Function at 0x404eb0
Capabilities:
Get file attributes

Disassembly:
push rbp
sub rsp, 0x1f0
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x18], r8
mov qword [rbp - 0x48], rdx
mov qword [rbp - 0x40], rcx
mov rax, rcx
mov qword [rbp - 0x38], rax
mov word [rcx + 0x40], 0
mov qword [rbp - 0x30], rcx
vmovaps ymm0, ymmword [section..rdata]
vmovaps xmm1, xmm0
vmovdqa xmmword [rbp], xmm1
mov qword [rbp + 0x10], 0x4d430001
mov rax, rbp
mov qword [rbp - 0x10], rax
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x20], 0x10
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
xor eax, eax
mov edx, eax
mov qword [rbp - 0x20], rdx
lea rax, [rbp + 0x10]
mov qword [rbp - 0x28], rax
rol rdi, 3
rol rdi, 0xd
rol rdi, 0x3d
rol rdi, 0x33
xchg rbx, rbx
mov rax, qword [rbp - 0x28]
mov rdx, qword [rbp - 0x20]
movabs rcx, 0xaaaaaaaaaaaaaaaa
mov qword [rbp + 0xa0], rcx
vmovups ymmword [rbp + 0x80], ymm0
vmovups ymmword [rbp + 0x60], ymm0
vmovups ymmword [rbp + 0x40], ymm0
mov qword [rbp + 0x10], 0x4d430001
lea r8, [rbp + 0x40]
mov qword [rbp + 0x18], r8
mov qword [rbp + 0x20], 0x68
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
rol rdi, 3
rol rdi, 0xd
rol rdi, 0x3d
rol rdi, 0x33
xchg rbx, rbx
mov rax, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rax]
mov rax, rsp
mov dword [rax + 0x20], 0x12
mov r9d, 0x68
vzeroupper
call sub.ntdll.dll_NtQueryInformationFile
mov ecx, eax
mov dword [rbp - 4], ecx
mov dword [rbp + 0xac], eax
sub eax, 0x80000005
je 0x405081
jmp 0x404fed
mov eax, dword [rbp - 4]
sub eax, 0xc000000d
je 0x405083
jmp 0x404ffd
mov eax, dword [rbp - 4]
sub eax, 0xc0000022
je 0x4050a0
jmp 0x40500d
mov eax, dword [rbp - 4]
test eax, eax
je 0x40507f
jmp 0x405040
mov rax, qword [rbp - 0x40]
cmp word [rax + 0x40], 0
je 0x405281
jmp 0x40528e
mov eax, dword [rbp + 0x60]
and eax, 0x400
cmp eax, 0
jne 0x40513d
jmp 0x4051e4
mov rcx, qword [rbp - 0x48]
mov edx, dword [rbp - 4]
call fcn.0040cfa0
mov rcx, qword [rbp - 0x48]
mov word [rbp + 0xf0], ax
call fcn.00402580
mov rcx, qword [rbp - 0x40]
lea rdx, [rbp + 0xb0]
mov r8d, 0x50
call fcn.004adbd0
mov rax, qword [rbp - 0x38]
add rsp, 0x1f0
pop rbp
ret
jmp 0x40502a
jmp 0x40502a
lea rcx, str.reached_unreachable_code
mov edx, 0x18
xor eax, eax
mov r8d, eax
lea r9, [0x004b2e60]
call fcn.00401c10
mov rcx, qword [rbp - 0x48]
call fcn.00402580
mov rcx, qword [rbp - 0x40]
lea rdx, [0x004b2e70]
mov r8d, 0x50
call fcn.004adbd0
mov rax, qword [rbp - 0x38]
add rsp, 0x1f0
pop rbp
ret
mov rax, qword [rbp - 0x30]
mov ecx, dword [rbp - 0x4c]
mov dword [rbp + 0x16c], ecx
mov edx, dword [rbp + 0x60]
mov dword [rax + 0x38], edx
mov dword [rax + 0x3c], ecx
mov rcx, qword [rbp + 0x70]
mov qword [rax + 0x30], rcx
mov rcx, qword [rbp + 0x48]
call fcn.0040e860
mov rcx, rax
mov rax, qword [rbp - 0x30]
mov qword [rax + 8], rdx
mov qword [rax], rcx
mov rcx, qword [rbp + 0x50]
call fcn.0040e860
mov rcx, rax
mov rax, qword [rbp - 0x30]
mov qword [rax + 0x18], rdx
mov qword [rax + 0x10], rcx
mov rcx, qword [rbp + 0x40]
call fcn.0040e860
mov rcx, rax
mov rax, qword [rbp - 0x30]
mov qword [rax + 0x28], rdx
mov qword [rax + 0x20], rcx
jmp 0x405016
xor eax, eax
mov dword [rbp - 0x4c], eax
jmp 0x4050cc
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rbp + 0x100], rax
mov qword [rbp + 0x10], 0x4d430001
lea r8, [rbp + 0x100]
mov qword [rbp + 0x18], r8
mov qword [rbp + 0x20], 8
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
xor eax, eax
mov edx, eax
lea rax, [rbp + 0x10]
rol rdi, 3
rol rdi, 0xd
rol rdi, 0x3d
rol rdi, 0x33
xchg rbx, rbx
mov rax, qword [rbp - 0x18]
mov rcx, qword [rax]
mov rax, rsp
mov dword [rax + 0x20], 0x23
mov rdx, rbp
mov r9d, 8
call sub.ntdll.dll_NtQueryInformationFile
mov dword [rbp + 0x10c], eax
mov ecx, eax
mov dword [rbp - 0x50], ecx
sub eax, 0xc0000004
je 0x405238
jmp 0x4051cf
mov eax, dword [rbp - 0x50]
sub eax, 0xc0000022
je 0x405255
jmp 0x4051db
mov eax, dword [rbp - 0x50]
test eax, eax
je 0x405236
jmp 0x4051f7
jmp 0x405136
mov eax, dword [rbp + 0x104]
mov dword [rbp - 0x4c], eax
jmp 0x4050cc
mov rcx, qword [rbp - 0x48]
mov edx, dword [rbp - 4]
call fcn.0040cfa0
mov rcx, qword [rbp - 0x48]
mov word [rbp + 0x150], ax
call fcn.00402580
mov rcx, qword [rbp - 0x40]
lea rdx, [rbp + 0x110]
mov r8d, 0x50
call fcn.004adbd0
mov rax, qword [rbp - 0x38]
add rsp, 0x1f0
pop rbp
ret
jmp 0x4051e9
lea rcx, str.reached_unreachable_code
mov edx, 0x18
xor eax, eax
mov r8d, eax
lea r9, [0x004b2e60]
call fcn.00401c10
mov rcx, qword [rbp - 0x48]
call fcn.00402580
mov rcx, qword [rbp - 0x40]
lea rdx, [0x004b2e70]
mov r8d, 0x50
call fcn.004adbd0
mov rax, qword [rbp - 0x38]
add rsp, 0x1f0
pop rbp
ret
mov rax, qword [rbp - 0x38]
add rsp, 0x1f0
pop rbp
ret
mov rcx, qword [rbp - 0x48]
call fcn.00402580
mov rax, qword [rbp - 0x38]
add rsp, 0x1f0
pop rbp
ret