Function at 0x18005ec34
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
xor r14d, r14d
mov r13d, edx
mov rdi, rcx
test rcx, rcx
jne 0x18005ec6a
xor eax, eax
jmp 0x18005f0e5
mov rcx, qword [rcx + 8]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r14w
jne 0x18005ec72
add eax, 5
xor ecx, ecx
mov esi, eax
lea rdx, [rax + rax]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x18005eca5
mov eax, 8
jmp 0x18005f0e5
lea r8, [0x18007bdd8]
mov r9, qword [rdi + 8]
mov rdx, rsi
mov rcx, rbx
cmp dword [rbp + 0x60], r14d
jne 0x18005ecc3
lea r8, str._s.
call qword [sym.imp.msvcrt.dll_swprintf_s]
nop dword [rax + rax]
mov edx, 0x230
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov rsi, rax
mov rcx, rbx
test rax, rax
jne 0x18005ecfb
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
jmp 0x18005ec9b
mov rdx, rax
call qword [sym.imp.msvcrt.dll__wfindfirst64]
nop dword [rax + rax]
mov rcx, rbx
mov r12, rax
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov ebx, r14d
cmp r12, 0xffffffffffffffff
je 0x18005f0cf
mov rcx, qword [rdi + 8]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
bt eax, 0xa
jb 0x18005f0c0
mov qword [rbp + 0x40], r14
lea r15, [rsi + 0x28]
cmp word [r15], 0x2e
jne 0x18005ed6f
cmp word [rsi + 0x2a], r14w
je 0x18005f079
cmp word [rsi + 0x2a], 0x2e
jne 0x18005ed6f
cmp word [rsi + 0x2c], r14w
je 0x18005f079
mov edx, dword [rdi + 0x38]
mov r8, r15
mov rcx, qword [rdi + 0x30]
call fcn.18005b940
test eax, eax
jne 0x18005f079
or rax, 0xffffffffffffffff
mov rcx, rax
inc rcx
cmp word [r15 + rcx*2], r14w
jne 0x18005ed8d
mov rdx, qword [rdi + 8]
inc rax
cmp word [rdx + rax*2], r14w
jne 0x18005ed9b
lea rbx, [rax + 2]
add rbx, rcx
xor ecx, ecx
mov ebx, ebx
lea rdx, [rbx + rbx]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov r14, rax
test rax, rax
je 0x18005f095
cmp dword [rbp + 0x60], 0
lea r8, [0x18007a7e8]
mov r9, qword [rdi + 8]
mov edx, ebx
mov qword [rsp + 0x20], r15
mov rcx, rax
jne 0x18005edee
lea r8, str._s_s
call qword [sym.imp.msvcrt.dll_swprintf_s]
nop dword [rax + rax]
mov r15d, dword [rsi]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov rdx, qword [rdi + 0x28]
lea rax, [rbp + 0x40]
mov qword [rsp + 0x48], rax
mov cl, r15b
mov rax, qword [rbp + 0x58]
and cl, 0x10
mov qword [rsp + 0x40], rax
xor esi, esi
mov rax, qword [rbp + 0x50]
cmp byte [rdi + 0x14], 2
mov qword [rsp + 0x38], rax
mov eax, dword [rdi + 0x18]
setne r9b
mov dword [rsp + 0x30], r13d
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov byte [rsp + 0x20], cl
mov rcx, r14
call fcn.180060ebc
mov ebx, eax
cmp eax, 0x20
je 0x18005ee70
cmp eax, 5
je 0x18005ee70
cmp eax, 0x780
je 0x18005ee70
cmp eax, 0x538
jne 0x18005ee85
mov r9, r14
mov r8d, 0x1c60
mov edx, ebx
mov ecx, 1
call fcn.180038d90
test ebx, ebx
jne 0x18005eeaf
test r15b, 0x10
jne 0x18005ef20
mov edx, dword [rdi + 0x18]
mov r9d, r13d
and qword [rsp + 0x20], rsi
and edx, 0x1c
mov r8, qword [rbp + 0x40]
mov rcx, r14
call fcn.18006124c
mov ebx, eax
mov r15d, dword [0x18008b2a0]
mov rcx, r14
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
xor r14d, r14d
cmp qword [rbp + 0x40], r14
je 0x18005eede
lea rcx, [rbp + 0x40]
call qword [sym.imp.ntdll.dll_RtlDeleteSecurityObject]
nop dword [rax + rax]
mov qword [rbp + 0x40], r14
cmp ebx, 0x538
je 0x18005f046
cmp ebx, 0x20
ja 0x18005ef07
movabs rcx, 0x10000002c
bt rcx, rbx
jb 0x18005f046
cmp ebx, 0x780
je 0x18005f046
test ebx, ebx
jne 0x18005f0c0
jmp 0x18005f05e
cmp byte [rdi + 0x14], 2
mov eax, dword [rdi + 0x18]
jne 0x18005ef54
mov rcx, qword [rbp + 0x58]
and eax, 0x1c
mov r8, qword [rbp + 0x40]
mov r9d, r13d
mov qword [rsp + 0x28], rcx
mov edx, eax
mov rcx, qword [rbp + 0x50]
mov qword [rsp + 0x20], rcx
mov rcx, r14
call fcn.18005f9ec
jmp 0x18005eead
xor ebx, ebx
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x38], rcx
and eax, 0xc
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov qword [rsp + 0x28], rbx
mov r8d, eax
mov edx, r13d
mov qword [rsp + 0x20], rbx
mov rcx, r14
mov qword [rbp - 0x10], rbx
lea r15d, [rbx + 1]
call qword [sym.imp.api_ms_win_security_provider_l1_1_0.dll_GetNamedSecurityInfoW]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x10]
test eax, eax
jne 0x18005efbc
test rcx, rcx
je 0x18005efd1
mov r8d, dword [rdi + 0x18]
mov rdx, qword [rbp + 0x40]
and r8d, 0xc
call fcn.18005e9a8
mov rcx, qword [rbp - 0x10]
test eax, eax
mov r15d, ebx
setne r15b
test rcx, rcx
je 0x18005efd1
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
and qword [rbp - 0x10], rbx
test r15d, r15d
je 0x18005eeaf
mov r8d, dword [rdi + 0x18]
mov edx, r13d
mov r9, qword [rbp + 0x40]
and r8d, 0x1c
mov rcx, r14
mov dword [rsp + 0x20], 1
call qword [sym.imp.NTMARTA.dll_AccRewriteSetNamedRights]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x18005eeaf
mov r15d, dword [0x18008b2a0]
mov rax, qword gs:[0x58]
mov ecx, 0x18
mov rax, qword [rax + r15*8]
mov dword [rcx + rax], ebx
cmp ebx, 5
jne 0x18005f03f
mov r9, qword [rdi + 8]
lea ecx, [rbx - 4]
mov edx, ebx
mov r8d, 0x1c77
call fcn.180038d90
xor ebx, ebx
jmp 0x18005eeb6
mov rax, qword gs:[0x58]
mov ecx, 0x18
mov rax, qword [rax + r15*8]
mov dword [rcx + rax], ebx
mov ebx, r14d
mov edx, 0x230
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x18005f098
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.msvcrt.dll__wfindnext64]
nop dword [rax + rax]
test eax, eax
je 0x18005ed47
jmp 0x18005f09d
xor r14d, r14d
mov ebx, 8
mov rax, qword [rbp + 0x40]
test rax, rax
je 0x18005f0c0
cmp rax, qword [rdi + 0x28]
je 0x18005f0c0
lea rcx, [rbp + 0x40]
call qword [sym.imp.ntdll.dll_RtlDeleteSecurityObject]
nop dword [rax + rax]
mov qword [rbp + 0x40], r14
mov rcx, r12
call qword [sym.imp.msvcrt.dll__findclose]
nop dword [rax + rax]
test rsi, rsi
je 0x18005f0e3
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov eax, ebx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret