Function at 0x474260
Capabilities:
Get file attributes

Disassembly:
push rbp
sub rsp, 0x380
lea rbp, [rsp + 0x80]
mov rcx, qword [rcx]
mov qword [rbp - 8], rcx
mov qword [rbp + 0x18], rcx
vmovdqa xmm0, xmmword [0x004b2480]
vmovdqa xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x38], 0x4d430001
lea rax, [rbp + 0x20]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], 0x10
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x60], 0
xor eax, eax
mov edx, eax
mov qword [rbp + 8], rdx
lea rax, [rbp + 0x38]
mov qword [rbp], rax
rol rdi, 3
rol rdi, 0xd
rol rdi, 0x3d
rol rdi, 0x33
xchg rbx, rbx
mov rax, qword [rbp]
mov rdx, qword [rbp + 8]
movabs r8, 0xaaaaaaaaaaaaaaaa
mov qword [rbp + 0x68], r8
mov qword [rbp + 0x38], 0x4d430001
lea r8, [rbp + 0x68]
mov qword [rbp + 0x40], r8
mov qword [rbp + 0x48], 8
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x60], 0
rol rdi, 3
rol rdi, 0xd
rol rdi, 0x3d
rol rdi, 0x33
xchg rbx, rbx
mov rdx, qword [rbp + 0x10]
mov rax, rsp
mov dword [rax + 0x20], 4
mov r9d, 8
call sub.ntdll.dll_NtQueryVolumeInformationFile
mov dword [rbp + 0x70], eax
test eax, eax
je 0x47442e
jmp 0x474423
lea rdx, [0x004ea7a9]
lea rcx, [rbp + 0x74]
mov qword [rbp - 0x20], rcx
mov r8d, 0x20c
call fcn.004adbd0
mov rcx, qword [rbp - 8]
mov r8, qword [rbp - 0x20]
vmovdqa xmm0, xmmword [0x004b2480]
vmovdqa xmmword [rbp + 0x280], xmm0
mov qword [rbp + 0x38], 0x4d430001
lea rax, [rbp + 0x280]
mov qword [rbp - 0x18], rax
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], 0x10
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x60], 0
xor eax, eax
mov edx, eax
lea rax, [rbp + 0x38]
rol rdi, 3
rol rdi, 0xd
rol rdi, 0x3d
rol rdi, 0x33
xchg rbx, rbx
mov rdx, qword [rbp - 0x18]
mov rax, rsp
mov dword [rax + 0x20], 9
mov r9d, 0x20c
call sub.ntdll.dll_NtQueryInformationFile
mov dword [rbp + 0x294], eax
mov ecx, eax
mov dword [rbp - 0xc], ecx
sub eax, 0xc000000d
je 0x47446a
jmp 0x474412
mov eax, dword [rbp - 0xc]
test eax, eax
je 0x474468
jmp 0x47445d
cmp dword [rbp + 0x68], 0x11
jne 0x474435
jmp 0x474440
xor eax, eax
add rsp, 0x380
pop rbp
ret
jmp 0x47441b
jmp 0x474361
xor eax, eax
add rsp, 0x380
pop rbp
ret
jmp 0x474430
lea rax, [rbp + 0x74]
mov qword [rbp + 0x298], rax
mov eax, dword [rbp + 0x74]
add eax, 4
mov dword [rbp - 0x24], eax
setb al
jb 0x474487
jmp 0x4744a4
xor eax, eax
add rsp, 0x380
pop rbp
ret
jmp 0x474442
lea rcx, str.reached_unreachable_code
mov edx, 0x18
xor eax, eax
mov r8d, eax
lea r9, [0x004ea9b8]
call fcn.00401c10
lea rcx, str.integer_overflow
mov edx, 0x10
xor eax, eax
mov r8d, eax
lea r9, [0x004b26f0]
call fcn.00401c10
mov eax, dword [rbp - 0x24]
lea rcx, [rbp + 0x74]
add rcx, 4
mov qword [rbp - 0x38], rcx
mov eax, eax
mov ecx, eax
mov qword [rbp - 0x30], rcx
mov eax, 4
cmp rax, rcx
jbe 0x4744e0
jmp 0x4744e2
mov rax, qword [rbp - 0x30]
mov rcx, rax
sub rcx, 4
mov qword [rbp - 0x40], rcx
cmp rax, 0x20c
jbe 0x474500
jmp 0x474502
jmp 0x4744c7
mov rdx, qword [rbp - 0x30]
mov ecx, 4
call fcn.00402c40
mov rcx, qword [rbp - 0x30]
mov eax, 4
cmp rax, rcx
jbe 0x47457b
jmp 0x47457d
jmp 0x4744f0
mov rcx, qword [rbp - 0x30]
mov edx, 0x20c
call fcn.00401c90
mov rdx, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x38]
mov qword [rbp + 0x2a8], rdx
mov qword [rbp + 0x2a0], rcx
call fcn.004805a0
mov rcx, rdx
mov qword [rbp - 0x50], rcx
mov rcx, rax
mov qword [rbp - 0x48], rcx
mov qword [rbp + 0x2b8], rdx
mov qword [rbp + 0x2b0], rax
mov qword [rbp + 0x2c8], rdx
mov qword [rbp + 0x2c0], rax
mov rcx, qword [rbp + 0x2c0]
mov rdx, qword [rbp + 0x2c8]
lea r8, str.msys_cygwin__pty
mov r9d, 6
call fcn.0047c3a0
test al, 1
jne 0x474597
jmp 0x47459e
jmp 0x474510
mov rdx, qword [rbp - 0x30]
mov ecx, 4
call fcn.00401c90
mov al, byte [rbp - 0x51]
test al, 1
jne 0x4745e5
jmp 0x474635
mov al, 1
mov byte [rbp - 0x51], al
jmp 0x47458b
mov rax, qword [rbp - 0x50]
mov rcx, qword [rbp - 0x48]
mov qword [rbp + 0x2d0], rcx
mov qword [rbp + 0x2d8], rax
mov rcx, qword [rbp + 0x2d0]
mov rdx, qword [rbp + 0x2d8]
lea r8, [0x004ea9d4]
mov r9d, 8
call fcn.0047c3a0
mov byte [rbp - 0x51], al
jmp 0x47458b
mov al, byte [rbp - 0x52]
add rsp, 0x380
pop rbp
ret
mov rax, qword [rbp - 0x50]
mov rcx, qword [rbp - 0x48]
mov qword [rbp + 0x2e0], rcx
mov qword [rbp + 0x2e8], rax
mov rdx, qword [rbp + 0x2e0]
mov r8, qword [rbp + 0x2e8]
lea r9, [0x004ea9e4]
mov eax, 4
lea rcx, [rbp + 0x2f0]
mov qword [rsp + 0x20], rax
call fcn.00480680
cmp byte [rbp + 0x2f8], 0
setne al
mov byte [rbp - 0x52], al
jmp 0x4745d9
xor eax, eax
mov byte [rbp - 0x52], al
jmp 0x4745d9