Function at 0x14000ab38
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x50
cmp dword [0x140024670], 0
mov rbx, rdx
mov esi, dword [rcx + 0x10]
mov rdi, rcx
mov ebp, 0xa0000003
mov r12d, 1
je 0x14000ab6f
cmp dword [rcx + 0x1c], ebp
je 0x14000ab81
cmp dword [0x140024680], 0
je 0x14000ab86
cmp dword [rcx + 0x1c], 0xa000000c
jne 0x14000ab86
mov r14d, r12d
jmp 0x14000ab89
xor r14d, r14d
cmp dword [0x14002456c], 0
jne 0x14000adfa
cmp esi, 0x12
je 0x14000adfa
mov cl, r12b
call fcn.14000bc30
cmp esi, r12d
jne 0x14000ac2b
mov ecx, dword [0x140023160]
test ecx, ecx
je 0x14000abdc
cmp dword [rbx + 0x1c], ebp
je 0x14000abdc
mov eax, dword [0x140024568]
and eax, dword [0x140024560]
bt eax, 0x12
jae 0x14000abdc
mov rax, qword [rbx]
test rax, rax
je 0x14000ac31
cmp qword [rax + 0x30], 0
jne 0x14000ac31
mov rdx, rdi
mov rcx, rbx
call fcn.140013fd8
test eax, eax
jne 0x14000ac2b
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r8d, 0x238e
mov rcx, rbx
mov ebp, eax
call fcn.1400148a4
test eax, eax
jne 0x14000ac2b
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov rdx, rbx
mov ecx, 0x2394
call fcn.140011974
jmp 0x14000adfd
mov ecx, dword [0x140023160]
test ecx, ecx
je 0x14000ac3a
cmp esi, 9
jne 0x14000ac4b
test r14d, r14d
jne 0x14000ac4b
xor ecx, ecx
cmp dword [0x140024684], ecx
je 0x14000ac82
jmp 0x14000ac4e
mov ecx, r12d
mov eax, dword [0x140023140]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x44], eax
mov rdx, rbx
mov eax, dword [0x14002455c]
mov dword [rsp + 0x48], ecx
mov rcx, rdi
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x40], 0x238e
call fcn.140012838
test eax, eax
je 0x14000acb5
mov r8d, dword [0x140024600]
test r8d, r8d
je 0x14000acce
mov eax, dword [0x1400246c8]
cmp esi, 9
jne 0x14000ac9d
test eax, eax
je 0x14000acce
cmp dword [0x140024550], 0
je 0x14000acbc
mov rdx, rbx
mov rcx, rdi
call fcn.1400130b4
test eax, eax
jne 0x14000acce
xor eax, eax
jmp 0x14000adfd
cmp esi, r12d
je 0x14000aca6
cmp dword [0x140024608], 0
jne 0x14000aca6
test eax, eax
jne 0x14000aca6
cmp dword [0x140024678], 0
je 0x14000adbb
cmp esi, r12d
jne 0x14000adbb
lea rdx, [rsp + 0x80]
mov rcx, rbx
call fcn.1400160ec
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
mov rdx, qword [rsp + 0x80]
mov ebp, eax
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, r12d
jg 0x14000ad38
mov rcx, qword [rdx]
mov r8, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [r8 + 8]
call qword [0x14001d898]
cmp ebp, 0xffffffff
je 0x14000acb5
mov eax, dword [rdi + 0x18]
xor eax, ebp
mov ebp, 0x4000
test ebp, eax
je 0x14000adbb
lea rdx, [rsp + 0x90]
mov rcx, rbx
call fcn.1400160ec
mov rcx, qword [rsp + 0x90]
test dword [rdi + 0x18], ebp
je 0x14000ad7a
call qword [sym.imp.ADVAPI32.dll_EncryptFileW]
nop dword [rax + rax]
jmp 0x14000ad88
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_DecryptFileW]
nop dword [rax + rax]
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, r12d
jg 0x14000adbb
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [0x14001d898]
cmp dword [0x14002316c], 0
je 0x14000adf3
cmp esi, 9
jne 0x14000addb
cmp dword [0x140024640], 0
jne 0x14000addb
cmp dword [0x140024660], 0
je 0x14000adf3
mov rdx, rbx
mov dword [rsp + 0x30], r14d
mov rcx, rdi
call fcn.140012568
test eax, eax
je 0x14000acb5
mov dword [rdi + 0x10], 0x12
mov eax, r12d
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret