Function at 0x2100816c0
Capabilities:
Get file attributes

Disassembly:
push rbp
push r14
push r13
push r12
sub rsp, 0x258
lea rbp, [rsp + 0x80]
mov r12, rcx
test dl, dl
jne 0x210081960
mov dword [rbp + 0x80], 0xffffffff
xor r9d, r9d
mov rdx, rcx
lea r13, [rbp + 0x80]
mov dword [rbp + 0x98], 0
mov r8d, 0x10a2
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x90], 0
mov dword [rbp + 0x9c], 0
mov byte [rbp + 0xa0], 0
mov qword [rbp + 0xf0], 0
mov qword [rbp + 0x110], 0
mov qword [rbp + 0x118], 0
mov qword [rbp + 0x120], 0
mov qword [rbp + 0x128], 0
mov qword [rbp + 0x130], 0
mov dword [rbp + 0x1a0], 0
mov qword [rbp + 0x1a8], 0
mov qword [rbp + 0x1b0], 0
mov qword [rbp + 0x1b8], 0
mov qword [rbp + 0x1c0], 0
mov qword [rbp + 0x1c8], 0
mov rcx, r13
call method.path_conv.check_char_const__unsigned_int__suffix_info_const_
mov eax, dword [rbp + 0x1b0]
cmp eax, 0xc3
je 0x2100817cf
test eax, eax
jne 0x210081888
test byte [rbp + 0x11a], 8
jne 0x210081850
mov rcx, qword [rbp + 0x130]
mov qword [rbp - 0x50], rcx
test rcx, rcx
je 0x2100818a8
mov dword [rsp + 0x20], 6
mov rdx, rbp
mov r9d, 8
lea r8, [rbp - 0x48]
call sym.NtQueryInformationFile
test eax, eax
js 0x210081850
test byte [rbp + 0x11a], 8
jne 0x210081850
mov r12, qword [rbp - 0x48]
mov rax, r12
shr rax, 0x20
jne 0x210081867
test byte [rbp + 0x98], 1
je 0x210081848
mov eax, dword [rbp + 0x94]
cmp eax, 3
je 0x210081850
cmp eax, 5
jne 0x210081848
cmp dword [rbp + 0x8c], 0x30503ff
jbe 0x210081850
nop dword [rax]
test r12, r12
jne 0x210081867
nop dword [rax]
xor edx, edx
mov rcx, r13
call method.path_conv.get_nt_native_path__UNICODE_STRING_
xor ecx, ecx
mov rdx, rax
call sym.hash_path_name_unsigned_long___UNICODE_STRING_
mov r12, rax
mov rcx, r13
call method.path_conv.path_conv__
mov rax, r12
lea rsp, [rbp + 0x1d8]
pop r12
pop r13
pop r14
pop rbp
ret
mov rdx, rbp
mov rcx, r13
call sym.stat_worker_path_conv__stat_
test eax, eax
jne 0x210081947
mov r12, qword [rbp + 8]
jmp 0x210081867
mov eax, dword [rbp + 0x11c]
mov rcx, r13
and eax, 8
cmp eax, 1
sbb r12d, r12d
xor edx, edx
call method.path_conv.get_nt_native_path__UNICODE_STRING_
and r12d, 0xffe00000
add r12d, 0x204000
mov r8, rax
test rax, rax
je 0x210081920
mov edx, dword [0x2102d1cd0]
xor eax, eax
mov dword [rbp - 0x30], 0x30
lea r8, [rbp - 0x30]
mov qword [rbp - 0x28], 0
test edx, edx
mov qword [rbp - 8], 0
setne al
add eax, eax
or eax, dword [rbp + 0x84]
mov dword [rbp - 0x18], eax
lea rax, [rbp + 0xf8]
mov qword [rbp - 0x20], rax
mov rax, qword [0x2102d1cc8]
mov qword [rbp - 0x10], rax
mov dword [rsp + 0x28], r12d
lea rcx, [rbp - 0x50]
lea r9, [rbp - 0x40]
mov edx, 0x20000
mov dword [rsp + 0x20], 7
call sym.NtOpenFile
test eax, eax
jns 0x210081a78
mov rcx, r13
xor r12d, r12d
call method.path_conv.path_conv__
jmp 0x21008186f
call sym.msys_2.0.dll_strlen
add rax, 0x13
and rax, 0xfffffffffffffff0
call fcn.21021b550
sub rsp, rax
mov rdx, r12
lea r14, [rsp + 0x30]
mov rcx, r14
call sym.msys_2.0.dll_stpcpy
cmp byte [rax - 1], 0x2f
je 0x210081992
mov byte [rax], 0x2f
add rax, 1
mov ecx, 0x2e2e
mov byte [rax + 2], 0
xor r9d, r9d
mov rdx, r14
mov word [rax], cx
lea r13, [rbp + 0x80]
mov r8d, 0x10a2
mov dword [rbp + 0x80], 0xffffffff
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x90], 0
mov dword [rbp + 0x98], 0
mov dword [rbp + 0x9c], 0
mov byte [rbp + 0xa0], 0
mov qword [rbp + 0xf0], 0
mov qword [rbp + 0x110], 0
mov qword [rbp + 0x118], 0
mov qword [rbp + 0x120], 0
mov qword [rbp + 0x128], 0
mov qword [rbp + 0x130], 0
mov dword [rbp + 0x1a0], 0
mov qword [rbp + 0x1a8], 0
mov qword [rbp + 0x1b0], 0
mov qword [rbp + 0x1b8], 0
mov qword [rbp + 0x1c0], 0
mov qword [rbp + 0x1c8], 0
jmp 0x2100817b2
mov dword [rsp + 0x20], 6
mov rcx, qword [rbp - 0x50]
mov rdx, rbp
mov r9d, 8
lea r8, [rbp - 0x48]
call sym.NtQueryInformationFile
test eax, eax
jns 0x21008180a
jmp 0x210081850