Function at 0x18009eb40
Capabilities:
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4a0
mov qword [rsp + 0xe8], 0xfffffffffffffffe
mov qword [rsp + 0x4f8], rbx
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov ebp, r9d
mov rbx, r8
mov r15, rdx
mov r13, rcx
mov r8, rcx
mov edx, 0x9ee3
lea rcx, [0x1801631b8]
call fcn.18005cd20
mov qword [rsp + 0x138], 0xf
xor r12d, r12d
mov qword [rsp + 0x130], r12
mov byte [rsp + 0x120], r12b
mov qword [rsp + 0x110], 0xf
mov qword [rsp + 0x108], r12
mov byte [rsp + 0xf8], r12b
test r15, r15
jne 0x18009ec46
cmp qword [rsp + 0x110], 0x10
jb 0x18009ebf1
mov rcx, qword [rsp + 0xf8]
call fcn.1800f4b9c
mov qword [rsp + 0x110], 0xf
mov qword [rsp + 0x108], r12
mov byte [rsp + 0xf8], 0
cmp qword [rsp + 0x138], 0x10
jb 0x18009ec25
mov rcx, qword [rsp + 0x120]
call fcn.1800f4b9c
mov qword [rsp + 0x138], 0xf
mov qword [rsp + 0x130], r12
mov byte [rsp + 0x120], 0
jmp 0x18009f50b
xor eax, eax
or rsi, 0xffffffffffffffff
mov rcx, rsi
mov rdi, r15
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r15
lea rcx, [rsp + 0x118]
call fcn.180003700
mov byte [rsp + 0x280], 0
xor edx, edx
mov r8d, 0x207
lea rcx, [rsp + 0x281]
call fcn.1800f4fb0
test ebp, ebp
jne 0x18009ecbd
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x200
lea rax, [rsp + 0x280]
mov qword [rsp + 0x20], rax
mov r9d, esi
mov r8, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x18009ecdd
lea rcx, [rsp + 0x280]
sub rcx, rbx
nop dword [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
inc rbx
test al, al
jne 0x18009ecd0
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0x280]
repne scasb al, byte [rdi]
not rcx
lea r14, [rcx - 1]
test byte [rsp + 0x140], 0x10
je 0x18009f11a
mov rcx, qword [rsp + 0x130]
test rcx, rcx
je 0x18009ee28
lea rdi, [rcx - 1]
cmp rcx, rdi
ja 0x18009ed47
call fcn.1800f3b58
mov rcx, qword [rsp + 0x130]
lea rax, [rsp + 0x120]
mov rbx, qword [rsp + 0x120]
mov rbp, qword [rsp + 0x138]
cmp rbp, 0x10
cmovae rax, rbx
cmp byte [rax + rdi], 0x5c
jne 0x18009ee28
cmp rcx, 1
jb 0x18009edd0
dec rcx
cmp rcx, 0xffffffffffffffff
cmova rcx, rsi
lea rdi, [rsp + 0x120]
cmp rbp, 0x10
cmovae rdi, rbx
add rdi, rcx
cmp byte [rdi], 0x5c
jne 0x18009eda4
mov al, byte [rdi]
cmp al, byte [0x180151570]
je 0x18009edbb
lea rcx, [rsp + 0x118]
call fcn.180001ac0
cmp rdi, rax
je 0x18009edd0
dec rdi
jmp 0x18009ed95
lea rax, [rsp + 0x120]
cmp rbp, 0x10
cmovae rax, rbx
sub rdi, rax
jmp 0x18009edd3
mov rdi, rsi
mov r9, rdi
xor r8d, r8d
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x118]
call fcn.180004410
nop
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x118]
call fcn.1800035e0
nop
cmp qword [rsp + 0x68], 0x10
jb 0x18009ee15
mov rcx, qword [rsp + 0x50]
call fcn.1800f4b9c
mov qword [rsp + 0x68], 0xf
mov qword [rsp + 0x60], r12
mov byte [rsp + 0x50], 0
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0x280]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0xf0]
call fcn.180003700
mov r9, qword [rsp + 0x108]
dec r9
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0xf0]
call fcn.180004410
nop
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0xf0]
call fcn.1800035e0
nop
cmp qword [rsp + 0x90], 0x10
jb 0x18009eea0
mov rcx, qword [rsp + 0x78]
call fcn.1800f4b9c
mov qword [rsp + 0x90], 0xf
mov qword [rsp + 0x88], r12
mov byte [rsp + 0x78], 0
mov rbx, qword [rsp + 0x108]
cmp rbx, 1
jb 0x18009efae
dec rbx
mov rcx, rbx
cmp rbx, 0xffffffffffffffff
cmova rcx, rsi
lea rdi, [rsp + 0xf8]
mov rbp, qword [rsp + 0xf8]
mov r12, qword [rsp + 0x110]
cmp r12, 0x10
cmovae rdi, rbp
add rdi, rcx
nop dword [rax]
cmp byte [rdi], 0x5c
jne 0x18009ef0f
mov al, byte [rdi]
cmp al, byte [0x180151570]
je 0x18009ef2a
lea rcx, [rsp + 0xf0]
call fcn.180001ac0
cmp rdi, rax
je 0x18009efa6
dec rdi
jmp 0x18009ef00
lea rax, [rsp + 0xf8]
cmp r12, 0x10
cmovae rax, rbp
sub rdi, rax
cmp rdi, 0xffffffffffffffff
je 0x18009efab
cmp rbx, 0xffffffffffffffff
cmova rbx, rsi
lea rdi, [rsp + 0xf8]
cmp r12, 0x10
cmovae rdi, rbp
add rdi, rbx
nop
cmp byte [rdi], 0x5c
jne 0x18009ef6f
mov al, byte [rdi]
cmp al, byte [0x180151570]
je 0x18009ef86
lea rcx, [rsp + 0xf0]
call fcn.180001ac0
cmp rdi, rax
je 0x18009ef9b
dec rdi
jmp 0x18009ef60
lea rax, [rsp + 0xf8]
cmp r12, 0x10
cmovae rax, rbp
sub rdi, rax
jmp 0x18009ef9e
mov rdi, rsi
mov r14d, edi
xor r12d, r12d
jmp 0x18009efae
xor r12d, r12d
jmp 0x18009efae
xor r12d, r12d
test r13, r13
je 0x18009f225
xor eax, eax
mov rcx, rsi
mov rdi, r13
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r13
lea rcx, [rsp + 0xf0]
call fcn.180003700
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0x280]
repne scasb al, byte [rdi]
not rcx
lea r9, [rcx - 1]
xor r8d, r8d
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0xf0]
call fcn.180015f00
cmp rax, 0xffffffffffffffff
je 0x18009f0ad
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0x280]
repne scasb al, byte [rdi]
not rcx
lea r9, [rcx - 1]
xor r8d, r8d
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0xf0]
call fcn.180015f00
movsxd r8, r14d
add r8, rax
mov r9, rsi
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0xf0]
call fcn.180004410
nop
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0xf0]
call fcn.1800035e0
nop
cmp qword [rsp + 0xb8], 0x10
jb 0x18009f08c
mov rcx, qword [rsp + 0xa0]
call fcn.1800f4b9c
mov qword [rsp + 0xb8], 0xf
mov qword [rsp + 0xb0], r12
mov byte [rsp + 0xa0], 0
jmp 0x18009f225
cmp qword [rsp + 0x110], 0x10
jb 0x18009f0c5
mov rcx, qword [rsp + 0xf8]
call fcn.1800f4b9c
mov qword [rsp + 0x110], 0xf
mov qword [rsp + 0x108], r12
mov byte [rsp + 0xf8], 0
cmp qword [rsp + 0x138], 0x10
jb 0x18009f0f9
mov rcx, qword [rsp + 0x120]
call fcn.1800f4b9c
mov qword [rsp + 0x138], 0xf
mov qword [rsp + 0x130], r12
mov byte [rsp + 0x120], 0
jmp 0x18009f50b
test r13, r13
je 0x18009f225
mov rcx, rsi
mov rdi, r13
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r13
lea rcx, [rsp + 0xf0]
call fcn.180003700
mov rcx, qword [rsp + 0x108]
cmp rcx, 1
jb 0x18009f1bb
dec rcx
cmp rcx, 0xffffffffffffffff
cmova rcx, rsi
lea rax, [rsp + 0xf8]
mov rbx, qword [rsp + 0xf8]
mov rbp, qword [rsp + 0x110]
cmp rbp, 0x10
cmovae rax, rbx
lea rdi, [rcx + rax]
nop
cmp byte [rdi], 0x5c
jne 0x18009f18f
mov al, byte [rdi]
cmp al, byte [0x180151570]
je 0x18009f1a6
lea rcx, [rsp + 0xf0]
call fcn.180001ac0
cmp rdi, rax
je 0x18009f1bb
dec rdi
jmp 0x18009f180
lea rax, [rsp + 0xf8]
cmp rbp, 0x10
cmovae rax, rbx
sub rdi, rax
jmp 0x18009f1be
mov rdi, rsi
mov r9, rsi
mov r8, rdi
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0xf0]
call fcn.180004410
nop
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0xf0]
call fcn.1800035e0
nop
cmp qword [rsp + 0xe0], 0x10
jb 0x18009f209
mov rcx, qword [rsp + 0xc8]
call fcn.1800f4b9c
mov qword [rsp + 0xe0], 0xf
mov qword [rsp + 0xd8], r12
mov byte [rsp + 0xc8], 0
lea rdx, [rsp + 0x120]
cmp qword [rsp + 0x138], 0x10
cmovae rdx, qword [rsp + 0x120]
lea rcx, [rsp + 0x40]
call fcn.1800050e0
nop
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0x10
je 0x18009f2c4
mov edx, 0x5c
mov rcx, qword [rsp + 0x40]
call fcn.1800f6344
mov rcx, qword [rsp + 0x40]
test rax, rax
jne 0x18009f277
mov eax, esi
jmp 0x18009f279
sub eax, ecx
mov r8d, dword [rcx - 0x10]
sub r8d, eax
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.1800392c0
mov rcx, qword [rsp + 0x40]
movsxd rdx, dword [rcx - 0xc]
call fcn.1800f6074
test eax, eax
js 0x18009f2b9
mov rcx, qword [rsp + 0x40]
cmp eax, dword [rcx - 0xc]
jg 0x18009f2b9
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rsp + 0x40]
mov byte [rcx + rax], 0
jmp 0x18009f2c4
mov ecx, 0x80070057
call fcn.180001700
int3
mov rbx, qword [rsp + 0x40]
movsxd rdi, dword [rbx - 0x10]
test edi, edi
je 0x18009f485
lea eax, [rdi - 1]
test eax, eax
js 0x18009f47a
cmp eax, edi
jg 0x18009f47a
cdqe
cmp byte [rax + rbx], 0x5c
jne 0x18009f393
lea ebp, [rdi - 1]
test ebp, ebp
js 0x18009f388
cmp ebp, edi
jge 0x18009f388
cmp dword [rbx - 8], 1
jle 0x18009f31f
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.180002390
mov rbx, qword [rsp + 0x40]
movsxd rax, ebp
mov byte [rax + rbx], 0
test edi, edi
js 0x18009f37d
mov rax, qword [rsp + 0x40]
cmp edi, dword [rax - 0xc]
jg 0x18009f37d
mov dword [rax - 0x10], edi
mov rax, qword [rsp + 0x40]
mov byte [rdi + rax], 0
mov rcx, qword [rsp + 0x40]
movsxd rdx, dword [rcx - 0xc]
call fcn.1800f6074
test eax, eax
js 0x18009f372
mov rcx, qword [rsp + 0x40]
cmp eax, dword [rcx - 0xc]
jg 0x18009f372
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rsp + 0x40]
mov byte [rcx + rax], 0
mov rbx, qword [rsp + 0x40]
jmp 0x18009f393
mov ecx, 0x80070057
call fcn.180001700
int3
mov ecx, 0x80070057
call fcn.180001700
int3
mov ecx, 0x80070057
call fcn.180001700
int3
test r13, r13
je 0x18009f417
cmp qword [rsp + 0x110], 0x10
jb 0x18009f3b5
mov rdx, qword [rsp + 0xf8]
test rdx, rdx
jne 0x18009f3bd
mov ecx, r12d
jmp 0x18009f3cd
lea rdx, [rsp + 0xf8]
xor eax, eax
mov rcx, rsi
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
mov r8d, ecx
lea rcx, [rsp + 0x40]
call fcn.180039700
mov rcx, qword [rsp + 0x40]
movsxd rdx, dword [rcx - 0xc]
call fcn.1800f6074
test eax, eax
js 0x18009f40c
mov rcx, qword [rsp + 0x40]
cmp eax, dword [rcx - 0xc]
jg 0x18009f40c
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rsp + 0x40]
mov byte [rcx + rax], 0
mov rbx, qword [rsp + 0x40]
jmp 0x18009f417
mov ecx, 0x80070057
call fcn.180001700
int3
xor eax, eax
mov rcx, rsi
mov rdi, r15
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
xor edx, edx
mov rcx, r15
call fcn.1800f4fb0
movsxd rdi, dword [rbx - 0x10]
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
or eax, ecx
jge 0x18009f456
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.180002910
mov rbx, qword [rsp + 0x40]
mov r8, rdi
mov rdx, rbx
mov rcx, r15
call fcn.1800f6e10
mov r8, r15
mov edx, 0x9f47
lea rcx, [0x1801631a0]
call fcn.18005cd20
jmp 0x18009f485
mov ecx, 0x80070057
call fcn.180001700
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x18009f4a3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
cmp qword [rsp + 0x110], 0x10
jb 0x18009f4bb
mov rcx, qword [rsp + 0xf8]
call fcn.1800f4b9c
mov qword [rsp + 0x110], 0xf
mov qword [rsp + 0x108], r12
mov byte [rsp + 0xf8], 0
cmp qword [rsp + 0x138], 0x10
jb 0x18009f4ef
mov rcx, qword [rsp + 0x120]
call fcn.1800f4b9c
mov qword [rsp + 0x138], 0xf
mov qword [rsp + 0x130], r12
mov byte [rsp + 0x120], 0
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.1800f4f80
mov rbx, qword [rsp + 0x4f8]
add rsp, 0x4a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret