Function at 0x401930
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
test r8, r8
je 0x401b10
movzx eax, byte [rdx]
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp eax, 0x2f
je 0x401988
cmp eax, 0x5c
je 0x401988
cmp rdi, 3
jb 0x401b10
cmp byte [rbx + 1], 0x3a
jne 0x401b10
movzx eax, byte [rbx + 2]
cmp eax, 0x2f
je 0x401988
cmp eax, 0x5c
jne 0x401b10
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
lea rcx, [0x00451634]
lea rdx, [rsp + 0x30]
mov r8, rbx
mov r9, rdi
mov rax, qword [rax + 0x20]
mov rax, qword [rax + 0x48]
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rax
call fcn.00409640
movzx ebp, word [rsp + 0x48]
test bp, bp
jne 0x401bc6
mov r14, qword [rsp + 0x40]
lea rcx, [section..data]
mov edx, 0x28
mov r8b, 3
call fcn.004081f0
test rax, rax
je 0x401a94
vbroadcastss ymm0, dword [0x00450100]
movabs r12, 0xaaaaaaaaaaaaaaaa
mov r15, rax
mov qword [rax + 0x20], r12
vmovups ymmword [rax], ymm0
test r15b, 7
jne 0x401bde
vmovups xmm2, xmmword [0x004516c8]
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x40]
mov r9d, 0x68
mov rcx, r14
mov qword [r15], r12
vxorps xmm1, xmm1, xmm1
vmovups xmmword [r15 + 8], xmm1
vmovups xmmword [r15 + 0x18], xmm2
vmovaps xmmword [rsp + 0x30], xmm0
vmovups ymmword [rsp + 0x40], ymm0
vmovups ymmword [rsp + 0x60], ymm0
vmovups ymmword [rsp + 0x80], ymm0
mov qword [rsp + 0xa0], r12
mov dword [rsp + 0x20], 0x12
vzeroupper
call sub.ntdll.dll_NtQueryInformationFile
mov bp, 0x10
cmp eax, 0xc0000021
jle 0x401aa2
cmp eax, 0xc0000022
je 0x401af3
test eax, eax
je 0x401aa9
jmp 0x401b00
mov rcx, r14
call sub.ntdll.dll_NtClose
mov bp, 0x1f
jmp 0x401b08
cmp eax, 0x80000005
jne 0x401af9
mov r13d, dword [rsp + 0x60]
xor r10d, r10d
test r13d, 0x400
je 0x401b2e
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x28]
mov r9d, 8
mov rcx, r14
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0x23
call sub.ntdll.dll_NtQueryInformationFile
cmp eax, 0xc0000022
je 0x401af3
test eax, eax
je 0x401b24
cmp eax, 0xc0000004
jne 0x401b00
jmp 0x401b10
mov bp, 0xb
jmp 0x401b00
cmp eax, 0xc000000d
je 0x401b10
mov rcx, r14
call sub.ntdll.dll_NtClose
test eax, eax
je 0x401bc6
lea rcx, [0x0045177e]
mov edx, 0x18
xor r9d, r9d
call fcn.00401000
mov r10d, dword [rsp + 0x2c]
mov r13d, dword [rsp + 0x60]
mov rax, qword [rsp + 0x48]
movabs rcx, 0xfe624e212ac18000
add rax, rcx
jo 0x401bf5
mov edx, 0x64
imul rdx
mov r8, rax
mov rax, qword [rsp + 0x50]
add rax, rcx
jo 0x401bf5
add rcx, qword [rsp + 0x40]
jo 0x401bf5
mov r12d, 0x64
mov r9, rdx
mov ebp, r10d
mov qword [rsi + 8], r9
mov qword [rsi], r8
imul r12
mov r10, rdx
mov qword [rsi + 0x18], r10
mov r11, rax
mov rax, rcx
imul r12
mov r12, qword [rsp + 0x70]
mov qword [rsi + 0x10], r11
mov qword [rsi + 0x28], rdx
mov qword [rsi + 0x20], rax
mov qword [rsi + 0x30], r12
mov dword [rsi + 0x38], r13d
mov dword [rsi + 0x3c], ebp
mov qword [rsi + 0x40], r14
mov qword [rsi + 0x48], 0
mov qword [rsi + 0x50], rbx
mov qword [rsi + 0x58], rdi
xor ebp, ebp
mov qword [rsi + 0x60], r15
mov word [rsi + 0x70], bp
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.incorrect_alignment
mov edx, 0x13
xor r9d, r9d
vzeroupper
call fcn.00401000
lea rcx, str.integer_overflow
mov edx, 0x10
xor r9d, r9d
call fcn.00401000
int3