Function at 0x18001de10
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov ebx, dword [rsp + 0xa8]
mov r10, r8
imul ebp, edx, 0x67d
mov edi, edx
mov r14, rcx
mov dword [rsp + 0x20], edx
mov esi, edx
mov dword [rsp + 0x40], ebp
cmp edx, ebp
ja 0x18001df8e
mov r12d, dword [rsp + 0xa8]
mov r15d, dword [rsp + 0xa8]
mov r13, qword [rsp + 0x30]
lea rdx, [0x180000000]
movabs r11, 0x9000800000000000
cmp esi, 0x535a
ja 0x18001e20e
je 0x18001e1f8
mov eax, esi
sub eax, 0x2f
je 0x18001e1b4
sub eax, 0xb3
je 0x18001df0a
sub eax, 0x34
je 0x18001def9
sub eax, 0x1ad2
je 0x18001dee5
cmp eax, 0x1bb9
jne 0x18001e2ad
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x50]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [rsp + 0x28], 0xffffffff
jne 0x18001e2ad
mov eax, 0xffffffff
jmp 0x18001df90
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsp + 0x28], eax
jmp 0x18001e2ad
mov rdx, qword [r9 + 0xc8]
mov qword [rsp + 0x58], rdx
jmp 0x18001e2ad
cmp dword [r9 + 0x10], 0
jbe 0x18001e050
mov edi, 0x93
mov dword [rsp + 0x24], edi
nop
lea ecx, [rdi - 0x93]
cmp ecx, 6
ja case.default.0x18001df40
mov edx, dword [rdx + rcx*4 + 0x1e2d8]
lea rcx, [0x180000000]
add rdx, rcx
jmp rdx
test r15d, r15d
je 0x18001e01a
mov rbp, qword [r9 + 8]
xor esi, esi
cmp dword [r9 + 0x10], esi
jbe 0x18001e016
nop dword [rax + rax]
mov edi, 0x113
cmp edi, 0x113
je 0x18001dfb8
cmp edi, 0x7c9c
jne 0x18001dfec
test r12d, r12d
jne 0x18001dfec
mov eax, 0x101
nop
cmp eax, 0x101
je 0x18001dfa8
cmp eax, 0x1c2
jne 0x18001dfaa
mov eax, ebx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor ebx, ebx
add eax, 0xc1
cmp eax, 0x283
jb 0x18001df80
jmp 0x18001dfec
mov edx, esi
add rdx, rdx
mov r12d, dword [rbp + rdx*8 + 8]
cmp r12d, r15d
jne 0x18001dfe9
mov rdx, qword [rbp + rdx*8]
lea r8, [rsp + 0x38]
mov r9d, 0x127
mov dword [rsp + 0x38], r15d
mov rcx, r13
call fcn.180088190
mov r12d, eax
jmp 0x18001dfec
sub r12d, r15d
add edi, 0x7b89
cmp edi, 0xf712
jbe 0x18001df65
mov r9, qword [rsp + 0xb8]
inc esi
cmp esi, dword [r9 + 0x10]
jb 0x18001df60
mov edi, dword [rsp + 0x24]
mov esi, dword [rsp + 0x20]
lea rdx, [0x180000000]
mov r10, qword [rsp + 0xb0]
inc edi
mov dword [rsp + 0x24], edi
movabs r11, 0x9000800000000000
cmp edi, 0x9a
jb 0x18001df20
mov edi, dword [rsp + 0xa8]
mov ebp, dword [rsp + 0x40]
mov ebx, 0xfffffffa
jmp 0x18001e2ad
mov esi, 0xe2
mov ecx, 0xef
mov dword [rsp + 0x20], esi
nop dword [rax + rax]
mov eax, ecx
sub eax, 0xef
je 0x18001e088
cmp eax, 1
jne 0x18001e08d
mov r15d, r14d
sub r15d, dword [rsp + 0x48]
jmp 0x18001e08d
mov r13, qword [rsp + 0x48]
inc ecx
cmp ecx, 0xf1
jb 0x18001e070
jmp 0x18001e01a
mov rdi, qword [rsp + 0x30]
cmp r14, rdi
jae 0x18001e0db
movsx rcx, byte [r14]
cmp cl, 0x3f
ja 0x18001e0b2
bt r11, rcx
jb 0x18001e0cb
cmp cl, 0xc0
jae 0x18001e0d3
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
je 0x18001e0d3
movabs r11, 0x9000800000000000
inc r14
cmp r14, rdi
jb 0x18001e0a3
mov r9, qword [rsp + 0xb8]
mov edi, dword [rsp + 0x24]
mov qword [rsp + 0x48], r14
jmp 0x18001e01a
movsxd rax, dword [r10]
add rax, r14
mov qword [rsp + 0x30], rax
jmp 0x18001e01a
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
jmp 0x18001e01a
mov rdi, qword [rsp + 0x30]
cmp r14, rdi
jae 0x18001e152
movsx eax, byte [r14]
cmp al, 0xc0
jb 0x18001e136
inc r14
cmp r14, rdi
jae 0x18001e14a
movzx eax, byte [r14]
and al, 0xc0
cmp al, 0x80
jne 0x18001e145
inc r14
cmp r14, rdi
jb 0x18001e122
jmp 0x18001e145
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
test eax, eax
je 0x18001e14a
inc r14
cmp r14, rdi
jb 0x18001e112
mov r9, qword [rsp + 0xb8]
mov edi, 0x96
jmp 0x18001e01a
test r15d, r15d
je 0x18001e01a
movsx eax, byte [r13]
cmp al, 0xc0
jae 0x18001e1a7
test al, al
je 0x18001e17e
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
je 0x18001e1a7
mov ecx, 0x31
mov eax, ecx
sub eax, 0x31
je 0x18001e194
cmp eax, 0x68
jne 0x18001e197
inc r13
jmp 0x18001e197
dec r15d
add ecx, 0x68
cmp ecx, 0x101
jb 0x18001e183
test r15d, r15d
jne 0x18001e165
mov r9, qword [rsp + 0xb8]
jmp 0x18001e01a
mov rdx, r9
mov ecx, 0xf
call fcn.1800d0d90
mov qword [rsp + 0x50], rax
cmp rax, 0
jne 0x18001e2ad
mov ecx, 0x2f
mov eax, ecx
sub eax, 0x2f
je 0x18001e1e7
cmp eax, 1
je 0x18001df8e
jmp 0x18001e1ec
mov ebx, 0xffffffff
inc ecx
cmp ecx, 0x31
jb 0x18001e1d5
jmp 0x18001e2ad
mov eax, dword [rsp + 0x28]
and eax, 0x400
neg eax
sbb ebx, ebx
neg ebx
dec ebx
jmp 0x18001e2ad
cmp esi, 0x6f13
je 0x18001df8e
cmp esi, 0x8630
je 0x18001df8e
cmp esi, 0xa510
je 0x18001e26b
cmp esi, 0x1490a
je 0x18001e244
cmp esi, 0x1ed04
je 0x18001df8e
jmp 0x18001e2ad
test r14, r14
je 0x18001e255
mov rax, qword [rsp + 0x58]
xor ebx, ebx
mov qword [r14], rax
jmp 0x18001e2ad
mov rdx, qword [rsp + 0x58]
mov r8d, 0xf8
xor ecx, ecx
call fcn.1800b0eb0
xor ebx, ebx
jmp 0x18001e2ad
mov rdx, qword [rsp + 0x58]
test rdx, rdx
jne 0x18001e2a2
mov ecx, 0x52
nop word [rax + rax]
mov eax, ecx
sub eax, 0x52
je 0x18001e292
cmp eax, 0x4d
je 0x18001df8e
jmp 0x18001e297
mov ebx, 0xfffffffd
add ecx, 0x4d
cmp ecx, 0xec
jb 0x18001e280
mov rax, qword [rdx + 8]
mov qword [r9 + 0xc8], rax
imul eax, edi, 0x97
add esi, eax
mov dword [rsp + 0x20], esi
cmp esi, ebp
ja 0x18001df8e
mov r9, qword [rsp + 0xb8]
mov r10, qword [rsp + 0xb0]
jmp 0x18001de6e