Function at 0x1800f2d10
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xb0
mov edi, dword [rbp + 0x77]
mov r14, rcx
mov ecx, dword [rbp + 0x77]
xor r11d, r11d
mov ebx, dword [rbp + 0x77]
mov r13, r9
imul r12d, ecx, 0x6ae
mov r10, rdx
mov r15d, ecx
cmp ecx, r12d
ja 0x1800f30b6
mov rax, qword [rbp - 0x31]
mov r11, qword [rbp - 0x31]
mov ecx, dword [rbp + 0x77]
mov esi, dword [rbp - 0x41]
mov qword [rbp - 0x39], rax
mov eax, dword [rbp + 0x77]
mov dword [rbp - 0x49], eax
mov eax, r15d
mov dword [rbp - 0x45], ecx
mov qword [rbp - 0x31], r11
nop word [rax + rax]
lea rdx, str.PNG_chunk_b
cmp r15d, 0x33e2
ja 0x1800f2fbc
je 0x1800f2fb4
cmp r15d, 0xa7
ja 0x1800f2e86
je 0x1800f2e30
cmp r15d, 0x3a
je 0x1800f2ded
cmp r15d, 0x3d
je 0x1800f2dd4
cmp r15d, 0x78
je 0x1800f2e53
jmp 0x1800f308f
mov rdx, r10
mov ecx, 0xf
call fcn.1800d0d90
mov r11, rax
mov qword [rbp - 0x31], rax
jmp 0x1800f3088
test r10, r10
je 0x1800f2e03
cmp dword [r10 + 0xa18], 0xbad1dead
jne 0x1800f308f
mov eax, 0xcb
cmp eax, 0xcb
je 0x1800f2e18
cmp eax, 0x4367
je 0x1800f2e67
jmp 0x1800f2e1f
mov dword [rbp - 0x29], 0xffffffe8
add eax, 0x429c
cmp eax, 0x8538
jbe 0x1800f2e08
jmp 0x1800f308c
mov eax, 0x36
cmp eax, 0x36
je 0x1800f2e43
cmp eax, 0xe9
je 0x1800f2e67
jmp 0x1800f2e47
mov qword [rbp - 0x29], rdx
add eax, 0xb3
cmp eax, 0x19c
jb 0x1800f2e35
test r10, r10
jne 0x1800f308c
nop dword [rax]
mov dword [rbp - 0x29], 0
mov rax, qword [rbp - 0x29]
mov rbx, qword [rsp + 0x108]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp r15d, 0xed
je 0x1800f2f9c
cmp r15d, 0x1a0e
je 0x1800f2ef2
cmp r15d, 0x1b67
jne 0x1800f308f
test r11, r11
jne 0x1800f2ed3
mov ecx, 0x69
mov eax, ecx
sub eax, 0x69
je 0x1800f2ec1
cmp eax, 0x62
je 0x1800f2e67
jmp 0x1800f2ec8
mov dword [rbp - 0x29], 0xffffffff
add ecx, 0x62
cmp ecx, 0x12d
jb 0x1800f2eb3
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r10, qword [rbp + 0x6f]
mov r9d, eax
mov r11, qword [rbp - 0x31]
mov dword [rbp - 0x49], eax
mov eax, dword [rbp + 0x77]
jmp 0x1800f3093
xor r9d, r9d
mov r8, r14
xor edx, edx
mov ecx, SHRegGetIntW
call fcn.180087440
mov rdx, qword [rbp + 0x6f]
lea r9, [rbp + 7]
add rdx, 0x2c0
mov dword [rbp - 0x41], eax
mov r8, r14
mov dword [rsp + 0x20], 0x6c
lea rcx, [rbp - 0x41]
call fcn.180081110
mov dword [rbp - 0x41], eax
cmp eax, 0
jne 0x1800f3082
mov r14, qword [rbp + 7]
mov esi, 0xb3
nop
cmp esi, 0xb3
je 0x1800f2f70
cmp esi, 0x6afb
jne 0x1800f2f82
mov rdx, qword [rbp + 0x6f]
mov r9d, 0xd5
xor r8d, r8d
mov qword [rsp + 0x20], 0
mov rcx, r14
call fcn.180023820
jmp 0x1800f2f82
mov rdx, qword [rbp + 0x6f]
mov r8d, IsCharSpaceW
mov rcx, qword [r14]
call fcn.1800825b0
add esi, 0x6a48
cmp esi, 0xd490
jbe 0x1800f2f40
mov esi, dword [rbp - 0x41]
mov r14, qword [rbp + 0x67]
jmp 0x1800f3084
mov r8d, dword [r13 + 0x1c]
mov rdx, r13
mov r9d, dword [rbp - 0x49]
mov qword [rbp - 0x39], rdx
mov dword [rbp - 0x45], r8d
jmp 0x1800f309b
mov dword [rbp - 0x29], esi
jmp 0x1800f308f
cmp r15d, 0xa0c8
ja 0x1800f3036
je 0x1800f301f
cmp r15d, 0x35e8
je 0x1800f2fe2
cmp r15d, 0x4db6
je 0x1800f2e67
jmp 0x1800f308f
mov r8d, 0x5e
mov dword [rbp - 0x41], 0
lea rdx, [rbp - 0x41]
mov rcx, r10
call fcn.1800b70b0
mov rcx, qword [rbp + 0x6f]
lea rdx, [rbp - 0x41]
mov r8d, 0x5e
mov qword [rbp - 1], rax
mov dword [rbp - 0x41], 1
call fcn.1800b70b0
mov qword [rbp - 9], rax
jmp 0x1800f3084
mov rdx, qword [rbp - 1]
xor r9d, r9d
xor ecx, ecx
lea r8d, [r9 + 0x78]
call fcn.1800f2d10
mov rbx, rax
jmp 0x1800f3084
cmp r15d, 0xd638
je 0x1800f306b
cmp r15d, 0x14118
jne 0x1800f308f
mov rax, qword [rbp - 0x11]
xor r9d, r9d
mov rdx, qword [rbp - 9]
xor ecx, ecx
mov eax, dword [rax]
lea r8d, [r9 + 0x78]
mov dword [0x180135a68], eax
call fcn.1800f2d10
mov rdi, rax
jmp 0x1800f3084
xor r9d, r9d
mov r8, r10
xor ecx, ecx
lea edx, [r9 + 0x70]
call fcn.1800b7660
mov qword [rbp - 0x11], rax
jmp 0x1800f3084
mov esi, eax
mov r11, qword [rbp - 0x31]
mov r10, qword [rbp + 0x6f]
mov eax, dword [rbp + 0x77]
mov r9d, dword [rbp - 0x49]
mov r8d, dword [rbp - 0x45]
mov rdx, qword [rbp - 0x39]
imul ecx, eax, 0x72
add r15d, ecx
cmp r15d, r12d
jbe 0x1800f2d90
mov ecx, dword [rbp + 0x77]
xor r11d, r11d
mov rsi, qword [rbp - 0x31]
jmp 0x1800f30d6
mov rdx, qword [rbp - 0x31]
mov rsi, qword [rbp - 0x31]
mov r8d, dword [rbp + 0x77]
mov r9d, dword [rbp + 0x77]
mov qword [rbp - 0x39], rdx
mov qword [rbp - 0x31], rsi
mov dword [rbp - 0x45], r8d
mov dword [rbp - 0x49], r9d
imul r13d, ecx, 0x12c
mov r14d, ecx
cmp ecx, r13d
ja 0x1800f2e67
mov r15, qword [rbp - 0x31]
mov r12, qword [rbp - 0x31]
cmp r14d, 0x25f5
ja 0x1800f327f
je 0x1800f323f
cmp r14d, 0x9c5
ja 0x1800f31d9
je 0x1800f34e2
cmp r14d, 0x3d
je 0x1800f3183
cmp r14d, 0xed
je 0x1800f317b
cmp r14d, 0x501
jne 0x1800f325a
test r9b, 0xa0
jne 0x1800f3165
mov eax, 0x50
nop
cmp eax, 0x50
je 0x1800f3152
cmp eax, 0x1360
je 0x1800f2e67
jmp 0x1800f3159
mov dword [rbp - 0x29], 0xffffffff
add eax, 0x1310
cmp eax, 0x2620
jbe 0x1800f3140
test r9b, 1
je 0x1800f325a
mov dword [rbp - 0x29], 0xffffffff
jmp 0x1800f2e67
mov r12, qword [rdx]
jmp 0x1800f325a
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r9d, dword [rbp - 0x49]
cmp r9d, 0xffffffff
jne 0x1800f3254
mov eax, 0xac
nop word [rax + rax]
cmp eax, 0xac
je 0x1800f31c4
cmp eax, 0x4284
je 0x1800f2e67
jmp 0x1800f31cb
mov dword [rbp - 0x29], 0xffffffff
add eax, 0x41d8
cmp eax, 0x83b0
jbe 0x1800f31b0
jmp 0x1800f3254
cmp r14d, 0x9d8
je 0x1800f320f
cmp r14d, 0xe89
je 0x1800f2e67
cmp r14d, 0x1371
jne 0x1800f325a
test r8b, 0x10
je 0x1800f325a
test byte [r10 + 0x10], 0xe
je 0x1800f325a
or r8d, 8
mov dword [rbp - 0x45], r8d
jmp 0x1800f325a
cmp ebx, edi
jle 0x1800f34f0
mov ecx, 0x7f
nop dword [rax]
mov eax, ecx
sub eax, 0x7e
je 0x1800f2e67
cmp eax, 1
jne 0x1800f3236
lea eax, [rbx + 1]
mov dword [rbp - 0x29], eax
dec ecx
cmp ecx, 0x7d
ja 0x1800f3220
jmp 0x1800f3257
xor r9d, r9d
mov r8, r10
xor ecx, ecx
lea edx, [r9 + 7]
call fcn.1801018c0
mov r9d, dword [rbp - 0x49]
xor r11d, r11d
mov ecx, dword [rbp + 0x77]
lea eax, [rcx + rcx*4]
lea r14d, [r14 + rax*4]
cmp r14d, r13d
ja 0x1800f2e67
mov r10, qword [rbp + 0x6f]
mov rdx, qword [rbp - 0x39]
mov r8d, dword [rbp - 0x45]
mov rsi, qword [rbp - 0x31]
jmp 0x1800f30f1
cmp r14d, 0x7005
ja 0x1800f349d
je 0x1800f337b
cmp r14d, 0x3879
je 0x1800f3367
cmp r14d, 0x4afd
je 0x1800f32df
cmp r14d, 0x5d81
jne 0x1800f325a
mov dword [rbp - 0x41], r11d
lea r9, [rbp - 0x41]
mov dword [rbp - 0x21], 1
lea r8, [rbp - 0x21]
mov edx, 0x6b
mov qword [rsp + 0x20], r12
lea rcx, [rbp + 0xf]
call fcn.180054650
mov r15, rax
jmp 0x1800f3250
test r8b, 8
je 0x1800f332c
mov r9d, dword [rdx + 0x18]
test r9d, r9d
jle 0x1800f332c
mov rax, qword [r10 + 0x28]
lea rsi, [rdx + 0x20]
mov qword [rsp + 0x30], rax
lea r8, str._.s__.s
mov eax, dword [r10 + 0x30]
mov rcx, rsi
mov dword [rsp + 0x28], eax
mov rax, qword [rdx + 0x10]
mov edx, 0x400
mov qword [rsp + 0x20], rax
call fcn.18007ff70
mov dword [rbp + 0x17], eax
mov qword [rbp + 0xf], rsi
jmp 0x1800f3250
mov r8, qword [r10 + 0x28]
lea rsi, [rdx + 0x20]
mov ecx, 0x400
mov qword [rsp + 0x20], r11
cmp dword [r10 + 0x30], ecx
lea rdx, [rbp - 0x19]
mov r9, rsi
cmovb ecx, dword [r10 + 0x30]
mov dword [rbp - 0x19], ecx
mov ecx, 0xd3
call fcn.1800b25d0
mov dword [rbp + 0x17], eax
mov qword [rbp + 0xf], rsi
jmp 0x1800f3250
cmp dword [r10 + 0x30], 1
jb 0x1800f2e60
mov dword [rbp + 0x17], r11d
jmp 0x1800f325a
test r15, r15
je 0x1800f3482
test r8b, 2
jne 0x1800f2e60
test r8b, 4
je 0x1800f325a
mov esi, reloc.SHLWAPI.dll_GetAcceptLanguagesA
nop dword [rax]
mov eax, esi
sub eax, 0xe
je 0x1800f342d
sub eax, 0x52
je 0x1800f33ed
cmp eax, 0x52
jne 0x1800f3460
lea r9, [rbp - 0x11]
mov dword [rbp - 0x11], 1
lea r8, [rbp - 9]
mov dword [rbp - 9], 1
lea edx, [rax + 0x19]
mov qword [rsp + 0x20], r12
lea rcx, [rbp + 0xf]
call fcn.180054650
mov rdx, qword [rbp - 0x39]
mov r15, rax
mov r8d, dword [rbp - 0x45]
jmp 0x1800f3460
mov rax, qword [r10 + 0x28]
lea rcx, [rdx + 0x20]
mov r9d, dword [rdx + 0x18]
lea r8, str._.s__.s
mov qword [rsp + 0x30], rax
mov eax, dword [r10 + 0x30]
mov dword [rsp + 0x28], eax
mov rax, qword [rdx + 0x10]
mov edx, 0x400
mov qword [rsp + 0x20], rax
call fcn.18007ff70
mov rdx, qword [rbp - 0x39]
mov r8d, dword [rbp - 0x45]
mov dword [rbp + 0x17], eax
jmp 0x1800f3460
test r8b, 8
jne 0x1800f3439
cmp dword [rdx + 0x18], 1
jge 0x1800f3460
mov ecx, 0xb5
nop
mov eax, ecx
sub eax, 0xb4
je 0x1800f2e67
cmp eax, 1
jne 0x1800f3456
mov dword [rbp - 0x29], r11d
dec ecx
cmp ecx, 0xb3
ja 0x1800f3440
mov r10, qword [rbp + 0x6f]
add esi, 0x52
mov r11d, 0
cmp esi, 0x104
jb 0x1800f33a0
mov r9d, dword [rbp - 0x49]
jmp 0x1800f3257
mov dword [rbp - 1], 1
lea r9, [rbp - 1]
mov dword [rbp + 7], 1
lea r8, [rbp + 7]
jmp 0x1800f32c4
cmp r14d, 0x8289
je 0x1800f34b8
cmp r14d, 0x950d
je 0x1800f2e67
jmp 0x1800f325a
test r15, r15
je 0x1800f34e2
mov rdx, qword [rbp + 0x67]
mov r9, r15
mov r8d, 0x120
xor ecx, ecx
call fcn.1800554e0
mov rax, qword [rbp - 0x39]
mov r9d, dword [rbp - 0x49]
mov ecx, dword [rbp + 0x77]
inc dword [rax + 8]
xor r11d, r11d
mov dword [rbp - 0x29], r11d
jmp 0x1800f325a
lea eax, [rdi + 1]
mov dword [rbp - 0x29], eax
jmp 0x1800f2e67