Function at 0x14000fb70
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x50
cmp dword [0x14002d8b0], 0
mov rbx, rdx
mov esi, dword [rcx + 0x10]
mov rdi, rcx
mov ebp, 0xa0000003
mov r12d, 1
je 0x14000fba7
cmp dword [rcx + 0x1c], ebp
je 0x14000fbb9
cmp dword [0x14002d8c0], 0
je 0x14000fbbe
cmp dword [rcx + 0x1c], 0xa000000c
jne 0x14000fbbe
mov r14d, r12d
jmp 0x14000fbc1
xor r14d, r14d
cmp dword [0x14002d7ac], 0
jne 0x14000fe32
cmp esi, 0x12
je 0x14000fe32
mov cl, r12b
call fcn.140011ea4
cmp esi, r12d
jne 0x14000fc63
mov ecx, dword [0x14002c2d0]
test ecx, ecx
je 0x14000fc14
cmp dword [rbx + 0x1c], ebp
je 0x14000fc14
mov eax, dword [0x14002d7a8]
and eax, dword [0x14002d7a0]
bt eax, 0x12
jae 0x14000fc14
mov rax, qword [rbx]
test rax, rax
je 0x14000fc69
cmp qword [rax + 0x30], 0
jne 0x14000fc69
mov rdx, rdi
mov rcx, rbx
call fcn.14001b038
test eax, eax
jne 0x14000fc63
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r8d, 0x238e
mov rcx, rbx
mov ebp, eax
call fcn.14001b904
test eax, eax
jne 0x14000fc63
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov rdx, rbx
mov ecx, 0x2394
call fcn.140018a44
jmp 0x14000fe35
mov ecx, dword [0x14002c2d0]
test ecx, ecx
je 0x14000fc72
cmp esi, 9
jne 0x14000fc83
test r14d, r14d
jne 0x14000fc83
xor ecx, ecx
cmp dword [0x14002d8c4], ecx
je 0x14000fcba
jmp 0x14000fc86
mov ecx, r12d
mov eax, dword [0x14002c2b0]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x44], eax
mov rdx, rbx
mov eax, dword [0x14002d79c]
mov dword [rsp + 0x48], ecx
mov rcx, rdi
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x40], 0x238e
call fcn.140019898
test eax, eax
je 0x14000fced
mov r8d, dword [0x14002d840]
test r8d, r8d
je 0x14000fd06
mov eax, dword [0x14002d908]
cmp esi, 9
jne 0x14000fcd5
test eax, eax
je 0x14000fd06
cmp dword [0x14002d790], 0
je 0x14000fcf4
mov rdx, rbx
mov rcx, rdi
call fcn.14001a114
test eax, eax
jne 0x14000fd06
xor eax, eax
jmp 0x14000fe35
cmp esi, r12d
je 0x14000fcde
cmp dword [0x14002d848], 0
jne 0x14000fcde
test eax, eax
jne 0x14000fcde
cmp dword [0x14002d8b8], 0
je 0x14000fdf3
cmp esi, r12d
jne 0x14000fdf3
lea rdx, [rsp + 0x80]
mov rcx, rbx
call fcn.14001d14c
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
mov rdx, qword [rsp + 0x80]
mov ebp, eax
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, r12d
jg 0x14000fd70
mov rcx, qword [rdx]
mov r8, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [r8 + 8]
call qword [0x1400249b8]
cmp ebp, 0xffffffff
je 0x14000fced
mov eax, dword [rdi + 0x18]
xor eax, ebp
mov ebp, 0x4000
test ebp, eax
je 0x14000fdf3
lea rdx, [rsp + 0x90]
mov rcx, rbx
call fcn.14001d14c
mov rcx, qword [rsp + 0x90]
test dword [rdi + 0x18], ebp
je 0x14000fdb2
call qword [sym.imp.ADVAPI32.dll_EncryptFileW]
nop dword [rax + rax]
jmp 0x14000fdc0
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_DecryptFileW]
nop dword [rax + rax]
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, r12d
jg 0x14000fdf3
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [0x1400249b8]
cmp dword [0x14002c2dc], 0
je 0x14000fe2b
cmp esi, 9
jne 0x14000fe13
cmp dword [0x14002d880], 0
jne 0x14000fe13
cmp dword [0x14002d8a0], 0
je 0x14000fe2b
mov rdx, rbx
mov dword [rsp + 0x30], r14d
mov rcx, rdi
call fcn.1400195c8
test eax, eax
je 0x14000fced
mov dword [rdi + 0x10], 0x12
mov eax, r12d
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret