Function at 0x18007da30
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0xa8
mov ebx, dword [rbp + 0x7f]
mov rsi, r9
xor r9d, r9d
mov r10, r8
mov r14d, ebx
lea r12d, [rbx + 0x492]
cmp ebx, r12d
jae 0x18007dde4
mov rax, qword [rbp - 0x29]
mov r13, qword [rbp - 0x29]
mov r15, qword [rbp - 0x29]
mov ebx, dword [rbp + 7]
mov rsi, qword [rbp - 1]
mov qword [rbp - 0x51], rax
mov eax, dword [rbp + 0x7f]
mov dword [rbp - 0x59], eax
nop dword [rax + rax]
cmp r14d, 0xd5
ja 0x18007dbc9
je 0x18007db78
mov eax, r14d
sub eax, 0x37
je 0x18007db12
sub eax, 2
je 0x18007dae6
sub eax, 0x27
je 0x18007db05
sub eax, 0x4c
je 0x18007dba2
mov edi, dword [rbp - 0x59]
cmp eax, 0x28
jne 0x18007dd30
mov r8, r13
mov qword [rbp - 0x51], r13
jmp 0x18007dd34
mov eax, 0x21
nop dword [rax + rax]
cmp eax, 0x21
je 0x18007ddca
add eax, 0x99
cmp eax, 0xba
jb 0x18007daf0
mov rax, qword [r10 + 0x10]
mov qword [r10 + 8], rax
jmp 0x18007dd2d
mov rdx, r10
mov ecx, 0xf
call fcn.1800d0d90
mov r15, rax
test rax, rax
jne 0x18007dd2d
mov edi, 0x8d
mov eax, edi
sub eax, 0x8c
je 0x18007e3f2
cmp eax, 1
jne 0x18007db69
mov r8, qword [rbp + 0x67]
lea r9, str.unknown
lea rdx, [rbp - 0x61]
mov dword [rbp - 0x61], 7
mov ecx, 0xcd
call fcn.1800612d0
mov dword [rbp - 0x41], 0xffffffff
dec edi
cmp edi, 0x8b
ja 0x18007db30
jmp 0x18007dd2d
mov ecx, 0xd5
nop dword [rax]
mov eax, ecx
sub eax, 0xd5
je 0x18007db94
cmp eax, 1
je 0x18007e3f2
jmp 0x18007db98
mov dword [rbp - 0x41], r9d
inc ecx
cmp ecx, 0xd7
jb 0x18007db80
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov dword [rbp - 0x59], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18007dd30
mov eax, r14d
sub eax, 0xe3
je 0x18007dcb0
sub eax, 0x66
je 0x18007dc60
sub eax, 0xf
je 0x18007dc26
cmp eax, 0x75
jne 0x18007dd2d
test ebx, ebx
je 0x18007dc11
lea edi, [rbx - 1]
movsx ecx, byte [rdi + rsi]
cmp cl, 0xc0
jae 0x18007dc11
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
je 0x18007dc11
mov ebx, edi
mov dword [rbp + 7], ebx
test edi, edi
jne 0x18007dbf2
cmp ebx, 1
jae 0x18007dd2d
mov dword [rbp - 0x41], 0xffffffe8
jmp 0x18007e3f2
test ebx, ebx
je 0x18007dd2d
nop
movsx eax, byte [rsi]
cmp al, 0xc0
jae 0x18007dd2d
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
je 0x18007dd2d
dec ebx
inc rsi
mov dword [rbp + 7], ebx
mov qword [rbp - 1], rsi
test ebx, ebx
jne 0x18007dc30
jmp 0x18007dd2d
cmp dword [rdx], 1
jge 0x18007dd2d
mov edi, 0xea
nop
mov eax, edi
sub eax, 0xea
je 0x18007dc84
cmp eax, 0x5b
je 0x18007e3f2
jmp 0x18007dca0
xor r9d, r9d
mov rdx, r10
xor ecx, ecx
lea r8d, [r9 + 0x44]
call fcn.18009fdb0
mov r10, qword [rbp + 0x6f]
mov dword [rbp - 0x41], 0
add edi, 0x5b
cmp edi, 0x1a0
jb 0x18007dc70
jmp 0x18007dd2d
test r10, r10
je 0x18007dcc2
cmp dword [r10 + 0xa18], 0xbad1dead
jne 0x18007dce7
mov ecx, IsCharSpaceW
mov eax, ecx
sub eax, 0x19
je 0x18007dcd9
cmp eax, 1
je 0x18007e3f2
jmp 0x18007dce0
mov dword [rbp - 0x41], 0xffffffe8
inc ecx
cmp ecx, 0x1b
jb 0x18007dcc7
mov r13, qword [rbp + 0x67]
mov edi, 0xd1
mov eax, edi
sub eax, 0xd0
je 0x18007dd03
cmp eax, 1
jne 0x18007dd1b
mov rsi, r13
jmp 0x18007dd1b
xor r9d, r9d
mov r8, r13
xor edx, edx
mov ecx, SHRegGetIntW
call fcn.180087440
mov rbx, rax
mov dword [rbp + 7], eax
dec edi
cmp edi, 0xcf
ja 0x18007dcf0
mov r13, qword [rbp - 0x29]
mov qword [rbp - 1], rsi
mov edi, dword [rbp - 0x59]
mov r8, qword [rbp - 0x51]
mov r10, qword [rbp + 0x6f]
add r14d, 0x75
mov rdx, qword [rbp + 0x67]
xor r9d, r9d
cmp r14d, r12d
jb 0x18007daa0
mov rsi, qword [rbp + 0x77]
mov ebx, dword [rbp + 0x7f]
mov rcx, qword [rbp + 0x5f]
imul eax, ebx, 0x26c
mov r12d, ebx
mov dword [rbp - 0x11], eax
cmp ebx, eax
ja 0x18007e3f2
mov ebx, dword [rbp + 0x7f]
mov r13d, dword [rbp - 0x45]
mov r14, qword [rbp - 0x29]
mov r15, qword [rbp - 0x29]
mov qword [rbp - 0x19], rbx
nop
cmp r12d, 0x342c
ja 0x18007e3a2
je 0x18007df75
mov eax, r12d
sub eax, 0x37
je 0x18007df11
sub eax, 0x9d
je 0x18007dee1
sub eax, 0xf
je 0x18007de7e
sub eax, 0xca6
je 0x18007ddf7
cmp eax, 0xd52
je 0x18007e3f2
jmp 0x18007e3d1
mov r8, qword [r10 + 0xe8]
xor r9d, r9d
xor ecx, ecx
lea edx, [r9 + 0x51]
call fcn.18003e6d0
jmp 0x18007e3f6
mov r8, qword [rbp - 0x29]
mov edi, dword [rbp + 0x7f]
mov qword [rbp - 0x51], r8
mov dword [rbp - 0x59], edi
jmp 0x18007dd57
test dil, 0xa2
je 0x18007de0d
mov dword [rbp - 0x61], 4
lea r9, str.file
jmp 0x18007de5d
test dil, 0x10
je 0x18007de23
mov dword [rbp - 0x61], 3
lea r9, [0x18011a6e8]
jmp 0x18007de5d
bt edi, 0xa
jae 0x18007de39
mov dword [rbp - 0x61], 4
lea r9, str.link
jmp 0x18007de5d
test dil, 0x40
je 0x18007de4f
mov dword [rbp - 0x61], 5
lea r9, str.block
jmp 0x18007de5d
mov dword [rbp - 0x61], 7
lea r9, str.unknown
mov r8, rdx
mov ecx, 0xcd
lea rdx, [rbp - 0x61]
call fcn.1800612d0
mov r8, qword [rbp - 0x51]
xor r9d, r9d
mov dword [rbp - 0x41], r9d
jmp 0x18007e3d1
test rsi, rsi
jne 0x18007deaf
mov eax, 0x107
cmp eax, 0x107
je 0x18007de9c
cmp eax, 0x7a41
je 0x18007e3f2
jmp 0x18007dea3
mov dword [rbp - 0x41], 0xffffffe8
add eax, 0x793a
cmp eax, 0xf274
jbe 0x18007de88
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x19]
lea rcx, [rbp - 1]
mov qword [rbp - 0x19], rsi
mov r8d, 0x90
mov rdx, r10
call fcn.1800fb7c0
mov r8, qword [rbp - 0x51]
mov rbx, rax
mov qword [rbp - 0x19], rax
xor r9d, r9d
jmp 0x18007e3d1
mov rax, qword [rsi]
lea rcx, [rbp - 0x21]
mov qword [rsp + 0x28], r9
xor r8d, r8d
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov edx, 0xe0
call fcn.1800a3a80
mov r8, rax
mov qword [rbp - 0x51], rax
xor r9d, r9d
jmp 0x18007e3d1
cmp edi, 0xffffffff
jne 0x18007e3d1
mov edi, 0x96
nop
mov eax, edi
sub eax, 0x95
je 0x18007e3f2
cmp eax, 1
jne 0x18007df58
mov r8, rdx
mov dword [rbp - 0x61], 7
lea rdx, [rbp - 0x61]
mov ecx, 0xcd
lea r9, str.unknown
call fcn.1800612d0
mov dword [rbp - 0x41], 0xffffffff
mov rdx, qword [rbp + 0x67]
dec edi
cmp edi, 0x94
ja 0x18007df20
mov r8, qword [rbp - 0x51]
xor r9d, r9d
mov edi, dword [rbp - 0x59]
jmp 0x18007e3d1
cmp dword [rbp - 0x21], 1
jge 0x18007dfc8
mov edi, 0x3b
mov eax, edi
sub eax, 0x3b
je 0x18007df92
cmp eax, 0x48
je 0x18007e3f2
jmp 0x18007dfb5
mov dword [rbp - 0x61], r9d
lea rdx, [rbp - 0x61]
lea r9, [0x18010e6c6]
mov r8, r10
mov ecx, 0xcd
call fcn.1800612d0
xor r9d, r9d
mov dword [rbp - 0x41], r9d
mov r10, qword [rbp + 0x6f]
add edi, 0x48
cmp edi, 0xcb
jb 0x18007df80
mov r8, qword [rbp - 0x51]
mov rax, qword [rbp + 0x67]
cmp dword [rax], 2
jge 0x18007e0f8
mov r13d, dword [rbp - 0x49]
mov esi, 0x10f
mov rbx, qword [rbp - 0x31]
mov eax, esi
sub eax, 0x10c
je 0x18007e0da
sub eax, 1
je 0x18007e095
sub eax, 1
je 0x18007e05d
cmp eax, 1
jne 0x18007e03c
mov edi, dword [rbp - 0x49]
mov ecx, 0x3d
mov rdx, qword [rbp - 0x31]
nop
cmp ecx, 0x3d
mov rax, rdx
mov rdx, r8
cmove edi, dword [rbp - 0x21]
cmovne rdx, rax
add ecx, 0x53e
cmp ecx, 0x53e
jbe 0x18007e010
mov dword [rbp - 0x49], edi
mov qword [rbp - 0x31], rdx
mov rbx, rdx
mov r13d, edi
mov r8, qword [rbp - 0x51]
dec esi
cmp esi, 0x10b
ja 0x18007dfe2
mov rbx, qword [rbp - 0x19]
xor r9d, r9d
mov r13d, dword [rbp - 0x45]
mov edi, dword [rbp - 0x59]
jmp 0x18007e3d1
mov edi, dword [rbp - 0x49]
test edi, edi
je 0x18007e039
mov rdx, qword [rbp - 0x31]
movsx eax, byte [rdx]
cmp al, 0xc0
jae 0x18007e0cd
test al, al
je 0x18007e083
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
je 0x18007e0cd
mov rdx, qword [rbp - 0x31]
dec edi
inc rdx
mov dword [rbp - 0x49], edi
mov qword [rbp - 0x31], rdx
test edi, edi
jne 0x18007e068
jmp 0x18007e036
mov edi, dword [rbp - 0x49]
test edi, edi
je 0x18007e039
mov rdx, qword [rbp - 0x31]
dec edi
movsx ecx, byte [rdi + rdx]
cmp cl, 0xc0
jae 0x18007e0cd
test cl, cl
je 0x18007e0bd
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
je 0x18007e0cd
mov rdx, qword [rbp - 0x31]
mov dword [rbp - 0x49], edi
test edi, edi
jne 0x18007e0a0
mov rbx, qword [rbp - 0x31]
jmp 0x18007e039
mov r13d, dword [rbp - 0x49]
mov rbx, qword [rbp - 0x31]
jmp 0x18007e03c
mov r8, qword [rbp + 0x6f]
lea rdx, [rbp - 0x61]
mov r9, rbx
mov dword [rbp - 0x61], r13d
mov ecx, 0xcd
call fcn.1800612d0
jmp 0x18007e03c
mov rbx, qword [rbp - 0x29]
mov eax, 0x8a
mov dword [rbp - 0x61], eax
sub eax, 0x89
je 0x18007e146
cmp eax, 1
jne 0x18007e378
mov rax, qword [rsi + 8]
lea rcx, [rbp - 0x45]
mov qword [rsp + 0x28], r9
xor r8d, r8d
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov edx, 0xe0
call fcn.1800a3a80
mov r13d, dword [rbp - 0x45]
mov rbx, rax
mov qword [rbp - 0x29], rax
jmp 0x18007e378
cmp r13d, 1
jge 0x18007e170
mov eax, dword [rbp - 0x21]
lea rdx, [rbp - 0x39]
mov r9, r8
mov dword [rbp - 0x39], eax
mov r8, qword [rbp + 0x6f]
mov ecx, 0xcd
call fcn.1800612d0
mov r13d, dword [rbp - 0x45]
jmp 0x18007e378
mov esi, 0x105
nop word [rax + rax]
cmp esi, 0x101f1
ja 0x18007e246
je 0x18007e351
cmp esi, 0x105
je 0x18007e23a
cmp esi, 0x4140
je 0x18007e232
cmp esi, 0x817b
je 0x18007e1c8
cmp esi, 0xc1b6
jne 0x18007e35c
mov esi, 0xc1b6
jmp 0x18007e35c
mov r9, qword [rbp - 0x29]
mov qword [rbp - 9], r9
mov r8d, 0x80
mov eax, r8d
sub eax, 0x80
je 0x18007e21e
sub eax, 0x59
je 0x18007e215
cmp eax, 0x59
jne 0x18007e223
test r13d, r13d
jle 0x18007e20e
mov rcx, rbx
mov edx, r13d
cmp r15, r14
jae 0x18007e205
movzx eax, byte [rcx]
cmp byte [r15], al
jne 0x18007e205
inc r15
inc rcx
sub rdx, 1
jne 0x18007e1f5
cmp r15, r9
je 0x18007e1be
jmp 0x18007e223
mov r9, r15
mov qword [rbp - 9], r15
jmp 0x18007e223
cmp r15, r14
jae 0x18007e1be
add r8d, 0x59
cmp r8d, 0x18b
jb 0x18007e1d6
jmp 0x18007e1d0
mov r15, r8
jmp 0x18007e35c
movsxd r14, dword [rbp - 0x21]
add r14, r8
jmp 0x18007e35c
cmp esi, 0x1422c
je 0x18007e359
cmp esi, 0x18267
je 0x18007e2f0
cmp esi, 0x1c2a2
je 0x18007e34c
cmp esi, 0x202dd
jne 0x18007e35c
cmp r15, r14
jb 0x18007e2a1
mov r8, qword [rbp + 0x6f]
lea rdx, [rbp - 0x39]
mov dword [rbp - 0x39], r9d
mov ecx, 0xcd
lea r9, [0x18010e6c6]
call fcn.1800612d0
mov r13d, dword [rbp - 0x45]
jmp 0x18007e35c
mov rbx, qword [rbp + 0x6f]
mov edi, 0x7b
nop word [rax + rax]
mov eax, edi
sub eax, 0x7b
je 0x18007e2db
cmp eax, 1
jne 0x18007e2de
mov eax, r14d
lea rdx, [rbp - 0x39]
sub eax, r15d
mov r9, r15
mov r8, rbx
mov dword [rbp - 0x39], eax
mov ecx, 0xcd
call fcn.1800612d0
jmp 0x18007e2de
inc r14
inc edi
cmp edi, 0x7d
jb 0x18007e2b0
mov r13d, dword [rbp - 0x45]
mov rbx, qword [rbp - 0x29]
jmp 0x18007e35c
mov r8d, 0x64
mov eax, r8d
sub eax, 0x62
je 0x18007e33b
sub eax, 1
je 0x18007e313
cmp eax, 1
jne 0x18007e341
cmp r14, r15
jbe 0x18007e34c
mov qword [rbp - 9], r14
jmp 0x18007e341
test r13d, r13d
jle 0x18007e341
mov rcx, rbx
mov edx, r13d
nop
cmp r14, r15
jbe 0x18007e330
movzx eax, byte [rcx]
cmp byte [r14], al
jne 0x18007e330
dec r14
inc rcx
sub rdx, 1
jne 0x18007e320
jmp 0x18007e341
cmp r14, qword [rbp - 9]
je 0x18007e34c
dec r8d
cmp r8d, 0x61
ja 0x18007e2f6
jmp 0x18007e2f0
mov esi, 0x1c2a2
mov r12d, 0x342c
jmp 0x18007e35c
dec r14
mov r8, qword [rbp - 0x51]
add esi, 0x403b
mov r9d, 0
cmp esi, 0x24213
jbe 0x18007e180
mov eax, dword [rbp - 0x61]
mov r9d, 0
mov r8, qword [rbp - 0x51]
dec eax
mov rsi, qword [rbp + 0x77]
mov dword [rbp - 0x61], eax
cmp eax, 0x88
ja 0x18007e104
mov rbx, qword [rbp - 0x19]
mov edi, dword [rbp - 0x59]
jmp 0x18007e3d1
cmp r12d, 0x37dd
je 0x18007e3ce
cmp r12d, 0x6784
je 0x18007e3c8
cmp r12d, 0x6ed7
je 0x18007e3f2
cmp r12d, 0x9adc
je 0x18007e3f2
jmp 0x18007e3d1
mov dword [rbp - 0x41], r9d
jmp 0x18007e3d1
mov dword [rbp - 0x41], ebx
imul eax, dword [rbp + 0x7f], 0x3e
mov r10, qword [rbp + 0x6f]
mov rdx, qword [rbp + 0x67]
mov rsi, qword [rbp + 0x77]
mov rcx, qword [rbp + 0x5f]
add r12d, eax
cmp r12d, dword [rbp - 0x11]
jbe 0x18007dd80
mov rax, qword [rbp - 0x41]
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret