Function at 0x1400f9653
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x398
movaps xmmword [rsp + 0x380], xmm7
movaps xmmword [rsp + 0x370], xmm6
mov r13, r9
mov rbp, r8
mov rbx, rdx
mov r12, rcx
mov rax, qword [0x14016c028]
xor rax, rsp
mov qword [rsp + 0x368], rax
movzx eax, byte [rcx + 0x17]
test al, al
jns 0x1400f96a1
mov rax, qword [r12 + 8]
mov edi, 0x80070057
cmp qword [rsp + 0x408], 0
je 0x1400f9a24
mov r15d, dword [rsp + 0x400]
test r15d, r15d
je 0x1400f9a24
test rax, rax
je 0x1400f9a24
cmp byte [rbx + 0x17], 0
js 0x1400f96e7
je 0x1400f9712
xorps xmm0, xmm0
movaps xmmword [rsp + 0x210], xmm0
mov rcx, rbx
jmp 0x1400f96fc
cmp qword [rbx + 8], 0
je 0x1400f9712
xorps xmm0, xmm0
movaps xmmword [rsp + 0x210], xmm0
mov rcx, qword [rbx]
lea rdx, [rsp + 0x210]
call qword [sym.imp.ole32.dll_IIDFromString]
test eax, eax
js 0x1400f9a22
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x210]
mov qword [rdi + 0x10], rax
movaps xmm6, xmmword [0x140146a10]
movaps xmmword [rdi], xmm6
movzx eax, byte [rbp + 0x17]
test al, al
mov rcx, qword [rbp]
cmovns rcx, rbp
lea rdx, [rsp + 0x170]
mov qword [rdx], rcx
cmovs rax, qword [rbp + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x1c0]
mov rcx, rsi
call fcn.1400999f0
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea r14, [rsp + 0x190]
mov qword [r14], rcx
cmovs rax, qword [rsi + 8]
mov qword [r14 + 8], rax
mov rcx, rdi
mov rdx, r14
call fcn.1400499a0
cmp byte [rsi + 0x17], 0
jns 0x1400f97a3
mov rcx, qword [rsp + 0x1c0]
call fcn.14010b880
mov rcx, qword [rsp + 0x210]
cmp rcx, qword [rsp + 0x218]
je 0x1400f97e8
xorps xmm0, xmm0
movaps xmmword [rsp + 0x1c0], xmm0
cmp byte [r13 + 0x17], 0
mov rcx, r13
jns 0x1400f97ce
mov rcx, qword [r13]
lea rdx, [rsp + 0x1c0]
call qword [sym.imp.ole32.dll_IIDFromString]
mov edi, eax
mov rcx, qword [rsp + 0x210]
jmp 0x1400f97ed
mov edi, 0x80070057
test rcx, rcx
je 0x1400f97ff
mov qword [rsp + 0x218], rcx
call fcn.14010b880
test edi, edi
js 0x1400f9a24
lea rcx, [rsp + 0x1c0]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rcx + 0x40], rax
movaps xmmword [rcx + 0x30], xmm6
movaps xmmword [rcx + 0x20], xmm6
movaps xmmword [rcx + 0x10], xmm6
movaps xmmword [rcx], xmm6
xor edx, edx
call fcn.140095ad0
movzx ecx, byte [rbx + 0x17]
mov rax, rcx
test cl, cl
jns 0x1400f9842
mov rax, qword [rbx + 8]
test rax, rax
je 0x1400f98a4
test cl, cl
jns 0x1400f984e
mov rbx, qword [rbx]
lea r8, [rsp + 0xc0]
mov qword [r8], rbx
mov qword [r8 + 8], rax
xorps xmm0, xmm0
lea rsi, [rsp + 0x210]
movups xmmword [rsi + 8], xmm0
mov byte [rsi + 0x17], 7
mov dword [rsi], 0x67707061
mov dword [rsi + 3], 0x64697567
mov byte [rsi + 7], 0
lea rcx, [rsp + 0x1c0]
mov rdx, rsi
call fcn.14005c780
cmp byte [rsi + 0x17], 0
jns 0x1400f98a4
mov rcx, qword [rsp + 0x210]
call fcn.14010b880
movzx eax, byte [rbp + 0x17]
test al, al
mov rcx, qword [rbp]
cmovns rcx, rbp
lea r8, [rsp + 0xb0]
mov qword [r8], rcx
cmovs rax, qword [rbp + 8]
mov qword [r8 + 8], rax
movabs rax, 0xf00000000000000
lea rsi, [rsp + 0x210]
mov qword [rsi + 0x10], rax
movabs rax, 0x2d726573776f7262
mov qword [rsi], rax
movabs rax, 0x6e6f69737265762d
mov qword [rsi + 7], rax
mov byte [rsi + 0xf], 0
lea rcx, [rsp + 0x1c0]
mov rdx, rsi
call fcn.14005c780
cmp byte [rsi + 0x17], 0
jns 0x1400f991e
mov rcx, qword [rsp + 0x210]
call fcn.14010b880
movzx eax, byte [r13 + 0x17]
test al, al
mov rcx, qword [r13]
cmovns rcx, r13
lea r8, [rsp + 0xa0]
mov qword [r8], rcx
cmovs rax, qword [r13 + 8]
mov qword [r8 + 8], rax
xorps xmm7, xmm7
lea rsi, [rsp + 0x210]
movaps xmmword [rsi], xmm7
mov qword [rsi + 0x10], 0
mov byte [rsi + 0x17], 9
movabs rax, 0x696e6f6973736573
mov qword [rsi], rax
mov word [rsi + 8], 0x64
lea rcx, [rsp + 0x1c0]
mov rdx, rsi
call fcn.14005c780
cmp byte [rsi + 0x17], 0
jns 0x1400f9991
mov rcx, qword [rsp + 0x210]
call fcn.14010b880
lea rsi, [rsp + 0x210]
movaps xmmword [rsi], xmm7
mov qword [rsi + 0x10], 0
mov byte [rsi + 0x17], 6
mov dword [rsi], 0x74737973
mov word [rsi + 4], 0x6d65
mov byte [rsi + 6], 0
lea rcx, [rsp + 0x1c0]
mov rdx, rsi
call fcn.14005c720
cmp byte [rsi + 0x17], 0
jns 0x1400f99db
mov rcx, qword [rsp + 0x210]
call fcn.14010b880
xorps xmm0, xmm0
lea rcx, [rsp + 0x80]
movaps xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
call fcn.1400f93d2
mov edi, eax
test eax, eax
jns 0x1400f9a5a
cmp byte [rsp + 0x97], 0
jns 0x1400f9a13
mov rcx, qword [rsp + 0x80]
call fcn.14010b880
lea rcx, [rsp + 0x1c0]
call fcn.140095ba0
jmp 0x1400f9a24
mov edi, eax
mov rcx, qword [rsp + 0x368]
xor rcx, rsp
call fcn.14010e4a0
mov eax, edi
movaps xmm6, xmmword [rsp + 0x370]
movaps xmm7, xmmword [rsp + 0x380]
add rsp, 0x398
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rax, str.msedgerecovery.exe
lea rdx, [rsp + 0x58]
mov qword [rdx], rax
mov qword [rdx + 8], 0x12
lea rcx, [rsp + 0x68]
call fcn.1400473f0
lea rax, [0x14014999d]
lea rdx, [rsp + 0x210]
mov qword [rdx], rax
mov qword [rdx + 8], 0x20
lea rcx, [rsp + 0x40]
call fcn.140078670
mov dword [rsp + 0x3c], 2
lea rsi, [rsp + 0xf0]
movaps xmmword [rsi], xmm6
mov rcx, rsi
xor edx, edx
call fcn.1400400c0
mov ecx, r15d
mov rdx, rsi
call fcn.1400f8ef8
test eax, eax
js 0x1400f9b83
xorps xmm7, xmm7
movaps xmmword [rsp + 0xd0], xmm7
xor eax, eax
mov qword [rsp + 0xe0], rax
lea rcx, [rsp + 0x170]
mov qword [rcx + 0x10], rax
movaps xmmword [rcx], xmm7
lea rdx, [rsp + 0x80]
call fcn.140097210
test al, al
je 0x1400f9b8a
lea rdx, [rsp + 0x150]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rdx + 0x10], rax
movaps xmmword [rdx], xmm6
lea rax, str.recovery_component_inner.crx
lea r8, [rsp + 0x140]
mov qword [r8], rax
mov qword [r8 + 8], 0x1c
lea rcx, [rsp + 0x170]
call fcn.140028c70
movaps xmmword [rsp + 0x120], xmm7
mov qword [rsp + 0x130], 0
cmp byte [r12 + 0x17], 0
js 0x1400f9bab
mov rax, qword [r12 + 0x10]
mov qword [rsp + 0x130], rax
movups xmm0, xmmword [r12]
movaps xmmword [rsp + 0x120], xmm0
jmp 0x1400f9c27
mov edi, eax
jmp 0x1400fa2a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov edi, 0x80004005
cmovne edi, ecx
jmp 0x1400fa0f1
movabs rbp, 0x7fffffffffffffef
mov rbx, qword [r12 + 8]
cmp rbx, rbp
ja 0x1400fa350
mov r15, qword [r12]
cmp rbx, 0xb
jb 0x1400f9c02
lea rsi, [rbx + 8]
and rsi, 0xfffffffffffffff8
lea rcx, [rsi + rsi]
call fcn.14010b888
mov rdi, rax
mov qword [rsp + 0x120], rax
add rbp, 0x11
or rbp, rsi
mov qword [rsp + 0x130], rbp
mov qword [rsp + 0x128], rbx
jmp 0x1400f9c12
lea rdi, [rsp + 0x120]
mov byte [rdi + 0x17], bl
test rbx, rbx
je 0x1400f9c21
lea r8, [rbx + rbx]
mov rcx, rdi
mov rdx, r15
call fcn.1401107e0
mov word [rdi + rbx*2], 0
lea rcx, [rsp + 0x210]
movaps xmmword [rcx + 0x20], xmm6
movaps xmmword [rcx + 0x10], xmm6
movaps xmmword [rcx], xmm6
call fcn.1400a7950
call qword [sym.imp.ole32.dll_CoImpersonateClient]
test eax, eax
js 0x1400f9d44
mov ecx, 0x28
call fcn.14010b888
mov dword [rax], 1
lea rcx, [0x1400fa360]
mov qword [rax + 8], rcx
lea rcx, [0x140095800]
mov qword [rax + 0x10], rcx
lea rcx, [0x1400ff460]
mov qword [rax + 0x18], rcx
mov qword [rsp + 0x190], rax
lea rsi, [rsp + 0x210]
lea rdx, [rsp + 0x120]
mov rcx, rsi
mov r8d, 0x80021
call fcn.1400271f0
mov rcx, qword [rsi]
lea rax, [rcx + 1]
cmp rax, 1
ja 0x1400f9d4b
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov edi, 0x80004005
cmovne edi, ecx
lea rcx, [rsp + 0x190]
call fcn.140006770
test edi, edi
js 0x1400f9e35
lea rsi, [rsp + 0x190]
movaps xmmword [rsi + 0x20], xmm6
movaps xmmword [rsi + 0x10], xmm6
movaps xmmword [rsi], xmm6
mov rcx, rsi
call fcn.1400a7950
lea rdx, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x80048
call fcn.1400271f0
mov rax, qword [rsi]
inc rax
cmp rax, 1
ja 0x1400f9d84
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov edi, 0x80004005
cmovne edi, ecx
jmp 0x1400f9e28
mov edi, eax
jmp 0x1400f9e35
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov edi, 0x80070057
cmp eax, 1
jne 0x1400f9cd1
lea rcx, [rsp + 0x210]
call fcn.14009a350
dec rax
xor ecx, ecx
cmp rax, 0x98967f
mov edi, 0x80070057
cmovb edi, ecx
jmp 0x1400f9cd1
mov ecx, 0x10000
call fcn.14010b888
mov rsi, rax
xor ebx, ebx
mov r8d, 0x10000
mov rcx, rax
xor edx, edx
call fcn.140110bf0
lea rdi, [rsp + 0x210]
lea r15, [rsp + 0x190]
mov rcx, rdi
mov rdx, rsi
mov r8d, 0x10000
call fcn.14009a010
test eax, eax
js 0x1400f9df9
mov ebp, eax
test eax, eax
je 0x1400f9e17
mov eax, ebp
add rbx, rax
cmp rbx, 0x989680
ja 0x1400f9e1b
mov rcx, r15
mov rdx, rsi
mov r8d, ebp
call fcn.14009a1c0
test eax, eax
js 0x1400f9df9
cmp eax, ebp
je 0x1400f9db3
mov edi, 0x8000ffff
jmp 0x1400f9e20
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov edi, 0x80004005
cmovne edi, ecx
jmp 0x1400f9e20
xor edi, edi
jmp 0x1400f9e20
mov edi, 0x80070057
mov rcx, rsi
call fcn.14010b880
lea rcx, [rsp + 0x190]
call fcn.140014460
lea rcx, [rsp + 0x210]
call fcn.140014460
cmp byte [rsp + 0x137], 0
jns 0x1400f9e59
mov rcx, qword [rsp + 0x120]
call fcn.14010b880
test edi, edi
js 0x1400fa0da
xorps xmm7, xmm7
movaps xmmword [rsp + 0x190], xmm7
xor esi, esi
mov qword [rsp + 0x1a0], rsi
mov qword [rsp + 0x220], rsi
movaps xmmword [rsp + 0x210], xmm7
mov qword [rsp + 0x360], rsi
movaps xmmword [rsp + 0x350], xmm7
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
sub rbp, rbx
je 0x1400fa304
test rbp, rbp
js 0x1400fa33b
mov rcx, rbp
call fcn.14010b888
mov rdi, rax
mov qword [rsp + 0x358], rax
mov qword [rsp + 0x350], rax
lea rsi, [rax + rbp]
mov qword [rsp + 0x360], rsi
mov rcx, rax
mov rdx, rbx
mov r8, rbp
call fcn.1401107e0
mov qword [rsp + 0x358], rsi
mov ecx, 0x18
call fcn.14010b888
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x108], rax
lea r15, [rax + 0x18]
mov qword [rsp + 0x118], r15
movups xmmword [rax], xmm7
mov qword [rax + 0x10], 0
sub rsi, rdi
je 0x1400f9f56
mov rbx, rax
test rsi, rsi
js 0x1400fa348
mov rcx, rsi
call fcn.14010b888
mov qword [rbx], rax
lea rbp, [rax + rsi]
mov qword [rbx + 0x10], rbp
mov rcx, rax
mov rdx, rdi
mov r8, rsi
call fcn.1401107e0
mov qword [rbx + 8], rbp
lea rdi, [rsp + 0x108]
mov qword [rdi + 8], r15
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], r14
lea rcx, [rsp + 0x150]
lea rdx, [rsp + 0x3c]
lea r9, [rsp + 0x210]
mov r8, rdi
call fcn.14009b4d8
mov esi, eax
mov rcx, rdi
call fcn.14005a16e
mov rcx, qword [rsp + 0x350]
test rcx, rcx
je 0x1400f9fb0
mov qword [rsp + 0x358], rcx
call fcn.14010b880
mov rcx, qword [rsp + 0x210]
test rcx, rcx
je 0x1400f9fca
mov qword [rsp + 0x218], rcx
call fcn.14010b880
mov edi, 0x80092009
test esi, esi
jne 0x1400fa0c3
lea rcx, [rsp + 0x150]
lea rdx, [rsp + 0x170]
call fcn.14009da56
mov edi, 0x8000ffff
test al, al
je 0x1400fa0c3
mov ecx, 1
call fcn.14000d460
test al, al
je 0x1400fa045
lea rcx, [rsp + 0x150]
xor edx, edx
call fcn.140018380
test al, al
jne 0x1400fa045
lea rdx, str..._.._chrome_elevation_service_elevated_recovery_impl.cc
lea rsi, [rsp + 0x210]
mov rcx, rsi
mov r8d, 0xbc
mov r9d, 1
call fcn.14000fbb0
mov rcx, rsi
call fcn.140010050
mov ecx, 1
call fcn.14000d460
xor edi, edi
test al, al
je 0x1400fa0c3
lea rcx, [rsp + 0x170]
lea rsi, [rsp + 0x108]
mov rdx, rsi
call fcn.1400970e0
lea rcx, [rsp + 0xd0]
mov rdx, rsi
call fcn.1400976e0
test al, al
jne 0x1400fa0ac
lea rdx, str..._.._chrome_elevation_service_elevated_recovery_impl.cc
lea rsi, [rsp + 0x210]
mov rcx, rsi
mov r8d, 0xbe
mov r9d, 1
call fcn.14000fbb0
mov rcx, rsi
call fcn.140010050
cmp byte [rsp + 0x11f], 0
jns 0x1400fa0c3
mov rcx, qword [rsp + 0x108]
call fcn.14010b880
cmp byte [rsp + 0x1a7], 0
jns 0x1400fa0da
mov rcx, qword [rsp + 0x190]
call fcn.14010b880
cmp byte [rsp + 0x167], 0
jns 0x1400fa0f1
mov rcx, qword [rsp + 0x150]
call fcn.14010b880
mov rbx, qword [rsp + 0x408]
lea rcx, [rsp + 0x170]
call fcn.1400971e0
test edi, edi
js 0x1400fa297
lea rsi, [rsp + 0x190]
movabs rbp, 0xaaaaaaaaaaaaaaaa
mov qword [rsi + 0x10], rbp
movaps xmmword [rsi], xmm6
lea rcx, [rsp + 0xd0]
lea r8, [rsp + 0x68]
mov rdx, rsi
call fcn.140028c10
lea rdi, [rsp + 0x210]
mov qword [rdi + 0x40], rbp
movaps xmmword [rdi + 0x30], xmm6
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
movaps xmmword [rdi], xmm6
mov rcx, rdi
mov rdx, rsi
call fcn.140095b30
lea rdx, [rsp + 0x1c0]
mov rcx, rdi
xor r8d, r8d
call fcn.140095ef0
lea r8, [rsp + 0x150]
mov qword [r8], 0
lea rdx, [rsp + 0xf0]
mov rcx, rdi
call fcn.1400f9006
mov edi, eax
test eax, eax
js 0x1400fa244
lea rcx, [rsp + 0xd0]
lea rsi, [rsp + 0x170]
mov rdx, rsi
call fcn.1400970e0
mov rcx, rsi
call fcn.1400f91dc
cmp byte [rsi + 0x17], 0
jns 0x1400fa1d1
mov rcx, qword [rsp + 0x170]
call fcn.14010b880
mov rbp, qword [rsp + 0x150]
lea rsi, [rbp + 1]
cmp rsi, 2
jb 0x1400fa1e8
call fcn.1400068d0
cmp qword [rbx], rbp
je 0x1400fa240
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
mov rax, qword [rbx]
inc rax
cmp rax, 2
jb 0x1400fa229
call fcn.1400068d0
mov r14, qword [rbx]
mov rcx, qword [0x140173f80]
test rcx, rcx
je 0x1400fa32a
mov rax, qword [rcx]
mov rdx, r14
call qword [rax]
mov qword [rbx], 0
cmp rsi, 2
jb 0x1400fa237
mov qword [rbx], rbp
call fcn.1400068d0
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x1400fa24c
mov rsi, qword [rsp + 0x150]
lea rax, [rsi + 1]
cmp rax, 2
jb 0x1400fa273
call fcn.1400068d0
mov rcx, qword [0x140173f80]
test rcx, rcx
je 0x1400fa319
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax]
lea rcx, [rsp + 0x210]
call fcn.140095ba0
cmp byte [rsp + 0x1a7], 0
jns 0x1400fa297
mov rcx, qword [rsp + 0x190]
call fcn.14010b880
lea rcx, [rsp + 0xd0]
call fcn.1400971e0
mov rax, qword [rsp + 0xf0]
inc rax
cmp rax, 2
jb 0x1400fa2d6
call fcn.1400068d0
mov rsi, qword [rsp + 0xf0]
mov rcx, qword [0x140173f80]
test rcx, rcx
je 0x1400fa30b
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400fa2ea
mov qword [rsp + 0x48], rcx
call fcn.14010b880
cmp byte [rsp + 0x7f], 0
jns 0x1400f99fc
mov rcx, qword [rsp + 0x68]
call fcn.14010b880
jmp 0x1400f99fc
xor edi, edi
jmp 0x1400f9eef
call fcn.140048130
mov rcx, qword [0x140173f80]
jmp 0x1400fa2ce
call fcn.140048130
mov rcx, qword [0x140173f80]
jmp 0x1400fa26b
call fcn.140048130
mov rcx, qword [0x140173f80]
jmp 0x1400fa21a
lea rcx, [rsp + 0x350]
call fcn.1400786e6
mov rcx, rbx
call fcn.1400786e6
lea rcx, [rsp + 0x120]
call fcn.1400786f8
int3