Function at 0x140038320
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x260
mov rax, qword [0x1400b8288]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor r13d, r13d
xorps xmm0, xmm0
mov ebp, r13d
mov r15, r9
movups xmmword [rsp + 0x30], xmm0
mov r12d, r8d
mov r14, rdx
mov esi, 2
mov edi, esi
shl edi, 5
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8d, edi
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x140038404
mov r9d, edi
mov dword [rsp + 0x20], reloc.Cabinet.dll_FDICopy
mov r8, rax
lea rdx, [rsp + 0x30]
mov rcx, r14
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jns 0x1400383ea
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
inc esi
mov rbx, r13
cmp edi, 0x80000005
je 0x14003836d
cmp edi, 0xc0000023
je 0x14003836d
jmp 0x140038409
mov edi, 0xc0000017
test edi, edi
js 0x1400385aa
test rbx, rbx
je 0x1400385cf
mov rdi, rbx
mov r14d, 0x7ffffffe
or esi, 0xffffffff
cmp dword [rdi + 4], 2
jbe 0x140038598
cmp word [rdi + 0x18], r13w
je 0x140038598
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call sub.msvcrt.dll_memset
mov r8d, dword [rdi + 4]
shr r8, 1
cmp r8, r14
ja 0x1400384a1
lea rax, [rsp + 0x40]
mov r9, rdi
sub r9, rax
lea rcx, [rsp + 0x40]
mov edx, 0x104
lea rax, [rdx - 0x104]
add rax, r8
je 0x140038492
movzx eax, word [r9 + rcx + 0x18]
test ax, ax
je 0x140038492
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14003846e
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r13w
lea rax, str.::_DATA
mov dword [rsp + 0x28], esi
mov r9d, esi
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x40]
mov edx, 1
mov ecx, 0x409
call qword [sym.imp.KERNEL32.dll_CompareStringW]
nop dword [rax + rax]
cmp eax, 2
je 0x14003857b
test r15, r15
jne 0x140038513
lea rax, str.:_WIMMOUNTDATA:_DATA
mov dword [rsp + 0x28], esi
mov r9d, esi
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x40]
mov ecx, 0x409
lea edx, [r15 + 1]
call qword [sym.imp.KERNEL32.dll_CompareStringW]
nop dword [rax + rax]
cmp eax, 2
je 0x140038598
mov ecx, dword [rdi + 4]
shr rcx, 1
sub rcx, 7
cmp rcx, r14
jbe 0x14003852a
mov word [rsp + 0x40], r13w
jmp 0x140038574
lea rax, [rsp + 0x40]
mov r10, rdi
sub r10, rax
lea r8, [rsp + 0x40]
mov r9d, 0x104
lea rax, [r9 - 0x104]
add rax, rcx
je 0x140038565
movzx eax, word [r10 + r8 + 0x1a]
test ax, ax
je 0x140038565
mov word [r8], ax
add r8, 2
sub r9, 1
jne 0x140038540
test r9, r9
lea rax, [r8 - 2]
cmovne rax, r8
mov word [rax], r13w
lea r8, [rsp + 0x40]
jmp 0x140038589
bt r12d, 0xa
jae 0x140038598
lea r8, [0x14009b48c]
mov r9, qword [rdi + 8]
mov rdx, rbp
call fcn.14003860c
mov rbp, rax
cmp dword [rdi], r13d
jbe 0x1400385af
mov eax, dword [rdi]
add rdi, rax
jne 0x140038426
jmp 0x1400385af
test rbx, rbx
je 0x1400385cf
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rax, rbp
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140096bd0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret