Function at 0x140022808
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1400b8288]
xor rax, rsp
mov qword [rbp - 8], rax
xor r13d, r13d
xorps xmm0, xmm0
mov dword [rbp - 0x40], r13d
mov rbx, rdx
mov qword [rbp - 0x30], r13
mov rsi, rcx
mov qword [rbp - 0x20], r13
mov r14d, r13d
mov qword [rbp - 0x28], r13
mov r12d, r13d
mov qword [rbp - 0x38], r13
movups xmmword [rbp - 0x18], xmm0
test rcx, rcx
je 0x140022b97
test rdx, rdx
je 0x140022b97
mov eax, dword [rcx + 0x18]
lea edi, [r13 + 1]
mov dword [rdx + 0x410], eax
mov ecx, dword [rcx]
sub ecx, edi
je 0x1400228f0
sub ecx, edi
je 0x1400228bc
cmp ecx, edi
je 0x1400228b0
mov r9d, 0x80070057
mov r8d, 0x88e
mov edi, r9d
lea rdx, str.onecore_base_ntsetupopktoolsosimagewimgapilibmount.c
mov qword [rsp + 0x20], r13
lea rcx, str.MountEntryToInfoStruct
call fcn.140046874
jmp 0x140022bd3
or dword [rdx + 0x414], 8
jmp 0x14002294f
lea rcx, [rsi + 0x1c]
lea rdx, [rbp - 0x40]
call fcn.14005c140
mov edi, eax
test eax, eax
jns 0x1400228da
mov r9d, eax
mov r8d, 0x87f
jmp 0x140022893
mov eax, 4
lea edi, [rax - 3]
cmp dword [rbp - 0x40], edi
cmove eax, edi
or dword [rbx + 0x414], eax
jmp 0x14002294f
or dword [rdx + 0x414], 2
lea rcx, [rsi + 0x1c]
lea rdx, [rbp - 0x38]
call qword [sym.imp.RPCRT4.dll_UuidToStringW]
nop dword [rax + rax]
test eax, eax
je 0x14002292b
movzx edi, ax
mov r8d, 0x863
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov r9d, edi
jmp 0x140022893
mov rcx, qword [rbp - 0x38]
lea r8, [rbp - 0x20]
xor edx, edx
call fcn.1400465dc
mov edi, eax
cmp eax, 0x80070002
jne 0x14002296e
or dword [rbx + 0x414], 8
mov edi, 1
mov rdx, qword [rsi + 8]
lea rcx, [rsi + 0x40]
lea r8, [rbp - 0x28]
call fcn.140051e40
mov r12, qword [rbp - 0x28]
test eax, eax
jns 0x140022980
mov r10, qword [rsi + 8]
jmp 0x140022983
test eax, eax
jns 0x14002294a
mov r9d, eax
mov r8d, 0x873
jmp 0x140022ba6
mov r10, r12
mov r15d, 0x104
mov r9d, 0x8007007a
test r10, r10
je 0x1400229f5
lea rcx, [rbx + 0x208]
mov r8, r10
sub r8, rcx
mov edx, r15d
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x1400229c6
movzx eax, word [r8 + rcx]
test ax, ax
je 0x1400229c6
mov word [rcx], ax
add rcx, 2
sub rdx, rdi
jne 0x1400229a4
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r13w
mov rax, rdx
neg rax
sbb edi, edi
not edi
and edi, r9d
test rdx, rdx
jne 0x1400229f5
mov r9d, edi
mov r8d, 0x8a3
jmp 0x140022ba6
mov r8, qword [rsi + 0x10]
test r8, r8
je 0x140022a59
mov rdx, r15
mov rcx, rbx
sub r8, rbx
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140022a2a
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140022a2a
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140022a07
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r13w
mov rax, rdx
neg rax
sbb edi, edi
not edi
and edi, r9d
test rdx, rdx
jne 0x140022a59
mov r9d, edi
mov r8d, 0x8ae
jmp 0x140022ba6
lea rax, [rbp - 0x30]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, r10
call fcn.140020050
mov ecx, eax
test eax, eax
js 0x140022b4b
mov r14, qword [rbp - 0x30]
lea rdx, [rbp - 0x18]
mov rcx, r14
call fcn.1400582f0
mov edi, eax
test eax, eax
jns 0x140022aa3
mov r9d, eax
mov r8d, 0x8c1
jmp 0x140022ba6
mov rax, qword [rbp - 0x18]
cmp rax, qword [rsi + 0x1c]
jne 0x140022ab7
mov rax, qword [rbp - 0x10]
cmp rax, qword [rsi + 0x24]
je 0x140022ac5
and dword [rbx + 0x414], 0xfffffffa
or dword [rbx + 0x414], 0x48
mov rcx, qword [r14 + 0x40]
test rcx, rcx
je 0x140022b2a
call fcn.14002e168
mov rdx, rbx
sub rax, rbx
lea rcx, [r15 + 0x7ffffefa]
test rcx, rcx
je 0x140022afb
movzx ecx, word [rax + rdx]
test cx, cx
je 0x140022afb
mov word [rdx], cx
add rdx, 2
sub r15, 1
jne 0x140022ad9
test r15, r15
lea rax, [rdx - 2]
cmovne rax, rdx
mov word [rax], r13w
mov rax, r15
neg rax
sbb edi, edi
not edi
and edi, 0x8007007a
test r15, r15
jne 0x140022b31
mov r9d, edi
mov r8d, 0x8d1
jmp 0x140022ba6
or dword [rbx + 0x414], 0x10
mov eax, dword [r14 + 0x20]
mov dword [rbx + 0x410], eax
cmp dword [r14 + 0x60], r13d
jne 0x140022bbe
bts dword [rbx + 0x414], 8
jmp 0x140022bbe
cmp ecx, 0xc142011c
je 0x140022b65
add eax, 0x7ff8fffe
cmp eax, 1
jbe 0x140022b65
cmp ecx, 0xc1420132
jne 0x140022b73
and dword [rbx + 0x414], 0xfffffffa
or dword [rbx + 0x414], 0x28
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
jne 0x140022b8e
or dword [rbx + 0x414], 0x10
mov r14, qword [rbp - 0x30]
mov edi, r13d
jmp 0x140022bbe
mov r9d, 0x80070057
mov r8d, 0x84b
mov edi, r9d
lea rdx, str.onecore_base_ntsetupopktoolsosimagewimgapilibmount.c
mov qword [rsp + 0x20], r13
lea rcx, str.MountEntryToInfoStruct
call fcn.140046874
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140022bd3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
cmp qword [rbp - 0x38], r13
je 0x140022be9
lea rcx, [rbp - 0x38]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
nop dword [rax + rax]
test r12, r12
je 0x140022c0e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rcx, r14
call fcn.140057bb4
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140096bd0
mov rbx, qword [rsp + 0xc0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret