Function at 0x14003f440
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2070]
mov eax, 0x2170
call fcn.140005810
sub rsp, rax
mov rax, qword [0x14013c170]
xor rax, rsp
mov qword [rbp + 0x2060], rax
mov r14, qword [rbp + 0x20d8]
xor eax, eax
xor r15d, r15d
mov r12d, r9d
mov rbx, r8
mov rsi, rdx
mov dword [rsp + 0x74], eax
mov r13, rcx
mov qword [rsp + 0x60], 0xffffffffffffffff
mov dword [rsp + 0x70], 0xc0000365
mov qword [rsp + 0x78], 0xffffffffffffffd5
cmp r9d, 2
je 0x14003f604
mov qword [rbp - 0x78], rcx
mov qword [rbp - 0x70], rdx
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x80]
mov dword [rbp - 0x80], 0x30
mov dword [rbp - 0x68], 0x40
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], r15
call qword [sym.imp.ntdll.dll_NtQueryFullAttributesFile]
mov edi, eax
test eax, eax
js 0x14003f594
mov r10, qword [rbp + 0x10]
bt r10d, 0xa
jb 0x14003f604
mov rax, qword [rbp + 8]
movabs rdx, 0x5e6684f4b3960000
or rcx, 0xffffffffffffffff
mov qword [rbx], rax
mov rax, qword [rbp]
and r10d, 0x7fff
mov qword [rbx + 8], rax
mov rax, qword [rbp - 0x20]
shl r10d, 0x10
mov rdi, r14
xor r9d, r9d
imul rax, rax, 0x64
add rax, rdx
mov qword [rbx + 0x28], rax
mov rax, qword [rbp - 0x18]
imul rax, rax, 0x64
add rax, rdx
mov qword [rbx + 0x10], rax
mov rax, qword [rbp - 0x10]
imul rax, rax, 0x64
add rax, rdx
mov qword [rbx + 0x18], rax
mov rax, qword [rbp - 8]
imul rax, rax, 0x64
add rax, rdx
mov rdx, r14
mov qword [rbx + 0x20], rax
xor eax, eax
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov ecx, r10d
call fcn.140039170
mov r8d, r12d
mov rdx, rbx
xor ecx, ecx
mov dword [rbx + 0x34], r12d
mov dword [rbx + 0x30], eax
call fcn.14003ed80
jmp 0x14003fa84
cmp eax, 0xc0000024
je 0x14003f5ce
cmp eax, 0xc0000033
je 0x14003f5ce
cmp eax, 0xc000000d
je 0x14003f5ce
cmp eax, 0xc0000022
je 0x14003f5bb
cmp eax, 0xc0000043
je 0x14003f5bb
mov ecx, eax
jmp 0x14003f5f4
mov dword [rsp + 0x70], 0xc0000365
mov qword [rsp + 0x78], 0xffffffffffffffd5
jmp 0x14003f604
lea r9, [rbp - 0x20]
lea rcx, [rbp - 0x80]
mov r8d, r12d
mov rdx, rbx
mov qword [rsp + 0x20], 0x2078
call fcn.14003edf0
test eax, eax
jns 0x14003fa84
mov ecx, edi
call sym.VBoxControl.exe_RTErrConvertFromNtStatus
mov edi, eax
cmp eax, 0x34
jne 0x14003fa82
mov edi, dword [rbp + 0x20d0]
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x48], r15
mov eax, edi
lea r9, [rsp + 0x70]
lea r8, [rbp - 0x80]
shl eax, 0x14
lea rcx, [rsp + 0x60]
mov edx, 0x100080
not eax
mov dword [rbp - 0x80], 0x30
mov qword [rbp - 0x78], r13
and eax, 0x200000
mov dword [rbp - 0x68], 0x40
mov qword [rbp - 0x70], rsi
or eax, 0x4020
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], r15
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], r15
call qword [sym.imp.ntdll.dll_NtCreateFile]
test eax, eax
js 0x14003f7a9
mov rcx, qword [rsp + 0x60]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x70]
mov r9d, 8
mov dword [rsp + 0x20], 0x23
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jns 0x14003f6bc
mov eax, r15d
mov ecx, r15d
mov dword [rsp + 0x6c], eax
mov dword [rsp + 0x68], ecx
jmp 0x14003f6c4
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x68]
bt ecx, 0xa
jae 0x14003f765
cmp eax, 0xa000000c
je 0x14003f765
test dil, 2
jne 0x14003f765
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x40], 0x4020
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 7
lea r9, [rsp + 0x70]
lea r8, [rbp - 0x80]
lea rcx, [rbp - 0x30]
mov edx, 0x100080
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x70], 0xc0000365
mov qword [rsp + 0x78], 0xffffffffffffffd5
mov qword [rsp + 0x20], r15
call qword [sym.imp.ntdll.dll_NtCreateFile]
test eax, eax
js 0x14003f761
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov rdx, qword [rbp - 0x30]
mov eax, r15d
mov dword [rsp + 0x6c], eax
mov dword [rsp + 0x68], r15d
mov qword [rsp + 0x60], rdx
jmp 0x14003f765
mov eax, dword [rsp + 0x6c]
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x30], eax
lea rdx, [rbp - 0x20]
mov r9, rbx
mov r8d, 0x2078
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r12d
call fcn.14003f230
mov rcx, qword [rsp + 0x60]
mov edi, eax
call qword [sym.imp.ntdll.dll_NtClose]
test edi, edi
jns 0x14003fa82
mov edi, 0xffffffcc
jmp 0x14003fa82
cmp eax, 0xc0000022
je 0x14003f7cb
cmp eax, 0xc0000043
je 0x14003f7cb
mov ecx, eax
call sym.VBoxControl.exe_RTErrConvertFromNtStatus
mov edi, eax
cmp eax, 0x34
jne 0x14003fa82
jmp 0x14003f7dc
mov dword [rsp + 0x70], 0xc0000365
mov qword [rsp + 0x78], 0xffffffffffffffd5
movzx r8d, word [rsi]
mov rdi, qword [rsi + 8]
mov ecx, r8d
shr rcx, 1
je 0x14003f819
cmp word [rdi + rcx*2 - 2], 0x5c
jne 0x14003f7f7
dec rcx
test rcx, rcx
je 0x14003f82e
lea rax, [rdi + rcx*2 - 2]
movzx edx, word [rax]
cmp dx, 0x5c
je 0x14003f819
cmp dx, 0x2f
je 0x14003f819
sub rax, 2
dec rcx
jne 0x14003f801
test rcx, rcx
je 0x14003f82e
movzx eax, cx
mov qword [rbp - 0x48], rdi
add ax, ax
mov word [rbp - 0x50], ax
jmp 0x14003f847
lea rax, [0x14012f9a8]
mov qword [rbp - 0x48], rax
mov eax, 2
mov word [rbp - 0x50], ax
mov eax, 4
mov dword [rsp + 0x50], r15d
mov word [rbp - 0x4e], ax
lea rax, [rdi + rcx*2]
mov qword [rsp + 0x48], r15
mov qword [rbp - 0x38], rax
movzx eax, word [rsi + 2]
add cx, cx
mov dword [rsp + 0x40], 0x4021
mov dword [rsp + 0x38], 1
sub ax, cx
sub r8w, cx
mov dword [rsp + 0x30], 7
mov word [rbp - 0x3e], ax
lea rax, [rbp - 0x50]
mov word [rbp - 0x40], r8w
lea r9, [rsp + 0x70]
lea r8, [rbp - 0x80]
lea rcx, [rsp + 0x60]
mov edx, 0x100001
mov dword [rsp + 0x28], 0x80
mov qword [rbp - 0x70], rax
mov dword [rbp - 0x80], 0x30
mov qword [rbp - 0x78], r13
mov dword [rbp - 0x68], 0x40
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.ntdll.dll_NtCreateFile]
test eax, eax
js 0x14003fa79
mov rax, qword gs:[0x60]
mov byte [rsp + 0x50], r15b
mov esi, 3
mov edx, dword [rax + 0x118]
mov rax, qword gs:[0x60]
mov ecx, dword [rax + 0x11c]
shl rdx, 0x20
movabs rax, 0x500000000
or rdx, rcx
mov ecx, 0x25
cmp rdx, rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x48], rax
cmova esi, ecx
mov rcx, qword [rsp + 0x60]
mov byte [rsp + 0x40], 1
mov dword [rsp + 0x38], esi
lea rax, [rbp - 0x20]
mov dword [rsp + 0x30], 0x2078
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
test eax, eax
js 0x14003fa63
mov rax, qword [rbp + 8]
mov r9d, dword [rbp + 0x20]
movabs rdx, 0x5e6684f4b3960000
mov qword [rbx], rax
mov rax, qword [rbp + 0x10]
or rcx, 0xffffffffffffffff
mov qword [rbx + 8], rax
mov rax, qword [rbp - 0x18]
mov rdi, r14
imul rax, rax, 0x64
add rax, rdx
mov qword [rbx + 0x28], rax
mov rax, qword [rbp - 0x10]
imul rax, rax, 0x64
add rax, rdx
mov qword [rbx + 0x10], rax
mov rax, qword [rbp - 8]
imul rax, rax, 0x64
add rax, rdx
mov qword [rbx + 0x18], rax
mov rax, qword [rbp]
imul rax, rax, 0x64
add rax, rdx
mov rdx, r14
mov qword [rbx + 0x20], rax
xor eax, eax
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov ecx, dword [rbp + 0x18]
and ecx, 0x7fff
shl ecx, 0x10
call fcn.140039170
mov dword [rbx + 0x34], r12d
mov dword [rbx + 0x30], eax
cmp r12d, 2
jne 0x14003fa47
mov rcx, qword [rsp + 0x60]
mov rax, r15
cmp esi, 0x25
cmove rax, qword [rbp + 0x40]
lea r8, [rbp - 0x20]
lea rdx, [rsp + 0x70]
mov r9d, 0x800
mov qword [rbx + 0x38], 0xffffffffffffffff
mov qword [rbx + 0x40], 1
mov qword [rbx + 0x48], rax
mov qword [rbx + 0x50], r15
mov dword [rbx + 0x58], r15d
mov dword [rsp + 0x20], 1
call qword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
test eax, eax
js 0x14003fa47
mov eax, dword [rbp - 0x18]
mov dword [rbx + 0x44], eax
mov r8d, r12d
mov rdx, rbx
xor ecx, ecx
call fcn.14003ed80
mov rcx, qword [rsp + 0x60]
mov edi, eax
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x14003fa82
mov ecx, eax
call sym.VBoxControl.exe_RTErrConvertFromNtStatus
mov rcx, qword [rsp + 0x60]
mov edi, eax
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x14003fa82
mov ecx, eax
call sym.VBoxControl.exe_RTErrConvertFromNtStatus
mov edi, eax
mov eax, edi
mov rcx, qword [rbp + 0x2060]
xor rcx, rsp
call fcn.1400057e0
mov rbx, qword [rsp + 0x21c8]
add rsp, 0x2170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret