Function at 0x10009a040
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor r15d, r15d
mov rdi, rdx
mov qword [rsp + 0x58], rdx
mov rbp, rcx
cmp rcx, r15
jne 0x10009a08e
lea r8, [0x100009bf0]
lea rcx, [0x100009b90]
mov edx, 0x15e
call fcn.100099ad8
mov qword [rdi], r15
mov r12, r15
mov r14, r15
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x10009a0ce
test byte [rcx + 0x1c], 1
je 0x10009a0ce
cmp byte [rcx + 0x19], 4
jb 0x10009a0ce
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003b28]
mov edx, 0x10
mov r9, rbp
call fcn.10001da24
or rbx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
mov rcx, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 2
jae 0x10009a0f3
mov edi, 0x80070057
jmp 0x10009a593
lea rdx, [0x100009bfc]
mov rcx, rbp
call sub.msvcrt.dll_wcsstr
cmp rax, rbp
jne 0x10009a0e9
xor eax, eax
lea rdi, [rbp + 4]
mov rcx, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 2
jb 0x10009a0e9
lea rdx, [0x100002954]
lea rcx, [rbp + 4]
call sub.msvcrt.dll_wcsstr
mov r11, rax
cmp rax, r15
je 0x10009a0e9
xor eax, eax
lea rdi, [r11 + 2]
mov rcx, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 2
jb 0x10009a0e9
lea rdx, [0x100002954]
lea rcx, [r11 + 2]
call sub.msvcrt.dll_wcsstr
mov rsi, rax
cmp rax, r15
je 0x10009a0e9
sub rsi, rbp
sar rsi, 1
inc rsi
lea rdi, [rsi + rsi]
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov r13, rax
cmp rax, r15
jne 0x10009a18f
mov edi, 0x8007000e
jmp 0x10009a577
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
lea r11, [rsi - 1]
mov edi, r15d
mov ebx, 0x80070057
cmp rsi, r15
je 0x10009a1b6
cmp rsi, 0x7fffffff
jbe 0x10009a1b8
mov edi, ebx
cmp edi, r15d
jl 0x10009a577
cmp r11, 0x7ffffffe
jbe 0x10009a1d3
mov edi, ebx
mov word [r13], r15w
jmp 0x10009a216
mov rcx, r13
mov edi, r15d
cmp rsi, r15
je 0x10009a209
sub r11, rsi
sub rbp, r13
lea rax, [r11 + rsi]
cmp rax, r15
je 0x10009a204
movzx eax, word [rcx + rbp]
cmp ax, r15w
je 0x10009a204
mov word [rcx], ax
add rcx, 2
sub rsi, 1
jne 0x10009a1e4
cmp rsi, r15
jne 0x10009a212
sub rcx, 2
mov edi, 0x8007007a
mov word [rcx], r15w
cmp edi, r15d
jl 0x10009a577
mov rcx, qword [0x1001653b8]
lea rsi, [0x1001653b8]
cmp rcx, rsi
je 0x10009a256
test byte [rcx + 0x1c], 1
je 0x10009a256
cmp byte [rcx + 0x19], 4
jb 0x10009a256
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003b28]
mov edx, 0x11
mov r9, r13
call fcn.10001da24
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov edx, 0x80000000
lea r8d, [r9 + 7]
mov rcx, r13
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x10009a2e1
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x10009a557
test byte [rcx + 0x1c], 1
je 0x10009a557
cmp byte [rcx + 0x19], 2
jb 0x10009a557
mov rcx, qword [rcx + 0x10]
lea edx, [r15 + 0x13]
lea r8, [0x100003b28]
mov r9, r13
mov dword [rsp + 0x20], edi
call fcn.10001daa4
jmp 0x10009a557
xor eax, eax
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x48]
lea ebp, [rax + 0x31]
lea r9d, [rax + 8]
mov rcx, r15
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], ebp
mov qword [rsp + 0x50], rax
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jns 0x10009a360
cmp eax, 0x80000005
je 0x10009a360
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x10009a557
test byte [rcx + 0x1c], 1
je 0x10009a557
cmp byte [rcx + 0x19], 2
jb 0x10009a557
lea edx, [rbp - 0x1e]
jmp 0x10009a404
mov edi, dword [rsp + 0x60]
add edi, 8
mov ecx, edi
mov esi, edi
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov r14, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x10009a388
mov edi, 0x8007000e
jmp 0x10009a557
mov r8, rsi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
xor r11d, r11d
lea rdx, [rsp + 0x48]
mov r9d, edi
mov r8, r14
mov rcx, r15
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x50], r11
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jns 0x10009a41c
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x10009a557
test byte [rcx + 0x1c], 1
je 0x10009a557
cmp byte [rcx + 0x19], 2
jb 0x10009a557
mov edx, 0x14
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003b28]
mov r9d, edi
call fcn.10001c7dc
jmp 0x10009a557
or rcx, 0xffffffffffffffff
add r14, 4
xor eax, eax
lea rbp, [r14 + 2]
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 2
jae 0x10009a443
mov edi, ebx
jmp 0x10009a552
lea rdx, [0x100002954]
mov rcx, rbp
call sub.msvcrt.dll_wcsstr
mov rsi, rax
test rax, rax
je 0x10009a43c
sub rsi, r14
sub rsi, 2
sar rsi, 1
inc rsi
lea rdi, [rsi + rsi]
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
xor r14d, r14d
mov r12, rax
cmp rax, r14
jne 0x10009a489
mov edi, 0x8007000e
jmp 0x10009a552
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
lea r11, [rsi - 1]
mov edi, r14d
cmp rsi, r14
je 0x10009a4ab
cmp rsi, 0x7fffffff
jbe 0x10009a4ad
mov edi, ebx
cmp edi, r14d
jl 0x10009a552
cmp r11, 0x7ffffffe
jbe 0x10009a4c8
mov edi, ebx
mov word [r12], r14w
jmp 0x10009a50b
mov rcx, r12
mov edi, r14d
cmp rsi, r14
je 0x10009a4fe
sub r11, rsi
sub rbp, r12
lea rax, [r11 + rsi]
cmp rax, r14
je 0x10009a4f9
movzx eax, word [rcx + rbp]
cmp ax, r14w
je 0x10009a4f9
mov word [rcx], ax
add rcx, 2
sub rsi, 1
jne 0x10009a4d9
cmp rsi, r14
jne 0x10009a507
sub rcx, 2
mov edi, 0x8007007a
mov word [rcx], r14w
cmp edi, r14d
jl 0x10009a552
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x10009a547
test byte [rcx + 0x1c], 1
je 0x10009a547
cmp byte [rcx + 0x19], 4
jb 0x10009a547
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003b28]
mov edx, 0x15
mov r9, r12
call fcn.10001da24
mov rax, qword [rsp + 0x58]
mov qword [rax], r12
mov r12, r14
mov r14, qword [rsp + 0x40]
cmp r15, 0xffffffffffffffff
je 0x10009a566
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r15d, r15d
cmp r12, r15
je 0x10009a577
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp r13, r15
je 0x10009a585
mov rcx, r13
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp r14, r15
je 0x10009a593
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, edi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.10014e480
mov rbx, qword [rsp + 0xc0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret