Function at 0x140037764
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x1400b8288]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov rax, qword [rbp + 0xd8]
xor r13d, r13d
mov rbx, qword [rbp + 0xd0]
xorps xmm0, xmm0
mov r15d, dword [rbp + 0xe0]
mov r14, rdx
mov qword [rbp - 0x58], rax
xor edx, edx
xor eax, eax
mov qword [rsp + 0x48], r8
mov qword [rbp - 0x78], rcx
mov edi, r13d
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x68], r9
mov qword [rbp - 0x60], rbx
mov esi, r13d
lea r8d, [rax + 0x40]
mov dword [rbp + 0x18], eax
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 0x70], r13
mov r12d, r13d
movups xmmword [rbp - 8], xmm0
mov qword [rsp + 0x60], r13
movups xmmword [rbp + 8], xmm0
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], r13
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x70], r13d
mov dword [rsp + 0x78], r13d
mov dword [rbp - 0x64], r13d
call sub.msvcrt.dll_memset
xor edx, edx
mov dword [rbp - 0x68], edx
test rbx, rbx
je 0x140038266
cmp word [rbx], dx
je 0x140038266
mov rax, qword [rsp + 0x68]
mov ebx, edx
mov rcx, qword [rbp - 0x60]
test rax, rax
mov dword [rsp + 0x50], edx
cmovne rcx, rax
call fcn.14002f960
mov rcx, qword [rbp - 0x60]
test rax, rax
mov qword [rbp - 0x28], rax
cmovne rcx, rax
mov qword [rbp - 0x50], rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
lea ecx, [r13 + 1]
mov edx, eax
cmp eax, 0xffffffff
je 0x140037881
shr eax, 0xa
mov ebx, edx
and eax, ecx
shr ebx, 0xe
mov dword [rsp + 0x50], eax
and ebx, ecx
jmp 0x140037883
mov eax, ebx
mov r9, qword [rbp - 0x78]
lea r8d, [rax + 0x10]
neg ebx
sbb ecx, ecx
shl r8d, 0x15
and ecx, 0x80120080
xor r10d, r10d
add ecx, 0x80000000
test r9, r9
je 0x1400378bc
cmp qword [r9 + 0x48], r10
mov rax, r9
cmovne rax, qword [r9 + 0x48]
mov ebx, dword [rax + 0x24]
mov dword [rsp + 0x78], ebx
jmp 0x1400378c0
mov ebx, dword [rsp + 0x78]
mov eax, edx
and eax, ebx
test al, 0x10
jne 0x1400378f4
test dl, 0x10
jne 0x1400378d2
test bl, 0x20
jne 0x1400378f4
mov dword [rsp + 0x58], r15d
mov edx, ecx
test r15d, r15d
je 0x1400378fb
mov dword [rsp + 0x58], r15d
bt ebx, 0x10
jae 0x1400378fb
bts edx, 0x18
mov dword [rsp + 0x58], r15d
jmp 0x1400378fb
mov dword [rsp + 0x58], r10d
mov edx, ecx
mov r15, qword [rbp - 0x50]
lea rax, [r14 + 1]
test rax, 0xfffffffffffffffe
jne 0x140037942
mov qword [rsp + 0x30], r10
xor r9d, r9d
mov dword [rsp + 0x28], r8d
mov rcx, r15
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1400379ad
mov r13d, 1
lea rdx, [rbp - 0x18]
mov dword [rbp - 0x80], r13d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
nop dword [rax + rax]
test eax, eax
je 0x140037dee
bt ebx, 0x19
mov ebx, dword [rbp - 0x18]
jae 0x140037971
btr ebx, 9
mov dword [rbp - 0x18], ebx
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x1400379c0
mov rcx, qword [rax + 0x60]
cmp rcx, 0xffffffffffffffff
jne 0x14003798e
test dword [rax + 0x38], 0x40000
jne 0x1400379c0
mov eax, dword [rbp + 0x14]
mov dword [rsp + 0x4c], eax
mov eax, dword [rbp + 0x18]
mov dword [rsp + 0x48], eax
cmp qword [rsp + 0x48], rcx
je 0x1400379c0
mov esi, 0x70d
jmp 0x140037dfc
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
jmp 0x1400381f8
lea rdx, [rbp - 0x68]
mov rcx, r14
call fcn.14004fc0c
test eax, eax
jns 0x140037a00
mov rdx, qword [rbp - 0x78]
lea rcx, str.AllocNode
mov dword [rsp + 0x30], 0x2db
lea r9, str.GetFileStorageTierClass_failed
mov qword [rsp + 0x28], rcx
mov r8, r15
mov ecx, 2
mov dword [rsp + 0x20], eax
call fcn.14002aaa0
xor eax, eax
mov r15d, ebx
cmp dword [rsp + 0x50], eax
je 0x140037c2f
xor r15d, r15d
mov dword [rsp + 0x54], r15d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
lea edx, [r15 + 8]
mov r8d, 0x4000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov r12, rax
test rax, rax
je 0x140037dfc
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x54]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], 0x4000
xor r8d, r8d
mov edx, 0x900a8
mov qword [rsp + 0x20], r12
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
nop dword [rax + rax]
xor ecx, ecx
test eax, eax
je 0x140037bdc
cmp dword [r12], 0x80000008
mov r15d, ebx
jne 0x140037c2f
lea eax, [rcx + 0x24]
cmp ax, word [r12 + 4]
jne 0x140037c2f
mov rax, qword [rbp - 0x78]
btr r15d, 0xa
test rax, rax
je 0x140037aba
mov rsi, qword [rax + 0x40]
test bl, 0x10
je 0x140037c2f
test rsi, rsi
je 0x140037c2f
mov r8d, dword [rsp + 0x54]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], rcx
xor r9d, r9d
mov rcx, rsi
mov qword [rsp + 0x20], rax
mov rdx, r12
call fcn.14004fa6c
test eax, eax
js 0x140037c2f
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x140037c2f
mov rcx, qword [rbp - 0x78]
lea r9, [rsp + 0x60]
mov r8, rax
mov rdx, rsi
call fcn.140037180
xor ebx, ebx
mov esi, eax
test eax, eax
jns 0x140037b94
mov r9d, eax
mov qword [rsp + 0x20], rbx
mov r8d, 0x314
lea rdx, str.onecore_base_ntsetupopktoolsosimagelibdataprocessdataprocess.c
lea rcx, str.AllocNode
call fcn.140046874
mov dword [rsp + 0x40], 1
mov ecx, esi
bt esi, 0x1c
jae 0x140037b80
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
cmp eax, 0x13d
jne 0x140037b6e
mov rdi, qword [rsp + 0x60]
jmp 0x140037e04
mov ecx, esi
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov esi, eax
jmp 0x140037b64
and ecx, 0x1fff0000
movzx eax, si
cmp ecx, 0x70000
cmove esi, eax
jmp 0x140037b64
mov rax, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x60]
mov dword [rsp + 0x50], ebx
mov ebx, r15d
mov qword [rdi + 0xb0], rax
btr dword [rbp - 0x18], 0xa
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
test eax, eax
je 0x140037c2f
mov r12d, ecx
jmp 0x140037c2f
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov esi, eax
cmp eax, 0x1126
jne 0x140037dfc
mov eax, 0xfffffbff
xor esi, esi
and dword [rbp - 0x18], eax
and ebx, eax
mov r15d, ebx
mov dword [rsp + 0x50], esi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test eax, eax
je 0x140037c2f
mov r12d, esi
mov r9, qword [rsp + 0x68]
mov r8d, r15d
mov rdx, r14
call fcn.140038320
mov r15, qword [rbp - 0x78]
mov rdx, r14
mov rcx, r15
mov qword [rbp - 0x30], rax
call fcn.140038e54
mov qword [rbp - 0x40], rax
mov r8d, ebx
mov eax, dword [rbp + 0xc]
mov rdx, r14
mov dword [rsp + 0x68], eax
mov rcx, r15
mov eax, dword [rbp + 8]
mov dword [rsp + 0x6c], eax
mov r9, qword [rsp + 0x68]
call fcn.140039020
xor ebx, ebx
mov qword [rbp - 0x38], rax
mov esi, ebx
cmp dword [rsp + 0x58], ebx
je 0x140037d97
mov r8d, dword [rsp + 0x78]
lea rcx, [rbp - 0x70]
mov qword [rsp + 0x38], rcx
lea r9, [rbp - 0x48]
and r8d, 0x10000
mov qword [rbp - 0x48], rbx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x30], rcx
lea edx, [rbx + 1]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x28], rcx
or r8d, 0x2e000
lea rcx, [rsp + 0x60]
shr r8d, 0xd
mov qword [rsp + 0x20], rcx
mov rcx, r14
mov qword [rsp + 0x68], rbx
call qword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
nop dword [rax + rax]
mov esi, eax
test eax, eax
je 0x140037d07
lea r9, str.GetSecInfo_failed
movzx eax, si
mov ecx, 0x39b
jmp 0x140037d3b
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorLength]
nop dword [rax + rax]
mov dword [rbp - 0x64], eax
test eax, eax
jne 0x140037d97
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
lea r9, str.LocalSize_failed
mov ecx, 0x3a9
mov esi, eax
movzx eax, ax
mov r8, qword [rbp - 0x50]
or eax, 0x80070000
mov dword [rsp + 0x30], ecx
mov rdx, r15
lea rcx, str.AllocNode
test esi, esi
mov qword [rsp + 0x28], rcx
mov r15d, 1
cmovle eax, esi
mov ecx, r15d
mov dword [rsp + 0x20], eax
call fcn.14002aaa0
mov rcx, qword [rbp - 0x70]
mov dword [rsp + 0x40], r15d
test rcx, rcx
je 0x140037e04
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
mov qword [rbp - 0x70], rbx
mov dword [rsp + 0x40], r15d
jmp 0x140037e04
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x54]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rbp + 0x20]
mov dword [rsp + 0x28], 0x40
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x9009c
mov dword [rsp + 0x54], ebx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
nop dword [rax + rax]
test eax, eax
je 0x140037e04
cmp dword [rsp + 0x54], 0x40
mov eax, ebx
mov ecx, 1
cmove eax, ecx
mov dword [rsp + 0x70], eax
jmp 0x140037e04
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov esi, eax
mov dword [rsp + 0x40], 1
mov r15, r12
test r13d, r13d
je 0x140037e1b
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
or r9, 0xffffffffffffffff
xor eax, eax
mov ebx, esi
mov r14, r9
cmp dword [rsp + 0x40], eax
jne 0x1400381f8
xor r13d, r13d
mov qword [rsp + 0x78], r13
mov word [rsp + 0x60], r13w
test rdi, rdi
jne 0x140037e6d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
lea edx, [rdi + 8]
mov r8d, 0xf0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rdi, rax
or r9, r14
mov rcx, qword [rbp - 0x60]
mov rax, r9
inc rax
cmp word [rcx + rax*2], r13w
jne 0x140037e74
mov qword [rbp - 0x20], rax
movzx eax, ax
inc rax
mov qword [rbp - 0x48], rax
lea rbx, [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov r12, qword [rbp - 0x58]
mov qword [rsp + 0x68], rax
test r12, r12
je 0x140037f11
cmp word [r12], r13w
je 0x140037f11
or r14, 0xffffffffffffffff
inc r14
cmp word [r12 + r14*2], r13w
jne 0x140037ecc
movzx eax, r14w
mov qword [rsp + 0x60], r14
lea rbx, [rax*2 + 2]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov qword [rsp + 0x48], rax
jmp 0x140037f1a
mov qword [rsp + 0x48], r13
mov qword [rbp - 0x58], r13
mov edx, dword [rsp + 0x70]
test edx, edx
je 0x140037f54
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x38]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov edx, dword [rsp + 0x70]
mov r11, rax
mov qword [rsp + 0x78], rax
jmp 0x140037f57
mov r11, r13
mov ecx, dword [rbp - 0x80]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov ebx, esi
mov r12, r15
mov r13d, ecx
mov r14, r9
test rdi, rdi
je 0x1400381f8
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x1400381f8
xor r13d, r13d
cmp qword [rbp - 0x58], r13
je 0x140037f9d
mov r13d, ecx
cmp qword [rsp + 0x48], r8
je 0x1400381f8
xor r13d, r13d
test edx, edx
je 0x140037fb8
mov ebx, esi
mov r12, r15
mov r13d, ecx
mov r14, r9
test r11, r11
je 0x1400381f8
xor r13d, r13d
mov r8, qword [rbp - 0x60]
mov rcx, rax
mov rdx, qword [rbp - 0x48]
call fcn.140001008
mov r14, qword [rsp + 0x48]
mov r12, qword [rsp + 0x60]
test r14, r14
je 0x140037fea
mov r8, qword [rbp - 0x58]
mov rcx, r14
movzx edx, r12w
inc rdx
call fcn.140001008
test r11, r11
je 0x140038012
movaps xmm0, xmmword [rbp + 0x20]
movups xmmword [r11], xmm0
movaps xmm1, xmmword [rbp + 0x30]
movups xmmword [r11 + 0x10], xmm1
movaps xmm0, xmmword [rbp + 0x40]
movups xmmword [r11 + 0x20], xmm0
movaps xmm1, xmmword [rbp + 0x50]
movups xmmword [r11 + 0x30], xmm1
mov rbx, qword [rdi]
test rbx, rbx
je 0x140038041
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test eax, eax
je 0x140038041
mov qword [rdi], r13
mov rbx, qword [rdi + 0x10]
test rbx, rbx
je 0x140038072
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test eax, eax
je 0x140038072
mov qword [rdi + 0x10], r13
mov rax, qword [rsp + 0x68]
mov qword [rdi], rax
mov rax, qword [rbp - 0x20]
mov word [rdi + 8], ax
mov qword [rdi + 0x10], r14
mov r14, qword [rbp - 0x78]
mov word [rdi + 0x18], r12w
mov eax, dword [rbp - 0x18]
mov dword [rdi + 0x1c], eax
mov eax, dword [rbp - 0x68]
mov dword [rdi + 0xec], eax
mov eax, dword [rbp + 8]
mov dword [rdi + 0x3c], eax
mov eax, dword [rbp + 0xc]
mov dword [rdi + 0x38], eax
mov rax, qword [rbp - 0x14]
mov qword [rdi + 0x40], rax
mov rax, qword [rbp - 0xc]
mov qword [rdi + 0x48], rax
mov rax, qword [rbp - 4]
mov qword [rdi + 0x50], rax
cmp dword [rsp + 0x58], r13d
je 0x140038113
mov r8d, dword [rbp - 0x64]
or r9d, 0xffffffff
mov rdx, qword [rbp - 0x70]
mov rcx, r14
call fcn.140038920
test rax, rax
je 0x1400380ee
mov eax, dword [rax + 0xc]
mov ebx, dword [rsp + 0x40]
mov dword [rdi + 0x58], eax
jmp 0x1400380f9
mov eax, 1
mov ebx, eax
mov dword [rsp + 0x40], eax
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
test ebx, ebx
jne 0x1400381bd
jmp 0x14003811f
mov ebx, dword [rsp + 0x40]
or dword [rdi + 0x58], 0xffffffff
mov dword [rsp + 0x40], ebx
mov rax, qword [rbp - 0x40]
mov qword [rdi + 0x70], rax
mov rax, qword [rbp - 0x38]
mov qword [rdi + 0x68], rax
mov rax, qword [rbp - 0x30]
mov qword [rdi + 0x60], rax
mov rax, qword [rsp + 0x78]
mov qword [rdi + 0x78], rax
mov eax, 1
cmp dword [rsp + 0x50], r13d
je 0x1400381a6
cmp dword [rbp + 0x10], eax
jbe 0x140038190
test r15, r15
je 0x140038190
cmp dword [r15], 0x80000008
je 0x140038190
mov r8, qword [rbp - 0x50]
lea rax, str.AllocNode
mov dword [rsp + 0x30], 0x44b
lea r9, str.Encountered_a_reparse_point_which_is_also_a_hard_link
mov qword [rsp + 0x28], rax
mov rdx, r14
mov ecx, 4
mov dword [rsp + 0x20], r13d
call fcn.14002aaa0
mov eax, dword [r15]
mov dword [rdi + 0x80], eax
movzx eax, word [r15 + 6]
mov dword [rdi + 0x84], eax
jmp 0x1400381bd
cmp dword [rbp + 0x10], eax
jbe 0x1400381bd
mov eax, dword [rbp + 0x14]
mov dword [rdi + 0x84], eax
mov eax, dword [rbp + 0x18]
mov dword [rdi + 0x80], eax
or r14, 0xffffffffffffffff
mov dword [rdi + 0xe8], r13d
xor eax, eax
mov ebx, esi
mov r12, r15
mov esi, dword [rbp - 0x80]
mov r13d, esi
cmp dword [rsp + 0x40], eax
je 0x1400381f8
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, rdi
mov ebx, eax
call fcn.140036ec0
xor eax, eax
mov edi, eax
or r14, r14
test r12, r12
je 0x14003821d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rsi, qword [rbp - 0x28]
test rsi, rsi
je 0x140038246
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test r13d, r13d
je 0x140038260
cmp r14, 0xffffffffffffffff
je 0x140038260
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test ebx, ebx
je 0x140038279
jmp 0x14003826b
mov ebx, 0x57
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov rax, rdi
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.140096bd0
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret