Function at 0x14000b568
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x140025328]
xor rax, rsp
mov qword [rbp], rax
or qword [rsp + 0x58], 0xffffffffffffffff
xor edi, edi
mov dword [rsp + 0x4c], edi
mov rbx, rdx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x78], rdi
mov dword [rsp + 0x48], 0x80000000
mov qword [rsp + 0x70], 0x20000
mov dword [rsp + 0x50], 0x14
call qword [sym.imp.RPCRT4.dll_RpcImpersonateClient]
movabs rsi, 0x400000000000
lea r13, str.ImpersonateAndCheckAccess
mov r14d, 0x80070000
test eax, eax
je 0x14000b6a5
movzx ebx, ax
or ebx, r14d
test eax, eax
cmovle ebx, eax
call fcn.14000af24
mov r10, rax
cmp dword [rax], 2
jbe 0x14000b979
test qword [rax + 0x10], rsi
je 0x14000b979
mov rcx, qword [rax + 0x18]
and rcx, rsi
cmp rcx, qword [rax + 0x18]
jne 0x14000b979
lea rax, [rsp + 0x40]
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x30], rax
lea rax, str.ImpersonateAndCheckAccess_failed:__RpcImpersonateClient_
mov qword [rbp - 0x20], rax
movzx eax, bx
or eax, r14d
mov qword [rbp - 0x38], 0x1a
test ebx, ebx
mov dword [rsp + 0x40], 0x5d
mov qword [rbp - 0x28], 4
cmovle eax, ebx
mov qword [rbp - 0x18], 0x39
mov dword [rsp + 0x44], eax
lea rax, [rsp + 0x44]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], 4
lea rax, [rbp - 0x60]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x14001fefd]
xor r8d, r8d
mov dword [rsp + 0x20], 6
mov rcx, r10
call fcn.140001078
jmp 0x14000b979
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThread]
lea r9, [rsp + 0x58]
mov edx, 0xf01ff
mov rcx, rax
mov r8d, 1
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenThreadToken]
test eax, eax
jne 0x14000b78c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ebx, ax
or ebx, r14d
test eax, eax
cmovle ebx, eax
call fcn.14000af24
mov r10, rax
cmp dword [rax], 2
jbe 0x14000b979
test qword [rax + 0x10], rsi
je 0x14000b979
mov rcx, qword [rax + 0x18]
and rcx, rsi
cmp rcx, qword [rax + 0x18]
jne 0x14000b979
lea rax, [rsp + 0x44]
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x30], rax
lea rax, str.ImpersonateAndCheckAccess_failed:__OpenThreadToken_
mov qword [rbp - 0x20], rax
movzx eax, bx
or eax, r14d
mov qword [rbp - 0x38], 0x1a
test ebx, ebx
mov dword [rsp + 0x44], 0x63
mov qword [rbp - 0x28], 4
cmovle eax, ebx
mov qword [rbp - 0x18], 0x34
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], 4
lea rax, [rbp - 0x60]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x14001fefd]
xor r8d, r8d
mov dword [rsp + 0x20], 6
mov rcx, r10
call fcn.140001078
jmp 0x14000b979
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_MapGenericMask]
xor r9d, r9d
lea r8, [rsp + 0x60]
mov rcx, rbx
lea edx, [r9 + 1]
call qword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
jne 0x14000b879
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ebx, ax
or ebx, r14d
test eax, eax
cmovle ebx, eax
call fcn.14000af24
mov r10, rax
cmp dword [rax], 2
jbe 0x14000b979
test qword [rax + 0x10], rsi
je 0x14000b979
mov rcx, qword [rax + 0x18]
and rcx, rsi
cmp rcx, qword [rax + 0x18]
jne 0x14000b979
lea rax, [rsp + 0x44]
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x30], rax
lea rax, str.ImpersonateAndCheckAccess_failed:__ConvertStringSecurityDescriptorToSecurityDescriptor_
mov qword [rbp - 0x20], rax
movzx eax, bx
or eax, r14d
mov qword [rbp - 0x38], 0x1a
test ebx, ebx
mov dword [rsp + 0x44], 0x6b
mov qword [rbp - 0x28], 4
cmovle eax, ebx
mov qword [rbp - 0x18], 0x58
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], 4
lea rax, [rbp - 0x60]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x14001fefd]
xor r8d, r8d
mov dword [rsp + 0x20], 6
mov rcx, r10
call fcn.140001078
jmp 0x14000b979
mov r8d, dword [rsp + 0x48]
lea rax, [rsp + 0x4c]
mov rdx, qword [rsp + 0x58]
lea r9, [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AccessCheck]
test eax, eax
jne 0x14000b979
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ebx, ax
or ebx, r14d
test eax, eax
cmovle ebx, eax
call fcn.14000af24
mov r10, rax
cmp dword [rax], 2
jbe 0x14000b979
test qword [rax + 0x10], rsi
je 0x14000b979
mov rcx, qword [rax + 0x18]
and rcx, rsi
cmp rcx, qword [rax + 0x18]
jne 0x14000b979
lea rax, [rsp + 0x44]
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x30], rax
lea rax, str.ImpersonateAndCheckAccess_failed:__AccessCheck_
mov qword [rbp - 0x20], rax
movzx eax, bx
or eax, r14d
mov qword [rbp - 0x38], 0x1a
test ebx, ebx
mov dword [rsp + 0x44], 0x75
mov qword [rbp - 0x28], 4
cmovle eax, ebx
mov qword [rbp - 0x18], 0x30
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], 4
lea rax, [rbp - 0x60]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x14001fefd]
xor r8d, r8d
mov dword [rsp + 0x20], 6
mov rcx, r10
call fcn.140001078
call qword [sym.imp.RPCRT4.dll_RpcRevertToSelf]
test eax, eax
je 0x14000ba38
movzx ebx, ax
or ebx, r14d
test eax, eax
cmovle ebx, eax
call fcn.14000af24
mov r10, rax
cmp dword [rax], 2
jbe 0x14000ba38
test qword [rax + 0x10], rsi
je 0x14000ba38
mov rcx, qword [rax + 0x18]
and rcx, rsi
cmp rcx, qword [rax + 0x18]
jne 0x14000ba38
lea rax, [rsp + 0x44]
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x30], rax
lea rax, str.ImpersonateAndCheckAccess_failed:__RpcRevertToSelf_
mov qword [rbp - 0x20], rax
movzx eax, bx
or eax, r14d
mov qword [rbp - 0x38], 0x1a
test ebx, ebx
mov dword [rsp + 0x44], 0x7d
mov qword [rbp - 0x28], 4
cmovle eax, ebx
mov qword [rbp - 0x18], 0x34
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], 4
lea rax, [rbp - 0x60]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x14001fefd]
xor r8d, r8d
mov dword [rsp + 0x20], 6
mov rcx, r10
call fcn.140001078
mov rcx, qword [rsp + 0x58]
cmp rcx, 0xffffffffffffffff
je 0x14000ba49
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14000ba59
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov eax, dword [rsp + 0x4c]
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.140018a70
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret