Function at 0x18009ae10
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov edi, dword [rsp + 0xf0]
lea r12d, [rcx + 0x302]
mov dword [rsp + 0x80], r12d
mov r14, r9
mov r13, r8
mov r15, rdx
mov esi, ecx
cmp ecx, r12d
jae 0x18009b17b
mov ebx, dword [rsp + 0xf0]
xor ecx, ecx
mov rbp, qword [rsp + 0x78]
nop dword [rax]
cmp esi, 0x105
ja 0x18009af96
je 0x18009af70
mov eax, esi
sub eax, 0x92
je 0x18009af2c
sub eax, 5
je 0x18009aecd
cmp eax, 0x69
jne 0x18009b16f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x90]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [rsp + 0xf0], 0xffffffff
je 0x18009b279
xor ecx, ecx
mov edi, ecx
jmp 0x18009b16f
cmp dword [r13], 2
jl 0x18009b283
mov rdx, qword [r14]
xor r9d, r9d
xor r8d, r8d
mov ecx, 0x119
call fcn.1800a59f0
test eax, eax
je 0x18009b283
movsxd rcx, dword [r13]
mov rax, qword [r14 + rcx*8 - 8]
mov qword [rsp + 0xa0], rax
cmp ecx, 2
je 0x18009b25d
xor edx, edx
mov r8d, 0x10b
mov rcx, r15
call fcn.18002b4e0
mov qword [rsp + 0x78], rax
mov rbp, rax
xor ecx, ecx
jmp 0x18009b16f
mov qword [rsp + 0x28], rcx
mov r9d, 0x62
xor ecx, ecx
mov qword [rsp + 0x20], r15
xor r8d, r8d
xor edx, edx
call fcn.180064120
mov qword [rsp + 0x90], rax
test rax, rax
je 0x18009b279
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsp + 0xf0], eax
xor ecx, ecx
jmp 0x18009b16f
test rbp, rbp
je 0x18009b283
mov rax, qword [r14]
mov rax, qword [rax + 8]
mov qword [rsp + 0x98], rax
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x70], rax
jmp 0x18009b16f
mov eax, esi
sub eax, 0x16e
je 0x18009b17b
sub eax, 5
je 0x18009afcf
cmp eax, 0x6e
jne 0x18009b16f
mov r9, qword [rsp + 0x78]
mov r8d, 0x122
mov rdx, r15
xor ecx, ecx
call fcn.1800e50a0
xor ebp, ebp
mov eax, ebp
jmp 0x18009b17d
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x2c]
cmp eax, 1
jb 0x18009b16a
mov rbp, qword [rsp + 0x70]
mov esi, eax
mov qword [rsp + 0x88], rax
nop dword [rax]
nop word [rax + rax]
xor edx, edx
mov r9, rbp
xor r8d, r8d
lea ecx, [rdx + 0x28]
call fcn.1800f5c10
mov qword [rsp + 0xa8], rax
test rax, rax
je 0x18009b138
mov ecx, dword [r13]
mov r12d, 1
dec ecx
cmp ecx, r12d
jle 0x18009b109
lea r15, [r14 + 8]
nop word [rax + rax]
mov r14, qword [r15]
mov esi, 0x119
xor ebp, ebp
nop word [rax + rax]
mov eax, esi
sub eax, 0x11
je 0x18009b1e3
sub eax, 0x46
je 0x18009b1a4
sub eax, 0x7f
je 0x18009b212
sub eax, 0x43
je 0x18009b198
cmp eax, 0xa15b
jne 0x18009b1fb
mov eax, ebx
xor edx, edx
test eax, eax
je 0x18009b0de
mov rax, qword [r15]
xor r9d, r9d
mov rcx, qword [rsp + 0xa0]
mov r8, qword [rsp + 0xa8]
mov qword [rsp + 0x60], rdx
mov dword [rsp + 0x58], 0x63
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rcx
xor ecx, ecx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rdx
mov rdx, qword [rax + 8]
call fcn.1800aaf30
test eax, eax
jne 0x18009b0f4
mov eax, dword [r13]
inc r12d
dec eax
add r15, 8
cmp r12d, eax
jl 0x18009b040
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x88]
mov r14, qword [rsp + 0x108]
mov eax, dword [r13]
dec eax
cmp r12d, eax
jl 0x18009b138
mov rax, qword [rsp + 0x78]
lea rdx, [rsp + 0x70]
mov r9d, 0x92
mov dword [rsp + 0x70], 1
mov rcx, rbp
mov r8, qword [rax + 8]
call fcn.18003c5d0
mov rbp, qword [rbp + 0x48]
sub rsi, 1
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x88], rsi
jne 0x18009b000
mov rbp, qword [rsp + 0x78]
xor ecx, ecx
mov r15, qword [rsp + 0xf8]
mov r12d, dword [rsp + 0x80]
mov esi, 0x173
add esi, 0x6e
cmp esi, r12d
jb 0x18009ae70
mov eax, edi
mov rbx, qword [rsp + 0x100]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ebx, dword [r14 + 0x10]
shr ebx, 6
and ebx, 1
jmp 0x18009b1fb
test r14, r14
je 0x18009b1fb
mov rdx, qword [r14 + 0x10]
test rdx, rdx
je 0x18009b1c1
xor r9d, r9d
xor r8d, r8d
lea ecx, [r9 + 0x57]
call fcn.1800a59f0
mov rdx, qword [r14 + 0x18]
test rdx, rdx
je 0x18009b1d9
xor r9d, r9d
xor r8d, r8d
lea ecx, [r9 + 0x57]
call fcn.1800a59f0
mov rcx, qword [r14 + 8]
xor edx, edx
call rbp
jmp 0x18009b1fb
xor r9d, r9d
mov rdx, r14
xor ecx, ecx
lea r8d, [r9 + 0x45]
call fcn.1800d5280
mov qword [r14 + 0x2a8], rbp
add esi, 0xa15b
cmp esi, 0x326c7
jbe 0x18009b050
jmp 0x18009b081
lea rsi, str.IsStoredValue
nop dword [rax]
mov rax, qword [rsi]
mov r8, r14
mov r9, qword [rsi + 8]
mov rdx, r14
mov ecx, 0x46
mov qword [rsp + 0x20], rax
call fcn.180096e30
mov rbx, rax
test eax, eax
jne 0x18009b083
inc ebp
add rsi, 0x10
cmp ebp, 0x7c
jb 0x18009b220
xor edx, edx
mov ebx, edx
mov eax, edx
jmp 0x18009b085
mov r9, qword [r14]
mov r8d, 0x122
mov rdx, r15
xor ecx, ecx
call fcn.1800e50a0
xor ebp, ebp
mov eax, ebp
jmp 0x18009b17d
mov eax, 0xffffffff
jmp 0x18009b17d
xor r9d, r9d
xor edx, edx
mov r8d, 0xed
mov rcx, r15
call fcn.1800f3ce0
xor ebp, ebp
mov eax, ebp
jmp 0x18009b17d