Function at 0x18009b660
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
mov rax, qword [0x180143ae0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov r10, qword [rsp + 0x130]
lea eax, [rcx + 0xe]
mov qword [rsp + 0x48], r8
mov r12, rdx
mov rdx, qword [rsp + 0x138]
mov r15, r9
mov qword [rsp + 0x58], rdx
mov r13d, ecx
mov qword [rsp + 0x50], r10
mov dword [rsp + 0x64], eax
cmp ecx, eax
jae 0x18009ba28
mov r14d, dword [rsp + 0x64]
lea r9, [0x180000000]
xor ebx, ebx
lea r11, str.CNVCustomPhase::CreateXml
nop word [rax + rax]
lea eax, [r13 - 0xaa]
cmp eax, 0x39
ja case.0x18009b704.184
movzx eax, byte [r9 + rax + 0x9ba94]
mov ecx, dword [r9 + rax*4 + 0x9ba58]
add rcx, r9
jmp rcx
mov dword [rsp + 0x60], ebx
jmp case.0x18009b704.184
lea rax, [rsp + 0x80]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], r15
xor edx, edx
mov dword [rsp + 0x28], 0xe4
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.180097db0
mov r8, qword [rsp + 0x48]
lea r9, [0x180000000]
mov r10, qword [rsp + 0x50]
lea r11, str.CNVCustomPhase::CreateXml
mov rdx, qword [rsp + 0x58]
jmp case.0x18009b704.184
test r12, r12
jne 0x18009b7bd
mov edi, 0x6a
nop dword [rax]
cmp edi, 0x6a
je 0x18009b783
cmp edi, 0x4c9a
je 0x18009ba28
jmp 0x18009b7af
mov rax, qword [0x180195268]
lea r9, str.set_ControlValueArray
mov edx, 0x61
mov qword [rsp + 0x20], rax
mov rcx, r15
lea r8d, [rdx - 0x60]
call fcn.1800c8a10
mov dword [rsp + 0x40], 0xffffffff
add edi, 0x4c30
cmp edi, 0x9860
jbe 0x18009b770
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsp + 0x60], eax
jmp 0x18009b73d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x80]
mov rcx, r12
lea edx, [r8 + 0x5a]
call fcn.1800462d0
jmp 0x18009b73d
cmp dword [rsp + 0x60], 0xffffffff
jne case.0x18009b704.184
mov ebp, 0x13
mov eax, ebp
sub eax, 0x13
je 0x18009b815
cmp eax, 1
je 0x18009b8df
jmp 0x18009b8ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov esi, eax
sub ecx, 2
je 0x18009b85d
sub ecx, 1
je 0x18009b85d
cmp ecx, 2
jne 0x18009b873
mov ecx, 0xc5
cmp ecx, 0xc5
je 0x18009b849
cmp ecx, 0x8083
je 0x18009b8df
jmp 0x18009b84f
mov r14d, 1
add ecx, 0x7fbe
cmp ecx, 0xff7c
jbe 0x18009b833
mov eax, 0x26
cmp eax, 0x26
je 0x18009b8dc
add eax, 0x9b
cmp eax, 0xc1
jb 0x18009b862
mov edi, 0x78
cmp edi, 0x78
je 0x18009b89d
cmp edi, 0x3840
je 0x18009b893
cmp edi, 0x7008
je 0x18009ba28
jmp 0x18009b8cc
mov dword [rsp + 0x40], 0xffffffff
jmp 0x18009b8cc
mov rax, qword [0x180195268]
xor r8d, r8d
mov qword [rsp + 0x30], r12
mov r9d, esi
mov qword [rsp + 0x28], rax
mov rcx, r15
lea rax, str.Mock_function_called_more_times_than_expected__
lea edx, [r8 + 0x49]
mov qword [rsp + 0x20], rax
call fcn.1800c8de0
add edi, 0x37c8
cmp edi, 0xa758
jbe 0x18009b878
jmp 0x18009b8ea
mov r14d, ebx
mov ebp, 0x14
mov r13d, 0xad
inc ebp
cmp ebp, 0x15
jb 0x18009b800
jmp 0x18009b73d
mov qword [0x180195268], r11
mov r14d, 1
jmp case.0x18009b704.184
cmp qword [rsp + 0x70], rbx
jne case.0x18009b704.184
mov qword [rsp + 0x30], rbx
lea rcx, str.nvapi64.lib
mov qword [rsp + 0x28], rbx
mov r9d, 0x111
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
call fcn.180070ab0
mov rax, rbx
jmp 0x18009ba2d
mov eax, dword [r8]
mov r9, rdx
mov r8, qword [rsp + 0x70]
mov rdx, r15
mov dword [rsp + 0x68], eax
mov rcx, r10
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x51
call fcn.18009f3c0
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x68], rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x18009b73d
lea r8, [0x1801267dc]
mov edx, 0xc1
mov rcx, r12
call fcn.18005dde0
mov qword [rsp + 0x70], rax
jmp 0x18009b73d
mov rcx, r12
mov dword [r12 + 0x28], ebx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x18009b73d
mov ecx, 0xc8
nop dword [rax]
mov eax, ecx
sub eax, 0xc7
je 0x18009ba28
cmp eax, 1
jne 0x18009b9d8
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x40], rax
dec ecx
cmp ecx, 0xc6
ja 0x18009b9c0
mov ecx, 0xc4
mov eax, ecx
sub eax, 0xc3
je 0x18009ba28
cmp eax, 1
jne 0x18009b9f9
mov dword [rsp + 0x40], eax
dec ecx
cmp ecx, 0xc2
ja 0x18009b9e7
inc r13d
cmp r13d, dword [rsp + 0x64]
jb 0x18009b6e0
jmp 0x18009ba28
mov dword [rsp + 0x40], r14d
jmp 0x18009ba28
mov dword [rsp + 0x40], 1
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1800c9c10
mov rbx, qword [rsp + 0x110]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret