Function at 0x2100d5170
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x448
mov edx, 0x5c
mov rdi, rcx
call sym.msys_2.0.dll_wcsrchr
mov rsi, rax
test rax, rax
je 0x2100d5440
cmp word [rax + 2], 0
jne 0x2100d5428
xor ecx, ecx
lea rdx, [rsp + 0x7c]
xor r9d, r9d
mov r8d, 0x1001
mov word [rsi], cx
mov rcx, rdi
mov qword [rsp + 0x20], 0
call method.dll_list.ntopenfile_wchar_t_const__int__unsigned_int__unsigned_int__void_
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x2100d5411
mov edx, 0x5c
lea rax, [rsp + 0x80]
lea rbx, [rsi + 2]
mov word [rsi], dx
lea rbp, [rsp + 0x1f0]
lea r13, [0x210297920]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x50], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rbp
mov rcx, r12
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 0x248
mov qword [rsp + 0x20], rax
call sym.NtQueryDirectoryFile
mov dword [rsp + 0x7c], eax
test eax, eax
js 0x2100d53f8
mov r15, rbp
lea rsi, [rsp + 0x90]
mov r8d, dword [r15 + 0x3c]
lea rdx, [r15 + 0x40]
mov rcx, rbx
shr r8d, 1
mov r14d, r8d
mov r8, r14
call sym.msys_2.0.dll_wcsncpy
xor eax, eax
mov word [rbx + r14*2], ax
test byte [r15 + 0x38], 0x10
je 0x2100d52b0
mov rdx, r13
mov rcx, rbx
call sym.msys_2.0.dll_wcscmp
test eax, eax
jne 0x2100d53d0
mov eax, dword [r15]
test eax, eax
je 0x2100d5200
add r15, rax
jmp 0x2100d525f
lea r14, [rsp + 0xa0]
mov rdx, rdi
mov rcx, rsi
call sym.RtlInitUnicodeString
xor r9d, r9d
mov rdx, rsi
mov rcx, r14
mov r8d, 0x21
mov dword [rsp + 0xa0], 0xffffffff
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
mov dword [rsp + 0xb8], 0
mov dword [rsp + 0xbc], 0
mov byte [rsp + 0xc0], 0
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x130], 0
mov qword [rsp + 0x138], 0
mov qword [rsp + 0x140], 0
mov qword [rsp + 0x148], 0
mov qword [rsp + 0x150], 0
mov dword [rsp + 0x1c0], 0
mov qword [rsp + 0x1c8], 0
mov qword [rsp + 0x1d0], 0
mov qword [rsp + 0x1d8], 0
mov qword [rsp + 0x1e0], 0
mov qword [rsp + 0x1e8], 0
call method.path_conv.check__UNICODE_STRING_const__unsigned_int__suffix_info_const_
mov rcx, r14
call sym.unlink_nt_shareable_path_conv_
mov rcx, r14
call method.path_conv.path_conv__
mov eax, dword [r15]
test eax, eax
jne 0x2100d52a4
jmp 0x2100d5200
lea rdx, [0x210297924]
mov rcx, rbx
call sym.msys_2.0.dll_wcscmp
test eax, eax
je 0x2100d5299
mov rcx, rdi
call sym.rmdirs_wchar_t_
jmp 0x2100d5299
cmp eax, 0x80000006
je 0x2100d5408
test byte [0x210273880], 1
jne 0x2100d5458
mov rcx, r12
call sym.CloseHandle
nop
add rsp, 0x448
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rax
call sym.msys_2.0.dll_wcslen
lea rsi, [rsi + rax*2]
jmp 0x2100d51a7
mov rcx, rdi
call sym.msys_2.0.dll_wcslen
lea rsi, [rdi + rax*2]
jmp 0x2100d51a7
mov rdx, qword [rsp + 0x88]
mov qword [rsp + 0x28], r12
lea r9, str._y__NtQueryDirectoryFile___p__io__y__info__d_
lea r8, str.void_rmdirs_WCHAR_
mov dword [rsp + 0x20], eax
lea rcx, [0x210273880]
mov qword [rsp + 0x38], rdx
mov edx, dword [rsp + 0x80]
mov dword [rsp + 0x30], edx
mov edx, 0x40
call method.strace.prntf_unsigned_int__char_const__char_const__..._
mov rcx, r12
call sym.CloseHandle
jmp 0x2100d5411