Function at 0x1400f9e71
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x398
movaps xmmword [rsp + 0x380], xmm7
movaps xmmword [rsp + 0x370], xmm6
mov r13, r9
mov rbp, r8
mov rbx, rdx
mov r12, rcx
mov rax, qword [0x140163028]
xor rax, rsp
mov qword [rsp + 0x368], rax
movzx eax, byte [rcx + 0x17]
test al, al
jns 0x1400f9ebf
mov rax, qword [r12 + 8]
mov edi, 0x80070057
cmp qword [rsp + 0x408], 0
je 0x1400fa242
mov r15d, dword [rsp + 0x400]
test r15d, r15d
je 0x1400fa242
test rax, rax
je 0x1400fa242
cmp byte [rbx + 0x17], 0
js 0x1400f9f05
je 0x1400f9f30
xorps xmm0, xmm0
movaps xmmword [rsp + 0x210], xmm0
mov rcx, rbx
jmp 0x1400f9f1a
cmp qword [rbx + 8], 0
je 0x1400f9f30
xorps xmm0, xmm0
movaps xmmword [rsp + 0x210], xmm0
mov rcx, qword [rbx]
lea rdx, [rsp + 0x210]
call qword [sym.imp.ole32.dll_IIDFromString]
test eax, eax
js 0x1400fa240
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x210]
mov qword [rdi + 0x10], rax
movaps xmm6, xmmword [0x140141df0]
movaps xmmword [rdi], xmm6
movzx eax, byte [rbp + 0x17]
test al, al
mov rcx, qword [rbp]
cmovns rcx, rbp
lea rdx, [rsp + 0x170]
mov qword [rdx], rcx
cmovs rax, qword [rbp + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x1c0]
mov rcx, rsi
call fcn.14009dba0
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea r14, [rsp + 0x190]
mov qword [r14], rcx
cmovs rax, qword [rsi + 8]
mov qword [r14 + 8], rax
mov rcx, rdi
mov rdx, r14
call fcn.1400501a0
cmp byte [rsi + 0x17], 0
jns 0x1400f9fc1
mov rcx, qword [rsp + 0x1c0]
call fcn.140105028
mov rcx, qword [rsp + 0x210]
cmp rcx, qword [rsp + 0x218]
je 0x1400fa006
xorps xmm0, xmm0
movaps xmmword [rsp + 0x1c0], xmm0
cmp byte [r13 + 0x17], 0
mov rcx, r13
jns 0x1400f9fec
mov rcx, qword [r13]
lea rdx, [rsp + 0x1c0]
call qword [sym.imp.ole32.dll_IIDFromString]
mov edi, eax
mov rcx, qword [rsp + 0x210]
jmp 0x1400fa00b
mov edi, 0x80070057
test rcx, rcx
je 0x1400fa01d
mov qword [rsp + 0x218], rcx
call fcn.140105028
test edi, edi
js 0x1400fa242
lea rcx, [rsp + 0x1c0]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rcx + 0x40], rax
movaps xmmword [rcx + 0x30], xmm6
movaps xmmword [rcx + 0x20], xmm6
movaps xmmword [rcx + 0x10], xmm6
movaps xmmword [rcx], xmm6
xor edx, edx
call fcn.14009a0a0
movzx ecx, byte [rbx + 0x17]
mov rax, rcx
test cl, cl
jns 0x1400fa060
mov rax, qword [rbx + 8]
test rax, rax
je 0x1400fa0c2
test cl, cl
jns 0x1400fa06c
mov rbx, qword [rbx]
lea r8, [rsp + 0xc0]
mov qword [r8], rbx
mov qword [r8 + 8], rax
xorps xmm0, xmm0
lea rsi, [rsp + 0x210]
movups xmmword [rsi + 8], xmm0
mov byte [rsi + 0x17], 7
mov dword [rsi], 0x67707061
mov dword [rsi + 3], 0x64697567
mov byte [rsi + 7], 0
lea rcx, [rsp + 0x1c0]
mov rdx, rsi
call fcn.140024930
cmp byte [rsi + 0x17], 0
jns 0x1400fa0c2
mov rcx, qword [rsp + 0x210]
call fcn.140105028
movzx eax, byte [rbp + 0x17]
test al, al
mov rcx, qword [rbp]
cmovns rcx, rbp
lea r8, [rsp + 0xb0]
mov qword [r8], rcx
cmovs rax, qword [rbp + 8]
mov qword [r8 + 8], rax
movabs rax, 0xf00000000000000
lea rsi, [rsp + 0x210]
mov qword [rsi + 0x10], rax
movabs rax, 0x2d726573776f7262
mov qword [rsi], rax
movabs rax, 0x6e6f69737265762d
mov qword [rsi + 7], rax
mov byte [rsi + 0xf], 0
lea rcx, [rsp + 0x1c0]
mov rdx, rsi
call fcn.140024930
cmp byte [rsi + 0x17], 0
jns 0x1400fa13c
mov rcx, qword [rsp + 0x210]
call fcn.140105028
movzx eax, byte [r13 + 0x17]
test al, al
mov rcx, qword [r13]
cmovns rcx, r13
lea r8, [rsp + 0xa0]
mov qword [r8], rcx
cmovs rax, qword [r13 + 8]
mov qword [r8 + 8], rax
xorps xmm7, xmm7
lea rsi, [rsp + 0x210]
movaps xmmword [rsi], xmm7
mov qword [rsi + 0x10], 0
mov byte [rsi + 0x17], 9
movabs rax, 0x696e6f6973736573
mov qword [rsi], rax
mov word [rsi + 8], 0x64
lea rcx, [rsp + 0x1c0]
mov rdx, rsi
call fcn.140024930
cmp byte [rsi + 0x17], 0
jns 0x1400fa1af
mov rcx, qword [rsp + 0x210]
call fcn.140105028
lea rsi, [rsp + 0x210]
movaps xmmword [rsi], xmm7
mov qword [rsi + 0x10], 0
mov byte [rsi + 0x17], 6
mov dword [rsi], 0x74737973
mov word [rsi + 4], 0x6d65
mov byte [rsi + 6], 0
lea rcx, [rsp + 0x1c0]
mov rdx, rsi
call fcn.14009a8d0
cmp byte [rsi + 0x17], 0
jns 0x1400fa1f9
mov rcx, qword [rsp + 0x210]
call fcn.140105028
xorps xmm0, xmm0
lea rcx, [rsp + 0x80]
movaps xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
call fcn.1400f9bf0
mov edi, eax
test eax, eax
jns 0x1400fa278
cmp byte [rsp + 0x97], 0
jns 0x1400fa231
mov rcx, qword [rsp + 0x80]
call fcn.140105028
lea rcx, [rsp + 0x1c0]
call fcn.14009a170
jmp 0x1400fa242
mov edi, eax
mov rcx, qword [rsp + 0x368]
xor rcx, rsp
call fcn.140107cc0
mov eax, edi
movaps xmm6, xmmword [rsp + 0x370]
movaps xmm7, xmmword [rsp + 0x380]
add rsp, 0x398
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rax, str.msedgerecovery.exe
lea rdx, [rsp + 0x58]
mov qword [rdx], rax
mov qword [rdx + 8], 0x12
lea rcx, [rsp + 0x68]
call fcn.14004e470
lea rax, [0x140141e4d]
lea rdx, [rsp + 0x210]
mov qword [rdx], rax
mov qword [rdx + 8], 0x20
lea rcx, [rsp + 0x40]
call fcn.14007cdbe
mov dword [rsp + 0x3c], 2
lea rsi, [rsp + 0xf0]
movaps xmmword [rsi], xmm6
mov rcx, rsi
xor edx, edx
call fcn.140045ed0
mov ecx, r15d
mov rdx, rsi
call fcn.1400f9704
test eax, eax
js 0x1400fa3a1
xorps xmm7, xmm7
movaps xmmword [rsp + 0xd0], xmm7
xor eax, eax
mov qword [rsp + 0xe0], rax
lea rcx, [rsp + 0x170]
mov qword [rcx + 0x10], rax
movaps xmmword [rcx], xmm7
lea rdx, [rsp + 0x80]
call fcn.14009b4d0
test al, al
je 0x1400fa3a8
lea rdx, [rsp + 0x150]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rdx + 0x10], rax
movaps xmmword [rdx], xmm6
lea rax, str.recovery_component_inner.crx
lea r8, [rsp + 0x140]
mov qword [r8], rax
mov qword [r8 + 8], 0x1c
lea rcx, [rsp + 0x170]
call fcn.14002e0d0
movaps xmmword [rsp + 0x120], xmm7
mov qword [rsp + 0x130], 0
cmp byte [r12 + 0x17], 0
js 0x1400fa3c9
mov rax, qword [r12 + 0x10]
mov qword [rsp + 0x130], rax
movups xmm0, xmmword [r12]
movaps xmmword [rsp + 0x120], xmm0
jmp 0x1400fa445
mov edi, eax
jmp 0x1400faac2
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov edi, 0x80004005
cmovne edi, ecx
jmp 0x1400fa90f
movabs rbp, 0x7fffffffffffffef
mov rbx, qword [r12 + 8]
cmp rbx, rbp
ja 0x1400fab7a
mov r15, qword [r12]
cmp rbx, 0xb
jb 0x1400fa420
lea rsi, [rbx + 8]
and rsi, 0xfffffffffffffff8
lea rcx, [rsi + rsi]
call fcn.140105030
mov rdi, rax
mov qword [rsp + 0x120], rax
add rbp, 0x11
or rbp, rsi
mov qword [rsp + 0x130], rbp
mov qword [rsp + 0x128], rbx
jmp 0x1400fa430
lea rdi, [rsp + 0x120]
mov byte [rdi + 0x17], bl
test rbx, rbx
je 0x1400fa43f
lea r8, [rbx + rbx]
mov rcx, rdi
mov rdx, r15
call fcn.14010a000
mov word [rdi + rbx*2], 0
lea rcx, [rsp + 0x210]
movaps xmmword [rcx + 0x20], xmm6
movaps xmmword [rcx + 0x10], xmm6
movaps xmmword [rcx], xmm6
call fcn.1400acac0
call qword [sym.imp.ole32.dll_CoImpersonateClient]
test eax, eax
js 0x1400fa562
mov ecx, 0x28
call fcn.140105030
mov dword [rax], 1
lea rcx, [0x1400fab90]
mov qword [rax + 8], rcx
lea rcx, [0x140099d70]
mov qword [rax + 0x10], rcx
lea rcx, [0x1400ff7f0]
mov qword [rax + 0x18], rcx
mov qword [rsp + 0x190], rax
lea rsi, [rsp + 0x210]
lea rdx, [rsp + 0x120]
mov rcx, rsi
mov r8d, 0x80021
call fcn.14002cf60
mov rcx, qword [rsi]
lea rax, [rcx + 1]
cmp rax, 1
ja 0x1400fa569
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov edi, 0x80004005
cmovne edi, ecx
lea rcx, [rsp + 0x190]
call fcn.140011190
test edi, edi
js 0x1400fa653
lea rsi, [rsp + 0x190]
movaps xmmword [rsi + 0x20], xmm6
movaps xmmword [rsi + 0x10], xmm6
movaps xmmword [rsi], xmm6
mov rcx, rsi
call fcn.1400acac0
lea rdx, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x80048
call fcn.14002cf60
mov rax, qword [rsi]
inc rax
cmp rax, 1
ja 0x1400fa5a2
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov edi, 0x80004005
cmovne edi, ecx
jmp 0x1400fa646
mov edi, eax
jmp 0x1400fa653
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov edi, 0x80070057
cmp eax, 1
jne 0x1400fa4ef
lea rcx, [rsp + 0x210]
call fcn.14009e470
dec rax
xor ecx, ecx
cmp rax, 0x98967f
mov edi, 0x80070057
cmovb edi, ecx
jmp 0x1400fa4ef
mov ecx, 0x10000
call fcn.140105030
mov rsi, rax
xor ebx, ebx
mov r8d, 0x10000
mov rcx, rax
xor edx, edx
call fcn.14010a410
lea rdi, [rsp + 0x210]
lea r15, [rsp + 0x190]
mov rcx, rdi
mov rdx, rsi
mov r8d, 0x10000
call fcn.14009e130
test eax, eax
js 0x1400fa617
mov ebp, eax
test eax, eax
je 0x1400fa635
mov eax, ebp
add rbx, rax
cmp rbx, 0x989680
ja 0x1400fa639
mov rcx, r15
mov rdx, rsi
mov r8d, ebp
call fcn.14009e2e0
test eax, eax
js 0x1400fa617
cmp eax, ebp
je 0x1400fa5d1
mov edi, 0x8000ffff
jmp 0x1400fa63e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov edi, 0x80004005
cmovne edi, ecx
jmp 0x1400fa63e
xor edi, edi
jmp 0x1400fa63e
mov edi, 0x80070057
mov rcx, rsi
call fcn.140105028
lea rcx, [rsp + 0x190]
call fcn.140019880
lea rcx, [rsp + 0x210]
call fcn.140019880
cmp byte [rsp + 0x137], 0
jns 0x1400fa677
mov rcx, qword [rsp + 0x120]
call fcn.140105028
test edi, edi
js 0x1400fa8f8
xorps xmm7, xmm7
movaps xmmword [rsp + 0x190], xmm7
xor esi, esi
mov qword [rsp + 0x1a0], rsi
mov qword [rsp + 0x220], rsi
movaps xmmword [rsp + 0x210], xmm7
mov qword [rsp + 0x360], rsi
movaps xmmword [rsp + 0x350], xmm7
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
sub rbp, rbx
je 0x1400fab2e
test rbp, rbp
js 0x1400fab65
mov rcx, rbp
call fcn.140105030
mov rdi, rax
mov qword [rsp + 0x358], rax
mov qword [rsp + 0x350], rax
lea rsi, [rax + rbp]
mov qword [rsp + 0x360], rsi
mov rcx, rax
mov rdx, rbx
mov r8, rbp
call fcn.14010a000
mov qword [rsp + 0x358], rsi
mov ecx, 0x18
call fcn.140105030
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x108], rax
lea r15, [rax + 0x18]
mov qword [rsp + 0x118], r15
movups xmmword [rax], xmm7
mov qword [rax + 0x10], 0
sub rsi, rdi
je 0x1400fa774
mov rbx, rax
test rsi, rsi
js 0x1400fab72
mov rcx, rsi
call fcn.140105030
mov qword [rbx], rax
lea rbp, [rax + rsi]
mov qword [rbx + 0x10], rbp
mov rcx, rax
mov rdx, rdi
mov r8, rsi
call fcn.14010a000
mov qword [rbx + 8], rbp
lea rdi, [rsp + 0x108]
mov qword [rdi + 8], r15
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], r14
lea rcx, [rsp + 0x150]
lea rdx, [rsp + 0x3c]
lea r9, [rsp + 0x210]
mov r8, rdi
call fcn.14009f498
mov esi, eax
mov rcx, rdi
call fcn.14005f97e
mov rcx, qword [rsp + 0x350]
test rcx, rcx
je 0x1400fa7ce
mov qword [rsp + 0x358], rcx
call fcn.140105028
mov rcx, qword [rsp + 0x210]
test rcx, rcx
je 0x1400fa7e8
mov qword [rsp + 0x218], rcx
call fcn.140105028
mov edi, 0x80092009
test esi, esi
jne 0x1400fa8e1
lea rcx, [rsp + 0x150]
lea rdx, [rsp + 0x170]
call fcn.1400a1a94
mov edi, 0x8000ffff
test al, al
je 0x1400fa8e1
mov ecx, 1
call fcn.1400120a0
test al, al
je 0x1400fa863
lea rcx, [rsp + 0x150]
xor edx, edx
call fcn.14001c950
test al, al
jne 0x1400fa863
lea rdx, str..._.._chrome_elevation_service_elevated_recovery_impl.cc
lea rsi, [rsp + 0x210]
mov rcx, rsi
mov r8d, 0xbc
mov r9d, 1
call fcn.140014890
mov rcx, rsi
call fcn.140014e70
mov ecx, 1
call fcn.1400120a0
xor edi, edi
test al, al
je 0x1400fa8e1
lea rcx, [rsp + 0x170]
lea rsi, [rsp + 0x108]
mov rdx, rsi
call fcn.14009b3a0
lea rcx, [rsp + 0xd0]
mov rdx, rsi
call fcn.14009b9a0
test al, al
jne 0x1400fa8ca
lea rdx, str..._.._chrome_elevation_service_elevated_recovery_impl.cc
lea rsi, [rsp + 0x210]
mov rcx, rsi
mov r8d, 0xbe
mov r9d, 1
call fcn.140014890
mov rcx, rsi
call fcn.140014e70
cmp byte [rsp + 0x11f], 0
jns 0x1400fa8e1
mov rcx, qword [rsp + 0x108]
call fcn.140105028
cmp byte [rsp + 0x1a7], 0
jns 0x1400fa8f8
mov rcx, qword [rsp + 0x190]
call fcn.140105028
cmp byte [rsp + 0x167], 0
jns 0x1400fa90f
mov rcx, qword [rsp + 0x150]
call fcn.140105028
mov rbx, qword [rsp + 0x408]
lea rcx, [rsp + 0x170]
call fcn.14009b4a0
test edi, edi
js 0x1400faab5
lea rsi, [rsp + 0x190]
movabs rbp, 0xaaaaaaaaaaaaaaaa
mov qword [rsi + 0x10], rbp
movaps xmmword [rsi], xmm6
lea rcx, [rsp + 0xd0]
lea r8, [rsp + 0x68]
mov rdx, rsi
call fcn.14002e070
lea rdi, [rsp + 0x210]
mov qword [rdi + 0x40], rbp
movaps xmmword [rdi + 0x30], xmm6
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
movaps xmmword [rdi], xmm6
mov rcx, rdi
mov rdx, rsi
call fcn.14009a100
lea rdx, [rsp + 0x1c0]
mov rcx, rdi
xor r8d, r8d
call fcn.14009aa20
lea r8, [rsp + 0x150]
mov qword [r8], 0
lea rdx, [rsp + 0xf0]
mov rcx, rdi
call fcn.1400f981b
mov edi, eax
test eax, eax
js 0x1400faa62
lea rcx, [rsp + 0xd0]
lea rsi, [rsp + 0x170]
mov rdx, rsi
call fcn.14009b3a0
mov rcx, rsi
call fcn.1400f99fa
cmp byte [rsi + 0x17], 0
jns 0x1400fa9ef
mov rcx, qword [rsp + 0x170]
call fcn.140105028
mov rbp, qword [rsp + 0x150]
lea rsi, [rbp + 1]
cmp rsi, 2
jb 0x1400faa06
call fcn.1400072c0
cmp qword [rbx], rbp
je 0x1400faa5e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
mov rax, qword [rbx]
inc rax
cmp rax, 2
jb 0x1400faa47
call fcn.1400072c0
mov r14, qword [rbx]
mov rcx, qword [0x140169900]
test rcx, rcx
je 0x1400fab54
mov rax, qword [rcx]
mov rdx, r14
call qword [rax]
mov qword [rbx], 0
cmp rsi, 2
jb 0x1400faa55
mov qword [rbx], rbp
call fcn.1400072c0
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x1400faa6a
mov rsi, qword [rsp + 0x150]
lea rax, [rsi + 1]
cmp rax, 2
jb 0x1400faa91
call fcn.1400072c0
mov rcx, qword [0x140169900]
test rcx, rcx
je 0x1400fab43
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax]
lea rcx, [rsp + 0x210]
call fcn.14009a170
cmp byte [rsp + 0x1a7], 0
jns 0x1400faab5
mov rcx, qword [rsp + 0x190]
call fcn.140105028
lea rcx, [rsp + 0xd0]
call fcn.14009b4a0
mov rax, qword [rsp + 0xf0]
inc rax
cmp rax, 2
jb 0x1400fab00
call fcn.1400072c0
mov rsi, qword [rsp + 0xf0]
mov rcx, qword [0x140169900]
test rcx, rcx
je 0x1400fab35
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax]
mov qword [rsp + 0xf0], 0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400fab14
mov qword [rsp + 0x48], rcx
call fcn.140105028
cmp byte [rsp + 0x7f], 0
jns 0x1400fa21a
mov rcx, qword [rsp + 0x68]
call fcn.140105028
jmp 0x1400fa21a
xor edi, edi
jmp 0x1400fa70d
call fcn.14004eba0
mov rcx, qword [0x140169900]
jmp 0x1400faaec
call fcn.14004eba0
mov rcx, qword [0x140169900]
jmp 0x1400faa89
call fcn.14004eba0
mov rcx, qword [0x140169900]
jmp 0x1400faa38
lea rcx, [rsp + 0x350]
call fcn.14007ce34
mov rcx, rbx
call fcn.14007ce34
lea rcx, [rsp + 0x120]
call fcn.14007ce46
int3