Function at 0x14001c718
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xb8]
sub rsp, 0x190
mov rax, qword [0x1400471f8]
xor rax, rsp
mov qword [rbp + 0x88], rax
mov rax, qword gs:[0x58]
mov r13, rcx
mov ecx, 8
mov rdx, qword [rax]
lea rax, str.TieringPinnedSession::MigratePinnedDatabaseToDscAttribute
mov qword [rcx + rdx], rax
lea rcx, [rsp + 0x70]
call fcn.140008524
xor eax, eax
lea rcx, [rbp + 0x60]
xor r12d, r12d
mov qword [rbp - 0x50], rax
xor edx, edx
mov qword [rbp - 0x48], rax
mov esi, r12d
mov dword [rsp + 0x48], r12d
lea r8d, [rax + 0x28]
mov r15d, r12d
call sub.msvcrt.dll_memset
mov rcx, qword [r13 + 8]
lea eax, [r12 + 5]
movzx edx, r12w
mov dword [rsp + 0x4c], r12d
mov dword [rsp + 0x44], edx
xor r9d, r9d
mov rdx, qword [r13 + 0x18]
mov r8d, 0x80000000
mov word [rsp + 0x54], ax
mov dword [rsp + 0x58], r12d
call qword [sym.imp.ESENT.dll_JetMove]
mov r8d, eax
add eax, 0x643
test eax, 0xfffffffd
je 0x14001cf8e
test r8d, r8d
je 0x14001c8a3
cmp r8d, 0xfffffdef
je 0x14001c839
cmp r8d, 0xfffffbbc
je 0x14001c839
cmp r8d, 0xfffff8f0
je 0x14001c839
cmp r8d, 0xfffffc0d
jne 0x14001c819
mov ecx, 0x8007000e
jmp 0x14001c845
mov eax, r8d
cdq
xor eax, edx
sub eax, edx
movzx ecx, ax
test r8d, r8d
mov eax, r12d
sets al
shl eax, 0x1f
or eax, 0xe5e0000
or ecx, eax
jmp 0x14001c845
mov ecx, 0x70
call fcn.140003930
mov ecx, eax
mov ebx, ecx
mov dword [rsp + 0x78], ecx
mov rcx, qword [0x140047138]
lea r14, [0x140047138]
mov edi, 1
lea r12d, [rdi + 1]
cmp rcx, r14
je 0x14001c893
test byte [rcx + 0x1c], dil
je 0x14001c893
cmp byte [rcx + 0x19], r12b
jb 0x14001c893
mov r9, qword [r13 + 0x28]
lea edx, [rdi + 0x10]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], r8d
lea r8, [0x14003f988]
mov r9, qword [r9 + 0x70]
call fcn.140003cf4
mov dword [rsp + 0x44], 4
xor r8d, r8d
jmp 0x14001ce73
mov rax, qword [r13 + 0x28]
lea r8, [rbp - 0x80]
mov edi, 1
mov r9d, 0x100080
mov cl, dil
mov rdx, qword [rax]
add rdx, 0x2a0
call fcn.140008aa0
mov dword [rsp + 0x78], eax
mov ebx, eax
test eax, eax
jns 0x14001c92a
mov rcx, qword [0x140047138]
lea r14, [0x140047138]
lea r12d, [rdi + 1]
cmp rcx, r14
je 0x14001c91a
test byte [rcx + 0x1c], dil
je 0x14001c91a
cmp byte [rcx + 0x19], r12b
jb 0x14001c91a
mov rax, qword [r13 + 0x28]
lea edx, [rdi + 0x11]
mov rcx, qword [rcx + 0x10]
lea r8, [0x14003f988]
mov dword [rsp + 0x20], ebx
mov r9, qword [rax]
add r9, 0x2a0
call fcn.140008a18
mov eax, 5
xor r8d, r8d
movzx edx, ax
jmp 0x14001ce7c
mov rcx, qword [r13 + 0x28]
xor edx, edx
call fcn.1400188ec
mov rcx, qword [r13 + 0x28]
mov edx, edi
call fcn.1400188ec
mov r15d, 0x8007000e
lea r14, [0x140047138]
mov r12d, 2
jmp 0x14001c959
mov esi, dword [rsp + 0x50]
xor r9d, r9d
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x50]
mov rcx, r13
call fcn.14001bd78
xor r9d, r9d
mov r8d, eax
test eax, eax
jne 0x14001cd6c
movups xmm0, xmmword [rbp - 0x50]
mov rcx, qword [rbp - 0x80]
lea rdx, [rbp - 0x78]
add esi, edi
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x50], esi
mov r8d, 0x180
movzx esi, byte [rsp + 0x40]
mov qword [rsp + 0x20], r9
and esi, edi
lea r9d, [rax + 7]
mov dword [rbp - 0x78], 0x18
add esi, edi
mov dword [rbp - 0x74], r12d
movdqu xmmword [rbp - 0x70], xmm0
call qword [sym.imp.api_ms_win_core_file_l2_1_1.dll_OpenFileById]
mov qword [rsp + 0x60], rax
cmp rax, 0xffffffffffffffff
je 0x14001cb79
mov r9d, 8
mov dword [rsp + 0x20], 0x43
lea r8, [rsp + 0x68]
mov rcx, rax
lea rdx, [rbp - 0x60]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov r15d, eax
xor eax, eax
test r15d, r15d
js 0x14001ca70
cmp dword [rsp + 0x68], esi
je 0x14001ca70
mov rcx, qword [0x140047138]
cmp rcx, r14
je 0x14001ca4e
test byte [rcx + 0x1c], dil
je 0x14001ca4e
cmp byte [rcx + 0x19], r12b
jb 0x14001ca4e
mov rax, qword [r13 + 0x28]
lea r8, [0x14003f988]
mov r9, qword [rbp - 0x48]
mov edx, 0x14
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x30], r15d
mov rax, qword [rax + 0x70]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x50]
mov qword [rsp + 0x20], rax
call fcn.14001bbcc
mov r15, qword [rsp + 0x60]
mov esi, dword [rsp + 0x44]
mov rcx, r15
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov r10d, dword [rsp + 0x4c]
mov r15d, 0x8007000e
jmp 0x14001cbd4
cmp r15d, 0xc000050c
jne 0x14001cb0c
mov r15, qword [rsp + 0x60]
lea r8, [rsp + 0x68]
mov rcx, r15
mov dword [rsp + 0x6c], eax
mov r9d, 8
mov dword [rsp + 0x68], esi
lea rdx, [rbp - 0x60]
mov dword [rsp + 0x20], 0x43
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
mov esi, eax
test eax, eax
jns 0x14001ca53
mov rcx, qword [0x140047138]
cmp rcx, r14
je 0x14001cafb
test byte [rcx + 0x1c], dil
je 0x14001cafb
cmp byte [rcx + 0x19], r12b
jb 0x14001cafb
mov rax, qword [r13 + 0x28]
lea r8, [0x14003f988]
mov r9, qword [rbp - 0x48]
mov edx, 0x15
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x30], esi
mov rax, qword [rax + 0x70]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x50]
mov qword [rsp + 0x20], rax
call fcn.14001bbcc
movzx edx, r12w
mov dword [rsp + 0x4c], esi
mov dword [rsp + 0x44], edx
jmp 0x14001ca53
test r15d, r15d
jns 0x14001ca4e
mov rcx, qword [0x140047138]
cmp rcx, r14
je 0x14001cb61
test byte [rcx + 0x1c], dil
je 0x14001cb61
cmp byte [rcx + 0x19], r12b
jb 0x14001cb61
mov rax, qword [r13 + 0x28]
lea r8, [0x14003f988]
mov r9, qword [rbp - 0x48]
mov edx, 0x16
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x30], r15d
mov rax, qword [rax + 0x70]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x50]
mov qword [rsp + 0x20], rax
call fcn.14001bbcc
mov esi, 3
mov dword [rsp + 0x4c], r15d
mov r15, qword [rsp + 0x60]
mov dword [rsp + 0x44], esi
jmp 0x14001ca57
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
mov rcx, qword [0x140047138]
cmp rcx, r14
je 0x14001cbc0
test byte [rcx + 0x1c], dil
je 0x14001cbc0
cmp byte [rcx + 0x19], r12b
jb 0x14001cbc0
mov rax, qword [r13 + 0x28]
mov r9, qword [rbp - 0x48]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x30], edx
mov rax, qword [rax + 0x70]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x50]
mov qword [rsp + 0x20], rax
call fcn.14001bb18
movzx esi, di
mov dword [rsp + 0x44], esi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r10d, eax
mov dword [rsp + 0x4c], eax
xor ecx, ecx
test r10d, r10d
je 0x14001cc3a
movzx r8d, word [rsp + 0x54]
xor eax, eax
cmp ax, r8w
jae 0x14001cc2b
mov r11d, dword [rsp + 0x58]
movzx r9d, r8w
cmp r11d, r9d
je 0x14001cc2b
movzx eax, cx
mov edx, dword [rbp + rax*8 + 0x60]
cmp edx, r10d
jne 0x14001cc0a
cmp word [rbp + rax*8 + 0x64], si
je 0x14001cc2b
test edx, edx
je 0x14001cc19
add cx, di
cmp cx, r8w
jb 0x14001cbf2
jmp 0x14001cc2b
add r11d, edi
mov dword [rbp + rax*8 + 0x60], r10d
mov dword [rsp + 0x58], r11d
mov word [rbp + rax*8 + 0x64], si
xor ecx, ecx
add dword [rsp + 0x48], edi
mov dword [rsp + 0x4c], ecx
mov word [rsp + 0x44], cx
mov rdx, qword [r13 + 0x18]
xor r9d, r9d
mov rcx, qword [r13 + 8]
mov r8d, edi
call qword [sym.imp.ESENT.dll_JetMove]
mov esi, eax
cmp eax, 0xfffffc07
je 0x14001cc3a
lea ecx, [rax + 0x643]
test ecx, 0xfffffffd
je 0x14001cd1c
xor r8d, r8d
test eax, eax
je 0x14001c955
mov rcx, qword [0x140047138]
cmp rcx, r14
je 0x14001ccb9
test byte [rcx + 0x1c], dil
je 0x14001ccb9
cmp byte [rcx + 0x19], r12b
jb 0x14001ccb9
mov rax, qword [r13 + 0x28]
lea edx, [r8 + 0x19]
mov r9d, dword [rsp + 0x50]
lea r8, [0x14003f988]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x28], esi
mov rax, qword [rax + 0x70]
mov qword [rsp + 0x20], rax
call fcn.1400156cc
xor r8d, r8d
cmp esi, 0xfffffdef
je 0x14001ccfc
cmp esi, 0xfffffbbc
je 0x14001ccfc
cmp esi, 0xfffff8f0
je 0x14001ccfc
cmp esi, 0xfffffc0d
jne 0x14001ccde
mov ebx, r15d
jmp 0x14001cd08
mov eax, esi
cdq
xor eax, edx
sub eax, edx
movzx ebx, ax
test esi, esi
mov eax, r8d
sets al
shl eax, 0x1f
or eax, 0xe5e0000
or ebx, eax
jmp 0x14001cd08
mov ecx, 0x70
call fcn.140003930
mov ebx, eax
mov dword [rsp + 0x78], ebx
cmp dword [rsp + 0x50], r8d
jle 0x14001cd5b
mov ebx, r8d
mov dword [rsp + 0x78], ebx
jmp 0x14001cd5b
mov rcx, qword [0x140047138]
cmp rcx, r14
je 0x14001cd5b
test byte [rcx + 0x1c], dil
je 0x14001cd5b
cmp byte [rcx + 0x19], 4
jb 0x14001cd5b
mov rax, qword [r13 + 0x28]
lea r8, [0x14003f988]
mov r9d, dword [rsp + 0x50]
mov edx, 0x18
mov rcx, qword [rcx + 0x10]
mov rax, qword [rax + 0x70]
mov qword [rsp + 0x20], rax
call fcn.1400039f4
test esi, esi
mov esi, dword [rsp + 0x50]
jne 0x14001ce0d
jmp 0x14001c959
cmp r8d, 0xfffffdef
je 0x14001cdb2
cmp r8d, 0xfffffbbc
je 0x14001cdb2
cmp r8d, 0xfffff8f0
je 0x14001cdb2
cmp r8d, 0xfffffc0d
jne 0x14001cd95
mov ebx, r15d
jmp 0x14001cdbe
cdq
xor eax, edx
sub eax, edx
movzx ebx, ax
test r8d, r8d
mov eax, r9d
sets al
shl eax, 0x1f
or eax, 0xe5e0000
or ebx, eax
jmp 0x14001cdbe
mov ecx, 0x70
call fcn.140003930
mov ebx, eax
mov rcx, qword [0x140047138]
cmp rcx, r14
je 0x14001ce03
test byte [rcx + 0x1c], dil
je 0x14001ce03
cmp byte [rcx + 0x19], r12b
jb 0x14001ce03
mov rax, qword [r13 + 0x28]
mov edx, 0x13
mov rcx, qword [rcx + 0x10]
mov r9d, esi
mov dword [rsp + 0x28], r8d
lea r8, [0x14003f988]
mov rax, qword [rax + 0x70]
mov qword [rsp + 0x20], rax
call fcn.1400156cc
xor r9d, r9d
test esi, esi
cmovg ebx, r9d
mov dword [rsp + 0x78], ebx
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [0x140047138]
cmp rcx, r14
je 0x14001ce66
test byte [rcx + 0x1c], dil
je 0x14001ce66
mov r15d, dword [rsp + 0x48]
cmp byte [rcx + 0x19], r12b
jb 0x14001ce6b
mov rax, qword [r13 + 0x28]
lea r8, [0x14003f988]
mov rcx, qword [rcx + 0x10]
mov r9d, esi
mov dword [rsp + 0x30], ebx
sub r9d, r15d
mov edx, 0x1a
mov rax, qword [rax + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
call fcn.14001b934
jmp 0x14001ce6b
mov r15d, dword [rsp + 0x48]
xor r8d, r8d
test r15d, r15d
jg 0x14001ce86
mov edx, dword [rsp + 0x44]
mov eax, 5
test ebx, ebx
jns 0x14001cfd5
jmp 0x14001ce8f
mov edx, dword [rsp + 0x44]
mov eax, 5
cmp dword [section..data], eax
jbe 0x14001cfd5
movabs r9, 0x200000000000
test qword [0x140047010], r9
je 0x14001cfd5
mov rax, qword [0x140047018]
and rax, r9
cmp rax, qword [0x140047018]
jne 0x14001cfd5
mov rax, qword [r13 + 0x28]
lea rcx, [rbp - 8]
mov rax, qword [rax]
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x18], 2
movzx ecx, word [rax + 0x2b8]
mov rax, qword [rax + 0x2c0]
mov qword [rbp - 0x10], rax
lea rax, [rsp + 0x58]
mov dword [rbp - 8], ecx
lea rcx, [rsp + 0x40]
mov qword [rbp], rax
lea rax, [rsp + 0x54]
mov qword [rbp + 0x10], rcx
lea rcx, [rsp + 0x4c]
mov qword [rbp + 0x40], rax
lea rax, [rbp + 0x60]
mov qword [rbp + 0x20], rcx
lea rcx, [rsp + 0x48]
mov qword [rbp + 0x50], rax
mov dword [rbp - 4], r8d
mov dword [rsp + 0x58], ebx
mov qword [rbp + 8], 4
mov byte [rsp + 0x40], dl
mov qword [rbp + 0x18], 1
mov dword [rsp + 0x4c], esi
mov qword [rbp + 0x28], 4
mov dword [rsp + 0x48], r15d
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x38], 4
mov qword [rbp + 0x48], 2
mov qword [rbp + 0x58], 0x28
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
lea rdx, [0x140041116]
mov dword [rsp + 0x20], 0xa
call fcn.140001078
jmp 0x14001cfd5
mov rcx, qword [0x140047138]
lea r14, [0x140047138]
cmp rcx, r14
je 0x14001cfcd
mov edi, 1
test byte [rcx + 0x1c], dil
je 0x14001cfcd
cmp byte [rcx + 0x19], 4
jb 0x14001cfcd
mov r9, qword [r13 + 0x28]
lea edx, [rdi + 0xf]
mov rcx, qword [rcx + 0x10]
lea r8, [0x14003f988]
mov r9, qword [r9 + 0x70]
call fcn.140003af0
mov dword [rsp + 0x78], r12d
mov ebx, r12d
lea rcx, [rsp + 0x70]
call fcn.140008380
mov eax, ebx
mov rcx, qword [rbp + 0x88]
xor rcx, rsp
call fcn.14003b910
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret