Function at 0x18000e480
Capabilities:
Get file attributes

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x18003d0b0]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rbx, rcx
xor r15d, r15d
mov qword [rcx + 0x50], r15
mov rax, qword [rcx + 0x40]
sub rax, qword [rcx + 0x38]
cmp rax, 0x20
jb 0x18000ebc9
mov rax, qword [rcx + 0x40]
sub rax, qword [rcx + 0x38]
sar rax, 5
cmp rax, 1
jne 0x18000e779
mov qword [rbp + 0x1f], 7
mov qword [rbp + 0x17], r15
mov word [rbp + 7], r15w
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, qword [rcx + 0x38]
lea rcx, [rbp + 7]
call fcn.1800036f0
nop
lea rcx, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae rcx, qword [rbp + 7]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x18000e544
cmp qword [rbp + 0x17], 3
jbe 0x18000e756
mov dword [rbx + 0x50], 0x3f
or dword [rbx + 0x54], 0x3f
jmp 0x18000e756
mov qword [rbp - 0x31], 7
mov qword [rbp - 0x39], r15
mov word [rbp - 0x49], r15w
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x49]
call fcn.1800036f0
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x19]
call fcn.180005260
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rdx, qword [rbp - 0x19]
lea rcx, [0x180029658]
call fcn.18000dde0
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rcx, qword [rbp - 0x19]
lea rdx, [0x180028d38]
call fcn.180018b48
test eax, eax
jne 0x18000e5be
mov dword [rbx + 0x50], 1
or dword [rbx + 0x54], 1
jmp 0x18000e73b
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rcx, qword [rbp - 0x19]
lea rdx, [0x180028d40]
call fcn.180018b48
test eax, eax
je 0x18000e737
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rcx, qword [rbp - 0x19]
lea rdx, str.docx
call fcn.180018b48
test eax, eax
je 0x18000e737
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rcx, qword [rbp - 0x19]
lea rdx, [0x180028da0]
call fcn.180018b48
test eax, eax
je 0x18000e731
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rcx, qword [rbp - 0x19]
lea rdx, str.pptx
call fcn.180018b48
test eax, eax
je 0x18000e731
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rcx, qword [rbp - 0x19]
lea rdx, [0x180028d58]
call fcn.180018b48
test eax, eax
je 0x18000e72b
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rcx, qword [rbp - 0x19]
lea rdx, str.xlsx
call fcn.180018b48
test eax, eax
je 0x18000e72b
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rcx, qword [rbp - 0x19]
lea rdx, [0x180028d88]
call fcn.180018b48
test eax, eax
jne 0x18000e6b1
or dword [rbx + 0x54], 0x10
jmp 0x18000e73b
mov edi, r15d
lea r14, [0x18003e650]
nop dword [rax + rax]
cmp qword [r14 + 0x18], 8
jb 0x18000e6cc
mov rdx, qword [r14]
jmp 0x18000e6cf
mov rdx, r14
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rcx, qword [rbp - 0x19]
call fcn.180018b48
test eax, eax
je 0x18000e6f3
inc edi
add r14, 0x20
cmp edi, 8
jb 0x18000e6c0
jmp 0x18000e73b
mov dword [rbx + 0x50], 0x20
or dword [rbx + 0x54], 0x20
mov r8, qword [rbp - 1]
cmp r8, 8
jb 0x18000e718
inc r8
mov rdx, qword [rbp - 0x19]
lea rcx, [rbp - 0x19]
call fcn.1800039f0
mov qword [rbp - 1], 7
mov qword [rbp - 9], r15
mov word [rbp - 0x19], r15w
jmp 0x18000e756
or dword [rbx + 0x54], 8
jmp 0x18000e73b
or dword [rbx + 0x54], 4
jmp 0x18000e73b
or dword [rbx + 0x54], 2
mov r8, qword [rbp - 1]
cmp r8, 8
jb 0x18000e756
inc r8
mov rdx, qword [rbp - 0x19]
lea rcx, [rbp - 0x19]
call fcn.1800039f0
nop
mov r8, qword [rbp + 0x1f]
cmp r8, 8
jb 0x18000ebc9
inc r8
mov rdx, qword [rbp + 7]
lea rcx, [rbp + 7]
call fcn.1800039f0
jmp 0x18000ebc9
mov esi, r15d
mov dword [rbp - 0x59], r15d
mov ecx, r15d
mov dword [rbp - 0x51], ecx
mov r12d, r15d
mov r13d, r15d
mov rax, qword [rbx + 0x40]
sub rax, qword [rbx + 0x38]
mov edi, 0x3f
cmp rax, 0x20
jb 0x18000eb1c
xor edi, edi
lea r14, [0x18003e650]
nop dword [rax]
mov rcx, qword [rbx + 0x38]
add rcx, r15
cmp qword [rcx + 0x18], 8
jb 0x18000e7c1
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x18000e7e3
mov rax, qword [rbx + 0x38]
mov esi, dword [rbp - 0x59]
cmp qword [r15 + rax + 0x10], 3
ja 0x18000eb07
jmp 0x18000eae7
movsxd rdx, r13d
shl rdx, 5
add rdx, qword [rbx + 0x38]
mov qword [rbp + 0x1f], 7
mov qword [rbp + 0x17], rdi
mov word [rbp + 7], di
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rbp + 7]
call fcn.1800036f0
nop
mov qword [rbp - 0x31], 7
mov qword [rbp - 0x39], rdi
mov word [rbp - 0x49], di
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x49]
call fcn.1800036f0
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x19]
call fcn.180005260
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rdx, qword [rbp - 0x19]
lea rcx, [0x180029658]
call fcn.18000dde0
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rcx, qword [rbp - 0x19]
lea rdx, [0x180028d38]
call fcn.180018b48
test eax, eax
jne 0x18000e896
mov esi, 1
mov dword [rbp - 0x59], esi
mov eax, dword [rbx + 0x54]
test sil, al
jne 0x18000eaa3
or eax, esi
mov dword [rbx + 0x54], eax
jmp 0x18000eaa3
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rcx, qword [rbp - 0x19]
lea rdx, [0x180028d40]
call fcn.180018b48
test eax, eax
je 0x18000ea93
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rcx, qword [rbp - 0x19]
lea rdx, str.docx
call fcn.180018b48
test eax, eax
je 0x18000ea93
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rcx, qword [rbp - 0x19]
lea rdx, [0x180028da0]
call fcn.180018b48
test eax, eax
je 0x18000ea81
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rcx, qword [rbp - 0x19]
lea rdx, str.pptx
call fcn.180018b48
test eax, eax
je 0x18000ea81
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rcx, qword [rbp - 0x19]
lea rdx, [0x180028d58]
call fcn.180018b48
test eax, eax
je 0x18000ea6f
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rcx, qword [rbp - 0x19]
lea rdx, str.xlsx
call fcn.180018b48
test eax, eax
je 0x18000ea6f
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rcx, qword [rbp - 0x19]
lea rdx, [0x180028d88]
call fcn.180018b48
test eax, eax
jne 0x18000e999
mov eax, dword [rbx + 0x54]
mov esi, dword [rbp - 0x59]
test al, 0x10
jne 0x18000eaa3
or eax, 0x10
mov dword [rbx + 0x54], eax
jmp 0x18000eaa3
mov esi, edi
mov rdi, r14
nop
cmp qword [rdi + 0x18], 8
jb 0x18000e9ac
mov rdx, qword [rdi]
jmp 0x18000e9af
mov rdx, rdi
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rcx, qword [rbp - 0x19]
call fcn.180018b48
test eax, eax
je 0x18000e9d3
inc esi
add rdi, 0x20
cmp esi, 8
jb 0x18000e9a0
jmp 0x18000e9e6
mov r12d, 1
mov eax, dword [rbx + 0x54]
test al, 0x20
jne 0x18000e9e6
or eax, 0x20
mov dword [rbx + 0x54], eax
xor esi, esi
lea rdi, [0x18003e570]
nop
cmp qword [rdi + 0x18], 8
jb 0x18000e9fc
mov rdx, qword [rdi]
jmp 0x18000e9ff
mov rdx, rdi
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rcx, qword [rbp - 0x19]
call fcn.180018b48
test eax, eax
je 0x18000ea23
inc esi
add rdi, 0x20
cmp esi, 7
jb 0x18000e9f0
jmp 0x18000ea2a
mov dword [rbp - 0x51], 1
xor esi, esi
mov rdi, r14
nop
cmp qword [rdi + 0x18], 8
jb 0x18000ea3c
mov rdx, qword [rdi]
jmp 0x18000ea3f
mov rdx, rdi
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rcx, qword [rbp - 0x19]
call fcn.180018b48
test eax, eax
je 0x18000ea65
inc esi
add rdi, 0x20
cmp esi, 8
jb 0x18000ea30
xor edi, edi
jmp 0x18000eaa0
mov r12d, 1
xor edi, edi
jmp 0x18000eaa0
mov eax, dword [rbx + 0x54]
mov esi, dword [rbp - 0x59]
test al, 8
jne 0x18000eaa3
or eax, 8
mov dword [rbx + 0x54], eax
jmp 0x18000eaa3
mov eax, dword [rbx + 0x54]
mov esi, dword [rbp - 0x59]
test al, 4
jne 0x18000eaa3
or eax, 4
mov dword [rbx + 0x54], eax
jmp 0x18000eaa3
mov eax, dword [rbx + 0x54]
test al, 2
jne 0x18000eaa0
or eax, 2
mov dword [rbx + 0x54], eax
mov esi, dword [rbp - 0x59]
mov r8, qword [rbp - 1]
cmp r8, 8
jb 0x18000eabd
inc r8
mov rdx, qword [rbp - 0x19]
lea rcx, [rbp - 0x19]
call fcn.1800039f0
mov qword [rbp - 1], 7
mov qword [rbp - 9], rdi
mov word [rbp - 0x19], di
mov r8, qword [rbp + 0x1f]
cmp r8, 8
jb 0x18000eae7
inc r8
mov rdx, qword [rbp + 7]
lea rcx, [rbp + 7]
call fcn.1800039f0
inc r13d
add r15, 0x20
mov rcx, qword [rbx + 0x40]
sub rcx, qword [rbx + 0x38]
sar rcx, 5
movsxd rax, r13d
cmp rax, rcx
je 0x18000eb14
jmp 0x18000e7b0
mov edi, 0x3f
mov dword [rbx + 0x50], edi
mov dword [rbx + 0x54], edi
jmp 0x18000eb19
mov edi, 0x3f
mov ecx, dword [rbp - 0x51]
mov eax, dword [rbx + 0x54]
test eax, eax
je 0x18000ebc9
cmp eax, 1
jne 0x18000eb31
mov dword [rbx + 0x54], eax
jmp 0x18000eb6f
cmp eax, 2
jne 0x18000eb3b
mov dword [rbx + 0x54], eax
jmp 0x18000eb6f
cmp eax, 4
jne 0x18000eb45
mov dword [rbx + 0x54], eax
jmp 0x18000eb6f
cmp eax, 8
jne 0x18000eb4f
mov dword [rbx + 0x54], eax
jmp 0x18000eb6f
cmp eax, 0x10
jne 0x18000eb59
mov dword [rbx + 0x54], eax
jmp 0x18000eb6f
cmp eax, 0x20
jne 0x18000eb63
mov dword [rbx + 0x54], eax
jmp 0x18000eb6f
movzx eax, al
and eax, 1
or eax, 0x3e
mov dword [rbx + 0x54], eax
test esi, esi
je 0x18000eb9e
test ecx, ecx
je 0x18000eb87
mov eax, 0x1f
test r12d, r12d
cmovne eax, edi
mov dword [rbx + 0x50], eax
jmp 0x18000ebc9
test r12d, r12d
je 0x18000eb95
mov dword [rbx + 0x50], 0x21
jmp 0x18000ebc9
mov dword [rbx + 0x50], 1
jmp 0x18000ebc9
test ecx, ecx
je 0x18000ebb0
test r12d, r12d
je 0x18000ebbe
mov dword [rbx + 0x50], 0x3e
jmp 0x18000ebc9
test r12d, r12d
je 0x18000ebbe
mov dword [rbx + 0x50], 0x20
jmp 0x18000ebc9
test ecx, ecx
je 0x18000ebc9
mov dword [rbx + 0x50], 0x1e
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1800143b0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret