Function at 0x1402a30e0
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x140379a08]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov rdi, r8
mov r12, rcx
cmp r8, 0xffffffffffffffff
jne 0x1402a3122
mov eax, 0x80000006
jmp 0x1402a396b
xor r14d, r14d
test r12, r12
jne 0x1402a3134
mov eax, 0xc00000ef
jmp 0x1402a396b
test rdi, rdi
jne 0x1402a3143
mov eax, 0xc00000f1
jmp 0x1402a396b
xorps xmm1, xmm1
mov word [rsp + 0x60], r14w
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x18], xmm0
mov qword [rbp + 0x68], rax
mov edx, 8
movups xmmword [rsp + 0x68], xmm1
mov r8d, 0x268
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp + 0x38], xmm1
movups xmmword [rbp + 0x48], xmm1
movups xmmword [rbp + 0x58], xmm1
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov r13, rax
test rax, rax
jne 0x1402a31a8
mov ebx, 0xc0000017
jmp 0x1402a3936
mov rax, qword [rdi + 0x20]
cmp rax, 1
jb 0x1402a3913
mov rcx, rax
lea rdx, [rax - 1]
mov rbx, r14
cmp rdx, rcx
jae 0x1402a31e7
mov rcx, qword [rdi + 0x18]
lea r8, [rbp - 0x60]
call fcn.14023dddc
test eax, eax
js 0x1402a31e4
mov rbx, qword [rbp - 0x60]
add rbx, qword [rdi + 0x38]
cmp rbx, qword [rdi + 0x38]
jae 0x1402a31e7
mov rbx, r14
test rbx, rbx
je 0x1402a3ca1
cmp qword [rbx + 0x18], r14
jne 0x1402a3422
lea r9, str.Node_on_the_stack_with_invalid_handle.
mov r8d, 0x9a7
lea rdx, str.AslPathWildcardFindNext
mov ecx, 1
call fcn.140013f14
mov rcx, qword [rdi + 0x20]
cmp rcx, 1
jae 0x1402a3229
mov ebx, 0x8000001a
jmp 0x1402a327d
lea rdx, [rcx - 1]
mov rax, r14
cmp rdx, rcx
jae 0x1402a3257
mov rcx, qword [rdi + 0x18]
lea r8, [rbp - 0x58]
call fcn.14023dddc
test eax, eax
js 0x1402a3254
mov rax, qword [rbp - 0x58]
add rax, qword [rdi + 0x38]
cmp rax, qword [rdi + 0x38]
jae 0x1402a3257
mov rax, r14
test rax, rax
jne 0x1402a329f
lea r9, str.RtlArrayGet_failed_to_get_the_next_node
mov r8d, 0x7ff
lea rdx, str.AslpPathWildcardPeekNode
mov ebx, 0xc00000e5
lea ecx, [rax + 1]
call fcn.140013f14
mov dword [rsp + 0x20], ebx
lea r9, str.AslpPathWildcardPeekNode_failed___x_
mov r8d, 0x81a
lea rdx, str.AslpPathWildcardPopNode
mov ecx, 1
jmp 0x1402a38fd
mov rcx, rax
call fcn.1402a4380
mov rax, qword [rdi + 0x20]
lea r9, [rax - 1]
cmp r9, rax
jae 0x1402a3902
mov rcx, qword [rdi + 0x18]
lea r8, [rbp - 0x50]
mov rdx, r9
call fcn.14023dddc
test eax, eax
js 0x1402a3902
mov rsi, qword [rbp - 0x50]
add rsi, qword [rdi + 0x38]
cmp rsi, qword [rdi + 0x38]
jb 0x1402a3902
mov rbx, qword [rdi + 0x20]
sub rbx, r9
sub rbx, 1
mov qword [rbp - 0x70], rbx
je 0x1402a3345
mov rdx, qword [rdi + 0x18]
lea r8, [rbp - 0x70]
mov rcx, rbx
call fcn.14023dddc
test eax, eax
js 0x1402a3902
mov rcx, qword [rdi + 0x18]
lea rdx, [r9 + 1]
lea r8, [rbp - 0x48]
call fcn.14023dddc
test eax, eax
js 0x1402a3902
mov rdx, qword [rbp - 0x48]
add rdx, qword [rdi + 0x38]
cmp rdx, qword [rdi + 0x38]
jb 0x1402a3902
mov rbx, qword [rbp - 0x70]
mov rcx, rsi
mov r8, rbx
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
mov r8, qword [rdi + 0x18]
lea rcx, [rbx + rsi]
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
dec qword [rdi + 0x20]
cmp qword [rdi + 0x20], 0x10
jbe 0x1402a3902
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x28]
mov rax, rdx
imul rax, rcx
cmp rax, 0x400
jb 0x1402a3902
mov rax, rcx
shr rax, 2
cmp qword [rdi + 0x20], rax
jae 0x1402a3902
mov rsi, rcx
lea r8, [rbp]
shr rsi, 1
call fcn.14023dddc
test eax, eax
js 0x1402a3902
mov rdx, qword [rdi + 0x18]
lea r8, [rsp + 0x78]
mov rcx, rsi
call fcn.14023dddc
test eax, eax
js 0x1402a3902
mov r8, qword [rdi + 0x38]
xor edx, edx
mov rcx, qword [rdi + 0x10]
test r8, r8
jne 0x1402a33f8
mov r8, qword [rsp + 0x78]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x1402a340c
mov r8, qword [rsp + 0x78]
xor edx, edx
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
jmp 0x1402a340c
mov r9, qword [rsp + 0x78]
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rbx, rbx
je 0x1402a3902
mov qword [rdi + 0x38], rbx
mov qword [rdi + 0x28], rsi
jmp 0x1402a3902
mov rdx, qword [rbx + 0x10]
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x18]
lea rax, [rsp + 0x68]
mov byte [rsp + 0x50], r14b
mov esi, 1
mov qword [rsp + 0x48], rax
xor r9d, r9d
mov byte [rsp + 0x40], sil
lea rax, [rbp + 0x18]
mov dword [rsp + 0x38], 3
xor r8d, r8d
mov dword [rsp + 0x30], 0x268
xor edx, edx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_ZwQueryDirectoryFile]
nop dword [rax + rax]
test eax, eax
jns 0x1402a36c6
cmp eax, 0x80000006
je 0x1402a34ea
cmp eax, 0xc000000f
je 0x1402a34ea
lea r9, str.NtQueryDirectoryFile_failed_to_query_next_file___x_
mov dword [rsp + 0x20], eax
mov r8d, 0x9bf
lea rdx, str.AslPathWildcardFindNext
mov ecx, esi
call fcn.140013f14
mov rax, qword [rsp + 0x70]
lea r9, str.FilePath:__ws__Pattern:__ws
mov qword [rsp + 0x28], rax
lea rdx, str.AslPathWildcardFindNext
mov rax, qword [rbx + 8]
lea ecx, [rsi + 1]
mov r8d, 0x9c0
mov qword [rsp + 0x20], rax
call fcn.140013f14
mov rcx, qword [rdi + 0x20]
cmp rcx, rsi
jae 0x1402a34fa
mov ebx, 0x8000001a
jmp 0x1402a354d
lea rdx, [rcx - 1]
mov rax, r14
cmp rdx, rcx
jae 0x1402a3528
mov rcx, qword [rdi + 0x18]
lea r8, [rbp - 0x40]
call fcn.14023dddc
test eax, eax
js 0x1402a3525
mov rax, qword [rbp - 0x40]
add rax, qword [rdi + 0x38]
cmp rax, qword [rdi + 0x38]
jae 0x1402a3528
mov rax, r14
test rax, rax
jne 0x1402a356a
lea r9, str.RtlArrayGet_failed_to_get_the_next_node
mov r8d, 0x7ff
lea rdx, str.AslpPathWildcardPeekNode
mov ecx, esi
mov ebx, 0xc00000e5
call fcn.140013f14
mov dword [rsp + 0x20], ebx
lea r9, str.AslpPathWildcardPeekNode_failed___x_
mov r8d, 0x81a
lea rdx, str.AslpPathWildcardPopNode
jmp 0x1402a38fb
mov rcx, rax
call fcn.1402a4380
mov rax, qword [rdi + 0x20]
lea r9, [rax - 1]
cmp r9, rax
jae 0x1402a3902
mov rcx, qword [rdi + 0x18]
lea r8, [rbp - 0x38]
mov rdx, r9
call fcn.14023dddc
test eax, eax
js 0x1402a3902
mov rsi, qword [rbp - 0x38]
add rsi, qword [rdi + 0x38]
cmp rsi, qword [rdi + 0x38]
jb 0x1402a3902
mov rbx, qword [rdi + 0x20]
sub rbx, r9
sub rbx, 1
mov qword [rbp - 0x68], rbx
je 0x1402a3610
mov rdx, qword [rdi + 0x18]
lea r8, [rbp - 0x68]
mov rcx, rbx
call fcn.14023dddc
test eax, eax
js 0x1402a3902
mov rcx, qword [rdi + 0x18]
lea rdx, [r9 + 1]
lea r8, [rbp - 0x30]
call fcn.14023dddc
test eax, eax
js 0x1402a3902
mov rdx, qword [rbp - 0x30]
add rdx, qword [rdi + 0x38]
cmp rdx, qword [rdi + 0x38]
jb 0x1402a3902
mov rbx, qword [rbp - 0x68]
mov rcx, rsi
mov r8, rbx
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
mov r8, qword [rdi + 0x18]
lea rcx, [rbx + rsi]
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
dec qword [rdi + 0x20]
cmp qword [rdi + 0x20], 0x10
jbe 0x1402a3902
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x28]
mov rax, rdx
imul rax, rcx
cmp rax, 0x400
jb 0x1402a3902
mov rax, rcx
shr rax, 2
cmp qword [rdi + 0x20], rax
jae 0x1402a3902
mov rsi, rcx
lea r8, [rbp + 8]
shr rsi, 1
call fcn.14023dddc
test eax, eax
js 0x1402a3902
mov rdx, qword [rdi + 0x18]
lea r8, [rbp - 0x80]
mov rcx, rsi
call fcn.14023dddc
test eax, eax
js 0x1402a3902
mov r8, qword [rdi + 0x38]
xor edx, edx
mov rcx, qword [rdi + 0x10]
test r8, r8
jne 0x1402a36bd
mov r8, qword [rbp - 0x80]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x1402a340c
mov r8, qword [rbp - 0x80]
jmp 0x1402a33ec
mov r9, qword [rbp - 0x80]
jmp 0x1402a33fd
mov eax, 4
cmp dword [r13 + 0x3c], eax
jne 0x1402a36e7
lea rcx, [r13 + 0x5e]
cmp word [rcx], 0x2e
jne 0x1402a3700
cmp word [r13 + 0x60], 0x2e
je 0x1402a3902
mov eax, 2
lea rcx, [r13 + 0x5e]
cmp dword [r13 + 0x3c], eax
jne 0x1402a3700
cmp word [rcx], 0x2e
je 0x1402a3902
mov r9d, dword [r13 + 0x38]
mov rdx, rbx
movzx eax, word [r13 + 0x3c]
mov r8, qword [rbx + 0x10]
shr r9d, 4
mov word [rsp + 0x28], ax
and r9d, esi
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x20]
call fcn.1402a4054
cmp eax, 0xc0000273
je 0x1402a38a9
cmp eax, 0xc0000103
je 0x1402a3902
cmp eax, 0xc00000ba
je 0x1402a3902
test eax, eax
js 0x1402a3896
mov r14, qword [rdi + 0x20]
cmp r14, qword [rdi + 0x28]
jb 0x1402a3842
lea rcx, [r14 + 1]
cmp rcx, qword [rdi + 0x28]
ja 0x1402a378d
mov ebx, 0xc000000d
xor r14d, r14d
test ebx, ebx
jns 0x1402a3902
lea r9, str.AslpPathWildcardPushNode_failed___x_
mov r8d, 0x9f1
jmp 0x1402a3cd1
mov rsi, qword [rdi + 0x30]
dec rsi
lea rax, [rsi + rcx]
cmp rax, rcx
jb 0x1402a3863
mov rdx, qword [rdi + 0x18]
lea r8, [rbp + 0x10]
mov rcx, qword [rdi + 0x28]
not rsi
and rsi, rax
call fcn.14023dddc
test eax, eax
jns 0x1402a37c3
mov ebx, 0xc0000095
jmp 0x1402a3837
mov rdx, qword [rdi + 0x18]
lea r8, [rbp - 0x78]
mov rcx, rsi
call fcn.14023dddc
test eax, eax
js 0x1402a37bc
mov r8, qword [rdi + 0x38]
xor edx, edx
mov rcx, qword [rdi + 0x10]
test r8, r8
jne 0x1402a380e
mov r8, qword [rbp - 0x78]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x1402a3821
mov r8, qword [rbp - 0x78]
xor edx, edx
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
jmp 0x1402a3821
mov r9, qword [rbp - 0x78]
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rbx, rbx
jne 0x1402a382d
mov ebx, 0xc0000017
jmp 0x1402a3837
mov qword [rdi + 0x38], rbx
xor ebx, ebx
mov qword [rdi + 0x28], rsi
test ebx, ebx
jne 0x1402a3770
lea esi, [rbx + 1]
mov rcx, qword [rdi + 0x18]
lea r8, [rbp - 0x28]
mov rdx, r14
call fcn.14023dddc
xor r14d, r14d
test eax, eax
jns 0x1402a386d
mov ebx, 0xc0000095
jmp 0x1402a3773
mov ebx, 0xc0000095
jmp 0x1402a3770
mov rdx, qword [rbp - 0x28]
add rdx, qword [rdi + 0x38]
cmp rdx, qword [rdi + 0x38]
jb 0x1402a3859
movups xmm0, xmmword [rbp - 0x20]
mov ebx, r14d
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp - 0x10]
movups xmmword [rdx + 0x10], xmm1
add qword [rdi + 0x20], rsi
jmp 0x1402a3773
mov dword [rsp + 0x20], eax
lea r9, str.AslpPathWildcardAllocMatchNode_failed___x_
mov r8d, 0x9f9
jmp 0x1402a38f4
movzx edx, word [r13 + 0x3c]
lea r8, [rsp + 0x60]
movzx ecx, word [rbx]
call fcn.1402a4804
test eax, eax
js 0x1402a38df
movzx ecx, word [rsp + 0x60]
lea r8, [rsp + 0x60]
mov r9d, 2
mov edx, r9d
call fcn.1402a4804
test eax, eax
jns 0x1402a3994
mov dword [rsp + 0x20], 0xc0000095
lea r9, str.Failed_to_compute_the_path_length___x_
mov r8d, 0xa25
lea rdx, str.AslPathWildcardFindNext
mov ecx, esi
call fcn.140013f14
mov rax, qword [rdi + 0x20]
mov rcx, rax
cmp rax, 1
jae 0x1402a31b9
mov ebx, 0x80000006
mov rcx, qword gs:[0x60]
mov r8, r13
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x48]
mov rax, qword [rbp + 0x50]
test rcx, rcx
je 0x1402a3960
cmp rcx, rax
je 0x1402a3960
mov qword [rbp + 0x30], rcx
lea rcx, [rbp + 0x28]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
nop dword [rax + rax]
mov rax, qword [rbp + 0x50]
test rax, rax
je 0x1402a3969
mov word [rax], r14w
mov eax, ebx
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.1400a2260
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
movzx r8d, word [rsp + 0x60]
lea rax, [rbp + 0x68]
mov qword [rbp + 0x50], rax
lea rcx, [rbp + 0x68]
add r8, r9
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0x60], r9
lea rax, [rbp + 0x68]
mov qword [rbp + 0x40], rax
mov rdx, r9
mov qword [rbp + 0x58], rdx
mov word [rbp + 0x68], r14w
mov dword [rbp + 0x38], 0x20000
cmp r8, 0xfffe
jbe 0x1402a39dc
mov ebx, 0xc0000106
jmp 0x1402a39fc
cmp r8, r9
jbe 0x1402a3a1c
lea rdx, [rbp + 0x48]
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlpEnsureBufferSize]
nop dword [rax + rax]
test eax, eax
jns 0x1402a3a14
mov ebx, 0xc0000017
lea r9, str.RtlEnsureUnicodeStringBufferSizeBytes_failed___x_
mov r8d, Ordinal_2611
mov dword [rsp + 0x20], ebx
mov ecx, esi
jmp 0x1402a3cda
mov rdx, qword [rbp + 0x58]
mov rcx, qword [rbp + 0x48]
movzx eax, word [rbp + 0x58]
movzx r9d, r14w
mov word [rbp + 0x3a], ax
mov qword [rbp + 0x40], rcx
mov word [rbp + 0x38], r14w
movzx r8d, word [rbx]
add r8, 2
cmp r8, 0xfffe
jbe 0x1402a3a49
mov ebx, 0xc0000106
jmp 0x1402a3a69
cmp r8, rdx
jbe 0x1402a3a81
lea rdx, [rbp + 0x48]
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlpEnsureBufferSize]
nop dword [rax + rax]
test eax, eax
jns 0x1402a3a78
mov ebx, 0xc0000017
lea r9, str.RtlAssignUnicodeStringBuffer_failed___x_
mov r8d, 0xa38
jmp 0x1402a3a09
mov rcx, qword [rbp + 0x48]
movzx r9d, word [rbp + 0x38]
mov qword [rbp + 0x40], rcx
movzx r8d, word [rbx]
mov rdx, qword [rbx + 8]
movzx eax, r9w
shr rax, 1
lea rcx, [rcx + rax*2]
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
movzx eax, word [rbx]
movzx ecx, word [rbp + 0x38]
add ax, 2
add ax, cx
mov word [rbp + 0x3a], ax
add cx, word [rbx]
mov rax, qword [rbp + 0x40]
mov word [rbp + 0x38], cx
movzx ecx, cx
shr rcx, 1
mov word [rax + rcx*2], r14w
movzx ecx, word [rbx]
mov rax, qword [rbx + 8]
mov ebx, 2
shr rcx, 1
cmp word [rax + rcx*2 - 2], 0x5c
je 0x1402a3b70
movzx ecx, word [rbp + 0x38]
lea r8d, [rbx + rcx]
add r8, rbx
cmp r8, 0xfffe
jbe 0x1402a3afb
mov ebx, 0xc0000106
jmp 0x1402a3b1c
cmp r8, qword [rbp + 0x58]
jbe 0x1402a3b32
lea rdx, [rbp + 0x48]
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlpEnsureBufferSize]
nop dword [rax + rax]
test eax, eax
jns 0x1402a3b2e
mov ebx, 0xc0000017
lea r9, str.RtlAppendUnicodeStringBuffer_failed___x_
mov r8d, 0xa3f
jmp 0x1402a3a09
movzx ecx, word [rbp + 0x38]
movzx eax, word [0x1402fda84]
mov rdx, qword [rbp + 0x48]
movzx ecx, cx
shr rcx, 1
mov qword [rbp + 0x40], rdx
mov word [rdx + rcx*2], ax
mov eax, 4
movzx ecx, word [rbp + 0x38]
add eax, ecx
add cx, bx
mov word [rbp + 0x38], cx
mov word [rbp + 0x3a], ax
mov rax, qword [rbp + 0x40]
movzx ecx, cx
shr rcx, 1
mov word [rax + rcx*2], r14w
movzx r10d, word [rbp + 0x38]
lea r9, [r13 + 0x5e]
mov qword [rsp + 0x70], r9
movzx edx, word [r13 + 0x3c]
mov word [rsp + 0x68], dx
movzx eax, word [r13 + 0x3c]
mov word [rsp + 0x6a], ax
lea r8d, [r10 + rdx]
add r8, 2
cmp r8, 0xfffe
jbe 0x1402a3baa
mov ebx, 0xc0000106
jmp 0x1402a3bcb
cmp r8, qword [rbp + 0x58]
jbe 0x1402a3bec
lea rdx, [rbp + 0x48]
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlpEnsureBufferSize]
nop dword [rax + rax]
test eax, eax
jns 0x1402a3bdd
mov ebx, 0xc0000017
lea r9, str.RtlAppendUnicodeStringBuffer_failed___x_
mov r8d, 0xa4e
jmp 0x1402a3a09
mov r9, qword [rsp + 0x70]
movzx edx, word [rsp + 0x68]
movzx r10d, word [rbp + 0x38]
mov rcx, qword [rbp + 0x48]
movzx eax, r10w
shr rax, 1
mov qword [rbp + 0x40], rcx
movzx r8d, dx
mov rdx, r9
lea rcx, [rcx + rax*2]
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
movzx eax, word [rsp + 0x68]
add ax, word [rbp + 0x38]
movzx ecx, ax
mov word [rbp + 0x38], cx
lea eax, [rbx + rcx]
shr rcx, 1
mov word [rbp + 0x3a], ax
mov rax, qword [rbp + 0x40]
mov word [rax + rcx*2], r14w
cmp dword [rdi], r14d
je 0x1402a3c67
xor r9d, r9d
lea rdx, [rbp + 0x38]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlNtPathNameToDosPathName]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x1402a3c67
mov dword [rsp + 0x20], eax
lea r9, str.RtlNtPathNameToDosPathName_failed___x_
mov r8d, 0xa59
jmp 0x1402a3a0d
movzx r9d, word [rbp + 0x38]
mov edx, 0x208
mov r8, qword [rbp + 0x40]
mov rcx, r12
call fcn.1402a476c
mov ebx, eax
test eax, eax
jns 0x1402a3c99
mov dword [rsp + 0x20], eax
lea r9, str.RtlStringCbCopyNW_failed___x_
mov r8d, 0xa64
jmp 0x1402a3a0d
mov ebx, r14d
jmp 0x1402a3918
lea r9, str.RtlArrayGet_failed_to_get_the_next_node
mov r8d, 0x7ff
lea rdx, str.AslpPathWildcardPeekNode
mov ecx, 1
call fcn.140013f14
lea r9, str.AslpPathWildcardPeekNode_failed___x_
mov r8d, 0x9a2
mov ebx, 0xc00000e5
mov dword [rsp + 0x20], ebx
mov ecx, 1
lea rdx, str.AslPathWildcardFindNext
call fcn.140013f14
jmp 0x1402a3918