Function at 0x1400087f0
Capabilities:
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r12d, r12d
or r13, 0xffffffffffffffff
mov dword [rax + 8], r12d
mov rbp, rcx
mov qword [rax + 0x10], r12
mov ebx, 1
mov r15d, r12d
mov edi, r12d
test rcx, rcx
je 0x140008887
mov rsi, r13
inc rsi
cmp word [rcx + rsi*2], r12w
jne 0x14000882b
lea r14, [rsi + 1]
cmp r14, rsi
jb 0x140008887
mov eax, 2
mul r14
test rdx, rdx
jne 0x140008887
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rdi, rax
test rax, rax
je 0x140008887
mov r9, rsi
mov r8, rbp
mov rdx, r14
mov rcx, rax
call fcn.140005cc4
lea rcx, [rsp + 0x80]
call qword [sym.imp.iertutil.dll_Ordinal_34]
test eax, eax
jns 0x14000888a
mov ebx, r12d
jmp 0x140008a3f
mov ebx, r12d
cmp dword [rsp + 0x80], r12d
je 0x1400088c1
call qword [sym.imp.ole32.dll_CoImpersonateClient]
test eax, eax
js 0x1400088be
mov edx, eax
lea rcx, [rsp + 0x88]
call fcn.1400083a8
mov r15, qword [rsp + 0x88]
test eax, eax
js 0x1400088be
test r15, r15
jne 0x1400088c1
mov ebx, r12d
test ebx, ebx
je 0x140008a31
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
or ebp, 0xffffffff
cmp esi, ebp
jne 0x140008927
add eax, 0xfffffffe
cmp eax, 1
ja 0x140008923
mov rcx, rdi
call fcn.14000cde4
test eax, eax
jne 0x140008923
mov rdx, r13
inc rdx
cmp word [rdi + rdx*2], r12w
jne 0x1400088f8
mov rcx, rdi
call fcn.14000d0b8
test eax, eax
js 0x140008923
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, ebp
je 0x1400088e1
cmp esi, ebp
je 0x140008946
test sil, 0x10
jne 0x140008946
mov rdx, r13
inc rdx
cmp word [rdi + rdx*2], r12w
jne 0x140008930
mov rcx, rdi
call fcn.14000d0b8
test eax, eax
js 0x140008977
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], 0x2000000
xor r8d, r8d
mov edx, 0x20000
mov dword [rsp + 0x20], 3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, r13
jne 0x14000897f
mov ebx, r12d
jmp 0x140008a31
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
mov esi, eax
test eax, eax
je 0x1400089c1
mov ecx, esi
add rcx, rcx
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rbp, rax
test rax, rax
je 0x1400089c1
xor r9d, r9d
mov r8d, esi
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
mov esi, eax
test eax, eax
jne 0x1400089c6
mov ebx, r12d
jmp 0x140008a28
inc esi
cmp esi, 8
jb 0x140008a28
mov rcx, rbp
call fcn.1400085d8
mov ebx, eax
test eax, eax
je 0x1400089f2
cmp dword [rsp + 0x80], r12d
je 0x1400089f2
mov rdx, r15
mov rcx, rbp
call fcn.1400086bc
mov ebx, eax
mov rcx, rbp
call fcn.14000cde4
test eax, eax
jne 0x140008a28
test ebx, ebx
je 0x140008a28
mov edx, esi
mov rcx, rbp
call fcn.14000d0b8
test eax, eax
mov ebx, r12d
mov rsi, r13
setns bl
inc rsi
cmp word [rbp + rsi*2], r12w
jne 0x140008a17
inc esi
test eax, eax
jns 0x1400089c8
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15, r15
je 0x140008a3f
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rdi, rdi
je 0x140008a4d
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret