Function at 0x10009a5b8
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor r15d, r15d
mov rdi, rdx
mov qword [rsp + 0x58], rdx
mov rbp, rcx
cmp rcx, r15
jne 0x10009a606
lea r8, [0x100009b70]
lea rcx, [0x100009b10]
mov edx, 0x15e
call fcn.10009a050
mov qword [rdi], r15
mov r12, r15
mov r14, r15
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x10009a646
test byte [rcx + 0x1c], 1
je 0x10009a646
cmp byte [rcx + 0x19], 4
jb 0x10009a646
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003ae8]
mov edx, 0x10
mov r9, rbp
call fcn.10001db08
or rbx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
mov rcx, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 2
jae 0x10009a66b
mov edi, 0x80070057
jmp 0x10009ab0b
lea rdx, [0x100009b7c]
mov rcx, rbp
call sub.msvcrt.dll_wcsstr
cmp rax, rbp
jne 0x10009a661
xor eax, eax
lea rdi, [rbp + 4]
mov rcx, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 2
jb 0x10009a661
lea rdx, [0x100002934]
lea rcx, [rbp + 4]
call sub.msvcrt.dll_wcsstr
mov r11, rax
cmp rax, r15
je 0x10009a661
xor eax, eax
lea rdi, [r11 + 2]
mov rcx, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 2
jb 0x10009a661
lea rdx, [0x100002934]
lea rcx, [r11 + 2]
call sub.msvcrt.dll_wcsstr
mov rsi, rax
cmp rax, r15
je 0x10009a661
sub rsi, rbp
sar rsi, 1
inc rsi
lea rdi, [rsi + rsi]
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov r13, rax
cmp rax, r15
jne 0x10009a707
mov edi, 0x8007000e
jmp 0x10009aaef
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
lea r11, [rsi - 1]
mov edi, r15d
mov ebx, 0x80070057
cmp rsi, r15
je 0x10009a72e
cmp rsi, 0x7fffffff
jbe 0x10009a730
mov edi, ebx
cmp edi, r15d
jl 0x10009aaef
cmp r11, 0x7ffffffe
jbe 0x10009a74b
mov edi, ebx
mov word [r13], r15w
jmp 0x10009a78e
mov rcx, r13
mov edi, r15d
cmp rsi, r15
je 0x10009a781
sub r11, rsi
sub rbp, r13
lea rax, [r11 + rsi]
cmp rax, r15
je 0x10009a77c
movzx eax, word [rcx + rbp]
cmp ax, r15w
je 0x10009a77c
mov word [rcx], ax
add rcx, 2
sub rsi, 1
jne 0x10009a75c
cmp rsi, r15
jne 0x10009a78a
sub rcx, 2
mov edi, 0x8007007a
mov word [rcx], r15w
cmp edi, r15d
jl 0x10009aaef
mov rcx, qword [0x1001653b8]
lea rsi, [0x1001653b8]
cmp rcx, rsi
je 0x10009a7ce
test byte [rcx + 0x1c], 1
je 0x10009a7ce
cmp byte [rcx + 0x19], 4
jb 0x10009a7ce
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003ae8]
mov edx, 0x11
mov r9, r13
call fcn.10001db08
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov edx, 0x80000000
lea r8d, [r9 + 7]
mov rcx, r13
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x10009a859
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x10009aacf
test byte [rcx + 0x1c], 1
je 0x10009aacf
cmp byte [rcx + 0x19], 2
jb 0x10009aacf
mov rcx, qword [rcx + 0x10]
lea edx, [r15 + 0x13]
lea r8, [0x100003ae8]
mov r9, r13
mov dword [rsp + 0x20], edi
call fcn.10001ddb0
jmp 0x10009aacf
xor eax, eax
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x48]
lea ebp, [rax + 0x31]
lea r9d, [rax + 8]
mov rcx, r15
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], ebp
mov qword [rsp + 0x50], rax
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jns 0x10009a8d8
cmp eax, 0x80000005
je 0x10009a8d8
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x10009aacf
test byte [rcx + 0x1c], 1
je 0x10009aacf
cmp byte [rcx + 0x19], 2
jb 0x10009aacf
lea edx, [rbp - 0x1e]
jmp 0x10009a97c
mov edi, dword [rsp + 0x60]
add edi, 8
mov ecx, edi
mov esi, edi
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov r14, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x10009a900
mov edi, 0x8007000e
jmp 0x10009aacf
mov r8, rsi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
xor r11d, r11d
lea rdx, [rsp + 0x48]
mov r9d, edi
mov r8, r14
mov rcx, r15
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x50], r11
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jns 0x10009a994
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x10009aacf
test byte [rcx + 0x1c], 1
je 0x10009aacf
cmp byte [rcx + 0x19], 2
jb 0x10009aacf
mov edx, 0x14
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003ae8]
mov r9d, edi
call fcn.10001c878
jmp 0x10009aacf
or rcx, 0xffffffffffffffff
add r14, 4
xor eax, eax
lea rbp, [r14 + 2]
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 2
jae 0x10009a9bb
mov edi, ebx
jmp 0x10009aaca
lea rdx, [0x100002934]
mov rcx, rbp
call sub.msvcrt.dll_wcsstr
mov rsi, rax
test rax, rax
je 0x10009a9b4
sub rsi, r14
sub rsi, 2
sar rsi, 1
inc rsi
lea rdi, [rsi + rsi]
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
xor r14d, r14d
mov r12, rax
cmp rax, r14
jne 0x10009aa01
mov edi, 0x8007000e
jmp 0x10009aaca
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
lea r11, [rsi - 1]
mov edi, r14d
cmp rsi, r14
je 0x10009aa23
cmp rsi, 0x7fffffff
jbe 0x10009aa25
mov edi, ebx
cmp edi, r14d
jl 0x10009aaca
cmp r11, 0x7ffffffe
jbe 0x10009aa40
mov edi, ebx
mov word [r12], r14w
jmp 0x10009aa83
mov rcx, r12
mov edi, r14d
cmp rsi, r14
je 0x10009aa76
sub r11, rsi
sub rbp, r12
lea rax, [r11 + rsi]
cmp rax, r14
je 0x10009aa71
movzx eax, word [rcx + rbp]
cmp ax, r14w
je 0x10009aa71
mov word [rcx], ax
add rcx, 2
sub rsi, 1
jne 0x10009aa51
cmp rsi, r14
jne 0x10009aa7f
sub rcx, 2
mov edi, 0x8007007a
mov word [rcx], r14w
cmp edi, r14d
jl 0x10009aaca
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x10009aabf
test byte [rcx + 0x1c], 1
je 0x10009aabf
cmp byte [rcx + 0x19], 4
jb 0x10009aabf
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003ae8]
mov edx, 0x15
mov r9, r12
call fcn.10001db08
mov rax, qword [rsp + 0x58]
mov qword [rax], r12
mov r12, r14
mov r14, qword [rsp + 0x40]
cmp r15, 0xffffffffffffffff
je 0x10009aade
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r15d, r15d
cmp r12, r15
je 0x10009aaef
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp r13, r15
je 0x10009aafd
mov rcx, r13
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp r14, r15
je 0x10009ab0b
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, edi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.10014e600
mov rbx, qword [rsp + 0xc0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret