Function at 0x14008b238
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x14017a608]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor r12d, r12d
mov qword [rsp + 0x40], rdx
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
jne 0x14008b286
lea r8, str.wszFilePath
mov edx, 0x17a
lea rcx, str.base_stor_blbutil_networkutils.cpp
call fcn.14008ac24
mov qword [rdi], r12
mov r14, r12
mov r13, r12
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x14008b2c6
test byte [rcx + 0x1c], 1
je 0x14008b2c6
cmp byte [rcx + 0x19], 4
jb 0x14008b2c6
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015d9c0]
mov edx, 0x11
mov r9, rbx
call fcn.1400112c8
or rbp, 0xffffffffffffffff
mov rax, rbp
inc rax
cmp word [rbx + rax*2], r12w
jne 0x14008b2cd
cmp rax, 2
jae 0x14008b2e7
mov ebx, 0x80070057
jmp 0x14008b7c2
lea rdx, [0x14015d9b4]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcsstr]
nop dword [rax + rax]
cmp rax, rbx
jne 0x14008b2dd
lea rcx, [rbx + 4]
mov rax, rbp
inc rax
cmp word [rcx + rax*2], r12w
jne 0x14008b309
cmp rax, 2
jb 0x14008b2dd
lea rdx, [0x140157a78]
call qword [sym.imp.msvcrt.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
je 0x14008b2dd
mov rcx, rbp
inc rcx
cmp word [rax + rcx*2 + 2], r12w
jne 0x14008b334
cmp rcx, 2
jb 0x14008b2dd
lea rdx, [0x140157a78]
lea rcx, [rax + 2]
call qword [sym.imp.msvcrt.dll_wcsstr]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x14008b2dd
sub rsi, rbx
sar rsi, 1
inc rsi
lea rdi, [rsi + rsi]
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov r15, rax
test rax, rax
jne 0x14008b396
mov ebx, 0x8007000e
jmp 0x14008b7c2
mov r8, rdi
xor edx, edx
mov rcx, r15
call sub.msvcrt.dll_memset
lea rax, [rsi - 1]
mov edx, 0x7ffffffe
lea rcx, [rsi - 1]
mov edi, 0x80070057
cmp rax, rdx
ja 0x14008b4e8
cmp rcx, rdx
jbe 0x14008b3ce
mov word [r15], r12w
mov ebx, edi
jmp 0x14008b79f
mov rcx, r15
sub rbx, r15
lea rax, [rsi - 1]
test rax, rax
je 0x14008b3f2
movzx eax, word [rbx + rcx]
test ax, ax
je 0x14008b3f2
mov word [rcx], ax
add rcx, 2
dec rsi
jmp 0x14008b3d4
test rsi, rsi
lea rax, [rcx - 2]
cmovne rax, rcx
neg rsi
mov word [rax], r12w
sbb eax, eax
not eax
and eax, 0x8007007a
mov ebx, eax
test eax, eax
js 0x14008b79f
mov rcx, qword [0x14017a048]
lea rsi, [0x14017a048]
cmp rcx, rsi
je 0x14008b44e
test byte [rcx + 0x1c], 1
je 0x14008b44e
cmp byte [rcx + 0x19], 4
jb 0x14008b44e
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015d9c0]
mov edx, 0x12
mov r9, r15
call fcn.1400112c8
xor r9d, r9d
mov qword [rsp + 0x30], r12
mov ebx, 0x80000000
mov dword [rsp + 0x28], 0x2000000
mov edx, ebx
mov dword [rsp + 0x20], 3
mov rcx, r15
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov r12, rax
cmp rax, rbp
jne 0x14008b4fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x14008b4a3
movzx ebx, ax
or ebx, 0x80070000
mov rcx, qword [0x14017a048]
cmp rcx, rsi
je 0x14008b79f
test byte [rcx + 0x1c], 1
je 0x14008b79f
cmp byte [rcx + 0x19], 2
jb 0x14008b79f
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015d9c0]
mov edx, 0x13
mov dword [rsp + 0x20], ebx
mov r9, r15
call fcn.140011330
jmp 0x14008b79f
mov ebx, edi
mov eax, edi
test rsi, rsi
je 0x14008b40d
mov word [r15], r12w
jmp 0x14008b79f
xor esi, esi
mov dword [rsp + 0x20], 0x31
xorps xmm0, xmm0
mov qword [rsp + 0x58], rsi
lea r8, [rsp + 0x58]
mov rcx, r12
lea rdx, [rsp + 0x48]
lea r9d, [rsi + 8]
movups xmmword [rsp + 0x48], xmm0
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
mov ecx, eax
add eax, ebx
test ebx, eax
jne 0x14008b5a5
cmp ecx, 0x80000005
je 0x14008b5a5
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x14008b55d
movzx ebx, ax
or ebx, 0x80070000
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x14008b77c
test byte [rcx + 0x1c], 1
je 0x14008b77c
cmp byte [rcx + 0x19], 2
jb 0x14008b77c
mov edx, 0x14
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015d9c0]
mov r9d, ebx
call fcn.140006bc4
jmp 0x14008b77c
mov ebx, dword [rsp + 0x58]
add ebx, 8
mov ecx, ebx
mov esi, ebx
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov r13, rax
test rax, rax
jne 0x14008b5ce
mov ebx, 0x8007000e
jmp 0x14008b77c
mov r8, rsi
xor edx, edx
mov rcx, r13
call sub.msvcrt.dll_memset
xorps xmm0, xmm0
mov dword [rsp + 0x20], 0x31
mov r9d, ebx
lea rdx, [rsp + 0x48]
mov r8, r13
mov rcx, r12
movups xmmword [rsp + 0x48], xmm0
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
xor esi, esi
test eax, eax
jns 0x14008b65d
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x14008b628
movzx ebx, ax
or ebx, 0x80070000
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x14008b77c
test byte [rcx + 0x1c], 1
je 0x14008b77c
cmp byte [rcx + 0x19], 2
jb 0x14008b77c
mov edx, 0x15
jmp 0x14008b58d
lea rbx, [r13 + 4]
lea rcx, [rbx + 2]
inc rbp
cmp word [rcx + rbp*2], si
jne 0x14008b665
cmp rbp, 2
jae 0x14008b67b
mov ebx, edi
jmp 0x14008b77c
lea rdx, [0x140157a78]
call qword [sym.imp.msvcrt.dll_wcsstr]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x14008b674
sub rsi, rbx
sub rsi, 2
sar rsi, 1
inc rsi
lea rbp, [rsi + rsi]
mov rcx, rbp
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov r14, rax
test rax, rax
je 0x14008b5c4
mov r8, rbp
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
lea rax, [rsi - 1]
mov edx, 0x7ffffffe
lea rcx, [rsi - 1]
cmp rax, rdx
ja 0x14008b7ea
cmp rcx, rdx
jbe 0x14008b6f2
xor eax, eax
mov word [r14], ax
jmp 0x14008b674
sub rbx, r14
mov rcx, r14
xor ebp, ebp
lea rax, [rsi - 1]
test rax, rax
je 0x14008b719
movzx eax, word [rbx + rcx + 2]
test ax, ax
je 0x14008b719
mov word [rcx], ax
add rcx, 2
dec rsi
jmp 0x14008b6fa
test rsi, rsi
lea rax, [rcx - 2]
cmovne rax, rcx
neg rsi
sbb edi, edi
not edi
and edi, 0x8007007a
mov word [rax], bp
mov ebx, edi
test edi, edi
js 0x14008b77c
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x14008b771
test byte [rcx + 0x1c], 1
je 0x14008b771
cmp byte [rcx + 0x19], 4
jb 0x14008b771
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015d9c0]
mov edx, 0x16
mov r9, r14
call fcn.1400112c8
mov rax, qword [rsp + 0x40]
mov qword [rax], r14
mov r14, rbp
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test r14, r14
je 0x14008b79f
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, r15
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
test r13, r13
je 0x14008b7c2
mov rcx, r13
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140001d90
mov rbx, qword [rsp + 0xc0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor ebp, ebp
mov ebx, edi
test rsi, rsi
je 0x14008b734
mov word [r14], bp
jmp 0x14008b77c