Function at 0x14004269c
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], r9
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov rax, rdx
mov r13, r9
xor edx, edx
mov r12, r8
mov rsi, rcx
mov r14d, edx
cmp rax, 0xffffffffffffffff
je 0x140042b37
test r8, r8
je 0x140042b37
movzx eax, word [r8]
mov r15, r8
cmp dx, ax
je 0x14004275f
lea r13, str.WindowsWinSxS_
mov rdi, r13
cmp dx, word [rdi]
je 0x140042746
mov rax, r15
sub rax, r13
mov qword [rbp - 0x39], rax
movzx ecx, word [rax + rdi]
call qword [sym.imp.msvcrt.dll_towupper]
nop dword [rax + rax]
movzx ecx, word [rdi]
movzx ebx, ax
call qword [sym.imp.msvcrt.dll_towupper]
nop dword [rax + rax]
movzx eax, ax
xor edx, edx
cmp ebx, eax
jne 0x140042743
mov rax, qword [rbp - 0x39]
add rdi, 2
cmp dx, word [rax + rdi]
jne 0x1400426fb
cmp dx, word [rdi]
mov r13, qword [rbp + 0x7f]
je 0x1400429d4
add r15, 2
cmp dx, word [r15]
jne 0x1400426f1
movzx eax, word [r12]
mov r15, r12
cmp dx, ax
je 0x1400427de
lea rax, [0x1400a44f0]
mov rdi, rax
lea r13, [0x1400a44f0]
movzx ecx, word [rdi]
cmp dx, cx
je 0x1400427c0
call qword [sym.imp.msvcrt.dll_towupper]
nop dword [rax + rax]
movzx ebx, ax
mov rax, r15
sub rax, r13
mov qword [rbp - 0x39], rax
movzx ecx, word [rax + rdi]
call qword [sym.imp.msvcrt.dll_towupper]
nop dword [rax + rax]
movzx eax, ax
xor edx, edx
cmp eax, ebx
jne 0x1400427c0
mov rax, qword [rbp - 0x39]
add rdi, 2
cmp dx, word [rax + rdi]
jne 0x140042778
mov r13, qword [rbp + 0x7f]
cmp dx, word [rdi]
je 0x1400429d4
add r15, 2
lea rax, [0x1400a44f0]
cmp dx, word [r15]
jne 0x14004276e
xor r15d, r15d
mov edi, 8
test rsi, rsi
je 0x14004287a
cmp qword [rsi + 0x48], r15
mov rax, rsi
mov ebx, 0x40000000
cmovne rax, qword [rsi + 0x48]
test dword [rax + 0x24], ebx
jne 0x14004287a
mov rcx, rsi
call fcn.14002e5e4
test rax, rax
je 0x14004287a
mov rdx, qword [rax]
test rdx, rdx
je 0x14004287a
test r13, r13
je 0x140042a2b
cmp word [r13], r15w
je 0x140042883
call fcn.1400424b8
test eax, eax
jns 0x140042854
mov r9d, eax
mov qword [rsp + 0x20], r15
mov r8d, 0x20b
lea rdx, str.onecore_base_ntsetupopktoolsosimagelibmainmiscutil.c
lea rcx, str.WIMSetFileShortName
call fcn.140046874
mov rcx, qword [rsi + 0x48]
mov rax, rsi
test rcx, rcx
cmovne rax, rcx
mov edx, dword [rax + 0x24]
or edx, ebx
jmp 0x140042870
mov rsi, rcx
mov rcx, qword [rcx + 0x48]
test rcx, rcx
jne 0x140042869
mov dword [rsi + 0x24], edx
jmp 0x140042883
test r13, r13
je 0x140042a2b
xorps xmm0, xmm0
lea rdx, [rbp - 0x31]
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
movups xmmword [rbp - 0x31], xmm0
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
nop dword [rax + rax]
test al, al
je 0x140042a10
mov dword [rsp + 0x50], r15d
lea rax, [rbp - 0x31]
mov qword [rsp + 0x48], r15
lea r9, [rbp - 0x21]
mov dword [rsp + 0x40], 0x4020
lea r8, [rbp - 0x11]
mov dword [rsp + 0x38], 1
lea rcx, [rbp - 0x39]
xorps xmm0, xmm0
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 0x80
mov edx, 0x100080
mov qword [rsp + 0x20], r15
mov qword [rbp - 0x39], r15
movups xmmword [rbp - 0x21], xmm0
mov qword [rbp - 0x11], 0x30
mov qword [rbp + 7], 0x40
mov qword [rbp - 9], r15
mov qword [rbp - 1], rax
movdqu xmmword [rbp + 0xf], xmm0
call qword [sym.imp.ntdll.dll_NtCreateFile]
nop dword [rax + rax]
test eax, eax
js 0x140042a10
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov esi, 0x28
xor edx, edx
mov rcx, rax
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x39]
lea rdx, [rbp - 0x21]
mov r8, rax
mov dword [rsp + 0x20], FDICopy
mov r9d, esi
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
test eax, eax
js 0x1400429db
or r8, 0xffffffffffffffff
inc r8
cmp word [r13 + r8*2], r15w
jne 0x14004297d
lea rdx, [rbx + 4]
mov rcx, r13
call qword [sym.imp.msvcrt.dll_wcsncmp]
nop dword [rax + rax]
test eax, eax
jne 0x1400429db
test rbx, rbx
je 0x1400429c4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
xor eax, eax
jmp 0x140042b3c
test rbx, rbx
je 0x140042a00
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
or rax, 0xffffffffffffffff
inc rax
cmp word [r13 + rax*2], r15w
jne 0x140042a14
mov r14, rax
add r14d, r14d
lea esi, [r14 + 0xa]
jmp 0x140042a34
lea r13, [0x14009fd54]
mov esi, edi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8d, esi
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov ebx, r15d
mov r12d, 0x80070000
mov rdi, rax
test rax, rax
jne 0x140042aa3
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, r12d
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x140042b30
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, r12d
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140042b2c
mov dword [rdi], r14d
test r14d, r14d
je 0x140042ac6
mov edx, r14d
lea rcx, [rdi + 4]
shr rdx, 1
mov r8, r13
inc rdx
call fcn.140001008
mov ebx, eax
test eax, eax
js 0x140042b0c
mov rcx, qword [rbp + 0x6f]
lea rdx, [rbp - 0x21]
xorps xmm0, xmm0
mov dword [rsp + 0x20], 0x28
mov r9d, esi
mov r8, rdi
movups xmmword [rbp - 0x21], xmm0
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
test eax, eax
jns 0x140042b0c
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, r12d
test eax, eax
cmovle ebx, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov eax, ebx
jmp 0x140042b3c
mov ebx, 0x80004005
jmp 0x140042b2c
mov eax, 0x80070057
mov rbx, qword [rsp + 0x100]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret