Function at 0x140009348
Capabilities:
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r12d, r12d
or r13, 0xffffffffffffffff
mov dword [rax + 8], r12d
mov rbp, rcx
mov qword [rax + 0x10], r12
mov ebx, 1
mov r15d, r12d
mov edi, r12d
test rcx, rcx
je 0x1400093eb
mov rsi, r13
inc rsi
cmp word [rcx + rsi*2], r12w
jne 0x140009383
lea r14, [rsi + 1]
cmp r14, rsi
jb 0x1400093eb
mov eax, 2
mul r14
test rdx, rdx
jne 0x1400093eb
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x1400093eb
mov r9, rsi
mov r8, rbp
mov rdx, r14
mov rcx, rax
call fcn.1400062a8
lea rcx, [rsp + 0x80]
call qword [sym.imp.iertutil.dll_Ordinal_34]
nop dword [rax + rax]
test eax, eax
jns 0x1400093ee
mov ebx, r12d
jmp 0x1400095e5
mov ebx, r12d
cmp dword [rsp + 0x80], r12d
je 0x14000942b
call qword [sym.imp.ole32.dll_CoImpersonateClient]
nop dword [rax + rax]
test eax, eax
js 0x140009428
mov edx, eax
lea rcx, [rsp + 0x88]
call fcn.140008e50
mov r15, qword [rsp + 0x88]
test eax, eax
js 0x140009428
test r15, r15
jne 0x14000942b
mov ebx, r12d
test ebx, ebx
je 0x1400095d1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
or ebp, 0xffffffff
cmp esi, ebp
jne 0x1400094a9
add eax, 0xfffffffe
cmp eax, 1
ja 0x1400094a5
mov rcx, rdi
call fcn.14000e1c0
test eax, eax
jne 0x1400094a5
mov rdx, r13
inc rdx
cmp word [rdi + rdx*2], r12w
jne 0x14000946e
mov rcx, rdi
call fcn.14000e4c4
test eax, eax
js 0x1400094a5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp esi, ebp
je 0x140009457
cmp esi, ebp
je 0x1400094c8
test sil, 0x10
jne 0x1400094c8
mov rdx, r13
inc rdx
cmp word [rdi + rdx*2], r12w
jne 0x1400094b2
mov rcx, rdi
call fcn.14000e4c4
test eax, eax
js 0x1400094ff
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], 0x2000000
xor r8d, r8d
mov edx, 0x20000
mov dword [rsp + 0x20], 3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov r14, rax
cmp rax, r13
jne 0x140009507
mov ebx, r12d
jmp 0x1400095d1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
nop dword [rax + rax]
mov esi, eax
test eax, eax
je 0x14000955b
mov ecx, esi
add rcx, rcx
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov rbp, rax
test rax, rax
je 0x14000955b
xor r9d, r9d
mov r8d, esi
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
nop dword [rax + rax]
mov esi, eax
test eax, eax
jne 0x140009560
mov ebx, r12d
jmp 0x1400095c2
inc esi
cmp esi, 8
jb 0x1400095c2
mov rcx, rbp
call fcn.1400090e4
mov ebx, eax
test eax, eax
je 0x14000958c
cmp dword [rsp + 0x80], r12d
je 0x14000958c
mov rdx, r15
mov rcx, rbp
call fcn.1400091ec
mov ebx, eax
mov rcx, rbp
call fcn.14000e1c0
test eax, eax
jne 0x1400095c2
test ebx, ebx
je 0x1400095c2
mov edx, esi
mov rcx, rbp
call fcn.14000e4c4
test eax, eax
mov ebx, r12d
mov rsi, r13
setns bl
inc rsi
cmp word [rbp + rsi*2], r12w
jne 0x1400095b1
inc esi
test eax, eax
jns 0x140009562
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test r15, r15
je 0x1400095e5
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
test rdi, rdi
je 0x1400095f9
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret