Function at 0x14001a108
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
xor ebx, ebx
mov r13, r9
mov r12, r8
mov rax, rdx
mov rsi, rcx
mov r15d, ebx
cmp rdx, 0xffffffffffffffff
je 0x14001a5aa
test r8, r8
je 0x14001a5aa
movzx eax, word [r8]
mov r14, r8
cmp bx, ax
je 0x14001a1db
lea rcx, str.WindowsWinSxS_
mov rdi, rcx
cmp bx, ax
je 0x14001a1c0
lea r13, str.WindowsWinSxS_
cmp bx, word [rdi]
je 0x14001a1b5
mov rax, r14
sub rax, r13
mov qword [rbp - 0x39], rax
movzx ecx, word [rax + rdi]
call sub.api_ms_win_crt_private_l1_1_0.dll__o_towupper
movzx ecx, word [rdi]
movzx ebx, ax
call sub.api_ms_win_crt_private_l1_1_0.dll__o_towupper
movzx eax, ax
cmp ebx, eax
jne 0x14001a1b3
mov rax, qword [rbp - 0x39]
add rdi, 2
xor ebx, ebx
cmp bx, word [rax + rdi]
jne 0x14001a177
jmp 0x14001a1b5
xor ebx, ebx
mov r13, qword [rbp + 0x7f]
lea rcx, str.WindowsWinSxS_
cmp bx, word [rdi]
je 0x14001a454
add r14, 2
movzx eax, word [r14]
cmp bx, ax
jne 0x14001a168
movzx eax, word [r12]
mov r14, r12
cmp bx, ax
je 0x14001a256
lea rcx, str.Program_FilesWindowsApps_
mov rdi, rcx
cmp bx, ax
je 0x14001a23c
lea r13, str.Program_FilesWindowsApps_
movzx ecx, word [rdi]
cmp bx, cx
je 0x14001a231
call sub.api_ms_win_crt_private_l1_1_0.dll__o_towupper
mov r12, r14
movzx ebx, ax
sub r12, r13
movzx ecx, word [r12 + rdi]
call sub.api_ms_win_crt_private_l1_1_0.dll__o_towupper
movzx eax, ax
sub eax, ebx
jne 0x14001a22f
add rdi, 2
xor ebx, ebx
cmp bx, word [r12 + rdi]
jne 0x14001a1f9
jmp 0x14001a231
xor ebx, ebx
mov r13, qword [rbp + 0x7f]
lea rcx, str.Program_FilesWindowsApps_
cmp bx, word [rdi]
je 0x14001a454
add r14, 2
movzx eax, word [r14]
cmp bx, ax
jne 0x14001a1ea
mov r12, qword [rbp + 0x77]
test rsi, rsi
je 0x14001a2f0
mov rcx, qword [rsi + 0x40]
mov rax, rsi
test rcx, rcx
mov edi, 0x40000000
cmovne rax, rcx
test dword [rax + 0x24], edi
jne 0x14001a2f0
test rcx, rcx
je 0x14001a285
mov rax, qword [rcx + 0xb0]
jmp 0x14001a28c
mov rax, qword [rsi + 0xb0]
test rax, rax
je 0x14001a296
mov rdx, qword [rax]
jmp 0x14001a299
mov rdx, rbx
test rdx, rdx
je 0x14001a2f0
test r13, r13
je 0x14001a4ad
cmp word [r13], bx
je 0x14001a2f0
call fcn.140019e48
test eax, eax
jns 0x14001a2cc
mov r9d, eax
lea rcx, str.WIMSetFileShortName
mov r8d, 0x267
call fcn.14001b2f8
mov rcx, qword [rsi + 0x40]
mov rax, rsi
test rcx, rcx
cmovne rax, rcx
mov edx, dword [rax + 0x24]
or edx, edi
jmp 0x14001a2e8
mov rsi, rcx
mov rcx, qword [rcx + 0x40]
test rcx, rcx
jne 0x14001a2e1
mov dword [rsi + 0x24], edx
test r13, r13
je 0x14001a4ad
xor eax, eax
lea rdx, [rbp - 0x31]
xor r9d, r9d
mov qword [rbp - 0x31], rax
xor r8d, r8d
mov qword [rbp - 0x29], rax
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
nop dword [rax + rax]
test al, al
je 0x14001a492
mov dword [rsp + 0x50], ebx
lea r9, [rbp - 0x21]
mov qword [rsp + 0x48], rbx
lea r8, [rbp - 0x11]
xor eax, eax
mov dword [rsp + 0x40], 0x4020
mov dword [rsp + 0x38], 1
lea rcx, [rbp - 0x39]
mov qword [rbp - 0x21], rax
xorps xmm0, xmm0
mov qword [rbp - 0x19], rax
mov edx, 0x100080
mov dword [rsp + 0x30], 7
lea rax, [rbp - 0x31]
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rbx
mov qword [rbp - 0x39], rbx
mov qword [rbp - 0x11], 0x30
mov qword [rbp + 7], 0x40
mov qword [rbp - 9], rbx
mov qword [rbp - 1], rax
movdqu xmmword [rbp + 0xf], xmm0
call qword [sym.imp.ntdll.dll_NtCreateFile]
nop dword [rax + rax]
test eax, eax
js 0x14001a492
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x28]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x39]
lea rdx, [rbp - 0x21]
mov r8, rax
mov dword [rsp + 0x20], FDICopy
mov r9d, 0x28
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
xor r14d, r14d
test eax, eax
js 0x14001a45b
or r8, 0xffffffffffffffff
inc r8
cmp word [r13 + r8*2], r14w
jne 0x14001a3fd
lea rdx, [rbx + 4]
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
nop dword [rax + rax]
test eax, eax
jne 0x14001a45b
test rbx, rbx
je 0x14001a444
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
xor eax, eax
jmp 0x14001a5af
test rbx, rbx
je 0x14001a480
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
xor ebx, ebx
or rax, 0xffffffffffffffff
inc rax
cmp word [r13 + rax*2], bx
jne 0x14001a496
mov r15, rax
add r15d, r15d
lea esi, [r15 + 0xa]
jmp 0x14001a4b9
lea r13, [0x14005e368]
mov esi, 8
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8d, esi
mov edx, 8
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
xor r14d, r14d
mov rdi, rax
mov ebx, r14d
test rax, rax
jne 0x14001a52d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov r12d, 0x80070000
or ecx, r12d
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x14001a524
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, r12d
test eax, eax
cmovle ebx, eax
jmp 0x14001a529
mov ebx, 0x80004005
test ebx, ebx
js 0x14001a5a6
mov dword [rdi], r15d
test r15d, r15d
je 0x14001a54c
mov edx, r15d
lea rcx, [rdi + 4]
shr rdx, 1
mov r8, r13
inc rdx
call fcn.140003908
mov ebx, eax
test ebx, ebx
js 0x14001a586
mov rcx, qword [rbp + 0x6f]
lea rdx, [rbp - 0x21]
xor eax, eax
mov dword [rsp + 0x20], 0x28
mov r9d, esi
mov qword [rbp - 0x21], rax
mov r8, rdi
mov qword [rbp - 0x19], rax
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
test eax, eax
jns 0x14001a586
mov ebx, eax
bts ebx, 0x1c
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov eax, ebx
jmp 0x14001a5af
mov eax, 0x80070057
mov rbx, qword [rsp + 0x100]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret