Function at 0x14000b684
Capabilities:
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x40
xor r13d, r13d
mov rbp, rcx
mov ebx, 1
mov dword [rax + 8], r13d
mov r15d, r13d
mov qword [rax + 0x10], r13
test rcx, rcx
je 0x14000b8ee
or r8, 0xffffffffffffffff
mov rdi, r8
inc rdi
cmp word [rcx + rdi*2], r13w
jne 0x14000b6c1
lea r14, [rdi + 1]
cmp r14, rdi
jb 0x14000b8ee
mov eax, 2
mul r14
mov rcx, rax
test rdx, rdx
jne 0x14000b6ed
mov eax, r13d
jmp 0x14000b6f5
mov rcx, r8
mov eax, 0x80070216
test eax, eax
js 0x14000b8ee
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rsi, rax
test rax, rax
je 0x14000b8ee
mov r9, rdi
mov r8, rbp
mov rdx, r14
mov rcx, rax
call fcn.140008c3c
lea rcx, [rsp + 0x70]
call fcn.14000d120
test eax, eax
jns 0x14000b736
mov ebx, r13d
jmp 0x14000b8e3
cmp dword [rsp + 0x70], r13d
je 0x14000b76d
call qword [sym.imp.ole32.dll_CoImpersonateClient]
test eax, eax
js 0x14000b81d
lea rcx, [rsp + 0x78]
mov edx, eax
call fcn.14000b1f8
mov r15, qword [rsp + 0x78]
test eax, eax
js 0x14000b81d
test r15, r15
je 0x14000b81d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
or ebp, 0xffffffff
cmp edi, ebp
jne 0x14000b7cb
add eax, 0xfffffffe
cmp eax, ebx
ja 0x14000b7c7
mov rcx, rsi
call fcn.14000f090
test eax, eax
jne 0x14000b7c7
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rsi + rdx*2], r13w
jne 0x14000b79c
mov rcx, rsi
call fcn.14000f390
test eax, eax
js 0x14000b7c7
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, ebp
je 0x14000b785
cmp edi, ebp
je 0x14000b7eb
test dil, 0x10
jne 0x14000b7eb
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rsi + rdx*2], r13w
jne 0x14000b7d5
mov rcx, rsi
call fcn.14000f390
test eax, eax
js 0x14000b81d
mov qword [rsp + 0x30], r13
xor r9d, r9d
xor r8d, r8d
mov edx, 0x20000
mov rcx, rsi
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x14000b825
mov ebx, r13d
jmp 0x14000b8d5
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
mov edi, eax
test eax, eax
je 0x14000b867
mov ecx, edi
add rcx, rcx
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rbp, rax
test rax, rax
je 0x14000b867
xor r9d, r9d
mov r8d, edi
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
mov edi, eax
test eax, eax
jne 0x14000b86c
mov ebx, r13d
jmp 0x14000b8cc
inc edi
cmp edi, 8
jb 0x14000b8cc
mov rcx, rbp
call fcn.14000b480
mov ebx, eax
test eax, eax
je 0x14000b895
cmp dword [rsp + 0x70], r13d
je 0x14000b895
mov rdx, r15
mov rcx, rbp
call fcn.14000b564
mov ebx, eax
mov rcx, rbp
call fcn.14000f090
test eax, eax
jne 0x14000b8cc
test ebx, ebx
je 0x14000b8cc
mov edx, edi
mov rcx, rbp
call fcn.14000f390
mov ebx, r13d
test eax, eax
setns bl
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rbp + rdi*2], r13w
jne 0x14000b8bb
inc edi
test ebx, ebx
jne 0x14000b86e
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15, r15
je 0x14000b8e3
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x14000b8f1
mov ebx, r13d
lea r11, [rsp + 0x40]
mov eax, ebx
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret