Function at 0x7fff25d92210
Capabilities:
Check os version
Get file attributes
Set file attributes

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x650
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rsp + 0x640], rax
mov r14, r9
mov qword [rsp + 0x1b0], r8
mov qword [rsp + 0x100], rdx
mov qword [rsp + 0x158], rcx
mov rbx, qword [rsp + 0x6b0]
mov rsi, qword [rsp + 0x6b8]
mov r15, qword [rsp + 0x6c0]
mov rax, qword [rsp + 0x6d8]
mov qword [rsp + 0x208], rax
mov qword [rsp + 0x218], rax
mov rax, qword [rsp + 0x6e0]
mov qword [rsp + 0x210], rax
mov qword [rsp + 0x220], rax
mov r12, qword [rsp + 0x6e8]
or rax, 0xffffffffffffffff
mov qword [r11 - 0x5f0], rax
mov qword [r11 - 0x5e8], rax
xor eax, eax
mov dword [rsp + 0xe0], eax
mov edi, eax
mov dword [rsp + 0x94], eax
mov dword [rsp + 0x130], eax
mov dword [rsp + 0x150], eax
mov dword [rsp + 0xc8], eax
mov r13d, eax
mov qword [r11 - 0x5b8], rax
mov dword [rsp + 0x174], eax
xor edx, edx
mov r8d, 0xa0
lea rcx, [r11 - 0x428]
call sub.ntdll.dll_memset
xor ecx, ecx
mov qword [rsp + 0xb0], rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x300], xmm0
movups xmmword [rsp + 0x310], xmm0
movups xmmword [rsp + 0x320], xmm0
mov qword [rsp + 0x330], rax
mov dword [rsp + 0x110], ecx
or dword [rsp + 0x128], 0xffffffff
mov qword [rsp + 0x188], rcx
mov qword [rsp + 0x108], rcx
mov dword [rsp + 0x13c], 1
mov ecx, dword [rsp + 0x6c8]
test ecx, 0xe11b0770
jne 0x7fff25df157f
test dword [rsp + 0x6d0], 0xfec4780f
jne 0x7fff25df157f
mov eax, ecx
mov edx, 0x4002
and eax, edx
cmp eax, edx
je 0x7fff25df157f
or ecx, dword [rsp + 0x6d0]
mov dword [rsp + 0x6c8], ecx
call qword [sym.imp.ntdll.dll_RtlGetCurrentTransaction]
nop dword [rax + rax]
test rax, rax
jne 0x7fff25df1526
lea rax, [rsp + 0x13c]
mov qword [rsp + 0x40], rax
call fcn.7fff25d93e28
xor edx, edx
test eax, eax
je 0x7fff25d93cf0
cmp dword [rsp + 0x13c], edx
je 0x7fff25d93cf0
mov rcx, qword [rsp + 0x1b0]
test rcx, rcx
je 0x7fff25df1539
lea rax, [rsp + 0x174]
test rbx, rbx
cmovne rax, rbx
mov qword [rsp + 0x2d0], rax
mov qword [rsp + 0x2d8], r14
mov qword [rsp + 0x2e0], rsi
mov qword [rsp + 0x2e8], r15
test rcx, rcx
je 0x7fff25d92436
mov rax, qword [rcx]
mov qword [rsp + 0x2f0], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x2f8], rax
lea rax, [rsp + 0x260]
mov qword [rsp + 0xb0], rax
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlSetCurrentTransaction]
nop dword [rax + rax]
mov dword [rsp + 0x290], 1
mov ecx, dword [rsp + 0x6c8]
mov esi, 0x1000
test esi, ecx
jne 0x7fff25d92c98
call fcn.7fff25d93d70
xor r8d, r8d
mov ecx, dword [rsp + 0x6c8]
test eax, eax
jne 0x7fff25d92c8a
test cl, 2
jne 0x7fff25d92ca0
mov eax, ecx
and eax, 0x180
mov dword [rsp + 0x17c], eax
neg eax
sbb edx, edx
and edx, 0x2000000
mov dword [rsp + 0x180], edx
mov eax, ecx
and eax, 0x2020
neg eax
sbb r12d, r12d
and r12d, 0x1000000
mov eax, ecx
and eax, 0xfffffffc
or eax, 0xfffffff8
shl eax, 0x1c
or r12d, eax
mov dword [rsp + 0x170], r12d
mov ebx, edx
or ebx, dword [0x7fff25fcfe80]
or ebx, 0x8200000
mov dword [rsp + 0xb8], ebx
mov eax, ecx
and eax, esi
shl eax, 0x11
or ebx, eax
mov dword [rsp + 0xb8], ebx
mov dword [rsp + 0x134], r8d
mov eax, 5
mov dword [rsp + 0x140], eax
bt ecx, 0x11
mov r14d, eax
lea eax, [r14 + 2]
cmovb r14d, eax
mov dword [rsp + 0x140], r14d
mov dword [rsp + 0xbc], r14d
mov esi, r12d
mov dword [rsp + 0xc4], r12d
mov r15d, r14d
mov dword [rsp + 0x138], r14d
mov qword [rsp + 0x30], r8
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r15d
mov edx, esi
mov rcx, qword [rsp + 0x158]
call sym.KERNELBASE.dll_CreateFileW
mov qword [rsp + 0x98], rax
cmp rax, 0xffffffffffffffff
je 0x7fff25d92beb
xor eax, eax
cmp dword [rsp + 0x134], eax
jne 0x7fff25d92620
mov dword [rsp + 0x290], 6
mov dword [rsp + 0x134], 1
mov eax, dword [rsp + 0x6c8]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x128]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x188]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xc8]
lea r8, [rsp + 0x150]
lea rdx, [rsp + 0x130]
mov rcx, qword [rsp + 0x98]
call fcn.7fff25d92140
mov r14d, eax
mov dword [rsp + 0x90], eax
xor eax, eax
test r14d, r14d
js 0x7fff25d92cf3
cmp dword [rsp + 0x130], eax
jne 0x7fff25d92d1d
cmp dword [rsp + 0x150], eax
je 0x7fff25d92dca
mov r14d, eax
mov dword [rsp + 0xd8], eax
test esi, esi
jns 0x7fff25d92669
mov r14d, 0x20
mov dword [rsp + 0xd8], r14d
mov eax, dword [rsp + 0x6c8]
and eax, 0x410
cmp eax, 0x10
lea eax, [r14 + 4]
cmove r14d, eax
mov dword [rsp + 0xd8], r14d
test byte [rsp + 0x6c8], 0x40
jne 0x7fff25d92e1c
bt esi, 0x18
jb 0x7fff25d92e2d
mov dword [rsp + 0x114], r14d
bt ebx, 0x1d
setae cl
test byte [rsp + 0x6c8], 2
sete al
test al, cl
je 0x7fff25d926ea
mov dword [rsp + 0x20], 4
mov r9d, 8
lea r8, [rsp + 0x1a8]
lea rdx, [rsp + 0xf0]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
nop dword [rax + rax]
mov dword [rsp + 0x90], eax
test eax, eax
js 0x7fff25d92d0e
test byte [rsp + 0x1ac], 0x10
jne 0x7fff25d92e4c
bt ebx, 0x1e
jb 0x7fff25d92bb3
mov dword [rsp + 0x20], 5
mov r9d, 0x18
lea r8, [rsp + 0x338]
lea rdx, [rsp + 0xf0]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
mov dword [rsp + 0x90], eax
xor r15d, r15d
test eax, eax
js 0x7fff25d92e85
mov dword [rsp + 0x20], 4
lea r9d, [r15 + 0x28]
lea r8, [rsp + 0x350]
lea rdx, [rsp + 0xf0]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
mov dword [rsp + 0x90], eax
test eax, eax
js 0x7fff25d92e85
mov eax, dword [rsp + 0x370]
mov dword [rsp + 0x12c], eax
mov rax, qword [rsp + 0x340]
mov qword [rsp + 0x260], rax
mov ebx, 0x1000
mov dword [rsp + 0xdc], ebx
mov r8d, ebx
mov rcx, qword gs:[0x60]
mov edx, dword [0x7fff25fd0c80]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov r13, rax
mov qword [rsp + 0xd0], rax
test rax, rax
je 0x7fff25d93c64
mov ebx, dword [rsp + 0xdc]
lea r9d, [rbx - 2]
mov dword [rsp + 0x20], 0x16
mov r8, rax
lea rdx, [rsp + 0xf0]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
mov dword [rsp + 0x90], eax
test eax, eax
js 0x7fff25d92e91
cmp qword [rsp + 0xf8], r15
je 0x7fff25d92b72
cmp eax, 0x80000005
je 0x7fff25d92797
cmp eax, 0xc0000023
je 0x7fff25d92797
cmp qword [rsp + 0x1b0], r15
je 0x7fff25d92ed2
mov eax, dword [rsp + 0x6c8]
and al, 2
neg al
sbb cx, cx
and cx, 0x2fd8
mov r9d, 0x4ac3
add cx, r9w
mov word [rsp + 0x300], cx
mov ecx, 0x38
mov word [rsp + 0x302], cx
mov rax, qword [rsp + 0x350]
mov qword [rsp + 0x308], rax
mov rax, qword [rsp + 0x360]
mov qword [rsp + 0x310], rax
mov rax, qword [rsp + 0x340]
mov qword [rsp + 0x318], rax
mov qword [rsp + 0x320], rax
mov r8d, r15d
mov dword [rsp + 0x304], r15d
mov dword [rsp + 0x330], r15d
mov qword [rsp + 0x328], r15
test r13, r13
je 0x7fff25d9291b
mov rdx, r15
mov qword [rsp + 0x1f8], rdx
mov rcx, r13
mov qword [rsp + 0x148], rcx
add rdx, qword [rcx + 8]
mov qword [rsp + 0x1f8], rdx
inc r8d
mov dword [rsp + 0x304], r8d
cmp dword [rcx], r15d
jne 0x7fff25d92eee
mov qword [rsp + 0x260], rdx
mov qword [rsp + 0x320], rdx
lea eax, [r8 - 1]
mov dword [rsp + 0x304], eax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x350], xmm0
mov dword [rsp + 0x370], r15d
test byte [rsp + 0x6c8], 2
jne 0x7fff25d92f00
lea rax, [rsp + 0x110]
mov qword [rsp + 0x80], rax
mov eax, dword [rsp + 0x114]
mov dword [rsp + 0x78], eax
mov eax, dword [rsp + 0x18c]
mov dword [rsp + 0x70], eax
mov ebx, dword [rsp + 0xc8]
mov dword [rsp + 0x68], ebx
lea rax, [rsp + 0x300]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x178]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x6c8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x340]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r12, qword [rsp + 0x100]
mov r9, r12
mov r8d, dword [rsp + 0xc4]
lea rdx, [rsp + 0x98]
mov rcx, qword [rsp + 0x158]
call fcn.7fff25d947e8
mov edi, eax
mov dword [rsp + 0x94], eax
test ebx, ebx
jne 0x7fff25d92f32
test edi, edi
je 0x7fff25d93c75
test dword [rsp + 0x6c8], 0x8000
jne 0x7fff25d92a99
mov dword [rsp + 0x290], 1
test r13, r13
je 0x7fff25d92a99
mov dword [rsp + 0x1a0], r15d
xor r8d, r8d
mov bl, r8b
mov byte [rsp + 0xa8], bl
mov r12b, r8b
mov byte [rsp + 0xc0], r8b
mov r14, r13
mov qword [rsp + 0x148], r13
mov esi, r8d
mov dword [rsp + 0x90], r8d
mov dword [rsp + 0x290], 1
cmp dword [r14 + 4], 2
jbe 0x7fff25d92a85
cmp word [r14 + 0x1a], 0x3a
jne 0x7fff25d93028
cmp dword [r14], r8d
jne 0x7fff25d935d2
xor r15d, r15d
mov r12, qword [rsp + 0x100]
test edi, edi
je 0x7fff25d93c75
test dword [rsp + 0x6c8], 0x4002
jne 0x7fff25d935e5
test edi, edi
je 0x7fff25d93c75
or ebx, 0xffffffff
cmp dword [rsp + 0x128], ebx
jne 0x7fff25d939d6
mov ebx, 4
mov dword [rsp + 0x290], ebx
mov dword [rsp + 0x20], ebx
lea esi, [rbx + 0x24]
mov r9d, esi
lea r8, [rsp + 0x350]
lea rdx, [rsp + 0xf0]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
mov dword [rsp + 0x90], eax
cmp eax, 0xc0000043
je 0x7fff25d93b34
mov ebx, 0x74
mov r8d, ebx
xor edx, edx
lea rcx, [rsp + 0x3a0]
call sub.ntdll.dll_memset
call sym.KERNELBASE.dll_GetLastError
mov esi, eax
mov r9d, ebx
lea r8, [rsp + 0x3a0]
lea edx, [rbx - 0x67]
mov rcx, qword [rsp + 0xa0]
call sym.KERNELBASE.dll_GetFileInformationByHandleEx
test eax, eax
jne 0x7fff25d93bd7
test edi, edi
je 0x7fff25d93c75
mov ecx, esi
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
jmp 0x7fff25d93c75
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0xd0]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov qword [rsp + 0xd0], r15
mov ebx, dword [rsp + 0xdc]
mov eax, dword [rsp + 0x90]
mov r13, r15
jmp 0x7fff25d9281c
mov rcx, qword [rsp + 0x98]
call sym.KERNELBASE.dll_CloseHandle
or qword [rsp + 0x98], 0xffffffffffffffff
btr ebx, 0x1e
mov dword [rsp + 0xb8], ebx
xor r8d, r8d
mov dword [0x7fff25fcfe80], r8d
mov r14d, dword [rsp + 0xbc]
jmp 0x7fff25d9254a
call sym.KERNELBASE.dll_GetLastError
cmp eax, 0x522
je 0x7fff25d92cb9
call sym.KERNELBASE.dll_GetLastError
cmp eax, 5
je 0x7fff25d92cb9
call sym.KERNELBASE.dll_GetLastError
cmp eax, 5
je 0x7fff25d92c1d
call sym.KERNELBASE.dll_GetLastError
cmp eax, 0x20
jne 0x7fff25d92c27
bt esi, 0x1e
jb 0x7fff25d92ccc
test r15b, 2
jne 0x7fff25d92c60
or r15d, 2
mov dword [rsp + 0x138], r15d
mov dword [rsp + 0xc4], r12d
btr ebx, 0x1d
mov dword [rsp + 0xb8], ebx
btr dword [rsp + 0x6c8], 0xc
mov esi, r12d
xor r8d, r8d
jmp 0x7fff25d9254a
bt ebx, 0x15
jae 0x7fff25d92d15
btr ebx, 0x15
mov dword [rsp + 0xb8], ebx
mov dword [rsp + 0xc4], r12d
mov r15d, r14d
mov dword [rsp + 0x138], r14d
jmp 0x7fff25d92c55
or ecx, esi
mov dword [rsp + 0x6c8], ecx
jmp 0x7fff25d9248b
xor r8d, r8d
jmp 0x7fff25d9248b
and ecx, 0xfffeefff
mov dword [rsp + 0x6c8], ecx
mov dword [0x7fff25fcfe80], r8d
jmp 0x7fff25d92494
mov eax, 0x1000000
test eax, esi
je 0x7fff25d92c09
btr esi, 0x18
jmp 0x7fff25d92ce7
btr esi, 0x1e
mov dword [rsp + 0xc4], esi
mov eax, 0x1000000
test eax, r12d
je 0x7fff25d92c58
or esi, eax
mov dword [rsp + 0xc4], esi
jmp 0x7fff25d92c58
mov rcx, qword [rsp + 0x98]
call sym.KERNELBASE.dll_CloseHandle
or qword [rsp + 0x98], 0xffffffffffffffff
mov ecx, r14d
jmp 0x7fff25d92d10
mov ecx, eax
call fcn.7fff25d6b370
xor r15d, r15d
jmp 0x7fff25d93c75
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sym.KERNELBASE.dll_CreateEventW
mov rsi, rax
xor r15d, r15d
mov rcx, qword [rsp + 0x98]
test rax, rax
jne 0x7fff25d92d52
call sym.KERNELBASE.dll_CloseHandle
or qword [rsp + 0x98], 0xffffffffffffffff
jmp 0x7fff25d93c75
mov eax, dword [rsp + 0x6c8]
and al, 0x80
neg al
sbb r9d, r9d
and r9d, 0x4001
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x6c8]
mov qword [rsp + 0x38], rax
mov r8, qword [rsp + 0x100]
mov rdx, qword [rsp + 0x158]
call 0x7fff25e07354
mov ebx, eax
mov dword [rsp + 0x90], eax
mov rcx, rsi
call sym.KERNELBASE.dll_CloseHandle
mov rcx, qword [rsp + 0x98]
call sym.KERNELBASE.dll_CloseHandle
or qword [rsp + 0x98], 0xffffffffffffffff
mov edi, r15d
test ebx, ebx
setne dil
mov dword [rsp + 0x94], edi
jmp 0x7fff25d93c75
btr ebx, 0x15
mov dword [rsp + 0xb8], ebx
mov rcx, qword [rsp + 0x98]
call sym.KERNELBASE.dll_CloseHandle
or qword [rsp + 0x98], 0xffffffffffffffff
jmp 0x7fff25d92e0f
call sym.KERNELBASE.dll_CloseHandle
or qword [rsp + 0x98], 0xffffffffffffffff
mov eax, 0x40000000
or ebx, eax
mov dword [rsp + 0xb8], ebx
mov dword [0x7fff25fcfe80], eax
mov r14d, dword [rsp + 0xbc]
jmp 0x7fff25d92c58
or r14d, 3
mov dword [rsp + 0xd8], r14d
jmp 0x7fff25d92669
test byte [rsp + 0x6c8], 0x20
je 0x7fff25d92673
or r14d, 8
mov dword [rsp + 0xd8], r14d
jmp 0x7fff25d92673
test dword [rsp + 0x1ac], 0x1000
jne 0x7fff25d926e0
mov rcx, qword [rsp + 0x98]
bt ebx, 0x1e
jae 0x7fff25d92ded
call 0x7fff25e05e98
mov edx, r14d
mov rcx, qword [rsp + 0x98]
call 0x7fff25e06c80
jmp 0x7fff25d926ea
mov ecx, eax
call fcn.7fff25d6b370
jmp 0x7fff25d93c75
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0xd0]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov qword [rsp + 0xd0], r15
mov eax, dword [rsp + 0xdc]
lea ebx, [rax + rax]
mov dword [rsp + 0xdc], ebx
jmp 0x7fff25d92ba4
test dword [rsp + 0x6c8], 0x4002
jne 0x7fff25d92840
mov r9d, 0x4ac3
jmp 0x7fff25d9291b
mov eax, dword [rcx]
add rcx, rax
mov qword [rsp + 0x148], rcx
jmp 0x7fff25d928e0
cmp qword [rsp + 0x320], 0x80000
jl 0x7fff25d92f1c
test byte [rsp + 0x12c], 0x10
je 0x7fff25d9293d
and dword [rsp + 0x6c8], 0xfffffffd
mov word [rsp + 0x300], r9w
jmp 0x7fff25d9293d
test edi, edi
jne 0x7fff25d92a14
call sym.KERNELBASE.dll_GetLastError
cmp eax, 0x50
jne 0x7fff25d92f52
test byte [rsp + 0x6c8], 1
jne 0x7fff25d92a0c
mov ebx, dword [rsp + 0x12c]
and ebx, 1
jne 0x7fff25d92f70
mov edx, 0x80
mov rcx, qword [rsp + 0xa0]
call sym.KERNELBASE.dll_BaseMarkFileForDelete
mov rcx, qword [rsp + 0xa0]
or rdi, 0xffffffffffffffff
cmp rcx, rdi
je 0x7fff25d92f8e
call sym.KERNELBASE.dll_CloseHandle
mov qword [rsp + 0xa0], rdi
test ebx, ebx
je 0x7fff25d92fa7
mov edx, 0x80
mov rcx, r12
call sym.KERNELBASE.dll_SetFileAttributesW
mov rcx, r12
call sym.KERNELBASE.dll_DeleteFileW
mov rcx, qword [rsp + 0x98]
cmp rcx, rdi
je 0x7fff25d92fc1
call sym.KERNELBASE.dll_CloseHandle
mov qword [rsp + 0x98], rdi
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0xd0]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov r13, r15
mov qword [rsp + 0xd0], r15
mov ebx, dword [rsp + 0xb8]
btr ebx, 0x15
mov dword [rsp + 0xb8], ebx
mov dword [rsp + 0xc8], r15d
mov edi, dword [rsp + 0x94]
mov r14d, dword [rsp + 0x140]
mov r12d, dword [rsp + 0x170]
xor r8d, r8d
jmp 0x7fff25d9252c
inc r15d
mov dword [rsp + 0x1a0], r15d
cmp edi, 2
jne 0x7fff25d93069
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x7fff25d93069
cmp r15d, dword [rsp + 0x330]
jae 0x7fff25d93055
mov rax, qword [r14 + 8]
jmp 0x7fff25d93065
mov rcx, qword [rsp + 0xb0]
mov rax, qword [rsp + 0x328]
add qword [rcx + 8], rax
test bl, bl
jne 0x7fff25d93132
mov byte [rsp + 0xa8], 1
mov ebx, 5
mov dword [rsp + 0x20], ebx
mov r9d, 0x218
lea r8, [rsp + 0x420]
lea rdx, [rsp + 0xf0]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
nop dword [rax + rax]
mov dword [rsp + 0x90], eax
xor r8d, r8d
test eax, eax
js 0x7fff25d934b7
test dword [rsp + 0x420], 0x40000
je 0x7fff25d93103
mov dword [rsp + 0x20], ebx
mov r9d, 0x218
lea r8, [rsp + 0x420]
lea rdx, [rsp + 0xf0]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
nop dword [rax + rax]
mov dword [rsp + 0x90], eax
xor r8d, r8d
test eax, eax
js 0x7fff25d934b7
test dword [rsp + 0x420], 0x40000
je 0x7fff25d934b7
mov r12b, 1
mov byte [rsp + 0xc0], r12b
mov esi, r8d
mov dword [rsp + 0x90], r8d
cmp edi, 1
je 0x7fff25d9314e
cmp edi, 2
jne 0x7fff25d93451
cmp dword [rsp + 0x330], r15d
jne 0x7fff25d93451
cmp edi, 2
je 0x7fff25d93163
mov dword [rsp + 0x330], r15d
mov qword [rsp + 0x328], r8
lea rax, [r14 + 0x18]
mov qword [rsp + 0x168], rax
movzx eax, word [r14 + 4]
mov word [rsp + 0x160], ax
mov word [rsp + 0x162], ax
mov dword [rsp + 0x228], 0x30
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x230], rax
mov dword [rsp + 0x240], r8d
lea rax, [rsp + 0x160]
mov qword [rsp + 0x238], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x248], xmm0
mov eax, 0x24
mov dword [rsp + 0xe4], eax
mov ebx, eax
mov eax, 0x4024
cmp dword [rsp + 0x17c], r8d
cmovne ebx, eax
mov dword [rsp + 0xe4], ebx
cmp dword [rsp + 0xc8], r8d
je 0x7fff25d931fd
bts ebx, 0x15
mov dword [rsp + 0xe4], ebx
mov dword [rsp + 0x50], r8d
mov qword [rsp + 0x48], r8
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 5
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0xf0]
lea r8, [rsp + 0x228]
mov edx, 0x80100000
lea rcx, [rsp + 0x190]
call qword [sym.imp.ntdll.dll_NtCreateFile]
nop dword [rax + rax]
mov esi, eax
mov dword [rsp + 0x90], eax
cmp eax, 0xc0000043
jne 0x7fff25d932b8
xor eax, eax
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xf0]
lea r8, [rsp + 0x228]
mov edx, 0x80100000
lea rcx, [rsp + 0x190]
call qword [sym.imp.ntdll.dll_NtCreateFile]
nop dword [rax + rax]
mov esi, eax
mov dword [rsp + 0x90], eax
xor r8d, r8d
test esi, esi
js 0x7fff25d93455
movzx ecx, word [rsp + 0x160]
shr rcx, 1
mov rax, qword [rsp + 0x168]
movzx ebx, word [rax + rcx*2]
mov word [rax + rcx*2], r8w
mov qword [rsp + 0x198], r8
mov eax, dword [rsp + 0x6c8]
and eax, 0xfffffffe
mov dword [rsp + 0x118], eax
and eax, 0xfffeefff
mov dword [rsp + 0x118], eax
lea rcx, [r14 + 8]
lea rax, [rsp + 0x110]
mov qword [rsp + 0x80], rax
mov eax, dword [rsp + 0x114]
mov dword [rsp + 0x78], eax
mov eax, dword [rsp + 0x18c]
mov dword [rsp + 0x70], eax
mov eax, dword [rsp + 0xc8]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x300]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x178]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r8
lea rax, [rsp + 0x198]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x118]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov eax, dword [rsp + 0xe0]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x168]
mov r8d, dword [rsp + 0xc4]
lea rdx, [rsp + 0x190]
mov rcx, qword [rsp + 0x158]
call fcn.7fff25d947e8
mov edi, eax
mov dword [rsp + 0x94], eax
movzx ecx, word [rsp + 0x160]
shr rcx, 1
mov rax, qword [rsp + 0x168]
mov word [rax + rcx*2], bx
mov rcx, qword [rsp + 0x190]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x198]
xor r8d, r8d
test rcx, rcx
je 0x7fff25d93451
test edi, edi
je 0x7fff25d93442
mov dword [rsp + 0x20], 4
lea r9d, [r8 + 0x28]
lea r8, [rsp + 0x350]
lea rdx, [rsp + 0xf0]
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
mov esi, eax
mov dword [rsp + 0x90], eax
mov rcx, qword [rsp + 0x198]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
xor r8d, r8d
test esi, esi
jns 0x7fff25d9346a
mov edi, r8d
mov dword [rsp + 0x94], r8d
mov ecx, esi
call fcn.7fff25d6b370
xor r8d, r8d
test edi, edi
jne 0x7fff25d935af
test r12b, r12b
je 0x7fff25d9359b
mov rcx, qword [rsp + 0xb0]
xor r15d, r15d
test rcx, rcx
je 0x7fff25d93495
cmp dword [rcx + 0x68], r15d
jne 0x7fff25d92a91
test byte [rsp + 0x6c8], 2
jne 0x7fff25d92a91
xor edx, edx
mov rcx, qword [rsp + 0xa0]
call sym.KERNELBASE.dll_BaseMarkFileForDelete
jmp 0x7fff25d92a91
mov ecx, 0xc00000bb
test eax, eax
cmovns eax, ecx
mov dword [rsp + 0x90], eax
test dword [rsp + 0x6c8], 0x13b87f0
je 0x7fff25d93127
mov rdx, qword [rsp + 0xb0]
test rdx, rdx
je 0x7fff25d93544
mov dword [rdx + 0x14], 1
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov rcx, qword [rsp + 0xb0]
mov dword [rcx + 0x18], eax
mov rax, qword [rsp + 0xb0]
xor ecx, ecx
mov qword [rax + 0x40], rcx
mov rcx, qword [rsp + 0x98]
mov rax, qword [rsp + 0xb0]
mov qword [rax + 0x20], rcx
mov rcx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0xb0]
mov qword [rax + 0x28], rcx
mov rdx, qword [rsp + 0xb0]
mov ecx, 8
call sym.KERNELBASE.dll_BasepCopyFileCallback
xor r8d, r8d
test eax, eax
jne 0x7fff25d93127
mov rax, qword gs:[0x30]
test rax, rax
je 0x7fff25d9356f
mov esi, dword [rax + 0x1250]
jmp 0x7fff25d93574
mov esi, 0xc000000d
mov dword [rsp + 0x90], esi
mov edi, r8d
mov dword [rsp + 0x94], r8d
mov r13, qword [rsp + 0xd0]
mov r14, qword [rsp + 0x148]
jmp 0x7fff25d93451
mov dword [rsp + 0x90], r8d
mov edi, 1
mov dword [rsp + 0x94], edi
cmp dword [r14], r8d
je 0x7fff25d92a8e
mov eax, dword [r14]
add r14, rax
mov qword [rsp + 0x148], r14
mov bl, byte [rsp + 0xa8]
jmp 0x7fff25d92a5c
mov eax, dword [r14]
add r14, rax
mov qword [rsp + 0x148], r14
jmp 0x7fff25d92a5c
mov esi, r15d
mov dword [rsp + 0xe8], r15d
mov r14d, r15d
mov dword [rsp + 0x120], r15d
mov dword [rsp + 0x124], r15d
mov ebx, r15d
mov dword [rsp + 0x11c], ebx
xorps xmm0, xmm0
movups xmmword [rsp + 0x1b8], xmm0
movups xmmword [rsp + 0x1c8], xmm0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x98]
call sym.KERNELBASE.dll_SetFilePointer
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xa0]
call sym.KERNELBASE.dll_SetFilePointer
mov eax, 0x38
mov r15d, eax
cmp qword [rsp + 0x340], rax
cmovb r15d, dword [rsp + 0x340]
xor r9d, r9d
xor r8d, r8d
lea edx, [rax - 0x37]
xor ecx, ecx
call sym.KERNELBASE.dll_CreateEventA
mov qword [rsp + 0x1d0], rax
xor eax, eax
test r15d, r15d
je 0x7fff25d9393c
lea ecx, [rax + 3]
mov dword [rsp + 0x290], ecx
cmp dword [rsp + 0xe0], eax
je 0x7fff25d937e3
mov edi, eax
mov dword [rsp + 0x94], eax
mov dword [rsp + 0x20], ecx
lea r9d, [rax + 0x18]
lea r8, [rsp + 0x378]
lea rdx, [rsp + 0xf0]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
nop dword [rax + rax]
mov dword [rsp + 0x90], eax
test eax, eax
js 0x7fff25d92d0e
mov ebx, dword [rsp + 0x38c]
mov dword [rsp + 0x11c], ebx
mov dword [rsp + 0x20], 3
mov r9d, 0x18
lea r8, [rsp + 0x378]
lea rdx, [rsp + 0xf0]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
nop dword [rax + rax]
mov dword [rsp + 0x90], eax
test eax, eax
js 0x7fff25d92d0e
cmp dword [rsp + 0x38c], ebx
cmova ebx, dword [rsp + 0x38c]
mov dword [rsp + 0x11c], ebx
mov esi, ebx
mov rcx, qword gs:[0x60]
mov r8d, ebx
mov edx, dword [0x7fff25fd0c80]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov qword [rsp + 0x108], rax
test rax, rax
jne 0x7fff25d93791
mov ecx, 0xc0000017
call fcn.7fff25d6b370
mov r13, qword [rsp + 0xd0]
xor r15d, r15d
jmp 0x7fff25d93c6e
mov r8, rsi
xor edx, edx
mov rcx, qword [rsp + 0x108]
call sub.ntdll.dll_memset
lea rax, [rsp + 0x1b8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, ebx
mov rdx, qword [rsp + 0x108]
mov rcx, qword [rsp + 0x98]
call sym.KERNELBASE.dll_ReadFile
mov dword [rsp + 0x94], eax
mov r13, qword [rsp + 0xd0]
mov esi, dword [rsp + 0xe8]
jmp 0x7fff25d93812
lea rax, [rsp + 0x1b8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, r15d
lea rdx, [rsp + 0x300]
mov rcx, qword [rsp + 0x98]
call sym.KERNELBASE.dll_ReadFile
mov dword [rsp + 0x94], eax
mov edi, eax
test eax, eax
jne 0x7fff25d93824
call sym.KERNELBASE.dll_GetLastError
cmp eax, 0x3e5
jne 0x7fff25d9385d
xor ecx, ecx
call fcn.7fff25d6b370
xor eax, eax
mov dword [rsp + 0x20], eax
or r9d, 0xffffffff
lea r8, [rsp + 0xe8]
lea rdx, [rsp + 0x1b8]
lea ecx, [rax + 1]
call sym.KERNELBASE.dll_GetOverlappedResultEx
mov edi, eax
mov dword [rsp + 0x94], eax
mov esi, dword [rsp + 0xe8]
test edi, edi
je 0x7fff25d9391d
cmp esi, r15d
jb 0x7fff25d9391d
mov dword [rsp + 0x290], 4
xor r15d, r15d
lea rax, [rsp + 0x1b8]
xor r9d, r9d
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
cmp dword [rsp + 0xe0], r15d
je 0x7fff25d938b5
mov r14d, ebx
mov dword [rsp + 0x120], ebx
mov r8d, ebx
mov rdx, qword [rsp + 0x108]
jmp 0x7fff25d938ca
mov r14d, esi
mov dword [rsp + 0x120], esi
mov r8d, esi
lea rdx, [rsp + 0x300]
call sym.KERNELBASE.dll_WriteFile
mov dword [rsp + 0x94], eax
mov edi, eax
test eax, eax
jne 0x7fff25d938e8
call sym.KERNELBASE.dll_GetLastError
cmp eax, 0x3e5
jne 0x7fff25d9393f
xor ecx, ecx
call fcn.7fff25d6b370
mov dword [rsp + 0x20], r15d
or r9d, 0xffffffff
lea r8, [rsp + 0x124]
lea rdx, [rsp + 0x1b8]
mov ecx, 1
call sym.KERNELBASE.dll_GetOverlappedResultEx
mov edi, eax
mov dword [rsp + 0x94], eax
jmp 0x7fff25d9393f
xor edx, edx
mov rcx, qword [rsp + 0xa0]
call sym.KERNELBASE.dll_BaseMarkFileForDelete
xor r15d, r15d
mov edi, r15d
mov dword [rsp + 0x94], r15d
jmp 0x7fff25d9393f
xor r15d, r15d
test edi, edi
je 0x7fff25d939a1
cmp r14d, dword [rsp + 0x124]
jne 0x7fff25d939a1
mov ecx, 0x38
cmp esi, ecx
jb 0x7fff25d9395a
cmp esi, ebx
jae 0x7fff25d939bb
mov eax, esi
mov qword [rsp + 0x200], rax
mov dword [rsp + 0x20], 0x14
mov r9d, 8
lea r8, [rsp + 0x200]
lea rdx, [rsp + 0xf0]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
mov dword [rsp + 0x90], eax
test eax, eax
jns 0x7fff25d939bb
xor edx, edx
mov rcx, qword [rsp + 0xa0]
call sym.KERNELBASE.dll_BaseMarkFileForDelete
mov dword [rsp + 0x94], r15d
mov edi, r15d
mov rcx, qword [rsp + 0x1d0]
test rcx, rcx
je 0x7fff25d92ab2
call sym.KERNELBASE.dll_CloseHandle
jmp 0x7fff25d92ab2
xorps xmm0, xmm0
movups xmmword [rsp + 0x1d8], xmm0
movups xmmword [rsp + 0x1e8], xmm0
movups xmmword [rsp + 0x390], xmm0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call sym.KERNELBASE.dll_CreateEventA
mov qword [rsp + 0x1f0], rax
test rax, rax
je 0x7fff25d92aca
lea rax, [rsp + 0x1d8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xbc]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
mov edx, 0x900c4
mov rcx, qword [rsp + 0xa0]
call sym.KERNELBASE.dll_DeviceIoControl
test eax, eax
jne 0x7fff25d93a88
call sym.KERNELBASE.dll_GetLastError
cmp eax, 0x3e5
jne 0x7fff25d93a88
mov rcx, qword [rsp + 0xa0]
or rcx, 1
mov dword [rsp + 0x20], r15d
mov r9d, ebx
lea r8, [rsp + 0xbc]
lea rdx, [rsp + 0x1d8]
call sym.KERNELBASE.dll_GetOverlappedResultEx
lea rcx, [rsp + 0x1f0]
call sym.KERNELBASE.dll_ResetEvent
mov rax, qword [rsp + 0x340]
mov qword [rsp + 0x398], rax
lea rax, [rsp + 0x1d8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xbc]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r9d, 0x10
lea r8, [rsp + 0x390]
mov edx, 0x980c8
mov rcx, qword [rsp + 0xa0]
call sym.KERNELBASE.dll_DeviceIoControl
test eax, eax
jne 0x7fff25d93b22
call sym.KERNELBASE.dll_GetLastError
cmp eax, 0x3e5
jne 0x7fff25d93b22
mov rcx, qword [rsp + 0xa0]
or rcx, 1
mov dword [rsp + 0x20], r15d
mov r9d, ebx
lea r8, [rsp + 0xbc]
lea rdx, [rsp + 0x1d8]
call sym.KERNELBASE.dll_GetOverlappedResultEx
mov rcx, qword [rsp + 0x1f0]
call sym.KERNELBASE.dll_CloseHandle
jmp 0x7fff25d92aca
mov rcx, qword [rsp + 0xa0]
call sym.KERNELBASE.dll_CloseHandle
or qword [rsp + 0xa0], 0xffffffffffffffff
mov eax, 0x80
mov dword [rsp + 0xe4], eax
mov ecx, 0x200080
cmp dword [rsp + 0xc8], r15d
cmovne eax, ecx
mov dword [rsp + 0xe4], eax
mov ecx, dword [rsp + 0x180]
or ecx, eax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x100
mov rcx, r12
call sym.KERNELBASE.dll_CreateFileW
mov qword [rsp + 0xa0], rax
cmp rax, 0xffffffffffffffff
je 0x7fff25d92b16
mov dword [rsp + 0x20], ebx
mov r9d, esi
lea r8, [rsp + 0x350]
lea rdx, [rsp + 0xf0]
mov rcx, rax
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
jmp 0x7fff25d92b16
cmp dword [rsp + 0x3a4], 0x2e0000
jne 0x7fff25d92b57
mov dword [rsp + 0x48], r15d
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x400007f
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ntdll.dll_NtFsControlFile]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x90], eax
test eax, eax
jns 0x7fff25d92b57
xor edx, edx
mov rcx, qword [rsp + 0xa0]
call sym.KERNELBASE.dll_BaseMarkFileForDelete
mov edi, r15d
mov dword [rsp + 0x94], r15d
mov ecx, ebx
call fcn.7fff25d6b370
jmp 0x7fff25d92b57
mov ecx, 0xc0000017
call fcn.7fff25d6b370
mov edi, dword [rsp + 0x94]
test edi, edi
je 0x7fff25d93d14
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x208]
mov qword [rcx], rax
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x210]
mov qword [rcx], rax
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlSetCurrentTransaction]
nop dword [rax + rax]
test r13, r13
je 0x7fff25d93ce0
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0xd0]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov edi, dword [rsp + 0x94]
cmp qword [rsp + 0x108], r15
jne 0x7fff25df1550
mov eax, edi
mov rcx, qword [rsp + 0x640]
xor rcx, rsp
call fcn.7fff25dce640
add rsp, 0x650
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
cmp qword [rsp + 0xb0], r15
je 0x7fff25d93c7d
call sym.KERNELBASE.dll_GetLastError
cmp eax, 0x4d3
je 0x7fff25d93c7d
call sym.KERNELBASE.dll_GetLastError
cmp eax, 0xbea
je 0x7fff25d93c7d
call sym.KERNELBASE.dll_GetLastError
mov rdx, qword [rsp + 0xb0]
mov dword [rdx + 0x5c], eax
mov rdx, qword [rsp + 0xb0]
mov ecx, 6
call sym.KERNELBASE.dll_BasepCopyFileCallback
jmp 0x7fff25d93c7d
mov ecx, 0x1a45
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
jmp 0x7fff25df1589
test rbx, rbx
jne 0x7fff25d923eb
test rsi, rsi
je 0x7fff25d92446
jmp 0x7fff25d923eb
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0x108]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov edi, dword [rsp + 0x94]
jmp 0x7fff25d93cee
mov ecx, 0xc000000d
call fcn.7fff25d6b370
xor eax, eax
jmp 0x7fff25d93cf0