Function at 0x10000ae6c
Capabilities:
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
push rbp
push rdi
push r12
push r13
push r14
sub rsp, 0x90
xor edi, edi
mov rbx, rcx
mov qword [rax + 0x18], rdi
cmp rcx, rdi
je 0x10000b1ad
cmp dword [0x100029a50], edi
je 0x10000b1ad
lea rdx, [rax + 0x18]
lea ecx, [rdi + 1]
call fcn.10000b244
cmp eax, edi
jne 0x10000aec4
lea rdx, [0x100001a30]
lea ecx, [rdi + 4]
call fcn.100010054
jmp 0x10000b175
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov edx, 0x100080
lea r8d, [r9 + 7]
mov rcx, rbx
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x10000af16
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x100001ab0]
lea ecx, [r12 + 5]
mov r8d, eax
call fcn.100010054
jmp 0x10000b166
mov dword [rsp + 0xc0], 0x400
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
cmp rax, rdi
je 0x10000b166
mov r9d, dword [rsp + 0xc0]
lea rdx, [rsp + 0x50]
mov r8, rax
mov rcx, r12
mov dword [rsp + 0x20], 0x2f
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov ecx, 4
cmp eax, edi
jge 0x10000af85
lea rdx, [0x100001b30]
mov r8d, eax
call fcn.100010054
jmp 0x10000b152
mov r8, rbx
lea rdx, [0x100001bc0]
cmp dword [rbp], edi
ja 0x10000af9b
lea rdx, [0x100001c10]
call fcn.100010054
mov qword [rsp + 0xc8], rdi
mov rbx, rdi
mov r13d, edi
cmp dword [rbp], edi
jbe 0x10000b152
lea r14, [rbp + 8]
mov qword [rsp + 0x48], rdi
mov rax, qword [r14]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0xc8]
mov edx, 0x1000
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x60], 0x30
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x78], edi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x88], rdi
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, edi
jge 0x10000b028
lea rdx, [0x100001c50]
mov r8d, eax
mov ecx, 4
call fcn.100010054
jmp 0x10000b10a
mov rcx, qword [rsp + 0xc8]
xor r9d, r9d
lea rax, [rsp + 0xc0]
lea edx, [r9 + 0x1b]
xor r8d, r8d
mov dword [rsp + 0xc0], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
cmp eax, 0x80000005
je 0x10000b072
cmp eax, 0xc0000023
je 0x10000b072
cmp eax, 0xc0000004
je 0x10000b072
lea rdx, [0x100001cd0]
jmp 0x10000b016
mov ebx, dword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
cmp rax, rdi
jne 0x10000b0ac
mov r8d, dword [rsp + 0xc0]
lea rdx, [0x100001d90]
jmp 0x10000b019
mov r9d, dword [rsp + 0xc0]
mov rcx, qword [rsp + 0xc8]
lea rax, [rsp + 0xc0]
mov r8, rbx
mov edx, 0x1b
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
cmp eax, edi
jge 0x10000b0e7
lea rdx, [0x100001e00]
jmp 0x10000b016
lea rdx, [0x100001e98]
mov ecx, 4
cmp word [rbx], di
jbe 0x10000b0fe
mov r8, qword [rbx + 8]
jmp 0x10000b105
lea r8, [0x100001ec0]
call fcn.100010054
mov rcx, qword [rsp + 0xc8]
cmp rcx, rdi
je 0x10000b125
call qword [sym.imp.ntdll.dll_NtClose]
mov qword [rsp + 0xc8], rdi
cmp rbx, rdi
je 0x10000b141
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, rdi
inc r13d
add r14, 8
cmp r13d, dword [rbp]
jb 0x10000afbb
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r12, 0xffffffffffffffff
je 0x10000b175
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0xd0]
cmp rbx, rdi
je 0x10000b1ad
cmp dword [rbx], 1
jne 0x10000b18a
mov edi, dword [rbx + 0xc]
test dil, 2
jne 0x10000b199
xor edx, edx
xor ecx, ecx
call fcn.10000b244
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0xd8]
add rsp, 0x90
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret