Function at 0x18007202c
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x1800b2220]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov rdi, r8
mov r12, rcx
cmp r8, 0xffffffffffffffff
jne 0x18007206e
mov eax, 0x80000006
jmp 0x1800728b7
xor r14d, r14d
test r12, r12
jne 0x180072080
mov eax, 0xc00000ef
jmp 0x1800728b7
test rdi, rdi
jne 0x18007208f
mov eax, 0xc00000f1
jmp 0x1800728b7
xorps xmm1, xmm1
mov word [rsp + 0x60], r14w
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x18], xmm0
mov qword [rbp + 0x68], rax
mov edx, 8
movups xmmword [rsp + 0x68], xmm1
mov r8d, 0x268
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp + 0x38], xmm1
movups xmmword [rbp + 0x48], xmm1
movups xmmword [rbp + 0x58], xmm1
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov r13, rax
test rax, rax
jne 0x1800720f4
mov ebx, 0xc0000017
jmp 0x180072882
mov rax, qword [rdi + 0x20]
cmp rax, 1
jb 0x18007285f
mov rcx, rax
lea rdx, [rax - 1]
mov rbx, r14
cmp rdx, rcx
jae 0x180072133
mov rcx, qword [rdi + 0x18]
lea r8, [rbp - 0x60]
call fcn.180073a60
test eax, eax
js 0x180072130
mov rbx, qword [rbp - 0x60]
add rbx, qword [rdi + 0x38]
cmp rbx, qword [rdi + 0x38]
jae 0x180072133
mov rbx, r14
test rbx, rbx
je 0x180072bed
cmp qword [rbx + 0x18], r14
jne 0x18007236e
lea r9, str.Node_on_the_stack_with_invalid_handle.
mov r8d, 0x9a7
lea rdx, str.AslPathWildcardFindNext
mov ecx, 1
call fcn.18001188c
mov rcx, qword [rdi + 0x20]
cmp rcx, 1
jae 0x180072175
mov ebx, 0x8000001a
jmp 0x1800721c9
lea rdx, [rcx - 1]
mov rax, r14
cmp rdx, rcx
jae 0x1800721a3
mov rcx, qword [rdi + 0x18]
lea r8, [rbp - 0x58]
call fcn.180073a60
test eax, eax
js 0x1800721a0
mov rax, qword [rbp - 0x58]
add rax, qword [rdi + 0x38]
cmp rax, qword [rdi + 0x38]
jae 0x1800721a3
mov rax, r14
test rax, rax
jne 0x1800721eb
lea r9, str.RtlArrayGet_failed_to_get_the_next_node
mov r8d, 0x7ff
lea rdx, str.AslpPathWildcardPeekNode
mov ebx, 0xc00000e5
lea ecx, [rax + 1]
call fcn.18001188c
mov dword [rsp + 0x20], ebx
lea r9, str.AslpPathWildcardPeekNode_failed___x_
mov r8d, 0x81a
lea rdx, str.AslpPathWildcardPopNode
mov ecx, 1
jmp 0x180072849
mov rcx, rax
call fcn.1800732cc
mov rax, qword [rdi + 0x20]
lea r9, [rax - 1]
cmp r9, rax
jae 0x18007284e
mov rcx, qword [rdi + 0x18]
lea r8, [rbp - 0x50]
mov rdx, r9
call fcn.180073a60
test eax, eax
js 0x18007284e
mov rsi, qword [rbp - 0x50]
add rsi, qword [rdi + 0x38]
cmp rsi, qword [rdi + 0x38]
jb 0x18007284e
mov rbx, qword [rdi + 0x20]
sub rbx, r9
sub rbx, 1
mov qword [rbp - 0x70], rbx
je 0x180072291
mov rdx, qword [rdi + 0x18]
lea r8, [rbp - 0x70]
mov rcx, rbx
call fcn.180073a60
test eax, eax
js 0x18007284e
mov rcx, qword [rdi + 0x18]
lea rdx, [r9 + 1]
lea r8, [rbp - 0x48]
call fcn.180073a60
test eax, eax
js 0x18007284e
mov rdx, qword [rbp - 0x48]
add rdx, qword [rdi + 0x38]
cmp rdx, qword [rdi + 0x38]
jb 0x18007284e
mov rbx, qword [rbp - 0x70]
mov rcx, rsi
mov r8, rbx
call sym.KERNEL32.dll_RtlMoveMemory
mov r8, qword [rdi + 0x18]
lea rcx, [rbx + rsi]
xor edx, edx
call sub.ntdll.dll_memset
dec qword [rdi + 0x20]
cmp qword [rdi + 0x20], 0x10
jbe 0x18007284e
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x28]
mov rax, rdx
imul rax, rcx
cmp rax, 0x400
jb 0x18007284e
mov rax, rcx
shr rax, 2
cmp qword [rdi + 0x20], rax
jae 0x18007284e
mov rsi, rcx
lea r8, [rbp]
shr rsi, 1
call fcn.180073a60
test eax, eax
js 0x18007284e
mov rdx, qword [rdi + 0x18]
lea r8, [rsp + 0x78]
mov rcx, rsi
call fcn.180073a60
test eax, eax
js 0x18007284e
mov r8, qword [rdi + 0x38]
xor edx, edx
mov rcx, qword [rdi + 0x10]
test r8, r8
jne 0x180072344
mov r8, qword [rsp + 0x78]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x180072358
mov r8, qword [rsp + 0x78]
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
jmp 0x180072358
mov r9, qword [rsp + 0x78]
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rbx, rbx
je 0x18007284e
mov qword [rdi + 0x38], rbx
mov qword [rdi + 0x28], rsi
jmp 0x18007284e
mov rdx, qword [rbx + 0x10]
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x18]
lea rax, [rsp + 0x68]
mov byte [rsp + 0x50], r14b
mov esi, 1
mov qword [rsp + 0x48], rax
xor r9d, r9d
mov byte [rsp + 0x40], sil
lea rax, [rbp + 0x18]
mov dword [rsp + 0x38], 3
xor r8d, r8d
mov dword [rsp + 0x30], 0x268
xor edx, edx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_ZwQueryDirectoryFile]
nop dword [rax + rax]
test eax, eax
jns 0x180072612
cmp eax, 0x80000006
je 0x180072436
cmp eax, 0xc000000f
je 0x180072436
lea r9, str.NtQueryDirectoryFile_failed_to_query_next_file___x_
mov dword [rsp + 0x20], eax
mov r8d, 0x9bf
lea rdx, str.AslPathWildcardFindNext
mov ecx, esi
call fcn.18001188c
mov rax, qword [rsp + 0x70]
lea r9, str.FilePath:__ws__Pattern:__ws
mov qword [rsp + 0x28], rax
lea rdx, str.AslPathWildcardFindNext
mov rax, qword [rbx + 8]
lea ecx, [rsi + 1]
mov r8d, 0x9c0
mov qword [rsp + 0x20], rax
call fcn.18001188c
mov rcx, qword [rdi + 0x20]
cmp rcx, rsi
jae 0x180072446
mov ebx, 0x8000001a
jmp 0x180072499
lea rdx, [rcx - 1]
mov rax, r14
cmp rdx, rcx
jae 0x180072474
mov rcx, qword [rdi + 0x18]
lea r8, [rbp - 0x40]
call fcn.180073a60
test eax, eax
js 0x180072471
mov rax, qword [rbp - 0x40]
add rax, qword [rdi + 0x38]
cmp rax, qword [rdi + 0x38]
jae 0x180072474
mov rax, r14
test rax, rax
jne 0x1800724b6
lea r9, str.RtlArrayGet_failed_to_get_the_next_node
mov r8d, 0x7ff
lea rdx, str.AslpPathWildcardPeekNode
mov ecx, esi
mov ebx, 0xc00000e5
call fcn.18001188c
mov dword [rsp + 0x20], ebx
lea r9, str.AslpPathWildcardPeekNode_failed___x_
mov r8d, 0x81a
lea rdx, str.AslpPathWildcardPopNode
jmp 0x180072847
mov rcx, rax
call fcn.1800732cc
mov rax, qword [rdi + 0x20]
lea r9, [rax - 1]
cmp r9, rax
jae 0x18007284e
mov rcx, qword [rdi + 0x18]
lea r8, [rbp - 0x38]
mov rdx, r9
call fcn.180073a60
test eax, eax
js 0x18007284e
mov rsi, qword [rbp - 0x38]
add rsi, qword [rdi + 0x38]
cmp rsi, qword [rdi + 0x38]
jb 0x18007284e
mov rbx, qword [rdi + 0x20]
sub rbx, r9
sub rbx, 1
mov qword [rbp - 0x68], rbx
je 0x18007255c
mov rdx, qword [rdi + 0x18]
lea r8, [rbp - 0x68]
mov rcx, rbx
call fcn.180073a60
test eax, eax
js 0x18007284e
mov rcx, qword [rdi + 0x18]
lea rdx, [r9 + 1]
lea r8, [rbp - 0x30]
call fcn.180073a60
test eax, eax
js 0x18007284e
mov rdx, qword [rbp - 0x30]
add rdx, qword [rdi + 0x38]
cmp rdx, qword [rdi + 0x38]
jb 0x18007284e
mov rbx, qword [rbp - 0x68]
mov rcx, rsi
mov r8, rbx
call sym.KERNEL32.dll_RtlMoveMemory
mov r8, qword [rdi + 0x18]
lea rcx, [rbx + rsi]
xor edx, edx
call sub.ntdll.dll_memset
dec qword [rdi + 0x20]
cmp qword [rdi + 0x20], 0x10
jbe 0x18007284e
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x28]
mov rax, rdx
imul rax, rcx
cmp rax, 0x400
jb 0x18007284e
mov rax, rcx
shr rax, 2
cmp qword [rdi + 0x20], rax
jae 0x18007284e
mov rsi, rcx
lea r8, [rbp + 8]
shr rsi, 1
call fcn.180073a60
test eax, eax
js 0x18007284e
mov rdx, qword [rdi + 0x18]
lea r8, [rbp - 0x80]
mov rcx, rsi
call fcn.180073a60
test eax, eax
js 0x18007284e
mov r8, qword [rdi + 0x38]
xor edx, edx
mov rcx, qword [rdi + 0x10]
test r8, r8
jne 0x180072609
mov r8, qword [rbp - 0x80]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x180072358
mov r8, qword [rbp - 0x80]
jmp 0x180072338
mov r9, qword [rbp - 0x80]
jmp 0x180072349
mov eax, 4
cmp dword [r13 + 0x3c], eax
jne 0x180072633
lea rcx, [r13 + 0x5e]
cmp word [rcx], 0x2e
jne 0x18007264c
cmp word [r13 + 0x60], 0x2e
je 0x18007284e
mov eax, 2
lea rcx, [r13 + 0x5e]
cmp dword [r13 + 0x3c], eax
jne 0x18007264c
cmp word [rcx], 0x2e
je 0x18007284e
mov r9d, dword [r13 + 0x38]
mov rdx, rbx
movzx eax, word [r13 + 0x3c]
mov r8, qword [rbx + 0x10]
shr r9d, 4
mov word [rsp + 0x28], ax
and r9d, esi
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x20]
call fcn.180072fa0
cmp eax, 0xc0000273
je 0x1800727f5
cmp eax, 0xc0000103
je 0x18007284e
cmp eax, 0xc00000ba
je 0x18007284e
test eax, eax
js 0x1800727e2
mov r14, qword [rdi + 0x20]
cmp r14, qword [rdi + 0x28]
jb 0x18007278e
lea rcx, [r14 + 1]
cmp rcx, qword [rdi + 0x28]
ja 0x1800726d9
mov ebx, 0xc000000d
xor r14d, r14d
test ebx, ebx
jns 0x18007284e
lea r9, str.AslpPathWildcardPushNode_failed___x_
mov r8d, 0x9f1
jmp 0x180072c1d
mov rsi, qword [rdi + 0x30]
dec rsi
lea rax, [rsi + rcx]
cmp rax, rcx
jb 0x1800727af
mov rdx, qword [rdi + 0x18]
lea r8, [rbp + 0x10]
mov rcx, qword [rdi + 0x28]
not rsi
and rsi, rax
call fcn.180073a60
test eax, eax
jns 0x18007270f
mov ebx, 0xc0000095
jmp 0x180072783
mov rdx, qword [rdi + 0x18]
lea r8, [rbp - 0x78]
mov rcx, rsi
call fcn.180073a60
test eax, eax
js 0x180072708
mov r8, qword [rdi + 0x38]
xor edx, edx
mov rcx, qword [rdi + 0x10]
test r8, r8
jne 0x18007275a
mov r8, qword [rbp - 0x78]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x18007276d
mov r8, qword [rbp - 0x78]
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
jmp 0x18007276d
mov r9, qword [rbp - 0x78]
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rbx, rbx
jne 0x180072779
mov ebx, 0xc0000017
jmp 0x180072783
mov qword [rdi + 0x38], rbx
xor ebx, ebx
mov qword [rdi + 0x28], rsi
test ebx, ebx
jne 0x1800726bc
lea esi, [rbx + 1]
mov rcx, qword [rdi + 0x18]
lea r8, [rbp - 0x28]
mov rdx, r14
call fcn.180073a60
xor r14d, r14d
test eax, eax
jns 0x1800727b9
mov ebx, 0xc0000095
jmp 0x1800726bf
mov ebx, 0xc0000095
jmp 0x1800726bc
mov rdx, qword [rbp - 0x28]
add rdx, qword [rdi + 0x38]
cmp rdx, qword [rdi + 0x38]
jb 0x1800727a5
movups xmm0, xmmword [rbp - 0x20]
mov ebx, r14d
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp - 0x10]
movups xmmword [rdx + 0x10], xmm1
add qword [rdi + 0x20], rsi
jmp 0x1800726bf
mov dword [rsp + 0x20], eax
lea r9, str.AslpPathWildcardAllocMatchNode_failed___x_
mov r8d, 0x9f9
jmp 0x180072840
movzx edx, word [r13 + 0x3c]
lea r8, [rsp + 0x60]
movzx ecx, word [rbx]
call fcn.180073748
test eax, eax
js 0x18007282b
movzx ecx, word [rsp + 0x60]
lea r8, [rsp + 0x60]
mov r9d, 2
mov edx, r9d
call fcn.180073748
test eax, eax
jns 0x1800728e0
mov dword [rsp + 0x20], 0xc0000095
lea r9, str.Failed_to_compute_the_path_length___x_
mov r8d, 0xa25
lea rdx, str.AslPathWildcardFindNext
mov ecx, esi
call fcn.18001188c
mov rax, qword [rdi + 0x20]
mov rcx, rax
cmp rax, 1
jae 0x180072105
mov ebx, 0x80000006
mov rcx, qword gs:[0x60]
mov r8, r13
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x48]
mov rax, qword [rbp + 0x50]
test rcx, rcx
je 0x1800728ac
cmp rcx, rax
je 0x1800728ac
mov qword [rbp + 0x30], rcx
lea rcx, [rbp + 0x28]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
nop dword [rax + rax]
mov rax, qword [rbp + 0x50]
test rax, rax
je 0x1800728b5
mov word [rax], r14w
mov eax, ebx
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.180024680
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
movzx r8d, word [rsp + 0x60]
lea rax, [rbp + 0x68]
mov qword [rbp + 0x50], rax
lea rcx, [rbp + 0x68]
add r8, r9
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0x60], r9
lea rax, [rbp + 0x68]
mov qword [rbp + 0x40], rax
mov rdx, r9
mov qword [rbp + 0x58], rdx
mov word [rbp + 0x68], r14w
mov dword [rbp + 0x38], 0x20000
cmp r8, 0xfffe
jbe 0x180072928
mov ebx, 0xc0000106
jmp 0x180072948
cmp r8, r9
jbe 0x180072968
lea rdx, [rbp + 0x48]
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlpEnsureBufferSize]
nop dword [rax + rax]
test eax, eax
jns 0x180072960
mov ebx, 0xc0000017
lea r9, str.RtlEnsureUnicodeStringBufferSizeBytes_failed___x_
mov r8d, 0xa2e
mov dword [rsp + 0x20], ebx
mov ecx, esi
jmp 0x180072c26
mov rdx, qword [rbp + 0x58]
mov rcx, qword [rbp + 0x48]
movzx eax, word [rbp + 0x58]
movzx r9d, r14w
mov word [rbp + 0x3a], ax
mov qword [rbp + 0x40], rcx
mov word [rbp + 0x38], r14w
movzx r8d, word [rbx]
add r8, 2
cmp r8, 0xfffe
jbe 0x180072995
mov ebx, 0xc0000106
jmp 0x1800729b5
cmp r8, rdx
jbe 0x1800729cd
lea rdx, [rbp + 0x48]
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlpEnsureBufferSize]
nop dword [rax + rax]
test eax, eax
jns 0x1800729c4
mov ebx, 0xc0000017
lea r9, str.RtlAssignUnicodeStringBuffer_failed___x_
mov r8d, 0xa38
jmp 0x180072955
mov rcx, qword [rbp + 0x48]
movzx r9d, word [rbp + 0x38]
mov qword [rbp + 0x40], rcx
movzx r8d, word [rbx]
mov rdx, qword [rbx + 8]
movzx eax, r9w
shr rax, 1
lea rcx, [rcx + rax*2]
call sym.KERNEL32.dll_RtlMoveMemory
movzx eax, word [rbx]
movzx ecx, word [rbp + 0x38]
add ax, 2
add ax, cx
mov word [rbp + 0x3a], ax
add cx, word [rbx]
mov rax, qword [rbp + 0x40]
mov word [rbp + 0x38], cx
movzx ecx, cx
shr rcx, 1
mov word [rax + rcx*2], r14w
movzx ecx, word [rbx]
mov rax, qword [rbx + 8]
mov ebx, 2
shr rcx, 1
cmp word [rax + rcx*2 - 2], 0x5c
je 0x180072abc
movzx ecx, word [rbp + 0x38]
lea r8d, [rbx + rcx]
add r8, rbx
cmp r8, 0xfffe
jbe 0x180072a47
mov ebx, 0xc0000106
jmp 0x180072a68
cmp r8, qword [rbp + 0x58]
jbe 0x180072a7e
lea rdx, [rbp + 0x48]
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlpEnsureBufferSize]
nop dword [rax + rax]
test eax, eax
jns 0x180072a7a
mov ebx, 0xc0000017
lea r9, str.RtlAppendUnicodeStringBuffer_failed___x_
mov r8d, 0xa3f
jmp 0x180072955
movzx ecx, word [rbp + 0x38]
movzx eax, word [0x180085368]
mov rdx, qword [rbp + 0x48]
movzx ecx, cx
shr rcx, 1
mov qword [rbp + 0x40], rdx
mov word [rdx + rcx*2], ax
mov eax, 4
movzx ecx, word [rbp + 0x38]
add eax, ecx
add cx, bx
mov word [rbp + 0x38], cx
mov word [rbp + 0x3a], ax
mov rax, qword [rbp + 0x40]
movzx ecx, cx
shr rcx, 1
mov word [rax + rcx*2], r14w
movzx r10d, word [rbp + 0x38]
lea r9, [r13 + 0x5e]
mov qword [rsp + 0x70], r9
movzx edx, word [r13 + 0x3c]
mov word [rsp + 0x68], dx
movzx eax, word [r13 + 0x3c]
mov word [rsp + 0x6a], ax
lea r8d, [r10 + rdx]
add r8, 2
cmp r8, 0xfffe
jbe 0x180072af6
mov ebx, 0xc0000106
jmp 0x180072b17
cmp r8, qword [rbp + 0x58]
jbe 0x180072b38
lea rdx, [rbp + 0x48]
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlpEnsureBufferSize]
nop dword [rax + rax]
test eax, eax
jns 0x180072b29
mov ebx, 0xc0000017
lea r9, str.RtlAppendUnicodeStringBuffer_failed___x_
mov r8d, 0xa4e
jmp 0x180072955
mov r9, qword [rsp + 0x70]
movzx edx, word [rsp + 0x68]
movzx r10d, word [rbp + 0x38]
mov rcx, qword [rbp + 0x48]
movzx eax, r10w
shr rax, 1
mov qword [rbp + 0x40], rcx
movzx r8d, dx
mov rdx, r9
lea rcx, [rcx + rax*2]
call sym.KERNEL32.dll_RtlMoveMemory
movzx eax, word [rsp + 0x68]
add ax, word [rbp + 0x38]
movzx ecx, ax
mov word [rbp + 0x38], cx
lea eax, [rbx + rcx]
shr rcx, 1
mov word [rbp + 0x3a], ax
mov rax, qword [rbp + 0x40]
mov word [rax + rcx*2], r14w
cmp dword [rdi], r14d
je 0x180072bb3
xor r9d, r9d
lea rdx, [rbp + 0x38]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlNtPathNameToDosPathName]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x180072bb3
mov dword [rsp + 0x20], eax
lea r9, str.RtlNtPathNameToDosPathName_failed___x_
mov r8d, 0xa59
jmp 0x180072959
movzx r9d, word [rbp + 0x38]
mov edx, 0x208
mov r8, qword [rbp + 0x40]
mov rcx, r12
call fcn.1800736b0
mov ebx, eax
test eax, eax
jns 0x180072be5
mov dword [rsp + 0x20], eax
lea r9, str.RtlStringCbCopyNW_failed___x_
mov r8d, 0xa64
jmp 0x180072959
mov ebx, r14d
jmp 0x180072864
lea r9, str.RtlArrayGet_failed_to_get_the_next_node
mov r8d, 0x7ff
lea rdx, str.AslpPathWildcardPeekNode
mov ecx, 1
call fcn.18001188c
lea r9, str.AslpPathWildcardPeekNode_failed___x_
mov r8d, 0x9a2
mov ebx, 0xc00000e5
mov dword [rsp + 0x20], ebx
mov ecx, 1
lea rdx, str.AslPathWildcardFindNext
call fcn.18001188c
jmp 0x180072864