Function at 0x7d2334e0
Capabilities:
Get file attributes

Disassembly:
mov r11, rsp
push rbp
push rsi
push r12
push r13
sub rsp, 0xb8
xor r13d, r13d
mov dword [r11 - 0x58], 0x30
lea rax, [r11 - 0x78]
mov qword [r11 - 0x50], r13
xorps xmm0, xmm0
mov qword [r11 - 0x48], rax
movdqu xmmword [r11 - 0x38], xmm0
or rbp, 0xffffffffffffffff
mov dword [r11 - 0x40], 0x40
movzx esi, dl
mov r12, rcx
inc rbp
cmp word [rcx + rbp*2], r13w
jne 0x7d233522
mov dword [rsp + 0x50], r13d
lea r9, [rsp + 0x70]
mov qword [rsp + 0x48], r13
lea r8, [rsp + 0x80]
mov dword [rsp + 0x40], 0x21
lea rcx, [rsp + 0xe0]
mov dword [rsp + 0x38], 1
add ebp, ebp
mov dword [rsp + 0x30], 7
mov edx, 0x120089
mov dword [rsp + 0x28], r13d
mov word [rsp + 0x60], bp
lea eax, [rbp + 2]
mov qword [rsp + 0x68], r12
mov word [rsp + 0x62], ax
mov qword [rsp + 0x20], r13
call qword [0x7d2ac098]
test eax, eax
js 0x7d233665
mov qword [rsp + 0xe8], rbx
mov ecx, 0x2a0
mov qword [rsp + 0xf0], rdi
call fcn.7d221988
mov rbx, rax
mov dl, 1
mov rcx, qword [rsp + 0xe0]
lea rax, [rsp + 0x70]
mov byte [rsp + 0x50], dl
xor r9d, r9d
mov qword [rsp + 0x48], r13
xor r8d, r8d
mov byte [rsp + 0x40], 1
xor edx, edx
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 0x2a0
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
xor dl, dl
mov edi, eax
test eax, eax
js 0x7d233673
mov eax, dword [rbx + 0x3c]
cmp eax, 2
jne 0x7d233611
cmp word [rbx + 0x40], 0x2e
jne 0x7d233611
mov cl, 1
jmp 0x7d233613
xor cl, cl
cmp eax, 4
jne 0x7d23362a
cmp word [rbx + 0x40], 0x2e
jne 0x7d23362a
cmp word [rbx + 0x42], 0x2e
jne 0x7d23362a
mov al, 1
jmp 0x7d23362c
xor al, al
test cl, cl
jne 0x7d2335b3
test al, al
jne 0x7d2335b3
mov edi, 0xc0000101
mov rcx, rbx
call fcn.7d221938
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ntdll.dll_NtClose]
mov rbx, qword [rsp + 0xe8]
mov eax, edi
mov rdi, qword [rsp + 0xf0]
add rsp, 0xb8
pop r13
pop r12
pop rsi
pop rbp
ret
cmp eax, 0x80000006
je 0x7d233681
cmp eax, 0xc000000f
jne 0x7d23363d
mov edi, r13d
test sil, sil
jne 0x7d23363d
mov qword [rsp + 0xb0], r15
mov r15b, 1
mov qword [rsp + 0xf8], r14
nop dword [rax]
mov rcx, qword [rsp + 0xe0]
lea rax, [rsp + 0x70]
mov byte [rsp + 0x50], r15b
xor r9d, r9d
mov qword [rsp + 0x48], r13
xor r8d, r8d
mov byte [rsp + 0x40], 1
xor edx, edx
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 0x2a0
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [0x7d2ac0c0]
xor r15b, r15b
mov edi, eax
test eax, eax
js 0x7d2337b8
mov edx, dword [rbx + 0x3c]
cmp edx, 2
jne 0x7d233704
cmp word [rbx + 0x40], 0x2e
jne 0x7d233704
mov cl, 1
jmp 0x7d233706
xor cl, cl
cmp edx, 4
jne 0x7d23371d
cmp word [rbx + 0x40], 0x2e
jne 0x7d23371d
cmp word [rbx + 0x42], 0x2e
jne 0x7d23371d
mov al, 1
jmp 0x7d23371f
xor al, al
test cl, cl
jne 0x7d2337b0
test al, al
jne 0x7d2337b0
lea esi, [rdx + 4]
add esi, ebp
mov ecx, esi
call fcn.7d2212da
mov r8d, ebp
mov rdx, r12
mov rcx, rax
mov edi, ebp
mov r14, rax
call sub.ntdll.dll_memcpy
mov eax, 0x5c
shr rdi, 1
lea rdi, [r14 + rdi*2]
mov word [rdi], ax
lea rdx, [rbx + 0x40]
mov r8d, dword [rbx + 0x3c]
lea rcx, [rdi + 2]
call sub.ntdll.dll_memcpy
mov eax, dword [rbx + 0x3c]
lea rcx, [rsp + 0x80]
shr rax, 1
mov word [rdi + rax*2 + 2], r13w
lea eax, [rsi - 2]
mov word [rsp + 0x60], ax
mov word [rsp + 0x62], si
mov qword [rsp + 0x68], r14
call qword [0x7d2ac0d8]
mov rcx, r14
mov edi, eax
call fcn.7d221938
cmp edi, 0xc0000034
je 0x7d2336a0
test edi, edi
jns 0x7d2336a0
mov rcx, rbx
call fcn.7d221938
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ntdll.dll_NtClose]
mov r15, qword [rsp + 0xb0]
mov r14, qword [rsp + 0xf8]
cmp edi, 0x80000006
je 0x7d2337f2
cmp edi, 0xc000000f
jne 0x7d233653
mov edi, r13d
jmp 0x7d233653