Function at 0x1400222f8
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xc8]
sub rsp, 0x1a0
mov rax, qword [0x14004d298]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov rax, qword gs:[0x58]
mov r12, rcx
mov qword [rsp + 0x70], rcx
mov ecx, 8
mov rdx, qword [rax]
lea rax, str.TieringPinnedSession::MigratePinnedDatabaseToDscAttribute
mov qword [rcx + rdx], rax
lea rcx, [rsp + 0x78]
call fcn.140005468
mov rdx, qword [r12 + 0x18]
xor ebx, ebx
mov rcx, qword [r12 + 8]
xorps xmm0, xmm0
xor eax, eax
mov dword [rsp + 0x50], ebx
mov qword [rbp - 0x18], rax
xor r9d, r9d
lea eax, [rbx + 5]
mov dword [rsp + 0x44], ebx
mov r8d, 0x80000000
mov word [rsp + 0x54], ax
movups xmmword [rbp - 0x48], xmm0
mov edi, ebx
mov word [rsp + 0x48], bx
mov r13d, ebx
mov dword [rsp + 0x58], ebx
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
call qword [sym.imp.ESENT.dll_JetMove]
nop dword [rax + rax]
mov r8d, eax
add eax, 0x643
test eax, 0xfffffffd
je 0x140022bc8
xor r9d, r9d
test r8d, r8d
je 0x140022485
cmp r8d, 0xfffffdef
je 0x14002241a
cmp r8d, 0xfffffbbc
je 0x14002241a
cmp r8d, 0xfffff8f0
je 0x14002241a
cmp r8d, 0xfffffc0d
jne 0x1400223fb
mov ebx, 0x8007000e
jmp 0x140022426
test r8d, r8d
mov eax, 0x8e5e0000
mov ecx, 0xe5e0000
cmovs ecx, eax
mov eax, r8d
cdq
xor eax, edx
sub eax, edx
movzx ebx, ax
or ebx, ecx
jmp 0x140022426
mov ecx, 0x70
call fcn.140002f2c
mov ebx, eax
mov dword [rbp - 0x80], ebx
mov rcx, qword [0x14004d128]
lea r14, [0x14004d128]
mov esi, 1
lea r15d, [rsi + 1]
cmp rcx, r14
je 0x140022478
test byte [rcx + 0x1c], sil
je 0x140022478
cmp byte [rcx + 0x19], r15b
jb 0x140022478
mov r9, qword [r12 + 0x28]
lea edx, [rsi + 0x10]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], r8d
lea r8, [0x140046ce8]
mov r9, qword [r9 + 0x70]
call fcn.14001ea08
xor r9d, r9d
mov r13d, edi
mov dword [rsp + 0x48], 4
jmp 0x140022a8f
mov rax, qword [r12 + 0x28]
lea r8, [rbp - 0x78]
mov esi, 1
mov r9d, 0x100080
mov cl, sil
mov rdx, qword [rax]
add rdx, 0x2a0
call fcn.14000c078
xor r9d, r9d
mov dword [rbp - 0x80], eax
mov ebx, eax
test eax, eax
jns 0x140022515
mov rcx, qword [0x14004d128]
lea r14, [0x14004d128]
lea r15d, [rsi + 1]
cmp rcx, r14
je 0x140022506
test byte [rcx + 0x1c], sil
je 0x140022506
cmp byte [rcx + 0x19], r15b
jb 0x140022506
mov rax, qword [r12 + 0x28]
lea edx, [rsi + 0x11]
mov rcx, qword [rcx + 0x10]
lea r8, [0x140046ce8]
mov dword [rsp + 0x20], ebx
mov r9, qword [rax]
add r9, 0x2a0
call fcn.14000c408
xor r9d, r9d
mov r13d, edi
mov eax, 5
mov word [rsp + 0x48], ax
jmp 0x140022a94
mov rcx, qword [r12 + 0x28]
xor edx, edx
call fcn.14001b7a0
mov rcx, qword [r12 + 0x28]
mov edx, esi
call fcn.14001b7a0
lea r14, [0x14004d128]
mov r15d, 2
lea r13, [0x140046ce8]
xor r9d, r9d
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x48]
mov rcx, r12
call fcn.140021644
xor r9d, r9d
mov r8d, eax
test eax, eax
jne 0x140022984
movups xmm0, xmmword [rbp - 0x48]
mov rcx, qword [rbp - 0x78]
lea rdx, [rbp - 0x70]
add edi, esi
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x4c], edi
mov r8d, 0x180
movzx edi, byte [rsp + 0x40]
mov qword [rsp + 0x20], r9
and edi, esi
lea r9d, [rax + 7]
mov dword [rbp - 0x70], 0x18
add edi, esi
mov dword [rbp - 0x6c], r15d
movdqu xmmword [rbp - 0x68], xmm0
call qword [sym.imp.api_ms_win_core_file_l2_1_1.dll_OpenFileById]
nop dword [rax + rax]
mov qword [rsp + 0x60], rax
cmp rax, 0xffffffffffffffff
je 0x14002276f
mov r9d, 8
mov dword [rsp + 0x20], 0x43
lea r8, [rsp + 0x68]
mov rcx, rax
lea rdx, [rbp - 0x58]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
mov r12d, eax
xor eax, eax
test r12d, r12d
js 0x140022665
cmp dword [rsp + 0x68], edi
je 0x140022643
mov rcx, qword [0x14004d128]
cmp rcx, r14
je 0x140022643
test byte [rcx + 0x1c], sil
je 0x140022643
cmp byte [rcx + 0x19], r15b
jb 0x140022643
mov rax, qword [rsp + 0x70]
mov edx, 0x14
mov r9, qword [rbp - 0x40]
mov r8, r13
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x30], r12d
mov rax, qword [rax + 0x28]
mov rax, qword [rax + 0x70]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x48]
mov qword [rsp + 0x20], rax
call fcn.1400230f4
mov r12, qword [rsp + 0x60]
mov edi, dword [rsp + 0x44]
mov rcx, r12
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov r12, qword [rsp + 0x70]
jmp 0x1400227d4
cmp r12d, 0xc000050c
jne 0x140022706
mov r12, qword [rsp + 0x60]
lea r8, [rsp + 0x68]
mov rcx, r12
mov dword [rsp + 0x6c], eax
mov r9d, 8
mov dword [rsp + 0x68], edi
lea rdx, [rbp - 0x58]
mov dword [rsp + 0x20], 0x43
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jns 0x140022648
mov rcx, qword [0x14004d128]
cmp rcx, r14
je 0x1400226f7
test byte [rcx + 0x1c], sil
je 0x1400226f7
cmp byte [rcx + 0x19], r15b
jb 0x1400226f7
mov rax, qword [rsp + 0x70]
mov edx, 0x15
mov r9, qword [rbp - 0x40]
mov r8, r13
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x30], edi
mov rax, qword [rax + 0x28]
mov rax, qword [rax + 0x70]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x48]
mov qword [rsp + 0x20], rax
call fcn.1400230f4
mov word [rsp + 0x48], r15w
mov dword [rsp + 0x44], edi
jmp 0x14002264c
mov rcx, qword [0x14004d128]
cmp rcx, r14
je 0x140022753
test byte [rcx + 0x1c], sil
je 0x140022753
cmp byte [rcx + 0x19], r15b
jb 0x140022753
mov rax, qword [rsp + 0x70]
mov edx, 0x16
mov r9, qword [rbp - 0x40]
mov r8, r13
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x30], r12d
mov rax, qword [rax + 0x28]
mov rax, qword [rax + 0x70]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x48]
mov qword [rsp + 0x20], rax
call fcn.1400230f4
mov eax, 3
mov dword [rsp + 0x44], r12d
mov edi, r12d
mov word [rsp + 0x48], ax
mov r12, qword [rsp + 0x60]
jmp 0x14002264c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edx, eax
mov rcx, qword [0x14004d128]
cmp rcx, r14
je 0x1400227bd
test byte [rcx + 0x1c], sil
je 0x1400227bd
cmp byte [rcx + 0x19], r15b
jb 0x1400227bd
mov rax, qword [r12 + 0x28]
mov r9, qword [rbp - 0x40]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x30], edx
mov rax, qword [rax + 0x70]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x48]
mov qword [rsp + 0x20], rax
call fcn.140022f84
mov word [rsp + 0x48], si
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
mov dword [rsp + 0x44], eax
xor eax, eax
test edi, edi
je 0x140022845
movzx r8d, word [rsp + 0x54]
cmp ax, r8w
jae 0x140022833
mov r11d, dword [rsp + 0x58]
movzx edx, ax
cmp r11d, r8d
je 0x140022833
mov r10d, dword [rsp + 0x48]
movzx ecx, dx
lea rax, [rbp - 0x34]
mov r9d, dword [rbp + rcx*8 - 0x38]
lea rax, [rax + rcx*8]
cmp r9d, edi
jne 0x140022813
cmp word [rax], r10w
je 0x140022833
test r9d, r9d
je 0x140022823
add dx, si
cmp dx, r8w
jb 0x1400227f8
jmp 0x140022833
add r11d, esi
mov dword [rbp + rcx*8 - 0x38], edi
mov dword [rsp + 0x58], r11d
mov word [rax], r10w
xor r8d, r8d
add dword [rsp + 0x50], esi
mov dword [rsp + 0x44], r8d
mov word [rsp + 0x48], r8w
mov rdx, qword [r12 + 0x18]
xor r9d, r9d
mov rcx, qword [r12 + 8]
mov r8d, esi
call qword [sym.imp.ESENT.dll_JetMove]
nop dword [rax + rax]
mov edi, eax
cmp eax, 0xfffffc07
je 0x140022845
lea ecx, [rax + 0x643]
test ecx, 0xfffffffd
je 0x1400228f4
xor r8d, r8d
test eax, eax
je 0x140022938
mov rcx, qword [0x14004d128]
cmp rcx, r14
je 0x1400228c5
test byte [rcx + 0x1c], sil
je 0x1400228c5
cmp byte [rcx + 0x19], r15b
jb 0x1400228c5
mov rax, qword [r12 + 0x28]
lea edx, [r8 + 0x19]
mov r9d, dword [rsp + 0x4c]
mov r8, r13
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x28], edi
mov rax, qword [rax + 0x70]
mov qword [rsp + 0x20], rax
call fcn.14001e8c8
xor r8d, r8d
cmp edi, 0xfffffdef
je 0x14002295e
cmp edi, 0xfffffbbc
je 0x14002295e
cmp edi, 0xfffff8f0
je 0x14002295e
cmp edi, 0xfffffc0d
jne 0x140022941
mov ebx, 0x8007000e
jmp 0x14002296a
mov rcx, qword [0x14004d128]
cmp rcx, r14
je 0x140022930
test byte [rcx + 0x1c], sil
je 0x140022930
cmp byte [rcx + 0x19], 4
jb 0x140022930
mov rax, qword [r12 + 0x28]
mov edx, 0x18
mov r9d, dword [rsp + 0x4c]
mov r8, r13
mov rcx, qword [rcx + 0x10]
mov rax, qword [rax + 0x70]
mov qword [rsp + 0x20], rax
call fcn.14000a2a8
test edi, edi
jne 0x140022a27
mov edi, dword [rsp + 0x4c]
jmp 0x140022541
test edi, edi
mov eax, 0x8e5e0000
mov ecx, 0xe5e0000
cmovs ecx, eax
mov eax, edi
cdq
xor eax, edx
sub eax, edx
movzx ebx, ax
or ebx, ecx
jmp 0x14002296a
mov ecx, 0x70
call fcn.140002f2c
mov ebx, eax
mov edi, dword [rsp + 0x4c]
mov dword [rbp - 0x80], ebx
test edi, edi
jle 0x140022a2b
mov ebx, r8d
mov dword [rbp - 0x80], ebx
jmp 0x140022a2b
cmp r8d, 0xfffffdef
je 0x1400229ce
cmp r8d, 0xfffffbbc
je 0x1400229ce
cmp r8d, 0xfffff8f0
je 0x1400229ce
cmp r8d, 0xfffffc0d
jne 0x1400229af
mov ebx, 0x8007000e
jmp 0x1400229da
test r8d, r8d
mov eax, 0x8e5e0000
mov ecx, 0xe5e0000
cmovs ecx, eax
mov eax, r8d
cdq
xor eax, edx
sub eax, edx
movzx ebx, ax
or ebx, ecx
jmp 0x1400229da
mov ecx, 0x70
call fcn.140002f2c
mov ebx, eax
mov rcx, qword [0x14004d128]
cmp rcx, r14
je 0x140022a1c
test byte [rcx + 0x1c], sil
je 0x140022a1c
cmp byte [rcx + 0x19], r15b
jb 0x140022a1c
mov rax, qword [r12 + 0x28]
mov edx, 0x13
mov rcx, qword [rcx + 0x10]
mov r9d, edi
mov dword [rsp + 0x28], r8d
mov r8, r13
mov rax, qword [rax + 0x70]
mov qword [rsp + 0x20], rax
call fcn.14001e8c8
xor r9d, r9d
test edi, edi
cmovg ebx, r9d
jmp 0x14002297c
mov edi, dword [rsp + 0x4c]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [0x14004d128]
cmp rcx, r14
je 0x140022a82
test byte [rcx + 0x1c], sil
je 0x140022a82
cmp byte [rcx + 0x19], r15b
jb 0x140022a82
mov rax, qword [r12 + 0x28]
mov r9d, edi
sub r9d, dword [rsp + 0x50]
mov edx, 0x1a
mov rcx, qword [rcx + 0x10]
mov r8, r13
mov dword [rsp + 0x30], ebx
mov rax, qword [rax + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
call fcn.140022d80
mov r13d, dword [rsp + 0x50]
xor r9d, r9d
test r13d, r13d
jg 0x140022a9e
mov eax, 5
test ebx, ebx
jns 0x140022bba
jmp 0x140022aa3
mov eax, 5
cmp dword [0x14004d098], eax
jbe 0x140022bba
movabs rdx, 0x200000000000
test qword [0x14004d0a8], rdx
je 0x140022bba
mov rax, qword [0x14004d0b0]
and rax, rdx
cmp rax, qword [0x14004d0b0]
jne 0x140022bba
mov rax, qword [r12 + 0x28]
lea rcx, [rbp - 0x38]
mov r10d, dword [rsp + 0x48]
lea rdx, [0x140047d80]
mov qword [rbp + 0x80], rcx
xor r8d, r8d
mov dword [rsp + 0x58], r13d
lea rcx, [rsp + 0x54]
mov qword [rbp + 0x70], rcx
lea rcx, [rsp + 0x58]
mov qword [rbp + 0x60], rcx
lea rcx, [rsp + 0x50]
mov qword [rbp + 0x50], rcx
lea rcx, [rsp + 0x40]
mov qword [rbp + 0x40], rcx
lea rcx, [rsp + 0x4c]
mov qword [rbp + 0x30], rcx
lea rcx, [rbp + 0x28]
mov dword [rsp + 0x50], edi
mov byte [rsp + 0x40], r10b
mov dword [rsp + 0x4c], ebx
mov rax, qword [rax]
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x88], 0x28
mov qword [rbp + 0x78], 2
mov qword [rbp + 0x68], 4
mov qword [rbp + 0x58], 4
mov qword [rbp + 0x48], 1
mov qword [rbp + 0x38], 4
mov qword [rbp + 0x18], 2
movzx ecx, word [rax + 0x2b8]
mov rax, qword [rax + 0x2c0]
mov qword [rbp + 0x20], rax
lea rax, [rbp - 0x10]
mov dword [rbp + 0x28], ecx
lea rcx, [0x14004d098]
mov dword [rbp + 0x2c], r9d
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xa
call fcn.140001098
lea rcx, [rsp + 0x78]
call fcn.1400059dc
mov eax, ebx
jmp 0x140022c17
mov rcx, qword [0x14004d128]
lea r14, [0x14004d128]
cmp rcx, r14
je 0x140022c08
mov esi, 1
test byte [rcx + 0x1c], sil
je 0x140022c08
cmp byte [rcx + 0x19], 4
jb 0x140022c08
mov r9, qword [r12 + 0x28]
lea edx, [rsi + 0xf]
mov rcx, qword [rcx + 0x10]
lea r8, [0x140046ce8]
mov r9, qword [r9 + 0x70]
call fcn.14000a404
lea rcx, [rsp + 0x78]
mov dword [rbp - 0x80], ebx
call fcn.1400059dc
xor eax, eax
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.140001e80
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret