Function at 0x180084330
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
lea rax, [rcx + 0x1000]
mov r14d, r8d
mov r15, rdx
cmp rax, 0x2000
jb 0x1800846b5
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x1800846b5
test r8d, 0xfffffff8
je 0x18008438d
mov eax, 0xfffffffe
add rsp, 0xb0
pop r15
pop r14
pop rbp
ret
mov eax, r8d
shr eax, 1
xor eax, r8d
test al, 1
je 0x18008437b
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
je 0x1800843b9
mov eax, 0xfffffffc
add rsp, 0xb0
pop r15
pop r14
pop rbp
ret
lea rax, [rbp - 0x29]
lea rdx, [rbp + 0x7f]
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
test eax, eax
jne 0x1800843f3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
add rsp, 0xb0
pop r15
pop r14
pop rbp
ret
test byte [rbp + 0x7f], 4
jne 0x1800843a7
cmp dword [rbp - 0x29], 1
jne 0x1800843a7
mov qword [rsp + 0xd8], rbx
xor ebx, ebx
lea r8, [rbp - 0x21]
mov dword [rsp + 0x30], ebx
lea rdx, [rbp - 0x25]
xor r9d, r9d
mov rcx, r15
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
test eax, eax
jne 0x180084441
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
jmp 0x180084647
mov eax, dword [rbp - 0x25]
test al, 1
jne 0x180084452
test al, 2
jne 0x180084452
cmp dword [rbp - 0x21], 1
jbe 0x18008445c
mov eax, 0xfffffffc
jmp 0x180084647
lea rdx, str.D:_tinderboxwin_4.2_srcVBoxRuntime_r3winpipe_win.cpp
mov ecx, 0x98
mov qword [rsp + 0x98], r12
call sym.VBoxRT.dll_RTMemAllocZTag
mov r12, rax
test rax, rax
jne 0x180084487
lea eax, [r12 - 8]
jmp 0x18008463f
lea rcx, [rax + 0x60]
mov qword [rsp + 0x90], r13
call sym.VBoxRT.dll_RTCritSectInit
mov r13d, eax
test eax, eax
js 0x18008462c
mov edx, 1
xor r9d, r9d
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [r12 + 0x38], rax
test rax, rax
je 0x180084622
movzx eax, r14b
lea rcx, [rbp - 1]
xor edx, edx
and al, 1
mov dword [r12], 0x19570528
mov qword [r12 + 8], r15
mov byte [r12 + 0x10], al
xor eax, eax
mov qword [r12 + 0x58], rbx
lea r8d, [rax + 0x28]
mov qword [rbp - 0x19], 0xffffffffffffffff
mov qword [rbp - 0x11], rax
mov qword [rbp - 9], rax
call sub.MSVCR100.dll_memset
lea r8, [rbp - 1]
lea rdx, [rbp - 0x11]
mov r9d, 0x28
mov rcx, r15
mov dword [rsp + 0x20], 0x18
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
js 0x18008452d
mov r13d, ebx
jmp 0x1800845ea
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0xa0], rdi
mov eax, 0x80000000
mov esi, r14d
mov edi, 0x40000080
shr esi, 2
and esi, 1
cmp byte [r12 + 0x10], bl
cmovne edi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 0
lea r9, [rbp - 0x19]
mov r8, rbx
mov rdx, r15
mov rcx, rax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0xa8]
test eax, eax
je 0x18008465c
mov rbx, qword [rbp - 0x19]
xor eax, eax
lea rcx, [rbp - 1]
lea r8d, [rax + 0x28]
xor edx, edx
mov qword [rbp - 0x11], rax
mov qword [r12 + 8], rbx
mov qword [rbp - 9], rax
call sub.MSVCR100.dll_memset
lea r8, [rbp - 1]
lea rdx, [rbp - 0x11]
mov r9d, 0x28
mov rcx, rbx
mov dword [rsp + 0x20], 0x18
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
js 0x1800845f7
xor r13d, r13d
cmp qword [rbp - 0x19], 0xffffffffffffffff
jne 0x1800846a1
jmp 0x180084664
mov rcx, qword [rbp - 0x19]
mov r13d, 0xffffffda
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x19]
cmp rcx, 0xffffffffffffffff
je 0x180084617
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [r12 + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [r12 + 0x60]
call sym.VBoxRT.dll_RTCritSectDelete
mov rcx, r12
call sym.VBoxRT.dll_RTMemFree
mov eax, r13d
mov r13, qword [rsp + 0x90]
mov r12, qword [rsp + 0x98]
mov rbx, qword [rsp + 0xd8]
add rsp, 0xb0
pop r15
pop r14
pop rbp
ret
mov qword [rbp - 0x19], 0xffffffffffffffff
shr r14d, 2
mov edx, 1
mov rcx, r15
and r14d, 1
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x180084691
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
mov r13d, eax
test r13d, r13d
js 0x180084607
cmp qword [rbp - 0x19], 0xffffffffffffffff
je 0x1800846aa
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x67]
mov qword [rax], r12
xor eax, eax
jmp 0x180084637
mov eax, 0xfffffffa
add rsp, 0xb0
pop r15
pop r14
pop rbp
ret