Function at 0x4ca5fa
Capabilities:
Get file attributes

Disassembly:
mov eax, 0x4140
call fcn.00547290
nop
mov qword [rbp + 0x10], rcx
mov eax, 0
mov byte [rbp - 1], al
mov eax, 0
mov byte [rbp - 0x11], al
mov eax, 0
mov byte [rbp - 0x2028], al
movabs rax, 0x1fff
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x2027]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
lea rax, [rbp - 0x2028]
mov qword [rbp - 0x2030], rax
mov eax, 0x200
mov r8, rax
mov rax, qword [rbp - 0x2030]
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetModuleFileNameW
mov dword [rbp - 0x2034], eax
mov rax, qword [rbp - 0x2030]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp - 0x2038], eax
mov eax, dword [rbp - 0x2038]
and eax, 0x400
mov dword [rbp - 0x203c], eax
mov eax, dword [rbp - 0x203c]
cmp eax, 0
je 0x4ca9ab
movabs rax, 0
mov qword [rsp + 0x30], rax
mov eax, pe_nt_image_headers64
mov qword [rsp + 0x28], rax
mov eax, 3
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
mov eax, 1
mov r8, rax
mov eax, 0x80000000
mov r11, rax
mov rax, qword [rbp - 0x2030]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_CreateFileW
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
cmp rax, 0xffffffffffffffff
je 0x4ca9ab
mov eax, 1
mov byte [rbp - 1], al
mov eax, 0
mov byte [rbp - 0x403c], al
movabs rax, 0x1fff
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x403b]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, 0
mov r9, rax
mov eax, 0x2000
mov r8, rax
lea rax, [rbp - 0x403c]
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetFinalPathNameByHandleW
mov dword [rbp - 0x4040], eax
mov eax, dword [rbp - 0x4040]
cmp eax, 0x2000
jae 0x4ca955
mov eax, dword [rbp - 0x4040]
mov r8, rax
lea rax, [rbp - 0x403c]
mov r11, rax
lea rax, [rbp - 0x4050]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00476fcd
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x4050]
mov r11, rax
lea rax, [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, 1
mov byte [rbp - 0x11], al
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x28]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, dword [rbp - 0x20]
mov r9, rax
mov eax, 4
mov r8, rax
lea r11, [rsp + 0x20]
lea rax, [rbp - 0x4070]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0046ad9d
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x4070]
mov r11, rax
lea rax, [rbp - 0x4060]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x4060]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r11, [rsp + 0x20]
lea rax, [rbp - 0x4090]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00467606
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x4090]
mov r11, rax
lea rax, [rbp - 0x4080]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x4080]
mov r11, rax
lea rax, [rbp - 0x40a0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
movzx eax, byte [rbp - 0x11]
cmp eax, 0
je 0x4ca910
lea rax, [rbp - 0x28]
mov r10, rax
mov rcx, r10
call fcn.0046f145
movzx eax, byte [rbp - 1]
cmp eax, 0
je 0x4ca92c
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_CloseHandle
mov rax, qword [rbp + 0x10]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x40a0]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x4caa82
lea rax, str.os.executable___saw_that_the_executable_file_path_was_too_long
mov qword [rbp - 0x40b0], rax
mov eax, 0x3e
mov dword [rbp - 0x40a8], eax
mov eax, 1
mov dword [rbp - 0x40a4], eax
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x40b0]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r10, [rsp + 0x20]
mov rcx, r10
call fcn.004596c5
mov eax, dword [rbp - 0x2034]
mov r8, rax
mov rax, qword [rbp - 0x2030]
mov r11, rax
lea rax, [rbp - 0x40d0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00476fcd
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x40d0]
mov r11, rax
lea rax, [rbp - 0x40c0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x40c0]
mov r11, rax
lea rax, [rbp - 0x40e0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
movzx eax, byte [rbp - 0x11]
cmp eax, 0
je 0x4caa3d
lea rax, [rbp - 0x28]
mov r10, rax
mov rcx, r10
call fcn.0046f145
movzx eax, byte [rbp - 1]
cmp eax, 0
je 0x4caa59
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_CloseHandle
mov rax, qword [rbp + 0x10]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x40e0]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x4caa82
leave
ret