Function at 0x14006d970
Capabilities:
Get file attributes

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x3f]
sub rsp, 0x98
xor esi, esi
mov rdi, rcx
cmp qword [rcx + 0xa0], rsi
jne 0x14006dacf
mov dword [rcx + 0x9c], 0x40000
lea r9d, [rsi + 8]
mov rcx, qword [rcx + 0x60]
lea r8, [rbp + 0x67]
xor eax, eax
mov dword [rbp + 0x27], 0xc0000365
lea rdx, [rbp + 0x27]
mov dword [rbp + 0x2b], eax
mov qword [rbp + 0x2f], 0xffffffffffffffd5
mov qword [rbp + 0x67], rsi
mov dword [rsp + 0x20], 4
call qword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
test eax, eax
js 0x14006d9fd
test byte [rbp + 0x6b], 0x10
jne 0x14006d9fd
mov eax, dword [rbp + 0x67]
cmp eax, 0x2e
ja 0x14006d9f5
movabs rcx, 0x410000140000
bt rcx, rax
jb 0x14006d9fd
mov eax, dword [rdi + 0x9c]
jmp 0x14006da0c
mov dword [rdi + 0x9c], 0x10000
mov eax, 0x10000
mov ecx, eax
lea rdx, [0x1400a1620]
call fcn.1400418f0
mov qword [rdi + 0xa0], rax
mov rbx, rax
test rax, rax
jne 0x14006da72
mov eax, dword [rdi + 0x9c]
nop
shr eax, 2
lea rdx, [0x1400a1620]
mov ecx, eax
mov dword [rdi + 0x9c], ecx
call fcn.1400418f0
mov qword [rdi + 0xa0], rax
mov rbx, rax
test rax, rax
jne 0x14006da72
mov eax, dword [rdi + 0x9c]
cmp eax, 0x1000
ja 0x14006da30
lea eax, [rbx - 8]
add rsp, 0x98
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov dword [rbx + 8], esi
lea rdx, [rbp + 0x17]
mov r9d, dword [rdi + 0x9c]
xor eax, eax
mov rcx, qword [rdi + 0x60]
mov r8, rbx
mov dword [rbp + 0x1b], eax
mov eax, 0x800
cmp r9d, eax
mov dword [rbp + 0x17], 0xc0000365
mov qword [rbp + 0x1f], 0xffffffffffffffd5
cmovae r9d, eax
mov dword [rsp + 0x20], 1
call qword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
test eax, eax
js 0x14006dac9
cmp dword [rbp + 0x17], esi
jl 0x14006dac9
mov eax, dword [rbx + 8]
mov dword [rdi + 0xa8], eax
jmp 0x14006dacf
mov dword [rdi + 0xa8], esi
mov r9d, dword [rdi + 0x88]
xor eax, eax
mov qword [rsp + 0xc8], r12
mov qword [rsp + 0xd0], r14
mov qword [rsp + 0x90], r15
mov dword [rbp + 7], 0xc0000365
mov dword [rbp + 0xb], eax
mov qword [rbp + 0xf], 0xffffffffffffffd5
test r9d, r9d
je 0x14006db98
movzx r10d, byte [rdi + 0x5e]
mov r8d, dword [rdi + 0x9c]
mov rdx, qword [rdi + 0xa0]
mov rcx, qword [rdi + 0x60]
cmp r9d, 0x4c
jne 0x14006db57
lea r9, [rbp + 0xf]
mov qword [rbp + 0xf], rsi
mov qword [rsp + 0x30], r9
lea rax, [rdi + 0x8c]
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov byte [rsp + 0x20], r10b
call qword [sym.imp.ntdll.dll_NtQueryDirectoryObject]
mov dword [rbp + 7], eax
jmp 0x14006ddaf
mov rax, qword [rdi + 0x80]
mov byte [rsp + 0x50], r10b
mov qword [rsp + 0x48], rax
lea rax, [rbp + 7]
mov byte [rsp + 0x40], sil
mov dword [rsp + 0x38], r9d
xor r9d, r9d
mov dword [rsp + 0x30], r8d
xor r8d, r8d
mov qword [rsp + 0x28], rdx
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
jmp 0x14006ddaf
mov rax, qword gs:[0x60]
mov r12d, 3
mov edx, dword [rax + 0x118]
mov rax, qword gs:[0x60]
shl rdx, 0x20
mov ecx, dword [rax + 0x11c]
movabs rax, 0x500000000
or rdx, rcx
mov ecx, 0x25
cmp rdx, rax
movzx eax, byte [rdi + 0x5e]
mov byte [rsp + 0x50], al
mov rax, qword [rdi + 0x80]
cmovbe ecx, r12d
mov qword [rsp + 0x48], rax
xor r9d, r9d
mov eax, dword [rdi + 0x9c]
xor r8d, r8d
mov byte [rsp + 0x40], sil
xor edx, edx
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], eax
mov rax, qword [rdi + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 7]
mov dword [rdi + 0x88], ecx
mov rcx, qword [rdi + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
test eax, eax
jns 0x14006dd61
movzx r14d, byte [rdi + 0x5e]
mov r15d, 0x278
cmp eax, 0xc0000003
je 0x14006dc52
cmp eax, 0xc00000f6
je 0x14006dc52
test esi, esi
je 0x14006dc59
mov dword [rdi + 0x88], r12d
mov ebx, dword [rdi + 0x9c]
cmp eax, 0xc000000d
je 0x14006dc78
cmp eax, 0xc00000f5
je 0x14006dc78
cmp eax, 0xc00000c3
je 0x14006dc78
test esi, esi
je 0x14006dc89
shr ebx, 1
mov r14b, 1
mov eax, ebx
mov ebx, 0x10000
cmp eax, ebx
cmovbe ebx, eax
mov rax, qword [rdi + 0x80]
xor r9d, r9d
mov rcx, qword [rdi + 0x60]
xor r8d, r8d
mov byte [rsp + 0x50], r14b
xor edx, edx
mov qword [rsp + 0x48], rax
mov eax, dword [rdi + 0x88]
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x38], eax
mov rax, qword [rdi + 0xa0]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
lea rax, [rbp + 7]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
test eax, eax
jns 0x14006dd5b
nop dword [rax]
cmp ebx, dword [rdi + 0x9c]
je 0x14006dda4
cmp ebx, r15d
jbe 0x14006dda4
mov ecx, dword [rdi + 0x88]
shr ebx, 3
cmp ebx, 0x400
jae 0x14006dd12
cmp ecx, 0x25
mov ebx, 0x268
cmove ebx, r15d
mov rax, qword [rdi + 0x80]
xor r9d, r9d
mov byte [rsp + 0x50], r14b
xor r8d, r8d
mov qword [rsp + 0x48], rax
xor edx, edx
mov rax, qword [rdi + 0xa0]
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x38], ecx
mov rcx, qword [rdi + 0x60]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
lea rax, [rbp + 7]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
test eax, eax
js 0x14006dce0
mov dword [rdi + 0x9c], ebx
mov rax, qword [rdi + 0xa0]
mov qword [rdi + 0x90], rax
mov eax, dword [rbp + 0xf]
mov dword [rdi + 0x98], eax
xor eax, eax
mov word [rdi + 0x5d], 1
mov r14, qword [rsp + 0xd0]
mov r12, qword [rsp + 0xc8]
mov r15, qword [rsp + 0x90]
add rsp, 0x98
pop rdi
pop rsi
pop rbx
pop rbp
ret
inc esi
cmp esi, 2
jb 0x14006dc40
test eax, eax
jns 0x14006dd61
cmp eax, 0x80000006
je 0x14006ddd1
cmp eax, 0x8000001a
je 0x14006ddd1
cmp eax, 0xc000000f
je 0x14006ddd1
mov ecx, eax
call fcn.140060810
jmp 0x14006dd80
mov eax, 0xffffff37
jmp 0x14006dd80