Function at 0x140065af0
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], r9
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
xor ebx, ebx
mov r12, r9
mov r13, r8
mov rsi, rcx
mov r15d, ebx
cmp rdx, 0xffffffffffffffff
je 0x140065f94
test r8, r8
je 0x140065f94
movzx eax, word [r8]
mov r14, r8
cmp bx, ax
je 0x140065bce
lea rcx, str.WindowsWinSxS_
mov rdi, rcx
cmp bx, ax
je 0x140065bb3
lea r12, str.WindowsWinSxS_
cmp bx, word [rdi]
je 0x140065ba8
mov rax, r14
sub rax, r12
mov qword [rbp - 0x39], rax
movzx ecx, word [rax + rdi]
call qword [sym.imp.msvcrt.dll_towupper]
nop dword [rax + rax]
movzx ecx, word [rdi]
movzx ebx, ax
call qword [sym.imp.msvcrt.dll_towupper]
nop dword [rax + rax]
movzx eax, ax
cmp ebx, eax
jne 0x140065ba6
mov rax, qword [rbp - 0x39]
add rdi, 2
xor ebx, ebx
cmp bx, word [rax + rdi]
jne 0x140065b5c
jmp 0x140065ba8
xor ebx, ebx
mov r12, qword [rbp + 0x7f]
lea rcx, str.WindowsWinSxS_
cmp bx, word [rdi]
je 0x140065e42
add r14, 2
movzx eax, word [r14]
cmp bx, ax
jne 0x140065b4d
movzx eax, word [r13]
mov r14, r13
cmp bx, ax
je 0x140065c5d
lea rcx, str.Program_FilesWindowsApps_
mov rdi, rcx
cmp bx, ax
je 0x140065c47
lea r12, str.Program_FilesWindowsApps_
movzx ecx, word [rdi]
cmp bx, cx
je 0x140065c3c
call qword [sym.imp.msvcrt.dll_towupper]
nop dword [rax + rax]
movzx ebx, ax
mov rax, r14
sub rax, r12
mov qword [rbp - 0x39], rax
movzx ecx, word [rax + rdi]
call qword [sym.imp.msvcrt.dll_towupper]
nop dword [rax + rax]
movzx eax, ax
cmp eax, ebx
jne 0x140065c3a
mov rax, qword [rbp - 0x39]
add rdi, 2
xor ebx, ebx
cmp bx, word [rax + rdi]
jne 0x140065bf0
jmp 0x140065c3c
xor ebx, ebx
mov r12, qword [rbp + 0x7f]
lea rcx, str.Program_FilesWindowsApps_
cmp bx, word [rdi]
je 0x140065e42
add r14, 2
movzx eax, word [r14]
cmp bx, ax
jne 0x140065be1
test rsi, rsi
je 0x140065ce8
cmp qword [rsi + 0x40], rbx
mov rax, rsi
mov edi, 0x40000000
cmovne rax, qword [rsi + 0x40]
test dword [rax + 0x24], edi
jne 0x140065ce8
mov rcx, rsi
call fcn.1400597b0
test rax, rax
je 0x140065c8e
mov rdx, qword [rax]
jmp 0x140065c91
mov rdx, rbx
test rdx, rdx
je 0x140065ce8
test r12, r12
je 0x140065e9a
cmp word [r12], bx
je 0x140065ce8
call fcn.140065834
test eax, eax
jns 0x140065cc4
mov r9d, eax
lea rcx, str.WIMSetFileShortName
mov r8d, 0x267
call fcn.140066474
mov rcx, qword [rsi + 0x40]
mov rax, rsi
test rcx, rcx
cmovne rax, rcx
mov edx, dword [rax + 0x24]
or edx, edi
jmp 0x140065ce0
mov rsi, rcx
mov rcx, qword [rcx + 0x40]
test rcx, rcx
jne 0x140065cd9
mov dword [rsi + 0x24], edx
test r12, r12
je 0x140065e9a
xorps xmm0, xmm0
lea rdx, [rbp - 0x31]
xor r9d, r9d
xor r8d, r8d
mov rcx, r13
movups xmmword [rbp - 0x31], xmm0
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
nop dword [rax + rax]
test al, al
je 0x140065e80
mov dword [rsp + 0x50], ebx
lea rax, [rbp - 0x31]
mov qword [rsp + 0x48], rbx
lea r9, [rbp - 0x21]
mov dword [rsp + 0x40], 0x4020
lea r8, [rbp - 0x11]
mov dword [rsp + 0x38], 1
lea rcx, [rbp - 0x39]
xorps xmm0, xmm0
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 0x80
mov edx, 0x100080
mov qword [rsp + 0x20], rbx
mov qword [rbp - 0x39], rbx
movups xmmword [rbp - 0x21], xmm0
mov qword [rbp - 0x11], 0x30
mov qword [rbp + 7], 0x40
mov qword [rbp - 9], rbx
mov qword [rbp - 1], rax
movdqu xmmword [rbp + 0xf], xmm0
call qword [sym.imp.ntdll.dll_NtCreateFile]
nop dword [rax + rax]
test eax, eax
js 0x140065e80
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x39]
lea rdx, [rbp - 0x21]
mov r8, rax
mov dword [rsp + 0x20], FDICopy
mov r9d, 0x28
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
xor r14d, r14d
test eax, eax
js 0x140065e49
or r8, 0xffffffffffffffff
inc r8
cmp word [r12 + r8*2], r14w
jne 0x140065dec
lea rdx, [rbx + 4]
mov rcx, r12
call qword [sym.imp.msvcrt.dll_wcsncmp]
nop dword [rax + rax]
test eax, eax
jne 0x140065e49
test rbx, rbx
je 0x140065e32
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
xor eax, eax
jmp 0x140065f99
test rbx, rbx
je 0x140065e6e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
xor ebx, ebx
or rax, 0xffffffffffffffff
inc rax
cmp word [r12 + rax*2], bx
jne 0x140065e84
mov r15, rax
add r15d, r15d
lea esi, [r15 + 0xa]
jmp 0x140065ea6
lea r12, [0x1400a9d54]
mov esi, 8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8d, esi
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
xor r14d, r14d
mov rdi, rax
mov ebx, r14d
test rax, rax
jne 0x140065f1a
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov r13d, 0x80070000
or ecx, r13d
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x140065f11
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, r13d
test eax, eax
cmovle ebx, eax
jmp 0x140065f16
mov ebx, 0x80004005
test ebx, ebx
js 0x140065f90
mov dword [rdi], r15d
test r15d, r15d
je 0x140065f39
mov edx, r15d
lea rcx, [rdi + 4]
shr rdx, 1
mov r8, r12
inc rdx
call fcn.1400026c0
mov ebx, eax
test ebx, ebx
js 0x140065f70
mov rcx, qword [rbp + 0x6f]
lea rdx, [rbp - 0x21]
xorps xmm0, xmm0
mov dword [rsp + 0x20], 0x28
mov r9d, esi
mov r8, rdi
movups xmmword [rbp - 0x21], xmm0
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
test eax, eax
jns 0x140065f70
mov ebx, eax
bts ebx, 0x1c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov eax, ebx
jmp 0x140065f99
mov eax, 0x80070057
mov rbx, qword [rsp + 0x100]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret