Function at 0x1400044b4
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xf0
mov rax, qword [0x140085080]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rax, qword [rcx + 8]
xor esi, esi
xorps xmm0, xmm0
mov qword [rbp + 7], rsi
mov qword [rbp - 0x21], rsi
mov rbx, r8
movdqu xmmword [rbp - 9], xmm0
mov dword [rbp - 0x29], 0x30
mov dword [rbp - 0x11], 0x40
mov qword [rbp - 0x19], rdx
movabs r10, 0xf81106491cd50a70
mov qword [rsp + 0x48], rsi
lea r11d, [rsi + 1]
mov qword [rsp + 0x40], rsi
lea rdx, [rbp + 0xf]
mov dword [rsp + 0x38], 0x60
lea r8, [rbp + 7]
mov dword [rsp + 0x30], r11d
mov r9d, 0x120089
mov qword [rsp + 0x28], rdx
lea rdx, [rbp - 0x29]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rcx + 0xa0]
mov ecx, r11d
call qword [case.0x14005dcc6.0]
mov rcx, qword [rbp + 7]
mov edi, eax
test eax, eax
jns 0x14000457d
lea rdx, [rcx - 1]
cmp rdx, 0xfffffffffffffffd
ja 0x140004576
mov qword [rbp + 7], rsi
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov eax, edi
jmp 0x1400046ee
mov r9d, 0x18
mov dword [rsp + 0x20], 5
lea r8, [rbp + 0x1f]
lea rdx, [rbp + 0xf]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jns 0x1400045ab
mov rcx, qword [rbp + 7]
jmp 0x14000455c
mov rax, qword [rbp + 0x27]
test rax, rax
jns 0x14000460c
lea rax, str.onecore_basewcp_toolspoqexecpoqexec.cpp
mov dword [rbp - 0x39], 0x784
mov qword [rbp - 0x49], rax
lea rcx, [rbp - 0x49]
lea rax, str.LoadXmlBlob
mov qword [rbp - 0x31], rsi
mov r8d, 0xc00000e5
mov qword [rbp - 0x41], rax
call fcn.140059c64
mov rcx, qword [rbp + 7]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140004602
mov qword [rbp + 7], rsi
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov eax, 0xc00000e5
jmp 0x1400046ee
mov ecx, 0xffffffff
cmp rax, rcx
jle 0x14000466e
lea rax, str.onecore_basewcp_toolspoqexecpoqexec.cpp
mov dword [rbp - 0x39], 0x78c
mov qword [rbp - 0x49], rax
lea rcx, [rbp - 0x49]
lea rax, str.LoadXmlBlob
mov qword [rbp - 0x31], rsi
mov r8d, 0xc000042b
mov qword [rbp - 0x41], rax
call fcn.140059c64
mov rcx, qword [rbp + 7]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140004664
mov qword [rbp + 7], rsi
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov eax, 0xc000042b
jmp 0x1400046ee
mov ecx, eax
mov rdx, rbx
call fcn.14005b59c
mov edi, eax
test eax, eax
js 0x1400045a5
mov eax, dword [rbx + 8]
xor r9d, r9d
mov rcx, qword [rbx + 0x10]
xor r8d, r8d
mov qword [rsp + 0x40], rsi
xor edx, edx
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], eax
lea rax, [rbp + 0xf]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 7]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtReadFile]
nop dword [rax + rax]
mov rcx, qword [rbp + 7]
mov edi, eax
test eax, eax
js 0x14000455c
mov rax, qword [rbp + 0x17]
mov qword [rbx], rax
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400046ec
mov qword [rbp + 7], rsi
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
xor eax, eax
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140063da0
mov rbx, qword [rsp + 0x128]
add rsp, 0xf0
pop rdi
pop rsi
pop rbp
ret