14018a040]
je 0x1400291ca
call fcn.1400b6410
int3
mov eax, r14d
movaps xmm6, xmmword [rsp + 0x2c0]
movaps xmm7, xmmword [rsp + 0x2d0]
add rsp, 0x2e8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.ole32.dll_CoRevertToSelf]
mov r14, qword [rsp + 0x350]
movabs rbp, 0xaaaaaaaaaaaaaaaa
lea rcx, [rsp + 0x90]
mov qword [rcx + 0x10], rbp
movaps xmmword [rcx], xmm6
call fcn.140103b70
lea r12, [rsp + 0x120]
mov qword [r12 + 0x10], rbp
movaps xmmword [r12], xmm6
mov rcx, r12
call fcn.140103b70
mov rcx, r12
mov rdx, r14
call fcn.140103cb0
test al, al
jne 0x14002927b
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r14d, ax
or r14d, 0x80070000
test eax, eax
cmovle r14d, eax
jne 0x140029723
lea rcx, [rsp + 0x120]
call fcn.140103c70
mov r14d, 0x80004005
jmp 0x140029191
lea r14, [rsp + 0x100]
mov qword [r14 + 0x10], rbp
movaps xmmword [r14], xmm6
lea rcx, [rsp + 0x120]
call fcn.1400e7320
lea rcx, str.ChromeRecoveryCRX.crx
lea r8, [rsp + 0xf0]
mov qword [r8], rcx
mov qword [r8 + 8], 0x15
mov rcx, rax
mov rdx, r14
call fcn.14008bc70
lea rcx, [rsp + 0xd8]
mov rdx, r15
call fcn.14008b070
lea rcx, [rsp + 0x140]
movaps xmmword [rcx + 0x20], xmm6
movaps xmmword [rcx + 0x10], xmm6
movaps xmmword [rcx], xmm6
call fcn.14003ec70
call qword [sym.imp.ole32.dll_CoImpersonateClient]
test eax, eax
js 0x1400294db
lea r14, [rsp + 0x140]
lea rdx, [rsp + 0xd8]
mov rcx, r14
mov r8d, 0x80021
call fcn.14003ed00
mov rcx, r14
call fcn.1400875a0
test al, al
je 0x140029366
lea rcx, [rsp + 0x140]
call fcn.140037e10
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov r14d, 0x80070057
cmp eax, 1
jne 0x140029467
lea rcx, [rsp + 0x140]
call fcn.140037f60
dec rax
cmp rax, 0x98967e
ja 0x140029467
call qword [sym.imp.ole32.dll_CoRevertToSelf]
jmp 0x140029394
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140029461
movzx r14d, ax
or r14d, 0x80070000
test eax, eax
cmovle r14d, eax
call qword [sym.imp.ole32.dll_CoRevertToSelf]
test r14d, r14d
js 0x1400294de
lea r14, [rsp + 0x270]
movaps xmmword [r14 + 0x20], xmm6
movaps xmmword [r14 + 0x10], xmm6
movaps xmmword [r14], xmm6
mov rcx, r14
call fcn.14003ec70
lea rdx, [rsp + 0x100]
mov rcx, r14
mov r8d, 0x80048
call fcn.14003ed00
mov rcx, r14
call fcn.1400875a0
test al, al
je 0x1400294ae
mov ecx, 0x10000
call fcn.1400b50e8
mov r15, rax
neg rax
xor ecx, ecx
cmp rax, rcx
je 0x14002966d
mov byte [r15 + rcx], 0
inc rcx
cmp rcx, 0x10000
jne 0x1400293ea
xor r13d, r13d
lea r14, [rsp + 0x140]
lea r12, [rsp + 0x270]
mov rcx, r14
mov rdx, r15
mov r8d, 0x10000
call fcn.1400876f0
test eax, eax
js 0x140029477
je 0x14002945c
mov ebp, eax
mov eax, eax
add r13, rax
cmp r13, 0x989680
ja 0x14002946f
mov rcx, r12
mov rdx, r15
mov r8d, ebp
call fcn.140037e20
test eax, eax
js 0x140029477
cmp eax, ebp
je 0x140029417
mov r14d, 0x8000ffff
jmp 0x140029495
xor r14d, r14d
jmp 0x140029495
mov r14d, 0x80004005
call qword [sym.imp.ole32.dll_CoRevertToSelf]
jmp 0x1400294de
mov r14d, 0x80070057
jmp 0x140029495
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov r14d, 0x80004005
cmovne r14d, ecx
test r15, r15
movabs rbp, 0xaaaaaaaaaaaaaaaa
je 0x1400294cc
mov rcx, r15
call fcn.1400b5124
jmp 0x1400294cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov r14d, 0x80004005
cmovne r14d, ecx
lea rcx, [rsp + 0x270]
call fcn.14008c740
jmp 0x1400294de
mov r14d, eax
lea rcx, [rsp + 0x140]
call fcn.14008c740
lea rcx, [rsp + 0xd8]
call fcn.14008b1f0
test r14d, r14d
js 0x140029716
xorps xmm0, xmm0
movaps xmmword [rsp + 0x270], xmm0
xor r14d, r14d
mov qword [rsp + 0x280], r14
mov qword [rsp + 0x150], r14
movaps xmmword [rsp + 0x140], xmm0
mov qword [rsp + 0x2b0], r14
movaps xmmword [rsp + 0x2a0], xmm0
mov r15, qword [rbx]
mov r12, qword [rbx + 8]
mov ebx, 0
sub r12, r15
je 0x140029583
js 0x1400299ca
mov rcx, r12
call fcn.1400b50e8
mov r14, rax
mov qword [rsp + 0x2a0], rax
lea rbx, [rax + r12]
mov qword [rsp + 0x2b0], rbx
mov rcx, rax
mov rdx, r15
mov r8, r12
call fcn.1400e68b0
mov qword [rsp + reloc.SHELL32.dll_IsUserAnAdmin], rbx
mov ecx, 0x18
call fcn.1400b50e8
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], rax
lea r12, [rax + 0x18]
mov qword [rsp + 0xd0], r12
test rax, rax
je 0x14002966d
mov r15, rax
xorps xmm7, xmm7
movups xmmword [rax], xmm7
mov qword [rax + 0x10], 0
sub rbx, r14
je 0x1400295f7
js 0x1400299d7
mov rcx, rbx
call fcn.1400b50e8
mov qword [r15], rax
mov qword [r15 + 8], rax
lea r13, [rax + rbx]
mov qword [r15 + 0x10], r13
mov rcx, rax
mov rdx, r14
mov r8, rbx
call fcn.1400e68b0
mov qword [r15 + 8], r13
lea rbx, [rsp + 0xc0]
mov qword [rbx + 8], r12
movups xmmword [rsp + 0x28], xmm7
lea rax, [rsp + 0x270]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x100]
lea r9, [rsp + 0x140]
mov rdx, rdi
mov r8, rbx
call fcn.140106390
mov edi, eax
mov rbx, qword [rbx]
test rbx, rbx
je 0x140029699
mov r14, qword [rsp + 0xc8]
mov rcx, rbx
cmp r14, rbx
je 0x14002968c
add r14, 0xffffffffffffffe8
test r14, r14
je 0x14002966d
mov rcx, qword [r14]
test rcx, rcx
je 0x140029678
mov rax, qword [r14 + 8]
mov rdx, rax
sub rdx, rcx
dec rax
cmp rdx, rax
jbe 0x14002966f
ud2
mov qword [r14 + 8], rcx
call fcn.1400b5124
lea rax, [r14 - 0x18]
cmp r14, rbx
mov r14, rax
jne 0x14002964e
mov rcx, qword [rsp + 0xc0]
mov qword [rsp + 0xc8], rbx
call fcn.1400b5124
mov rcx, qword [rsp + 0x2a0]
test rcx, rcx
je 0x1400296c1
mov rax, qword [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
mov rdx, rax
sub rdx, rcx
dec rax
cmp rdx, rax
ja 0x14002966d
call fcn.1400b5124
mov rcx, qword [rsp + 0x140]
test rcx, rcx
je 0x1400296f1
mov rax, qword [rsp + 0x148]
mov rdx, rax
sub rdx, rcx
dec rax
cmp rdx, rax
ja 0x14002966d
mov qword [rsp + 0x148], rcx
call fcn.1400b5124
mov r14d, 0x80092009
test edi, edi
je 0x14002988f
cmp byte [rsp + 0x287], 0
jns 0x140029716
mov rcx, qword [rsp + 0x270]
call fcn.1400b5124
lea rcx, [rsp + 0x100]
call fcn.14008b1f0
lea rcx, [rsp + 0x120]
call fcn.140103c70
test r14d, r14d
js 0x140029191
mov rdi, qword [rsp + 0x358]
lea rbx, [rsp + 0x270]
mov qword [rbx + 0x10], rbp
movaps xmmword [rbx], xmm6
lea rcx, [rsp + 0x90]
call fcn.1400e7320
mov rcx, rax
mov rdx, rbx
mov r8, rdi
call fcn.14003e6b0
lea rdi, [rsp + 0x40]
movaps xmmword [rdi + 0x40], xmm6
movaps xmmword [rdi + 0x30], xmm6
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
movaps xmmword [rdi], xmm6
mov rcx, rdi
mov rdx, rbx
call fcn.14003ee40
xor ebp, ebp
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
call fcn.140105d10
lea rsi, [rsp + 0x140]
mov r8d, 0x98
mov rcx, rsi
mov dl, 0xaa
call fcn.1400e6f50
mov rcx, rsi
call fcn.14003abd0
mov byte [rsi + 0x22], 1
lea rcx, [rsp + 0x148]
call fcn.140038c00
lea rbx, [rsp + 0x120]
movaps xmmword [rbx], xmm6
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.140037470
mov rcx, rbx
call fcn.1400868f0
test al, al
je 0x1400290b0
lea rsi, [rsp + 0x100]
mov qword [rsi], 0
lea rcx, [rsp + 0xb0]
call fcn.140086910
mov rdi, rax
lea rcx, [rsp + 0x120]
call fcn.140086910
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 0x101000
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x1400290b0
mov rsi, qword [rsp + 0x100]
test rsi, rsi
je 0x1400299a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
xor r14d, r14d
cmp rsi, 0xffffffffffffffff
je 0x1400299aa
call fcn.14008b040
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400290d0
xorps xmm0, xmm0
lea rdi, [rsp + 0x40]
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
mov byte [rdi + 0x40], 0
lea rcx, [rsp + 0x120]
call fcn.1400e7320
lea rcx, [rsp + 0x100]
mov rdx, rax
mov r8, rdi
call fcn.140107e90
mov r14d, 0x8000ffff
test al, al
je 0x1400296ff
mov ecx, 1
call fcn.140089d00
test al, al
je 0x140029922
lea rcx, [rsp + 0x100]
call fcn.140038650
test al, al
jne 0x140029922
lea rdx, str.....chromeelevation_serviceelevated_recovery_impl.cc
lea rdi, [rsp + 0x140]
mov rcx, rdi
mov r8d, 0xbc
mov r9d, 1
call fcn.14003c3b0
mov rcx, rdi
call fcn.14003c9b0
mov ecx, 1
call fcn.140089d00
xor r14d, r14d
test al, al
je 0x1400296ff
lea rcx, [rsp + 0x120]
lea rdi, [rsp + 0xc0]
mov rdx, rdi
call fcn.140103b80
lea rcx, [rsp + 0x90]
mov rdx, rdi
call fcn.140103d30
test al, al
jne 0x14002998e
lea rdx, str.....chromeelevation_serviceelevated_recovery_impl.cc
lea rdi, [rsp + 0x140]
mov rcx, rdi
mov r8d, 0xbe
mov r9d, 1
call fcn.14003c3b0
mov rcx, rdi
call fcn.14003c9b0
lea rcx, [rsp + 0xc0]
call fcn.14008b1f0
jmp 0x1400296ff
xor esi, esi
xor r14d, r14d
jmp 0x1400290d0
xor esi, esi
jmp 0x140029882
call fcn.14008b040
mov rcx, qword [rbx]
call fcn.140086370
mov qword [rbx], 0
jmp 0x14002914b
lea rcx, [rsp + 0x2a0]
call fcn.1400e7bd0
mov rcx, r15
call fcn.1400e7bd0
int3