Function at 0x140027da0
Capabilities:
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x488
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x400], 0xfffffffffffffffe
mov rbx, rdx
mov rdi, rcx
lea rsi, [rbp - 0x50]
mov r8d, 0x208
mov rcx, rsi
xor edx, edx
call fcn.140111ac0
lea rcx, [rdi + 0x10]
mov rdx, rsi
mov r8d, 0x104
call fcn.140028710
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, 0x80004005
cmp eax, 0xffffffe
ja 0x14002806e
mov qword [rbp + 0x3e8], 0
lea rax, [rbp + 0x3e8]
mov qword [rsp + 0x20], rax
lea rcx, [0x1401683a0]
lea r9, [0x1401566e0]
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140027f62
mov qword [rbp + 0x3f0], 0
mov rcx, qword [rbp + 0x3e8]
mov rax, qword [rcx]
lea rdx, [0x140156b78]
lea r8, [rbp + 0x3f0]
call qword [rax]
mov esi, eax
test eax, eax
js 0x140028034
mov rcx, qword [rbp + 0x3f0]
mov rax, qword [rcx]
lea rdx, [rbp - 0x50]
mov r8d, 2
call qword [rax + 0x28]
mov esi, eax
test eax, eax
js 0x140028034
mov qword [rbp + 0x3f8], 0
mov rcx, qword [rbp + 0x3e8]
mov rax, qword [rcx]
lea rdx, [0x140156b88]
lea r8, [rbp + 0x3f8]
call qword [rax]
mov esi, eax
test eax, eax
js 0x140028017
mov rcx, qword [rbp + 0x3f8]
mov rax, qword [rcx]
lea rdx, [0x1401683d0]
lea r8, [rbp + 0x3d0]
call qword [rax + 0x28]
mov esi, eax
test eax, eax
js 0x140028017
lea rcx, [rbp + 0x3d0]
lea rdx, [rbp + 0x1c0]
mov r8d, 0x104
call qword [0x1401fe4b8]
mov esi, eax
mov byte [rbx], 0
test eax, eax
js 0x140027f69
lea rcx, [rbp + 0x1c0]
call fcn.1401328d8
movzx edx, byte [rdi + 0x3f]
mov rcx, rdx
test dl, dl
jns 0x140027f20
mov rcx, qword [rdi + 0x30]
cmp rax, rcx
jne 0x140027f69
test rax, rax
je 0x14002800a
lea rcx, [rdi + 0x28]
cmp rax, 0xffffffffffffffff
je 0x14002807c
test dl, dl
jns 0x140027f43
mov rcx, qword [rcx]
xor edx, edx
movzx r8d, word [rcx + rdx*2]
cmp r8w, word [rbp + rdx*2 + 0x1c0]
jne 0x140027f69
inc rdx
cmp rax, rdx
jne 0x140027f45
jmp 0x14002800a
mov esi, eax
jmp 0x140028051
mov esi, 0x80004005
cmp dword [rdi + 0xc], 2
jne 0x14002800a
mov byte [rbx], 1
lea rsi, [rbp + 0x3d0]
mov rcx, rsi
call qword [sym.imp.ole32.dll_PropVariantClear]
cmp byte [rdi + 0x3f], 0
jns 0x140027f97
mov rdi, qword [rdi + 0x28]
jmp 0x140027f9b
add rdi, 0x28
mov rcx, rdi
mov rdx, rsi
call fcn.140028880
mov esi, eax
test eax, eax
js 0x14002800a
mov rcx, qword [rbp + 0x3f8]
mov rax, qword [rcx]
lea rdx, [0x1401683d0]
lea r8, [rbp + 0x3d0]
call qword [rax + 0x30]
mov esi, eax
test eax, eax
js 0x14002800a
mov rcx, qword [rbp + 0x3f8]
mov rax, qword [rcx]
call qword [rax + 0x38]
mov esi, eax
test eax, eax
js 0x14002800a
mov rcx, qword [rbp + 0x3f0]
mov rax, qword [rcx]
call qword [rax + 0x20]
test eax, eax
js 0x14002800a
mov rcx, qword [rbp + 0x3f0]
mov rax, qword [rcx]
lea rdx, [rbp - 0x50]
mov r8d, 1
call qword [rax + 0x30]
mov esi, eax
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.ole32.dll_PropVariantClear]
mov rcx, qword [rbp + 0x3f8]
test rcx, rcx
je 0x140028034
mov qword [rbp + 0x3f8], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x3f0]
test rcx, rcx
je 0x140028051
mov qword [rbp + 0x3f0], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x3e8]
test rcx, rcx
je 0x14002806e
mov qword [rbp + 0x3e8], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, esi
add rsp, 0x488
pop rbx
pop rdi
pop rsi
pop rbp
ret
call fcn.140031340
int3