Function at 0x140011998
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rdi, rdx
mov qword [rsp + 0x60], rcx
jb 0x1400119b8
jae 0x1400119b8
call 0x1586ba708
lea r13, [rdx + 0x18]
mov rbp, qword [rdx + 8]
mov r14, qword [rdx + 0x10]
xor esi, esi
jp 0x1400119cb
jnp 0x1400119cb
call 0x18ceca317
cmp ebp, esi
mov rbx, rbp
cmp rbp, r14
jb 0x140011a4c
jl 0x1400119d8
jge 0x1400119d8
call 0xca10a524
xchg dword [rax], ebx
add al, 0
add byte [rdi + 3], bh
mov rcx, qword [rdi]
mov al, byte [rdi + 0x418]
jg 0x1400119e6
jle 0x1400119e6
call 0x190255e72
mov byte [rsp + 0x50], al
mov byte [rsp + 0x40], sil
and qword [rsp + 0x48], 0
mov qword [rsp + 0x28], r13
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], 3
mov dword [rsp + 0x30], 0x400
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtQueryDirectoryFile
mov byte [rdi + 0x418], sil
mov r14, qword [rsp + 0x70]
call 0x140011a33
add al, ch
test r14, r14
je 0x140011afb
and qword [rdi + 8], 0
mov qword [rdi + 0x10], r14
test eax, eax
jne 0x140011ac4
mov ebx, eax
jbe 0x140011a51
ja 0x140011a51
call 0x15f3da7a1
lea r15, [rdi + rbx]
add r15, 0x76
mov eax, dword [r15 - 0x5e]
lea rbp, [rbx + rax]
test rax, rax
mov eax, 0x400
cmove rbp, rax
mov qword [rdi + 8], rbp
mov r12d, dword [r15 - 0x22]
shr r12, 1
jae 0x140011a7d
jb 0x140011a7d
call 0x14002d3c2
add byte [rax], al
mov r9d, 1
mov rcx, r15
mov rdx, r12
lea r8, [0x140003590]
call fcn.1400110cd
test al, 1
jne 0x140011aba
jae 0x140011a9e
jb 0x140011a9e
call 0x14003d3e3
add byte [rax], al
mov r9d, 2
mov rcx, r15
mov rdx, r12
lea r8, [0x140003592]
call fcn.1400110cd
test al, 1
je 0x140011b14
jns 0x140011abf
js 0x140011abf
call fcn.140001dac
invalid
jmp 0x1400119c6
cmp eax, 0xc0000022
jne 0x140011b87
ja 0x140011ad4
jbe 0x140011ad4
call 0xdd062ae7
sbb bh, bh
dec dword [rax - 0x75]
and al, 0x60
movups xmm0, xmmword [0x140003578]
mov rax, qword [rsp + 0x60]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [0x140003568]
movups xmmword [rax], xmm0
mov qword [rax + 0x20], 9
jmp 0x140011b97
xorps xmm0, xmm0
mov rax, qword [rsp + 0x60]
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax], xmm0
and qword [rax + 0x20], 0
jmp 0x140011b97
lea rsi, [rdi + rbx]
add rsi, 0x18
jnp 0x140011b21
jp 0x140011b21
call 0x159c89c6d
add al, 0
add byte [rsi + 3], dh
add rdi, 0x419
jbe 0x140011b2d
ja 0x140011b2d
call 0x16465a47d
and byte [rax - 0x73], cl
pop rsp
and al, 0x78
mov qword [rsp + 0x20], r12
lea rbx, [rsp + 0x78]
mov r8d, 0x2fd
mov rcx, rbx
mov rdx, rdi
mov r9, r15
call fcn.140009197
jbe 0x140011b50
ja 0x140011b50
call 0x14f3961df
mov edx, 0x930f0ae0
rol dword [rax + 0x10a804c9], 0xf
mov dh, 0xc1
mov eax, dword [rsi + 0x38]
bt eax, 0xa
setae cl
or cl, 4
test al, 0x10
movzx eax, cl
mov ecx, 2
cmove ecx, eax
mov rax, qword [rbx]
mov rdx, qword [rsp + 0x60]
and word [rdx + 0x20], 0
mov byte [rdx + 0x18], 1
mov qword [rdx], rdi
mov qword [rdx + 8], rax
mov byte [rdx + 0x10], cl
jmp 0x140011b97
je 0x140011b8c
jne 0x140011b8c
call 0x16445a6d8
invalid
mov rax, qword [rsp + 0x60]
mov word [rax + 0x20], 0xe
jbe 0x140011b9c
ja 0x140011b9c
call 0xc8c59ce8
add byte [rax], al
add byte [rbx + 0x5d], bl
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret