Function at 0x1402afa70
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x140387a48]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov rdi, r8
mov r12, rcx
cmp r8, 0xffffffffffffffff
jne 0x1402afab2
mov eax, 0x80000006
jmp 0x1402b02fb
xor r14d, r14d
test r12, r12
jne 0x1402afac4
mov eax, 0xc00000ef
jmp 0x1402b02fb
test rdi, rdi
jne 0x1402afad3
mov eax, 0xc00000f1
jmp 0x1402b02fb
xorps xmm1, xmm1
mov word [rsp + 0x60], r14w
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x18], xmm0
mov qword [rbp + 0x68], rax
mov edx, 8
movups xmmword [rsp + 0x68], xmm1
mov r8d, 0x268
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp + 0x38], xmm1
movups xmmword [rbp + 0x48], xmm1
movups xmmword [rbp + 0x58], xmm1
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov r13, rax
test rax, rax
jne 0x1402afb38
mov ebx, 0xc0000017
jmp 0x1402b02c6
mov rax, qword [rdi + 0x20]
cmp rax, 1
jb 0x1402b02a3
mov rcx, rax
lea rdx, [rax - 1]
mov rbx, r14
cmp rdx, rcx
jae 0x1402afb77
mov rcx, qword [rdi + 0x18]
lea r8, [rbp - 0x60]
call fcn.14024a7fc
test eax, eax
js 0x1402afb74
mov rbx, qword [rbp - 0x60]
add rbx, qword [rdi + 0x38]
cmp rbx, qword [rdi + 0x38]
jae 0x1402afb77
mov rbx, r14
test rbx, rbx
je 0x1402b0631
cmp qword [rbx + 0x18], r14
jne 0x1402afdb2
lea r9, str.Node_on_the_stack_with_invalid_handle.
mov r8d, 0x9a7
lea rdx, str.AslPathWildcardFindNext
mov ecx, 1
call fcn.1400139b4
mov rcx, qword [rdi + 0x20]
cmp rcx, 1
jae 0x1402afbb9
mov ebx, 0x8000001a
jmp 0x1402afc0d
lea rdx, [rcx - 1]
mov rax, r14
cmp rdx, rcx
jae 0x1402afbe7
mov rcx, qword [rdi + 0x18]
lea r8, [rbp - 0x58]
call fcn.14024a7fc
test eax, eax
js 0x1402afbe4
mov rax, qword [rbp - 0x58]
add rax, qword [rdi + 0x38]
cmp rax, qword [rdi + 0x38]
jae 0x1402afbe7
mov rax, r14
test rax, rax
jne 0x1402afc2f
lea r9, str.RtlArrayGet_failed_to_get_the_next_node
mov r8d, 0x7ff
lea rdx, str.AslpPathWildcardPeekNode
mov ebx, 0xc00000e5
lea ecx, [rax + 1]
call fcn.1400139b4
mov dword [rsp + 0x20], ebx
lea r9, str.AslpPathWildcardPeekNode_failed___x_
mov r8d, 0x81a
lea rdx, str.AslpPathWildcardPopNode
mov ecx, 1
jmp 0x1402b028d
mov rcx, rax
call fcn.1402b0d10
mov rax, qword [rdi + 0x20]
lea r9, [rax - 1]
cmp r9, rax
jae 0x1402b0292
mov rcx, qword [rdi + 0x18]
lea r8, [rbp - 0x50]
mov rdx, r9
call fcn.14024a7fc
test eax, eax
js 0x1402b0292
mov rsi, qword [rbp - 0x50]
add rsi, qword [rdi + 0x38]
cmp rsi, qword [rdi + 0x38]
jb 0x1402b0292
mov rbx, qword [rdi + 0x20]
sub rbx, r9
sub rbx, 1
mov qword [rbp - 0x70], rbx
je 0x1402afcd5
mov rdx, qword [rdi + 0x18]
lea r8, [rbp - 0x70]
mov rcx, rbx
call fcn.14024a7fc
test eax, eax
js 0x1402b0292
mov rcx, qword [rdi + 0x18]
lea rdx, [r9 + 1]
lea r8, [rbp - 0x48]
call fcn.14024a7fc
test eax, eax
js 0x1402b0292
mov rdx, qword [rbp - 0x48]
add rdx, qword [rdi + 0x38]
cmp rdx, qword [rdi + 0x38]
jb 0x1402b0292
mov rbx, qword [rbp - 0x70]
mov rcx, rsi
mov r8, rbx
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
mov r8, qword [rdi + 0x18]
lea rcx, [rbx + rsi]
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
dec qword [rdi + 0x20]
cmp qword [rdi + 0x20], 0x10
jbe 0x1402b0292
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x28]
mov rax, rdx
imul rax, rcx
cmp rax, 0x400
jb 0x1402b0292
mov rax, rcx
shr rax, 2
cmp qword [rdi + 0x20], rax
jae 0x1402b0292
mov rsi, rcx
lea r8, [rbp]
shr rsi, 1
call fcn.14024a7fc
test eax, eax
js 0x1402b0292
mov rdx, qword [rdi + 0x18]
lea r8, [rsp + 0x78]
mov rcx, rsi
call fcn.14024a7fc
test eax, eax
js 0x1402b0292
mov r8, qword [rdi + 0x38]
xor edx, edx
mov rcx, qword [rdi + 0x10]
test r8, r8
jne 0x1402afd88
mov r8, qword [rsp + 0x78]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x1402afd9c
mov r8, qword [rsp + 0x78]
xor edx, edx
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
jmp 0x1402afd9c
mov r9, qword [rsp + 0x78]
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rbx, rbx
je 0x1402b0292
mov qword [rdi + 0x38], rbx
mov qword [rdi + 0x28], rsi
jmp 0x1402b0292
mov rdx, qword [rbx + 0x10]
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x18]
lea rax, [rsp + 0x68]
mov byte [rsp + 0x50], r14b
mov esi, 1
mov qword [rsp + 0x48], rax
xor r9d, r9d
mov byte [rsp + 0x40], sil
lea rax, [rbp + 0x18]
mov dword [rsp + 0x38], 3
xor r8d, r8d
mov dword [rsp + 0x30], 0x268
xor edx, edx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_ZwQueryDirectoryFile]
nop dword [rax + rax]
test eax, eax
jns 0x1402b0056
cmp eax, 0x80000006
je 0x1402afe7a
cmp eax, 0xc000000f
je 0x1402afe7a
lea r9, str.NtQueryDirectoryFile_failed_to_query_next_file___x_
mov dword [rsp + 0x20], eax
mov r8d, 0x9bf
lea rdx, str.AslPathWildcardFindNext
mov ecx, esi
call fcn.1400139b4
mov rax, qword [rsp + 0x70]
lea r9, str.FilePath:__ws__Pattern:__ws
mov qword [rsp + 0x28], rax
lea rdx, str.AslPathWildcardFindNext
mov rax, qword [rbx + 8]
lea ecx, [rsi + 1]
mov r8d, 0x9c0
mov qword [rsp + 0x20], rax
call fcn.1400139b4
mov rcx, qword [rdi + 0x20]
cmp rcx, rsi
jae 0x1402afe8a
mov ebx, 0x8000001a
jmp 0x1402afedd
lea rdx, [rcx - 1]
mov rax, r14
cmp rdx, rcx
jae 0x1402afeb8
mov rcx, qword [rdi + 0x18]
lea r8, [rbp - 0x40]
call fcn.14024a7fc
test eax, eax
js 0x1402afeb5
mov rax, qword [rbp - 0x40]
add rax, qword [rdi + 0x38]
cmp rax, qword [rdi + 0x38]
jae 0x1402afeb8
mov rax, r14
test rax, rax
jne 0x1402afefa
lea r9, str.RtlArrayGet_failed_to_get_the_next_node
mov r8d, 0x7ff
lea rdx, str.AslpPathWildcardPeekNode
mov ecx, esi
mov ebx, 0xc00000e5
call fcn.1400139b4
mov dword [rsp + 0x20], ebx
lea r9, str.AslpPathWildcardPeekNode_failed___x_
mov r8d, 0x81a
lea rdx, str.AslpPathWildcardPopNode
jmp 0x1402b028b
mov rcx, rax
call fcn.1402b0d10
mov rax, qword [rdi + 0x20]
lea r9, [rax - 1]
cmp r9, rax
jae 0x1402b0292
mov rcx, qword [rdi + 0x18]
lea r8, [rbp - 0x38]
mov rdx, r9
call fcn.14024a7fc
test eax, eax
js 0x1402b0292
mov rsi, qword [rbp - 0x38]
add rsi, qword [rdi + 0x38]
cmp rsi, qword [rdi + 0x38]
jb 0x1402b0292
mov rbx, qword [rdi + 0x20]
sub rbx, r9
sub rbx, 1
mov qword [rbp - 0x68], rbx
je 0x1402affa0
mov rdx, qword [rdi + 0x18]
lea r8, [rbp - 0x68]
mov rcx, rbx
call fcn.14024a7fc
test eax, eax
js 0x1402b0292
mov rcx, qword [rdi + 0x18]
lea rdx, [r9 + 1]
lea r8, [rbp - 0x30]
call fcn.14024a7fc
test eax, eax
js 0x1402b0292
mov rdx, qword [rbp - 0x30]
add rdx, qword [rdi + 0x38]
cmp rdx, qword [rdi + 0x38]
jb 0x1402b0292
mov rbx, qword [rbp - 0x68]
mov rcx, rsi
mov r8, rbx
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
mov r8, qword [rdi + 0x18]
lea rcx, [rbx + rsi]
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
dec qword [rdi + 0x20]
cmp qword [rdi + 0x20], 0x10
jbe 0x1402b0292
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x28]
mov rax, rdx
imul rax, rcx
cmp rax, 0x400
jb 0x1402b0292
mov rax, rcx
shr rax, 2
cmp qword [rdi + 0x20], rax
jae 0x1402b0292
mov rsi, rcx
lea r8, [rbp + 8]
shr rsi, 1
call fcn.14024a7fc
test eax, eax
js 0x1402b0292
mov rdx, qword [rdi + 0x18]
lea r8, [rbp - 0x80]
mov rcx, rsi
call fcn.14024a7fc
test eax, eax
js 0x1402b0292
mov r8, qword [rdi + 0x38]
xor edx, edx
mov rcx, qword [rdi + 0x10]
test r8, r8
jne 0x1402b004d
mov r8, qword [rbp - 0x80]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x1402afd9c
mov r8, qword [rbp - 0x80]
jmp 0x1402afd7c
mov r9, qword [rbp - 0x80]
jmp 0x1402afd8d
mov eax, 4
cmp dword [r13 + 0x3c], eax
jne 0x1402b0077
lea rcx, [r13 + 0x5e]
cmp word [rcx], 0x2e
jne 0x1402b0090
cmp word [r13 + 0x60], 0x2e
je 0x1402b0292
mov eax, 2
lea rcx, [r13 + 0x5e]
cmp dword [r13 + 0x3c], eax
jne 0x1402b0090
cmp word [rcx], 0x2e
je 0x1402b0292
mov r9d, dword [r13 + 0x38]
mov rdx, rbx
movzx eax, word [r13 + 0x3c]
mov r8, qword [rbx + 0x10]
shr r9d, 4
mov word [rsp + 0x28], ax
and r9d, esi
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x20]
call fcn.1402b09e4
cmp eax, 0xc0000273
je 0x1402b0239
cmp eax, 0xc0000103
je 0x1402b0292
cmp eax, 0xc00000ba
je 0x1402b0292
test eax, eax
js 0x1402b0226
mov r14, qword [rdi + 0x20]
cmp r14, qword [rdi + 0x28]
jb 0x1402b01d2
lea rcx, [r14 + 1]
cmp rcx, qword [rdi + 0x28]
ja 0x1402b011d
mov ebx, 0xc000000d
xor r14d, r14d
test ebx, ebx
jns 0x1402b0292
lea r9, str.AslpPathWildcardPushNode_failed___x_
mov r8d, 0x9f1
jmp 0x1402b0661
mov rsi, qword [rdi + 0x30]
dec rsi
lea rax, [rsi + rcx]
cmp rax, rcx
jb 0x1402b01f3
mov rdx, qword [rdi + 0x18]
lea r8, [rbp + 0x10]
mov rcx, qword [rdi + 0x28]
not rsi
and rsi, rax
call fcn.14024a7fc
test eax, eax
jns 0x1402b0153
mov ebx, 0xc0000095
jmp 0x1402b01c7
mov rdx, qword [rdi + 0x18]
lea r8, [rbp - 0x78]
mov rcx, rsi
call fcn.14024a7fc
test eax, eax
js 0x1402b014c
mov r8, qword [rdi + 0x38]
xor edx, edx
mov rcx, qword [rdi + 0x10]
test r8, r8
jne 0x1402b019e
mov r8, qword [rbp - 0x78]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x1402b01b1
mov r8, qword [rbp - 0x78]
xor edx, edx
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
jmp 0x1402b01b1
mov r9, qword [rbp - 0x78]
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rbx, rbx
jne 0x1402b01bd
mov ebx, 0xc0000017
jmp 0x1402b01c7
mov qword [rdi + 0x38], rbx
xor ebx, ebx
mov qword [rdi + 0x28], rsi
test ebx, ebx
jne 0x1402b0100
lea esi, [rbx + 1]
mov rcx, qword [rdi + 0x18]
lea r8, [rbp - 0x28]
mov rdx, r14
call fcn.14024a7fc
xor r14d, r14d
test eax, eax
jns 0x1402b01fd
mov ebx, 0xc0000095
jmp 0x1402b0103
mov ebx, 0xc0000095
jmp 0x1402b0100
mov rdx, qword [rbp - 0x28]
add rdx, qword [rdi + 0x38]
cmp rdx, qword [rdi + 0x38]
jb 0x1402b01e9
movups xmm0, xmmword [rbp - 0x20]
mov ebx, r14d
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp - 0x10]
movups xmmword [rdx + 0x10], xmm1
add qword [rdi + 0x20], rsi
jmp 0x1402b0103
mov dword [rsp + 0x20], eax
lea r9, str.AslpPathWildcardAllocMatchNode_failed___x_
mov r8d, 0x9f9
jmp 0x1402b0284
movzx edx, word [r13 + 0x3c]
lea r8, [rsp + 0x60]
movzx ecx, word [rbx]
call fcn.1402b1194
test eax, eax
js 0x1402b026f
movzx ecx, word [rsp + 0x60]
lea r8, [rsp + 0x60]
mov r9d, 2
mov edx, r9d
call fcn.1402b1194
test eax, eax
jns 0x1402b0324
mov dword [rsp + 0x20], 0xc0000095
lea r9, str.Failed_to_compute_the_path_length___x_
mov r8d, 0xa25
lea rdx, str.AslPathWildcardFindNext
mov ecx, esi
call fcn.1400139b4
mov rax, qword [rdi + 0x20]
mov rcx, rax
cmp rax, 1
jae 0x1402afb49
mov ebx, 0x80000006
mov rcx, qword gs:[0x60]
mov r8, r13
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x48]
mov rax, qword [rbp + 0x50]
test rcx, rcx
je 0x1402b02f0
cmp rcx, rax
je 0x1402b02f0
mov qword [rbp + 0x30], rcx
lea rcx, [rbp + 0x28]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
nop dword [rax + rax]
mov rax, qword [rbp + 0x50]
test rax, rax
je 0x1402b02f9
mov word [rax], r14w
mov eax, ebx
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.1400a15a0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
movzx r8d, word [rsp + 0x60]
lea rax, [rbp + 0x68]
mov qword [rbp + 0x50], rax
lea rcx, [rbp + 0x68]
add r8, r9
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0x60], r9
lea rax, [rbp + 0x68]
mov qword [rbp + 0x40], rax
mov rdx, r9
mov qword [rbp + 0x58], rdx
mov word [rbp + 0x68], r14w
mov dword [rbp + 0x38], 0x20000
cmp r8, 0xfffe
jbe 0x1402b036c
mov ebx, 0xc0000106
jmp 0x1402b038c
cmp r8, r9
jbe 0x1402b03ac
lea rdx, [rbp + 0x48]
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlpEnsureBufferSize]
nop dword [rax + rax]
test eax, eax
jns 0x1402b03a4
mov ebx, 0xc0000017
lea r9, str.RtlEnsureUnicodeStringBufferSizeBytes_failed___x_
mov r8d, Ordinal_2611
mov dword [rsp + 0x20], ebx
mov ecx, esi
jmp 0x1402b066a
mov rdx, qword [rbp + 0x58]
mov rcx, qword [rbp + 0x48]
movzx eax, word [rbp + 0x58]
movzx r9d, r14w
mov word [rbp + 0x3a], ax
mov qword [rbp + 0x40], rcx
mov word [rbp + 0x38], r14w
movzx r8d, word [rbx]
add r8, 2
cmp r8, 0xfffe
jbe 0x1402b03d9
mov ebx, 0xc0000106
jmp 0x1402b03f9
cmp r8, rdx
jbe 0x1402b0411
lea rdx, [rbp + 0x48]
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlpEnsureBufferSize]
nop dword [rax + rax]
test eax, eax
jns 0x1402b0408
mov ebx, 0xc0000017
lea r9, str.RtlAssignUnicodeStringBuffer_failed___x_
mov r8d, 0xa38
jmp 0x1402b0399
mov rcx, qword [rbp + 0x48]
movzx r9d, word [rbp + 0x38]
mov qword [rbp + 0x40], rcx
movzx r8d, word [rbx]
mov rdx, qword [rbx + 8]
movzx eax, r9w
shr rax, 1
lea rcx, [rcx + rax*2]
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
movzx eax, word [rbx]
movzx ecx, word [rbp + 0x38]
add ax, 2
add ax, cx
mov word [rbp + 0x3a], ax
add cx, word [rbx]
mov rax, qword [rbp + 0x40]
mov word [rbp + 0x38], cx
movzx ecx, cx
shr rcx, 1
mov word [rax + rcx*2], r14w
movzx ecx, word [rbx]
mov rax, qword [rbx + 8]
mov ebx, 2
shr rcx, 1
cmp word [rax + rcx*2 - 2], 0x5c
je 0x1402b0500
movzx ecx, word [rbp + 0x38]
lea r8d, [rbx + rcx]
add r8, rbx
cmp r8, 0xfffe
jbe 0x1402b048b
mov ebx, 0xc0000106
jmp 0x1402b04ac
cmp r8, qword [rbp + 0x58]
jbe 0x1402b04c2
lea rdx, [rbp + 0x48]
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlpEnsureBufferSize]
nop dword [rax + rax]
test eax, eax
jns 0x1402b04be
mov ebx, 0xc0000017
lea r9, str.RtlAppendUnicodeStringBuffer_failed___x_
mov r8d, 0xa3f
jmp 0x1402b0399
movzx ecx, word [rbp + 0x38]
movzx eax, word [0x14030ab44]
mov rdx, qword [rbp + 0x48]
movzx ecx, cx
shr rcx, 1
mov qword [rbp + 0x40], rdx
mov word [rdx + rcx*2], ax
mov eax, 4
movzx ecx, word [rbp + 0x38]
add eax, ecx
add cx, bx
mov word [rbp + 0x38], cx
mov word [rbp + 0x3a], ax
mov rax, qword [rbp + 0x40]
movzx ecx, cx
shr rcx, 1
mov word [rax + rcx*2], r14w
movzx r10d, word [rbp + 0x38]
lea r9, [r13 + 0x5e]
mov qword [rsp + 0x70], r9
movzx edx, word [r13 + 0x3c]
mov word [rsp + 0x68], dx
movzx eax, word [r13 + 0x3c]
mov word [rsp + 0x6a], ax
lea r8d, [r10 + rdx]
add r8, 2
cmp r8, 0xfffe
jbe 0x1402b053a
mov ebx, 0xc0000106
jmp 0x1402b055b
cmp r8, qword [rbp + 0x58]
jbe 0x1402b057c
lea rdx, [rbp + 0x48]
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlpEnsureBufferSize]
nop dword [rax + rax]
test eax, eax
jns 0x1402b056d
mov ebx, 0xc0000017
lea r9, str.RtlAppendUnicodeStringBuffer_failed___x_
mov r8d, 0xa4e
jmp 0x1402b0399
mov r9, qword [rsp + 0x70]
movzx edx, word [rsp + 0x68]
movzx r10d, word [rbp + 0x38]
mov rcx, qword [rbp + 0x48]
movzx eax, r10w
shr rax, 1
mov qword [rbp + 0x40], rcx
movzx r8d, dx
mov rdx, r9
lea rcx, [rcx + rax*2]
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
movzx eax, word [rsp + 0x68]
add ax, word [rbp + 0x38]
movzx ecx, ax
mov word [rbp + 0x38], cx
lea eax, [rbx + rcx]
shr rcx, 1
mov word [rbp + 0x3a], ax
mov rax, qword [rbp + 0x40]
mov word [rax + rcx*2], r14w
cmp dword [rdi], r14d
je 0x1402b05f7
xor r9d, r9d
lea rdx, [rbp + 0x38]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlNtPathNameToDosPathName]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x1402b05f7
mov dword [rsp + 0x20], eax
lea r9, str.RtlNtPathNameToDosPathName_failed___x_
mov r8d, 0xa59
jmp 0x1402b039d
movzx r9d, word [rbp + 0x38]
mov edx, 0x208
mov r8, qword [rbp + 0x40]
mov rcx, r12
call fcn.1402b10fc
mov ebx, eax
test eax, eax
jns 0x1402b0629
mov dword [rsp + 0x20], eax
lea r9, str.RtlStringCbCopyNW_failed___x_
mov r8d, 0xa64
jmp 0x1402b039d
mov ebx, r14d
jmp 0x1402b02a8
lea r9, str.RtlArrayGet_failed_to_get_the_next_node
mov r8d, 0x7ff
lea rdx, str.AslpPathWildcardPeekNode
mov ecx, 1
call fcn.1400139b4
lea r9, str.AslpPathWildcardPeekNode_failed___x_
mov r8d, 0x9a2
mov ebx, 0xc00000e5
mov dword [rsp + 0x20], ebx
mov ecx, 1
lea rdx, str.AslPathWildcardFindNext
call fcn.1400139b4
jmp 0x1402b02a8