Function at 0x100005ca4
Capabilities:
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
push rbp
push rdi
push r12
push r13
push r14
sub rsp, 0x90
xor edi, edi
mov rbx, rcx
mov qword [rax + 0x18], rdi
cmp rcx, rdi
je 0x100005fe5
cmp dword [0x100011a30], edi
je 0x100005fe5
lea rdx, [rax + 0x18]
lea ecx, [rdi + 1]
call fcn.10000607c
cmp eax, edi
jne 0x100005cfc
lea rdx, [0x1000029a0]
lea ecx, [rdi + 4]
call fcn.100006a9c
jmp 0x100005fad
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov edx, 0x100080
lea r8d, [r9 + 7]
mov rcx, rbx
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x100005d4e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x100002a20]
lea ecx, [r12 + 5]
mov r8d, eax
call fcn.100006a9c
jmp 0x100005f9e
mov dword [rsp + 0xc0], 0x400
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
cmp rax, rdi
je 0x100005f9e
mov r9d, dword [rsp + 0xc0]
lea rdx, [rsp + 0x50]
mov r8, rax
mov rcx, r12
mov dword [rsp + 0x20], 0x2f
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov ecx, 4
cmp eax, edi
jge 0x100005dbd
lea rdx, [0x100002aa0]
mov r8d, eax
call fcn.100006a9c
jmp 0x100005f8a
mov r8, rbx
lea rdx, [0x100002b30]
cmp dword [rbp], edi
ja 0x100005dd3
lea rdx, [0x100002b80]
call fcn.100006a9c
mov qword [rsp + 0xc8], rdi
mov rbx, rdi
mov r13d, edi
cmp dword [rbp], edi
jbe 0x100005f8a
lea r14, [rbp + 8]
mov qword [rsp + 0x48], rdi
mov rax, qword [r14]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0xc8]
mov edx, 0x1000
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x60], 0x30
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x78], edi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x88], rdi
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, edi
jge 0x100005e60
lea rdx, [0x100002bc0]
mov r8d, eax
mov ecx, 4
call fcn.100006a9c
jmp 0x100005f42
mov rcx, qword [rsp + 0xc8]
xor r9d, r9d
lea rax, [rsp + 0xc0]
lea edx, [r9 + 0x1b]
xor r8d, r8d
mov dword [rsp + 0xc0], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
cmp eax, 0x80000005
je 0x100005eaa
cmp eax, 0xc0000023
je 0x100005eaa
cmp eax, 0xc0000004
je 0x100005eaa
lea rdx, [0x100002c40]
jmp 0x100005e4e
mov ebx, dword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
cmp rax, rdi
jne 0x100005ee4
mov r8d, dword [rsp + 0xc0]
lea rdx, [0x100002d00]
jmp 0x100005e51
mov r9d, dword [rsp + 0xc0]
mov rcx, qword [rsp + 0xc8]
lea rax, [rsp + 0xc0]
mov r8, rbx
mov edx, 0x1b
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
cmp eax, edi
jge 0x100005f1f
lea rdx, [0x100002d70]
jmp 0x100005e4e
lea rdx, [0x100002e08]
mov ecx, 4
cmp word [rbx], di
jbe 0x100005f36
mov r8, qword [rbx + 8]
jmp 0x100005f3d
lea r8, [0x100002e30]
call fcn.100006a9c
mov rcx, qword [rsp + 0xc8]
cmp rcx, rdi
je 0x100005f5d
call qword [sym.imp.ntdll.dll_NtClose]
mov qword [rsp + 0xc8], rdi
cmp rbx, rdi
je 0x100005f79
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, rdi
inc r13d
add r14, 8
cmp r13d, dword [rbp]
jb 0x100005df3
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r12, 0xffffffffffffffff
je 0x100005fad
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0xd0]
cmp rbx, rdi
je 0x100005fe5
cmp dword [rbx], 1
jne 0x100005fc2
mov edi, dword [rbx + 0xc]
test dil, 2
jne 0x100005fd1
xor edx, edx
xor ecx, ecx
call fcn.10000607c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0xd8]
add rsp, 0x90
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret