Function at 0x14000f4d7
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd28
mov rdi, qword [r8 + 8]
test rdi, rdi
je 0x14000f525
mov r12, r9
mov rsi, r8
mov r14, rdx
mov r15, rcx
lea rbx, [rdx + 8]
mov rbp, qword [rdx + 8]
mov rcx, rdx
mov rdx, r15
xor r8d, r8d
call fcn.14000f4a0
test ax, ax
je 0x14000f52f
mov r13d, eax
mov qword [rbx], rbp
jmp 0x14000f5ca
mov r13w, 8
jmp 0x14000f5ce
mov qword [rsp + 0x60], rbx
mov rdx, qword [r14]
mov r8, qword [r14 + 8]
dec r8
lea rbx, [rsp + 0x308]
mov rcx, rbx
call fcn.14000fd03
movzx r13d, word [rbx + 0x218]
test r13w, r13w
je 0x14000f566
mov rax, qword [rsp + 0x60]
mov qword [rax], rbp
jmp 0x14000f5ca
lea rcx, [rsp + 0xf0]
lea rdx, [rsp + 0x308]
mov r8d, 0x218
call fcn.1400027aa
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x20]
mov rdx, qword [rax + 0x48]
lea r8, [rsp + 0xf8]
mov byte [rsp + 0x20], 1
lea rbx, [rsp + 0xb0]
mov rcx, rbx
xor r9d, r9d
call fcn.14000ffa7
cmp word [rbx + 8], 0
je 0x14000f5e5
mov rax, qword [rsp + 0x60]
mov qword [rax], rbp
mov r13w, 8
mov qword [rsi + 8], rdi
mov eax, r13d
add rsp, 0xd28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x68], rax
mov rbx, qword [rsp + 0x60]
mov qword [rbx], rbp
mov rcx, rsi
mov rdx, r15
mov r8w, 0x2a
call fcn.14000f4a0
test ax, ax
je 0x14000f621
mov r13d, eax
mov rcx, qword [rsp + 0x68]
call sub.ntdll.dll_NtClose
jmp 0x14000f51d
mov rcx, rsi
mov rdx, r15
xor r8d, r8d
call fcn.14000f4a0
test ax, ax
je 0x14000f646
mov r13d, eax
mov rcx, qword [rsp + 0x68]
call sub.ntdll.dll_NtClose
jmp 0x14000f55c
mov rax, qword [rsi]
mov qword [rsp + 0x98], rax
mov rax, qword [rsi + 8]
and dword [rsp + 0x7c], 0
add rax, rax
add rax, 0xfffffffffffffffe
mov qword [rsp + 0x90], rax
cmp rax, 0xffff
mov rbx, qword [rsp + 0x60]
jbe 0x14000f68d
mov rcx, qword [rsp + 0x68]
call sub.ntdll.dll_NtClose
mov qword [rbx], rbp
mov r13w, 0xb
jmp 0x14000f5ca
mov ebx, 0x800
xor eax, eax
mov qword [rsp + 0x80], rax
xor eax, eax
mov qword [rsp + 0x88], rax
mov r13, qword [rsp + 0x68]
mov rax, qword [rsp + 0x90]
mov word [rsp + 0xa0], ax
mov word [rsp + 0xa2], ax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0xa8], rax
xor eax, eax
mov byte [rsp + 0x50], al
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0x48], rcx
mov byte [rsp + 0x40], al
lea rax, [rsp + 0x528]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 0x800
mov rcx, r13
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtQueryDirectoryFile
test eax, eax
jne 0x14000f7ae
xor r13d, r13d
cmp r13, 0x7ff
ja 0x14000f6a6
mov rax, r13
mov ecx, dword [rsp + r13 + 0x528]
add r13, rcx
test rcx, rcx
cmove r13, rbx
test byte [rsp + rax + 0x560], 0x10
jne 0x14000f72f
add rax, rsp
add rax, 0x528
mov r8d, dword [rax + 0x3c]
shr r8, 1
cmp rdi, r8
je 0x14000f7a2
lea rdx, [rax + rdi*2]
add rdx, 0x40
sub r8, rdi
lea rcx, [rsp + 0x70]
call fcn.1400100cc
cmp byte [rsp + 0x71], 0
je 0x14000f72f
movzx eax, byte [rsp + 0x70]
mov byte [rsp + rax + 0x7c], 1
mov al, 1
mov qword [rsp + 0x80], rax
jmp 0x14000f72f
mov al, 1
mov qword [rsp + 0x88], rax
jmp 0x14000f72f
cmp eax, 0x80000006
je 0x14000f7e5
cmp eax, 0xc000000f
mov rbx, qword [rsp + 0x60]
mov rcx, r13
je 0x14000f8c0
cmp eax, 0xc0000022
jne 0x14000f8cd
call sub.ntdll.dll_NtClose
mov qword [rbx], rbp
mov r13w, 9
jmp 0x14000f5ca
mov r13w, 8
test byte [rsp + 0x88], 1
mov rbx, qword [rsp + 0x60]
je 0x14000f935
test rbp, rbp
je 0x14000f831
mov rax, qword [r14]
mov rcx, qword [r14 + 8]
movzx eax, word [rax + rcx*2 - 2]
cmp eax, 0x2f
je 0x14000f831
cmp eax, 0x5c
je 0x14000f831
mov rcx, r14
mov rdx, r15
mov r8w, 0x5c
call fcn.14000f4a0
test ax, ax
jne 0x14000f60f
mov r8, qword [rsi]
mov rcx, r14
mov rdx, r15
mov r9, rdi
call fcn.14000f42b
test ax, ax
jne 0x14000f60f
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.14000f4a0
test ax, ax
jne 0x14000f60f
mov rcx, qword [r14]
mov rax, qword [rsp + 0xdb8]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xdb0]
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0xd98]
mov r8, qword [rsp + 0xda0]
mov r9, qword [rsp + 0xda8]
call fcn.14001020c
mov r13d, eax
movzx eax, ax
lea ecx, [rax - 8]
cmp ecx, 2
jb 0x14000f930
cmp eax, 0x6d
je 0x14000f8df
test eax, eax
je 0x14000fad4
jmp 0x14000f637
call sub.ntdll.dll_NtClose
mov qword [rbx], rbp
jmp 0x14000f5c5
call sub.ntdll.dll_NtClose
mov qword [rbx], rbp
mov r13w, 0xe
jmp 0x14000f5ca
lea rax, [rdi + rdi]
add rax, qword [rsi]
xor edx, edx
mov r13w, 0x6d
cmp rdi, rdx
je 0x14000f930
lea rcx, [rax - 2]
inc rdx
cmp word [rax - 2], 0x2e
mov rax, rcx
jne 0x14000f8e8
lea r8, str..EXE
mov r9d, 4
call fcn.1400102ab
test al, 1
mov rbx, qword [rsp + 0x60]
je 0x14000f935
mov rcx, qword [rsp + 0x68]
call sub.ntdll.dll_NtClose
mov qword [rbx], rbp
jmp 0x14000faaa
mov rbx, qword [rsp + 0x60]
test byte [rsp + 0x80], 1
je 0x14000f612
lea rcx, [rsp + 0xd0]
mov qword [rcx], r12
mov rax, qword [rsp + 0xd90]
mov qword [rcx + 8], rax
and qword [rcx + 0x10], 0
mov word [rcx + 0x18], 0x3b
lea rcx, [rsp + 0xd0]
call fcn.14000fc88
mov r12, rax
test rax, rax
je 0x14000f637
mov rax, rdx
lea rcx, [rsp + 0x78]
mov rdx, r12
mov rbx, rax
mov r8, rax
call fcn.1400100cc
cmp byte [rsp + 0x79], 0
je 0x14000f965
movzx eax, byte [rsp + 0x78]
cmp byte [rsp + rax + 0x7c], 1
jne 0x14000f965
mov rax, qword [rsp + 0x60]
mov qword [rax], rbp
test rbp, rbp
je 0x14000f9df
mov rax, qword [r14]
movzx eax, word [rax + rbp*2 - 2]
cmp eax, 0x2f
je 0x14000f9df
cmp eax, 0x5c
je 0x14000f9df
mov rcx, r14
mov rdx, r15
mov r8w, 0x5c
call fcn.14000f4a0
test ax, ax
jne 0x14000fab4
mov r8, qword [rsi]
mov rcx, r14
mov rdx, r15
mov r9, rdi
call fcn.14000f42b
test ax, ax
jne 0x14000fab4
mov rcx, r14
mov rdx, r15
mov r8, r12
mov r9, rbx
call fcn.14000f42b
test ax, ax
jne 0x14000fab4
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.14000f4a0
test ax, ax
jne 0x14000fab4
mov rcx, qword [r14]
mov rax, qword [rsp + 0xdb8]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xdb0]
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0xd98]
mov r8, qword [rsp + 0xda0]
mov r9, qword [rsp + 0xda8]
call fcn.14001020c
movzx edx, ax
lea ecx, [rdx - 8]
cmp ecx, 2
jb 0x14000f965
cmp edx, 0x6d
jne 0x14000fad0
mov r9d, 4
mov rcx, r12
mov rdx, rbx
lea r8, str..EXE
call fcn.1400102ab
test al, 1
je 0x14000f965
mov rcx, qword [rsp + 0x68]
call sub.ntdll.dll_NtClose
mov rax, qword [rsp + 0x60]
mov qword [rax], rbp
mov r13w, 0x76
jmp 0x14000f5ca
mov rcx, qword [rsp + 0x68]
mov ebx, eax
call sub.ntdll.dll_NtClose
mov rax, qword [rsp + 0x60]
mov qword [rax], rbp
mov r13d, ebx
jmp 0x14000f5ca
test edx, edx
jne 0x14000faee
mov rcx, qword [rsp + 0x68]
call sub.ntdll.dll_NtClose
mov rax, qword [rsp + 0x60]
mov qword [rax], rbp
xor r13d, r13d
jmp 0x14000f5ca
mov ebx, eax
mov rcx, qword [rsp + 0x68]
jmp 0x14000fabb