Function at 0x1800d7fb0
Capabilities:
Get file attributes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0xa8
mov rdi, qword [rbp + 0x77]
mov r12, rcx
mov ecx, dword [rbp + 0x7f]
mov r13, r9
mov esi, ecx
mov qword [rbp - 0x29], r8
mov rax, rdx
mov qword [rbp - 0x41], rdx
mov qword [rbp - 0x21], rdi
lea r14d, [rcx + 0x23a]
mov dword [rbp - 0x51], r14d
cmp ecx, r14d
mov ecx, dword [rbp - 0x51]
mov ebx, dword [rbp - 0x51]
mov dword [rbp - 0x59], ecx
jae 0x1800d845b
cmp esi, 0x10f
ja 0x1800d81bd
je 0x1800d80e6
mov eax, esi
sub eax, 0xe
je 0x1800d80a3
sub eax, 0x5c
je 0x1800d8098
sub eax, 0xd
je 0x1800d8069
sub eax, 0x2c
je 0x1800d8045
cmp eax, 0xd
mov rax, qword [rbp - 0x41]
jne 0x1800d844f
mov ebx, dword [rbp - 0x11]
jmp 0x1800d844f
mov r8, r13
mov dword [rbp - 0x49], 0
mov edx, 0x75
lea rcx, [rbp - 0x49]
call fcn.1800d2280
mov ecx, dword [rbp - 0x59]
mov r8, qword [rbp - 0x29]
jmp 0x1800d844b
test byte [r13 + 0x10], 0x40
je 0x1800d84e0
mov rdx, qword [r13 + 8]
mov r9, r8
mov r8d, 0x11c
mov rcx, rdi
call fcn.1800412a0
mov ecx, dword [rbp - 0x59]
mov r8, qword [rbp - 0x29]
mov dword [rbp - 0x11], eax
jmp 0x1800d844b
xor edi, edi
mov qword [rbp - 0x21], rdi
jmp 0x1800d844b
mov eax, 0xa7
cmp eax, 0xa7
je 0x1800d80cc
cmp eax, 0x357e
jne 0x1800d80d5
mov eax, ebx
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor ebx, ebx
cmp qword [r13 + 8], rbx
setne bl
add eax, 0x34d7
cmp eax, 0x69ae
jbe 0x1800d80a8
jmp 0x1800d844b
cmp dword [rax], 0x1f
jle 0x1800d844f
mov edi, 0xb9
mov eax, edi
sub eax, 0xb7
je 0x1800d80b6
sub eax, 1
je 0x1800d8174
cmp eax, 1
jne 0x1800d819f
movups xmm0, xmmword [str.Canary_failed_to_create_ping_event._gle_d]
movzx eax, word [0x18010fab8]
lea r9, [0x18016d750]
movups xmm1, xmmword [0x18010faa0]
mov word [0x18016d778], ax
mov r8d, 0x123
movzx eax, byte [0x18010faba]
lea rcx, [rbp - 0x49]
movups xmmword [0x18016d750], xmm0
mov rdx, r13
mov byte [0x18016d77a], al
movsd xmm0, qword [0x18010fab0]
movsd qword [0x18016d770], xmm0
movups xmmword [0x18016d760], xmm1
mov dword [rbp - 0x49], 0x2a
call fcn.1800d3940
jmp 0x1800d819f
cmp dword [r8], 0
je 0x1800d819a
lea r9, [0x18010d5c8]
mov dword [rbp - 0x49], 1
mov r8d, 0x123
lea rcx, [rbp - 0x49]
mov rdx, r13
call fcn.1800d3940
mov ebx, 0xfffffff9
mov r8, qword [rbp - 0x29]
dec edi
cmp edi, 0xb6
ja 0x1800d80f4
mov ecx, dword [rbp - 0x59]
mov rdi, qword [rbp - 0x21]
jmp 0x1800d844b
mov eax, esi
sub eax, 0x148
je 0x1800d8446
sub eax, 0x39
je 0x1800d8400
sub eax, 0x39
je 0x1800d83c4
cmp eax, 0x39
jne 0x1800d844b
lea rdx, [rdi + 0x10]
xor r9d, r9d
xor ecx, ecx
lea r8d, [rax + 0x6a]
call fcn.18009fdb0
mov qword [rbp - 0x19], rax
test rax, rax
je 0x1800d83b3
nop dword [rax]
nop dword [rax + rax]
mov ecx, 0x121
mov dword [rbp - 0x49], ecx
nop dword [rax + rax]
cmp ecx, 0x121
jne 0x1800d8375
mov r14, qword [rax + 0x10]
mov rax, qword [r14]
test byte [rax + 0x10], 3
jne 0x1800d8371
mov r15d, 0x39
mov eax, r15d
sub eax, 0x38
je 0x1800d828d
cmp eax, 1
jne 0x1800d8361
xor edi, edi
cmp dword [r12], edi
jle 0x1800d835d
lea r9, [0x18010f474]
mov dword [rbp - 0x39], 1
mov r8d, 0x123
lea rcx, [rbp - 0x39]
mov rdx, r13
call fcn.1800d3940
inc edi
cmp edi, dword [r12]
jl 0x1800d8260
jmp 0x1800d835d
mov r8, qword [rdi]
mov rdx, r14
mov ecx, 0x18
call fcn.1800acf80
mov rsi, rax
test rax, rax
je 0x1800d8361
mov edi, 0x12d
nop
mov eax, edi
sub eax, 0x12c
je 0x1800d82f6
cmp eax, 1
jne 0x1800d834f
mov r8, qword [r14]
lea rdx, str.__z___
mov rcx, r13
call fcn.18007f6b0
lea r9, [0x18010cf28]
mov dword [rbp - 0x39], 2
mov r8d, 0x123
lea rcx, [rbp - 0x39]
mov rdx, r13
call fcn.1800d3940
jmp 0x1800d834f
mov rax, qword [rbp - 0x41]
lea r8, [rbp - 0x31]
mov r9, rsi
mov dword [rbp - 0x59], 0
mov edx, 0x25
mov rcx, r13
mov eax, dword [rax]
mov dword [rbp - 0x31], eax
mov eax, dword [r12]
inc eax
mov dword [rbp - 0x39], eax
mov rax, qword [rbp - 0x29]
mov eax, dword [rax]
mov dword [rbp - 9], eax
lea rax, [rbp - 0x39]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x59]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
call fcn.1800317f0
mov dword [rbp - 0x59], eax
cmp eax, 0xfffffff9
je 0x1800d83ab
dec edi
cmp edi, 0x12b
ja 0x1800d82b0
mov rdi, qword [rbp - 0x21]
dec r15d
cmp r15d, 0x37
ja 0x1800d8243
mov ecx, dword [rbp - 0x49]
mov rax, qword [rbp - 0x19]
add ecx, 0xb5c1
mov dword [rbp - 0x49], ecx
cmp ecx, 0xb5c1
jbe 0x1800d8220
xor r9d, r9d
lea rdx, [rdi + 0x10]
mov r8d, 0xa3
xor ecx, ecx
call fcn.18009fdb0
mov qword [rbp - 0x19], rax
test rax, rax
jne 0x1800d8210
mov rdi, qword [rbp - 0x21]
mov r14d, dword [rbp - 0x51]
mov ecx, dword [rbp - 0x59]
mov esi, 0x1f3
mov r8, qword [rbp - 0x29]
jmp 0x1800d844b
lea r9, [0x18010cf28]
mov dword [rbp - 0x31], 2
mov r8d, 0x123
lea rcx, [rbp - 0x31]
mov rdx, r13
call fcn.1800d3940
lea r8, [rdi + 0x10]
xor r9d, r9d
xor edx, edx
mov ecx, 0x10e
call fcn.180063050
mov ecx, dword [rbp - 0x59]
mov r8, qword [rbp - 0x29]
jmp 0x1800d844b
cmp dword [r8], 0
jne 0x1800d8426
lea r9, str.Object_
mov dword [rbp - 0x31], 7
mov r8d, 0x123
lea rcx, [rbp - 0x31]
mov rdx, r13
call fcn.1800d3940
mov r8, qword [rdi + 8]
lea rdx, [0x18010fa88]
add r8, 0x48
mov rcx, r13
call fcn.18007f6b0
mov ecx, dword [rbp - 0x59]
mov r8, qword [rbp - 0x29]
jmp 0x1800d844b
xor ecx, ecx
mov dword [rbp - 0x59], ecx
mov rax, qword [rbp - 0x41]
add esi, 0x39
cmp esi, r14d
jb 0x1800d8004
mov eax, dword [rbp + 0x7f]
lea r15d, [rax + 0x6ae]
cmp eax, r15d
jae 0x1800d80b6
mov r14d, dword [rbp - 0x51]
mov rsi, qword [rbp - 0x19]
nop word [rax + rax]
cmp eax, 0x1dd
ja 0x1800d85d5
je 0x1800d8587
sub eax, 0x77
je 0x1800d80b6
sub eax, 0x10
je 0x1800d853d
sub eax, 0x88
je 0x1800d84fb
sub eax, 0x23
je 0x1800d84ea
cmp eax, 0x88
jne 0x1800d8626
lea r9, [0x18010d7f8]
mov dword [rbp - 0x51], 1
mov r8d, 0x123
lea rcx, [rbp - 0x51]
mov rdx, r13
call fcn.1800d3940
jmp 0x1800d8626
mov eax, 0xffffffe8
jmp 0x1800d80b8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r14d, eax
jmp 0x1800d8626
xor edi, edi
cmp dword [r12], edi
jle 0x1800d8626
nop word [rax + rax]
lea r9, [0x18010f474]
mov dword [rbp - 0x51], 1
mov r8d, 0x123
lea rcx, [rbp - 0x51]
mov rdx, r13
call fcn.1800d3940
inc edi
cmp edi, dword [r12]
jl 0x1800d8510
jmp 0x1800d8626
mov rdx, r13
mov ecx, 0xf
call fcn.1800d0d90
mov rsi, rax
test rax, rax
jne 0x1800d8626
mov edx, 0x59
nop dword [rax + rax]
mov ecx, edx
sub ecx, 0x59
je 0x1800d8572
cmp ecx, 0x66
je 0x1800d80b6
jmp 0x1800d8577
mov ebx, 0xffffffff
add edx, 0x66
cmp edx, 0x125
jb 0x1800d8560
jmp 0x1800d8626
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r14d, 0xffffffff
jne 0x1800d8626
mov eax, 0x2a
nop word [rax + rax]
cmp eax, 0x2a
je 0x1800d85c2
cmp eax, 0x834
je 0x1800d80b6
jmp 0x1800d85c7
mov ebx, 0xffffffff
add eax, 0x80a
cmp eax, 0x1014
jbe 0x1800d85b0
jmp 0x1800d8626
sub eax, 0x265
je 0x1800d8624
sub eax, 0x23
je 0x1800d85f7
sub eax, 0x88
je 0x1800d80b6
cmp eax, 0x23
je 0x1800d80b6
jmp 0x1800d8626
test r14b, r14b
js 0x1800d8620
mov ecx, 0x11e
mov eax, ecx
sub eax, 0x11d
je 0x1800d80b6
cmp eax, 1
jne 0x1800d8616
lea ebx, [rax - 2]
dec ecx
cmp ecx, 0x11c
ja 0x1800d8601
xor ebx, ebx
jmp 0x1800d8626
mov ebx, ecx
mov eax, dword [rbp + 0x7f]
add eax, 0xab
mov dword [rbp + 0x7f], eax
cmp eax, r15d
jae 0x1800d80b6
mov ecx, dword [rbp - 0x59]
jmp 0x1800d8480