Function at 0x66206af0
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x518]
sub rsp, 0x618
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
lea rcx, [rbp + 0x230]
call fcn.662035e0
nop
xor r9d, r9d
mov edx, 0x252
lea r8d, [r9 + 8]
lea rcx, [rbp + 0x230]
call fcn.66203e10
mov r14, rax
mov rdx, rbx
lea rcx, [rbp + 0x160]
call fcn.66203360
nop
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
or r9, 0xffffffffffffffff
lea r8, [0x6621f6b0]
mov dl, 1
lea rcx, [rbp + 0x160]
call fcn.66203710
lea rcx, [rbp + 0x160]
call fcn.662048a0
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x40], 1
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 0x250
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
test eax, eax
js 0x66206f00
mov rdi, qword [rbp + 0x598]
movzx r15d, byte [rbp + 0x590]
mov r13, qword [rbp + 0x588]
mov r12d, dword [rbp + 0x580]
nop dword [rax]
test byte [r14 + 0x38], 0x10
jne 0x66206ea9
mov eax, dword [r14 + 0x3c]
shr rax, 1
xor ecx, ecx
mov word [r14 + rax*2 + 0x40], cx
mov rax, qword [rbx + 8]
lea rbx, [r14 + 0x42]
lea rbx, [rbx + rax*2]
test rbx, rbx
je 0x66206ea2
mov rcx, rbx
movzx eax, word [rbx]
test ax, ax
je 0x66206c5c
nop word [rax + rax]
cmp ax, 0x30
jb 0x66206c5c
cmp ax, 0x39
ja 0x66206c5c
add rcx, 2
movzx eax, word [rcx]
test ax, ax
jne 0x66206c40
mov al, 1
jmp 0x66206c5e
xor al, al
test al, al
je 0x66206ea2
mov rdx, rsi
lea rcx, [rbp + 0x90]
call fcn.66203360
nop
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
or r9, 0xffffffffffffffff
lea r8, [0x6621f6b8]
mov dl, 1
lea rcx, [rbp + 0x90]
call fcn.66203710
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
or r9, 0xffffffffffffffff
lea r8, [r14 + 0x40]
mov dl, 1
lea rcx, [rbp + 0x90]
call fcn.66203710
test rdi, rdi
je 0x66206ce7
mov byte [rsp + 0x20], 0
or r9, 0xffffffffffffffff
mov r8, rdi
mov rdx, qword [rbp + 0x98]
mov rcx, qword [rbp + 0x90]
call fcn.66203ae0
test eax, eax
je 0x66206e8f
mov rcx, rbx
call fcn.6620ec08
mov ebx, eax
mov rdx, qword [rbp + 0x568]
lea rcx, [rbp - 0x40]
call fcn.66203360
nop
xor dil, dil
mov ecx, dword [r13]
cmp ecx, ebx
jae 0x66206d97
test r15b, r15b
je 0x66206d61
cmp ecx, r12d
je 0x66206d61
xor edi, edi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
or r9, 0xffffffffffffffff
lea r8, [0x6621f6b8]
mov dl, 1
lea rcx, [rbp - 0x40]
call fcn.66203710
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
mov rax, qword [rbp + 0x578]
mov r9, qword [rax + 8]
mov r8, qword [rax]
mov dl, 1
lea rcx, [rbp - 0x40]
call fcn.66203710
mov dil, 1
mov dword [r13], ebx
or r9, 0xffffffffffffffff
lea r8, [r14 + 0x40]
mov edx, 0x104
lea rcx, [rbp + 0x300]
call fcn.6620f930
or r8, 0xffffffffffffffff
lea rdx, [rbp + 0x300]
mov rcx, qword [rbp + 0x578]
call fcn.662046d0
jmp 0x66206de3
test r15b, r15b
je 0x66206de3
cmp ebx, r12d
je 0x66206de3
xor ebx, ebx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
or r9, 0xffffffffffffffff
lea r8, [0x6621f6b8]
mov dl, 1
lea rcx, [rbp - 0x40]
call fcn.66203710
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
or r9, 0xffffffffffffffff
lea r8, [r14 + 0x40]
mov dl, 1
lea rcx, [rbp - 0x40]
call fcn.66203710
mov dil, 1
jmp 0x66206de5
xor ebx, ebx
test dil, dil
je 0x66206e7f
lea rdx, [rbp - 0x40]
mov rcx, qword [rbp - 0x40]
call fcn.6620c430
lea rcx, [rbp - 0x40]
call fcn.662048a0
mov dword [rbp - 0x80], 0x30
mov qword [rbp - 0x78], rbx
mov dword [rbp - 0x68], 0x40
mov qword [rbp - 0x70], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rsp + 0x28], 0x60
mov dword [rsp + 0x20], ebx
lea r9, [rsp + 0x70]
lea r8, [rbp - 0x80]
mov edx, 0x40110000
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntdll.dll_NtOpenFile]
test eax, eax
js 0x66206e7f
mov byte [rsp + 0x60], 1
mov dword [rsp + 0x20], 0xd
mov r9d, 1
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntdll.dll_NtClose]
nop
lea rcx, [rbp - 0x40]
call fcn.66203630
mov rdi, qword [rbp + 0x598]
lea rcx, [rbp + 0x90]
call fcn.66203630
mov rsi, qword [rbp + 0x568]
mov rbx, qword [rbp + 0x570]
lea rcx, [rbp + 0x160]
call fcn.662048a0
mov byte [rsp + 0x50], 0
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x40], 1
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 0x250
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x560]
call qword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
test eax, eax
jns 0x66206c00
lea rcx, [rbp + 0x160]
call fcn.66203630
nop
lea rcx, [rbp + 0x230]
call fcn.66203630
add rsp, 0x618
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret