Function at 0x1400515f8
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xc0
mov rax, qword [0x1400b8288]
xor rax, rsp
mov qword [rbp + 0x1f], rax
xor r13d, r13d
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp - 0x29], r13
or r14, 0xffffffffffffffff
mov qword [rbp - 0x39], r13
mov qword [rbp - 0x31], r13
xorps xmm1, xmm1
mov qword [rbp + 0xf], rax
mov r12, r9
mov dword [rbp + 0x17], eax
mov r15, r8
mov edi, r13d
mov esi, r13d
movups xmmword [rbp - 0x21], xmm0
movups xmmword [rbp - 1], xmm1
movups xmmword [rbp - 0x11], xmm0
test rcx, rcx
je 0x14005183d
test r8, r8
je 0x14005183d
lea rdx, [rbp - 0x39]
call fcn.140030314
mov ebx, eax
test eax, eax
jns 0x1400516a7
mov r9d, eax
mov qword [rsp + 0x20], r13
mov r8d, 0x25e
lea rdx, str.onecore_base_ntsetupopktoolsosimagelibutility_fileio.c
lea rcx, str.FIOEnumerateReparsePoints
call fcn.140046874
mov rdi, qword [rbp - 0x39]
jmp 0x140051863
mov rdi, qword [rbp - 0x39]
lea r9, str._Extend_Reparse:_R:_INDEX_ALLOCATION
mov r8, rdi
lea rdx, [0x14009f488]
lea rcx, [rbp - 0x31]
call fcn.14000ca00
mov ebx, eax
test eax, eax
jns 0x1400516f5
mov r9d, eax
mov qword [rsp + 0x20], r13
mov r8d, 0x268
lea rdx, str.onecore_base_ntsetupopktoolsosimagelibutility_fileio.c
lea rcx, str.FIOEnumerateReparsePoints
call fcn.140046874
mov rsi, qword [rbp - 0x31]
jmp 0x140051863
mov rsi, qword [rbp - 0x31]
mov r8d, 3
mov qword [rsp + 0x30], r13
mov rcx, rsi
mov dword [rsp + 0x28], r13d
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x140051778
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov r15d, 0x80070000
or ecx, r15d
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x140051768
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, r15d
test eax, eax
cmovle ebx, eax
jmp 0x14005176d
mov ebx, 0x80004005
mov r8d, 0x273
jmp 0x140051848
mov byte [rsp + 0x50], r13b
lea rax, [rbp - 1]
mov qword [rsp + 0x48], r13
xorps xmm0, xmm0
mov byte [rsp + 0x40], 1
xor r9d, r9d
mov dword [rsp + 0x38], 0x21
xor r8d, r8d
mov dword [rsp + 0x30], FDICopy
xor edx, edx
mov qword [rsp + 0x28], rax
mov rcx, r14
lea rax, [rbp - 0x21]
mov qword [rsp + 0x20], rax
movups xmmword [rbp - 1], xmm0
call qword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
nop dword [rax + rax]
cmp eax, 0x80000006
je 0x140051838
cmp eax, 0xc000000f
je 0x140051863
test eax, eax
js 0x14005182a
mov ebx, dword [rbp - 0x21]
test ebx, ebx
js 0x14005181e
mov rax, qword [rbp - 1]
mov qword [rbp - 0x29], rax
movabs r10, 0xebd9a67f1c5e5b70
mov edx, dword [rbp + 7]
lea rcx, [rbp - 0x29]
mov r8, r12
mov rax, r15
call qword [vtable._SH_n.0]
mov ebx, eax
test eax, eax
jns 0x140051778
mov r9d, eax
mov r8d, 0x2d4
jmp 0x14005184b
bts ebx, 0x1c
mov r8d, 0x2ae
jmp 0x140051848
mov ebx, eax
mov r8d, 0x2ad
bts ebx, 0x1c
jmp 0x140051848
mov ebx, r13d
jmp 0x140051863
mov ebx, 0x80070057
mov r8d, 0x256
mov r9d, ebx
lea rdx, str.onecore_base_ntsetupopktoolsosimagelibutility_fileio.c
mov qword [rsp + 0x20], r13
lea rcx, str.FIOEnumerateReparsePoints
call fcn.140046874
test rdi, rdi
je 0x140051888
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test rsi, rsi
je 0x1400518ad
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
cmp r14, 0xffffffffffffffff
je 0x1400518c2
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.140096bd0
mov rbx, qword [rsp + 0x108]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret