Function at 0x140205874
Capabilities:
Check if file exists

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xf0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x14044e770]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov r15, r8
mov r14, rdx
mov r12, rcx
lea rsi, [rdx + 0x20]
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x1402058bc
mov rcx, qword [rsi]
call qword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathFileExistsW]
xor edi, edi
test eax, eax
jne 0x140205932
lea rdx, str.Remediation_has_not_occurred_since_the_file
lea rcx, [rbp - 0x79]
call fcn.14004a9e4
nop
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x1402058e6
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
lea rcx, [rbp - 0x79]
call fcn.14005b1c8
mov r8d, reloc.OLEAUT32.dll_SafeArrayUnlock
lea rdx, str._does_no_longer_exist
lea rcx, [rbp - 0x79]
call fcn.14005b1c8
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x79]
mov r8, rsi
mov ebx, 0x80070002
mov edx, ebx
call fcn.140203418
nop
lea rcx, [rbp - 0x79]
call fcn.14004b500
mov eax, ebx
jmp 0x140205b56
movdqa xmm0, xmmword [0x14034f9a0]
movdqu xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x38], di
mov r9b, 1
lea r8, [rsp + 0x38]
mov rdx, rsi
call fcn.140205b74
mov ebx, eax
cmp eax, 5
jne 0x1402059a9
call fcn.14004acb4
mov rcx, qword [rax + 8]
cmp dword [rcx], 4
jbe 0x140205b4a
lea rax, str.The_check_if_the_sha1_of_the_file_has_been_changed_was_skipped_since_there_was_access_denied_error_when_trying_to_read_the_file_hash
mov qword [rbp - 0x59], rax
mov qword [rbp - 0x51], 0x10a
lea rax, [rbp - 0x79]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14039e961]
call fcn.140001158
jmp 0x140205b4a
test ebx, ebx
jns 0x1402059c2
mov r9, r15
mov r8, rsi
mov edx, ebx
mov rcx, r12
call fcn.1402031b0
jmp 0x140205b48
add r14, 0x40
xor r8d, r8d
mov rdx, r14
lea rcx, [rbp - 0x79]
call fcn.14005f560
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x79]
call fcn.1400aa150
mov ebx, eax
lea rcx, [rbp - 0x79]
call fcn.14004b500
test ebx, ebx
je 0x140205b4a
lea rdx, str.Remediation_has_not_occurred_since_the_file
lea rcx, [rbp - 0x79]
call fcn.14004a9e4
nop
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x140205a14
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
lea rcx, [rbp - 0x79]
call fcn.14005b1c8
mov r8d, reloc.OLEAUT32.dll_SafeArrayAccessData
lea rdx, str._sha1_has_been_changed
lea rcx, [rbp - 0x79]
call fcn.14005b1c8
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x79]
mov r8, rsi
mov ebx, 0x80073bc5
mov edx, ebx
mov rcx, r12
call fcn.140203228
call fcn.14004acb4
mov r10, qword [rax + 8]
cmp dword [r10], 3
jbe 0x140205b3f
lea rax, [rbp - 0x79]
cmp qword [rbp - 0x61], 8
cmovae rax, qword [rbp - 0x79]
lea rdx, [0x14030cae0]
mov r8, rdx
mov rcx, rdi
or r9, 0xffffffffffffffff
test rax, rax
je 0x140205a98
mov r8, rax
mov rcx, r9
inc rcx
cmp word [rax + rcx*2], di
jne 0x140205a8f
mov qword [rbp - 0x21], r8
lea eax, [rcx*2 + 2]
mov dword [rbp - 0x19], eax
mov dword [rbp - 0x15], edi
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
mov r8, rdx
mov rax, rdi
test rcx, rcx
je 0x140205ad4
mov r8, rcx
mov rax, r9
inc rax
cmp word [rcx + rax*2], di
jne 0x140205acb
mov qword [rbp - 0x11], r8
lea eax, [rax*2 + 2]
mov dword [rbp - 9], eax
mov dword [rbp - 5], edi
cmp qword [r14 + 0x18], 8
jb 0x140205aef
mov r14, qword [r14]
mov rax, rdi
test r14, r14
je 0x140205b07
mov rdx, r14
mov rax, r9
inc rax
cmp word [r14 + rax*2], di
jne 0x140205afd
mov qword [rbp - 1], rdx
lea eax, [rax*2 + 2]
mov dword [rbp + 7], eax
mov dword [rbp + 0xb], edi
lea rax, [rbp - 0x41]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 5
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14039ea56]
mov rcx, r10
call fcn.140001158
nop
lea rcx, [rbp - 0x79]
call fcn.14004b500
mov edi, ebx
lea rcx, [rsp + 0x38]
call fcn.14004b500
mov eax, edi
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.1402ae860
add rsp, 0xf0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret