Function at 0x14000e63c
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x20908
call fcn.1400017dc
sub rsp, rax
mov rdi, qword [r8 + 8]
test rdi, rdi
je 0x14000e690
mov r12, r9
mov rsi, r8
mov r14, rdx
mov r15, rcx
lea rbx, [rdx + 8]
mov rbp, qword [rdx + 8]
mov rcx, rdx
mov rdx, r15
xor r8d, r8d
call fcn.14000e605
test ax, ax
je 0x14000e69a
mov r13d, eax
mov qword [rbx], rbp
jmp 0x14000e735
mov r13w, 0x11
jmp 0x14000e739
mov qword [rsp + 0x60], rbx
mov rdx, qword [r14]
mov r8, qword [r14 + 8]
dec r8
lea rbx, [rsp + 0x108f8]
mov rcx, rbx
call fcn.14000ee78
movzx r13d, word [rbx + 0x10008]
test r13w, r13w
je 0x14000e6d1
mov rax, qword [rsp + 0x60]
mov qword [rax], rbp
jmp 0x14000e735
lea rcx, [rsp + 0x8f0]
lea rdx, [rsp + 0x108f8]
mov r8d, 0x10008
call fcn.14000370d
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x20]
mov rdx, qword [rax + 0x48]
lea r8, [rsp + 0x8f8]
mov byte [rsp + 0x20], 1
lea rbx, [rsp + 0xb0]
mov rcx, rbx
xor r9d, r9d
call fcn.14000f123
cmp word [rbx + 8], 0
je 0x14000e750
mov rax, qword [rsp + 0x60]
mov qword [rax], rbp
mov r13w, 0x11
mov qword [rsi + 8], rdi
mov eax, r13d
add rsp, 0x20908
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x68], rax
mov rbx, qword [rsp + 0x60]
mov qword [rbx], rbp
mov rcx, rsi
mov rdx, r15
mov r8w, 0x2a
call fcn.14000e605
test ax, ax
je 0x14000e78c
mov r13d, eax
mov rcx, qword [rsp + 0x68]
call sub.ntdll.dll_NtClose
jmp 0x14000e688
mov rcx, rsi
mov rdx, r15
xor r8d, r8d
call fcn.14000e605
test ax, ax
je 0x14000e7b1
mov r13d, eax
mov rcx, qword [rsp + 0x68]
call sub.ntdll.dll_NtClose
jmp 0x14000e6c7
mov rax, qword [rsi]
mov qword [rsp + 0x98], rax
mov rax, qword [rsi + 8]
and dword [rsp + 0x7c], 0
add rax, rax
add rax, 0xfffffffffffffffe
mov qword [rsp + 0x90], rax
cmp rax, 0xffff
mov rbx, qword [rsp + 0x60]
jbe 0x14000e7f8
mov rcx, qword [rsp + 0x68]
call sub.ntdll.dll_NtClose
mov qword [rbx], rbp
mov r13w, 0x10
jmp 0x14000e735
mov ebx, 0x800
xor eax, eax
mov qword [rsp + 0x80], rax
xor eax, eax
mov qword [rsp + 0x88], rax
mov r13, qword [rsp + 0x68]
mov rax, qword [rsp + 0x90]
mov word [rsp + 0xa0], ax
mov word [rsp + 0xa2], ax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0xa8], rax
xor eax, eax
mov byte [rsp + 0x50], al
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0x48], rcx
mov byte [rsp + 0x40], al
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 0x800
mov rcx, r13
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtQueryDirectoryFile
test eax, eax
jne 0x14000e919
xor r13d, r13d
cmp r13, 0x7ff
ja 0x14000e811
mov rax, r13
mov ecx, dword [rsp + r13 + 0xf0]
add r13, rcx
test rcx, rcx
cmove r13, rbx
test byte [rsp + rax + 0x128], 0x10
jne 0x14000e89a
add rax, rsp
add rax, 0xf0
mov r8d, dword [rax + 0x3c]
shr r8, 1
cmp rdi, r8
je 0x14000e90d
lea rdx, [rax + rdi*2]
add rdx, 0x40
sub r8, rdi
lea rcx, [rsp + 0x70]
call fcn.14000f248
cmp byte [rsp + 0x71], 0
je 0x14000e89a
movzx eax, byte [rsp + 0x70]
mov byte [rsp + rax + 0x7c], 1
mov al, 1
mov qword [rsp + 0x80], rax
jmp 0x14000e89a
mov al, 1
mov qword [rsp + 0x88], rax
jmp 0x14000e89a
cmp eax, 0x80000006
je 0x14000e950
cmp eax, 0xc000000f
mov rbx, qword [rsp + 0x60]
mov rcx, r13
je 0x14000ea2e
cmp eax, 0xc0000022
jne 0x14000ea3b
call sub.ntdll.dll_NtClose
mov qword [rbx], rbp
mov r13w, 0xb
jmp 0x14000e735
mov r13w, 0x11
test byte [rsp + 0x88], 1
mov rbx, qword [rsp + 0x60]
je 0x14000eaa3
test rbp, rbp
je 0x14000e99c
mov rax, qword [r14]
mov rcx, qword [r14 + 8]
movzx eax, word [rax + rcx*2 - 2]
cmp eax, 0x2f
je 0x14000e99c
cmp eax, 0x5c
je 0x14000e99c
mov rcx, r14
mov rdx, r15
mov r8w, 0x5c
call fcn.14000e605
test ax, ax
jne 0x14000e77a
mov r8, qword [rsi]
mov rcx, r14
mov rdx, r15
mov r9, rdi
call fcn.14000e590
test ax, ax
jne 0x14000e77a
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.14000e605
test ax, ax
jne 0x14000e77a
mov rcx, qword [r14]
mov rax, qword [rsp + 0x20998]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20990]
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x20978]
mov r8, qword [rsp + 0x20980]
mov r9, qword [rsp + 0x20988]
call fcn.14000f388
cmp ax, 0x39
je 0x14000ea4d
mov r13d, eax
movzx eax, ax
cmp eax, 0xb
je 0x14000ea9e
cmp eax, 0x11
je 0x14000ea9e
test eax, eax
je 0x14000ec49
jmp 0x14000e7a2
call sub.ntdll.dll_NtClose
mov qword [rbx], rbp
jmp 0x14000e730
call sub.ntdll.dll_NtClose
mov qword [rbx], rbp
mov r13w, 0x18
jmp 0x14000e735
lea rax, [rdi + rdi]
add rax, qword [rsi]
xor edx, edx
mov r13w, 0x39
cmp rdi, rdx
je 0x14000ea9e
lea rcx, [rax - 2]
inc rdx
cmp word [rax - 2], 0x2e
mov rax, rcx
jne 0x14000ea56
lea r8, [0x141332056]
mov r9d, 4
call fcn.14000f427
test al, 1
mov rbx, qword [rsp + 0x60]
je 0x14000eaa3
mov rcx, qword [rsp + 0x68]
call sub.ntdll.dll_NtClose
mov qword [rbx], rbp
jmp 0x14000ec1f
mov rbx, qword [rsp + 0x60]
test byte [rsp + 0x80], 1
je 0x14000e77d
lea rcx, [rsp + 0xd0]
mov qword [rcx], r12
mov rax, qword [rsp + 0x20970]
mov qword [rcx + 8], rax
and qword [rcx + 0x10], 0
mov word [rcx + 0x18], 0x3b
lea rcx, [rsp + 0xd0]
call fcn.14000edfd
mov r12, rax
test rax, rax
je 0x14000e7a2
mov rax, rdx
lea rcx, [rsp + 0x78]
mov rdx, r12
mov rbx, rax
mov r8, rax
call fcn.14000f248
cmp byte [rsp + 0x79], 0
je 0x14000ead3
movzx eax, byte [rsp + 0x78]
cmp byte [rsp + rax + 0x7c], 1
jne 0x14000ead3
mov rax, qword [rsp + 0x60]
mov qword [rax], rbp
test rbp, rbp
je 0x14000eb4d
mov rax, qword [r14]
movzx eax, word [rax + rbp*2 - 2]
cmp eax, 0x2f
je 0x14000eb4d
cmp eax, 0x5c
je 0x14000eb4d
mov rcx, r14
mov rdx, r15
mov r8w, 0x5c
call fcn.14000e605
test ax, ax
jne 0x14000ec29
mov r8, qword [rsi]
mov rcx, r14
mov rdx, r15
mov r9, rdi
call fcn.14000e590
test ax, ax
jne 0x14000ec29
mov rcx, r14
mov rdx, r15
mov r8, r12
mov r9, rbx
call fcn.14000e590
test ax, ax
jne 0x14000ec29
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.14000e605
test ax, ax
jne 0x14000ec29
mov rcx, qword [r14]
mov rax, qword [rsp + 0x20998]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20990]
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x20978]
mov r8, qword [rsp + 0x20980]
mov r9, qword [rsp + 0x20988]
call fcn.14000f388
cmp ax, 0xb
je 0x14000ead3
movzx ecx, ax
cmp ecx, 0x11
je 0x14000ead3
cmp ecx, 0x39
jne 0x14000ec45
mov r9d, 4
mov rcx, r12
mov rdx, rbx
lea r8, [0x141332056]
call fcn.14000f427
test al, 1
je 0x14000ead3
mov rcx, qword [rsp + 0x68]
call sub.ntdll.dll_NtClose
mov rax, qword [rsp + 0x60]
mov qword [rax], rbp
mov r13w, 0x53
jmp 0x14000e735
mov rcx, qword [rsp + 0x68]
mov ebx, eax
call sub.ntdll.dll_NtClose
mov rax, qword [rsp + 0x60]
mov qword [rax], rbp
mov r13d, ebx
jmp 0x14000e735
test ecx, ecx
jne 0x14000ec63
mov rcx, qword [rsp + 0x68]
call sub.ntdll.dll_NtClose
mov rax, qword [rsp + 0x60]
mov qword [rax], rbp
xor r13d, r13d
jmp 0x14000e735
mov ebx, eax
mov rcx, qword [rsp + 0x68]
jmp 0x14000ec30