Function at 0x14016cf80
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
movaps xmmword [rsp + 0xa0], xmm6
mov rax, qword [0x140362028]
xor rax, rsp
mov qword [rsp + 0x98], rax
cmp byte [rcx + 0x6c], 0
je 0x14016d03b
mov r14, rdx
mov r13, rcx
mov rbx, qword [rcx + 0x20]
mov rax, qword [rcx + 0x18]
movabs r12, 0xaaaaaaaaaaaaaaab
movabs r15, 0xfffffffffffffff
xorps xmm6, xmm6
movaps xmmword [rsp + 0x70], xmm6
mov qword [rsp + 0x80], 0
sub rbx, rax
je 0x14016d09a
sar rbx, 3
imul rbx, r12
cmp rbx, r15
ja 0x14016d436
shl rbx, 4
mov rcx, rbx
call fcn.1401a2e6c
mov rsi, rax
mov qword [rsp + 0x70], rax
lea rdi, [rax + rbx]
mov qword [rsp + 0x80], rdi
test rbx, rbx
je 0x14016d045
mov rcx, rsi
xor edx, edx
mov r8, rbx
call fcn.1401a64a0
jmp 0x14016d048
mov edi, 0x3f0
jmp 0x14016d3d9
mov rdi, rsi
mov qword [rsp + 0x78], rdi
mov ebx, 1
xor ebp, ebp
xor edi, edi
mov dword [rsi + rdi + 8], reloc.WS2_32.dll_recv
mov rcx, qword [r13 + 0x18]
add rcx, rbp
call fcn.1400e69a0
mov rcx, qword [rsp + 0x70]
mov qword [rcx + rdi], rax
mov rax, qword [r13 + 0x20]
sub rax, qword [r13 + 0x18]
sar rax, 3
imul rax, r12
cmp rbx, rax
jae 0x14016d09a
mov rsi, qword [rsp + 0x70]
inc rbx
add rdi, 0x10
add rbp, 0x18
jmp 0x14016d056
mov rbx, qword [r13 + 8]
mov rax, qword [r13]
movaps xmmword [rsp + 0x50], xmm6
mov qword [rsp + 0x60], 0
sub rbx, rax
je 0x14016d150
sar rbx, 3
imul rbx, r12
cmp rbx, r15
ja 0x14016d440
shl rbx, 4
mov rcx, rbx
call fcn.1401a2e6c
mov rsi, rax
mov qword [rsp + 0x50], rax
lea rdi, [rax + rbx]
mov qword [rsp + 0x60], rdi
test rbx, rbx
je 0x14016d0fb
mov rcx, rsi
xor edx, edx
mov r8, rbx
call fcn.1401a64a0
jmp 0x14016d0fe
mov rdi, rsi
mov qword [rsp + 0x58], rdi
mov ebx, 1
xor ebp, ebp
xor edi, edi
mov dword [rsi + rdi + 8], 0
mov rcx, qword [r13]
add rcx, rbp
call fcn.1400e69a0
mov rcx, qword [rsp + 0x50]
mov qword [rcx + rdi], rax
mov rax, qword [r13 + 8]
sub rax, qword [r13]
sar rax, 3
imul rax, r12
cmp rbx, rax
jae 0x14016d150
mov rsi, qword [rsp + 0x50]
inc rbx
add rdi, 0x10
add rbp, 0x18
jmp 0x14016d10c
mov qword [rsp + 0x48], 0
mov rbx, qword [rsp + 0x70]
mov r8, qword [rsp + 0x78]
mov r15, qword [rsp + 0x50]
mov rax, qword [rsp + 0x58]
cmp rbx, r8
jne 0x14016d185
cmp r15, rax
jne 0x14016d185
cmp byte [r13 + 0x6e], 0
mov rax, r15
je 0x14016d407
sub rax, r15
shr rax, 4
sub r8, rbx
shr r8, 4
movzx edx, byte [r13 + 0x6e]
mov rcx, qword [r13 + 0x48]
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, rbx
call qword [sym.imp.ADVAPI32.dll_CreateRestrictedToken]
test eax, eax
je 0x14016d1ec
mov rsi, qword [rsp + 0x48]
test rsi, rsi
je 0x14016d1f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp rsi, 0xffffffffffffffff
je 0x14016d1fd
call fcn.1400c5840
jmp 0x14016d1ff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14016d3bf
xor esi, esi
jmp 0x14016d207
xor esi, esi
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [r13 + 0x6e], 0
je 0x14016d279
cmp byte [r13 + 0x6f], 0
je 0x14016d279
lea r8, [rsp + 0x8c]
mov dword [r8 + 8], 0
mov qword [r8], 0
mov dword [r8 - 4], 1
lea rdx, str.SeChangeNotifyPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x14016d3a0
lea r8, [rsp + 0x88]
mov dword [r8 + 0xc], 4
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov rcx, rsi
xor edx, edx
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x14016d3a0
cmp byte [r13 + 0x6d], 0
je 0x14016d28a
mov rcx, rsi
call fcn.14016e1b0
jmp 0x14016d2a0
mov rcx, rsi
mov edx, 0xa
xor r8d, r8d
mov r9d, 0x10000000
call fcn.14016e0c0
test al, al
je 0x14016d3a0
mov rbp, qword [r13 + 0x30]
mov rdi, qword [r13 + 0x38]
cmp rbp, rdi
je 0x14016d2d6
mov r8d, dword [rbp + 0x18]
mov r9d, dword [rbp + 0x1c]
mov rcx, rsi
mov rdx, rbp
call fcn.14016de80
test al, al
je 0x14016d3a0
add rbp, 0x20
jmp 0x14016d2b0
mov rcx, rsi
mov edx, 0x10000000
call fcn.14016e2b0
test al, al
je 0x14016d3a0
mov edx, dword [r13 + 0x68]
mov rcx, rsi
call fcn.140144070
mov edi, eax
test eax, eax
jne 0x14016d3a8
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r12, [rsp + 0x88]
mov qword [r12], rax
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rdi
mov rbp, rax
call rdi
xor edi, edi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 0xf01ff
mov rcx, rax
mov rdx, rsi
mov r8, rbp
mov r9, r12
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x14016d3a0
mov rbp, qword [rsp + 0x88]
cmp qword [r14], rbp
je 0x14016d3a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
mov rax, qword [r14]
inc rax
cmp rax, 2
jb 0x14016d383
call fcn.1400c5840
mov rcx, qword [r14]
call fcn.1400e21b0
mov qword [r14], 0
lea rax, [rbp + 1]
cmp rax, 2
jb 0x14016d395
mov qword [r14], rbp
call fcn.1400c5840
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14016d3a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14016d3bf
call fcn.1400c5840
mov rcx, rsi
call fcn.1400e21b0
test r15, r15
je 0x14016d3cc
mov rcx, r15
call fcn.1401a2ea8
test rbx, rbx
je 0x14016d3d9
mov rcx, rbx
call fcn.1401a2ea8
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1401a4270
mov eax, edi
movaps xmm6, xmmword [rsp + 0xa0]
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [r13 + 0x48]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov edx, 0xf01ff
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
jmp 0x14016d1c9
lea rcx, [rsp + 0x70]
call fcn.14003c400
lea rcx, [rsp + 0x50]
call fcn.14003c400
int3