Function at 0x18005bdd0
Capabilities:
Get file attributes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0x90
mov rax, qword [0x1800b2220]
xor rax, rsp
mov qword [rbp - 1], rax
mov r12, qword [rbp + 0x7f]
xor esi, esi
mov r14, rcx
mov al, byte [rbp + 0x77]
mov qword [rbp - 0x51], rdx
mov dword [rbp - 0x41], r8d
mov rdi, qword [r12]
mov qword [rbp - 0x49], r9
mov byte [rbp - 0x3d], al
cmp dword [rbp + 0x6f], esi
je 0x18005be4f
test rdi, rdi
je 0x18005be2b
call fcn.18005e598
mov rcx, r12
call fcn.18005e47c
mov eax, 1
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.180024680
add rsp, 0x90
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
and dword [r9], esi
cmp rdi, 0xffffffffffffffff
je 0x18005be2b
test r8d, r8d
je 0x18005be2b
lea rbx, [0x18008a628]
test rdi, rdi
je 0x18005be76
mov eax, dword [rdi + 0x428]
cmp dword [rbx + rax*4], esi
jne 0x18005bec2
jmp 0x18005be1e
mov ecx, 0x400
call fcn.18005baf4
mov rdi, rax
test rax, rax
je 0x18005c097
mov r9d, 0x28
mov dword [rsp + 0x20], 4
lea r8, [rbp - 0x29]
mov rcx, r14
lea rdx, [rbp - 0x39]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
test eax, eax
js 0x18005c0a2
mov eax, dword [rbp - 9]
mov dword [rdi + 0x46c], eax
mov qword [r12], rdi
mov al, byte [rdi + 0x469]
test al, al
je 0x18005bef6
and qword [rdi + 8], 0
and qword [rdi + 0x420], 0
and dword [rdi + 0x44c], 0
and dword [rdi + 0x448], 0
xor ecx, ecx
mov byte [rdi + 0x46a], 0
jmp 0x18005befd
mov rcx, qword [rdi + 0x420]
mov esi, 1
test al, al
jne 0x18005bf15
mov eax, dword [rdi + 0x42c]
cmp rcx, rax
jl 0x18005bfe9
mov edx, dword [rdi + 0x428]
mov ecx, dword [rbx + rdx*4]
sub ecx, esi
je 0x18005bfd8
sub ecx, esi
je 0x18005bfc7
sub ecx, esi
je 0x18005bfb6
sub ecx, esi
je 0x18005bfa5
sub ecx, 3
je 0x18005bf94
sub ecx, esi
je 0x18005bf83
sub ecx, 2
je 0x18005bf72
cmp ecx, esi
je 0x18005bf61
lea eax, [rdx + 1]
mov byte [rdi + 0x469], sil
mov dword [rdi + 0x428], eax
jmp 0x18005bfe9
lea r8, [rbp - 0x51]
mov rdx, rdi
mov rcx, r14
call fcn.18005c6d0
jmp 0x18005bfe7
lea r8, [rbp - 0x51]
mov rdx, rdi
mov rcx, r14
call fcn.18005ce00
jmp 0x18005bfe7
lea r8, [rbp - 0x51]
mov rdx, rdi
mov rcx, r14
call fcn.18005c97c
jmp 0x18005bfe7
lea r8, [rbp - 0x51]
mov rdx, rdi
mov rcx, r14
call fcn.18005c888
jmp 0x18005bfe7
lea r8, [rbp - 0x51]
mov rdx, rdi
mov rcx, r14
call fcn.18005c0b8
jmp 0x18005bfe7
lea r8, [rbp - 0x51]
mov rdx, rdi
mov rcx, r14
call fcn.18005cb2c
jmp 0x18005bfe7
lea r8, [rbp - 0x51]
mov rdx, rdi
mov rcx, r14
call fcn.18005c59c
jmp 0x18005bfe7
lea r8, [rbp - 0x51]
mov rdx, rdi
mov rcx, r14
call fcn.18005c480
mov esi, eax
mov r15d, dword [rdi + 0x42c]
mov rdx, qword [rdi + 0x420]
cmp rdx, r15
jge 0x18005c050
mov eax, dword [rbp - 0x41]
mov ecx, r15d
sub rcx, rdx
cmp rcx, rax
jge 0x18005c00f
sub r15d, edx
jmp 0x18005c013
mov r15d, dword [rbp - 0x41]
mov rcx, qword [rbp - 0x51]
add rdx, rdi
mov r8d, r15d
mov ebx, r15d
call sub.ntdll.dll_memcpy
add qword [rdi + 0x420], rbx
sub dword [rbp - 0x41], r15d
mov rax, qword [rbp - 0x49]
add dword [rax], r15d
add qword [rbp - 0x51], rbx
lea rbx, [0x18008a628]
mov r15d, dword [rdi + 0x42c]
mov rdx, qword [rdi + 0x420]
mov eax, r15d
cmp rdx, rax
jl 0x18005c064
mov rcx, rdi
call fcn.18005d184
test eax, eax
je 0x18005c09e
test esi, esi
je 0x18005c097
mov eax, dword [rdi + 0x428]
cmp dword [rbx + rax*4], 0
je 0x18005c07e
cmp dword [rbp - 0x41], 0
jne 0x18005bec6
mov rax, qword [rbp - 0x49]
cmp dword [rax], 0
jne 0x18005c097
mov rcx, r14
call fcn.18005e598
mov rcx, r12
call fcn.18005e47c
mov eax, esi
jmp 0x18005be30
xor esi, esi
jmp 0x18005c097
mov ecx, eax
call sym.KERNEL32.dll_BaseSetLastNTError
xor eax, eax
jmp 0x18005be30