Function at 0x3a98e0090
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x108
mov rbx, qword [rsp + 0x178]
mov eax, dword [rsp + 0x180]
mov rsi, rcx
mov rcx, qword [rbx]
mov dword [rsp + 0x60], eax
mov rdi, rdx
mov qword [rsp + 0x90], 0
mov rbp, r8
mov r12, r9
mov qword [rsp + 0x98], 0
call fcn.3a98c5600
mov r15d, eax
test eax, eax
js 0x3a98e03a8
jne 0x3a98e03d8
mov r9d, 0x1020088
mov r8, r12
mov rdx, rbp
mov rcx, rdi
lea r14, [rsp + 0x98]
mov qword [rsp + 0x20], r14
call fcn.3a98deb10
test eax, eax
js 0x3a98f4e46
mov rcx, qword [rsp + 0x98]
lea rdx, [rsp + 0xc0]
call fcn.3a98dec00
test eax, eax
js 0x3a98f4dd4
mov rax, qword [rbx]
mov r8, qword [rsp + 0xe0]
mov rdx, qword [rsp + 0x170]
mov r9, qword [rax + 0xd8]
mov rcx, qword [rax + 0x10]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
xor eax, eax
cmp dword [rsp + 0xc4], 1
setbe al
mov dword [rsp + 0x20], eax
call fcn.3a98b22b0
mov r15d, eax
test eax, eax
je 0x3a98e01f0
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x3a98e0193
call sub.ntdll.dll_NtClose
mov rax, qword [rbx]
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rax]
call fcn.3a98a7280
mov rax, qword [rbx]
mov r8d, r15d
mov qword [rsp + 0x90], 0
mov rdx, qword [rax + 0x38]
mov rcx, qword [rax + 0x30]
mov r9, qword [rax + 0xb0]
call fcn.3a98c1e50
mov rdx, qword [rsp + 0x90]
mov qword [rsi], rdx
add rsp, 0x108
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x98]
call fcn.3a98def40
cmp eax, 0xc0000017
je 0x3a98e04b8
mov rax, qword [rsp + 0x90]
mov r13, qword [rax]
mov eax, dword [r13 + 0x58]
and eax, 0x3fffffff
cmp eax, 1
ja 0x3a98e0348
mov eax, dword [rsp + 0xc0]
mov rcx, qword [rsp + 0x98]
movq xmm0, qword [rsp + 0xc8]
mov dword [r13 + 0x34], eax
mov rax, qword [rsp + 0xd0]
movhps xmm0, qword [rsp + 0xd8]
mov qword [r13 + 0x78], rax
mov rax, qword [rbx]
movups xmmword [r13 + 0x68], xmm0
test byte [rax + 0x28], 0x20
jne 0x3a98e0275
test byte [rbx + 0xc], 8
jne 0x3a98e0480
mov r8, rbx
mov rdx, r13
call fcn.3a98defc0
mov r15d, eax
test eax, eax
jne 0x3a98e0460
mov r9d, dword [rsp + 0xf0]
mov rcx, qword [rsp + 0x98]
test r9d, r9d
jne 0x3a98e0690
test byte [r13 + 0x35], 4
jne 0x3a98e06c8
call fcn.3a98dec90
mov qword [rsp + 0x68], rax
test byte [r13 + 0x35], 0x40
jne 0x3a98e0700
mov r8, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0x98]
mov r9, rbx
mov rdx, r13
call fcn.3a98df8d0
mov r15d, eax
test eax, eax
jne 0x3a98e04d8
mov eax, dword [r13 + 0x34]
test eax, 0x4010
jne 0x3a98e0418
test ah, 4
jne 0x3a98e03f8
cmp byte [rbx + 0x18], 0
jne 0x3a98e0418
mov rcx, qword [rsp + 0x98]
mov r8, rbx
mov rdx, r13
call fcn.3a98df410
mov r15d, eax
test eax, eax
je 0x3a98e0418
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x3a98e0193
call sub.ntdll.dll_NtClose
jmp 0x3a98e0193
cmp byte [rsp + 0x60], 0
je 0x3a98e0388
mov rcx, qword [rbx]
mov r8, r13
xor edx, edx
call fcn.3a98c5280
mov r15d, eax
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x3a98e0371
call sub.ntdll.dll_NtClose
test r15d, r15d
jne 0x3a98e0193
xor eax, eax
jmp 0x3a98e01cc
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x3a98e037a
call sub.ntdll.dll_NtClose
xor eax, eax
jmp 0x3a98e01cc
xor r13d, r13d
cmp byte [rsp + 0x60], 0
je 0x3a98e0388
cmp qword [rsp + 0x90], 0
mov rcx, qword [rbx]
jne 0x3a98e0352
xor r8d, r8d
mov edx, 1
call fcn.3a98c5280
mov r15d, eax
jmp 0x3a98e035f
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x3a98e0193
call sub.ntdll.dll_NtClose
jmp 0x3a98e0193
cmp dword [r13 + 0x88], 0x80000017
jne 0x3a98e0418
mov rax, qword [rbx]
test byte [rax + 0x29], 0x10
jne 0x3a98e030c
nop word [rax + rax]
mov rdx, qword [rsp + 0x68]
mov rcx, r13
call fcn.3a98df360
mov eax, dword [r13 + 0x34]
and eax, 0x410
cmp eax, 0x10
jne 0x3a98e03ab
cmp byte [rsp + 0x60], 0
mov rcx, qword [rsp + 0x98]
jne 0x3a98e04f8
test rcx, rcx
je 0x3a98e037a
call sub.ntdll.dll_NtClose
xor eax, eax
jmp 0x3a98e01cc
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x3a98e0193
call sub.ntdll.dll_NtClose
jmp 0x3a98e0193
mov r8, rbx
mov rdx, r13
call fcn.3a98decf0
mov rcx, qword [rsp + 0x98]
mov r15d, eax
test eax, eax
je 0x3a98e0275
test rcx, rcx
je 0x3a98e0193
call sub.ntdll.dll_NtClose
jmp 0x3a98e0193
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x3a98e04ca
call sub.ntdll.dll_NtClose
mov r15d, 0x27
jmp 0x3a98e0193
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x3a98e0193
call sub.ntdll.dll_NtClose
jmp 0x3a98e0193
test rcx, rcx
je 0x3a98e050e
call sub.ntdll.dll_NtClose
mov qword [rsp + 0x98], 0
mov qword [rsp + 0x20], r14
mov r8, r12
mov rdx, rbp
mov rcx, rdi
mov r9d, 1
call fcn.3a98deb10
test eax, eax
js 0x3a98f4e0d
mov rax, qword [rsp + 0x90]
mov ecx, 0x2000
mov rbp, qword [rsp + 0x98]
mov qword [rsp + 0x68], rax
call fcn.3a98cd930
mov qword [rsp + 0x70], rax
test rax, rax
je 0x3a98e0929
lea rax, [rsp + 0xb0]
lea r12, [rsp + 0xa8]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x50], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rax, qword [rsp + 0x70]
mov dword [rsp + 0x40], 0
mov rcx, rbp
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x78]
mov dword [rsp + 0x38], 0xc
mov dword [rsp + 0x30], 0x2000
mov qword [rsp + 0x20], rax
call sub.ntdll.dll_NtQueryDirectoryFile
test eax, eax
js 0x3a98e0931
mov r14, qword [rsp + 0x70]
jmp 0x3a98e05ea
mov eax, dword [r14]
test eax, eax
je 0x3a98e057e
add r14, rax
mov edx, dword [r14 + 8]
lea rdi, [r14 + 0xc]
mov rcx, rdi
shr edx, 1
call fcn.3a98c5790
test al, al
jne 0x3a98e05e0
mov r8d, dword [r14 + 8]
mov rcx, qword [rbx]
mov r9, r12
mov rdx, rdi
shr r8d, 1
and r8d, 0x7fffffff
call fcn.3a98c58d0
mov r8, rax
test rax, rax
je 0x3a98e08df
mov r9d, dword [r14 + 8]
mov dword [rsp + 0x30], 1
mov rdx, rbp
mov qword [rsp + 0x28], rbx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
shr r9d, 1
and r9d, 0x7fffffff
call fcn.3a98e0090
mov rcx, qword [rbx]
mov rdx, qword [rsp + 0xa8]
mov r15d, eax
call fcn.3a98c59c0
test r15d, r15d
jne 0x3a98e08e5
mov rax, qword [rbx]
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x68]
mov r8, qword [rax]
call fcn.3a98c5800
jmp 0x3a98e05e0
mov r8, rbx
mov rdx, r13
call fcn.3a98df070
mov rcx, qword [rsp + 0x98]
mov r15d, eax
test eax, eax
je 0x3a98e02a4
test rcx, rcx
je 0x3a98e0193
call sub.ntdll.dll_NtClose
jmp 0x3a98e0193
mov r8, rbx
mov rdx, r13
call fcn.3a98dfa90
mov rcx, qword [rsp + 0x98]
mov r15d, eax
test eax, eax
je 0x3a98e02af
test rcx, rcx
je 0x3a98e0193
call sub.ntdll.dll_NtClose
jmp 0x3a98e0193
mov rcx, qword [rsp + 0x98]
call sub.ntdll.dll_NtClose
mov rax, qword [rbx]
mov r15d, dword [r13 + 0x34]
lea rdx, str.___
mov qword [rsp + 0x98], 0
mov rcx, qword [rax + 0xb0]
mov rax, qword [rax + 0xb8]
and r15d, 0x10
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
cmp rcx, rdx
je 0x3a98e078d
test rcx, rcx
je 0x3a98e0773
xor eax, eax
jmp 0x3a98e0762
add rax, 2
cmp rax, 8
je 0x3a98e078d
mov rcx, qword [rsp + 0x70]
movzx r10d, word [rdx + rax]
cmp word [rcx + rax], r10w
je 0x3a98e0758
mov r8d, 0x4d9
lea rdx, str.src_win32_capture.c
lea rcx, str._wmemcmp_path__L______4_
call qword [sym.imp.msvcrt.dll__wassert]
xor edx, edx
mov rcx, qword [rsp + 0x70]
test r15d, r15d
mov r8d, 0x5c
setne dl
mov word [rcx + 2], r8w
add edx, edx
lea r8, [rsp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_OpenEncryptedFileRawW]
test eax, eax
jne 0x3a98f4dad
mov r8, qword [rsp + 0xb0]
lea rdx, [rsp + 0xa8]
mov qword [rsp + 0xa8], 0
lea rcx, [0x3a98deb00]
call qword [sym.imp.ADVAPI32.dll_ReadEncryptedFileRaw]
test eax, eax
jne 0x3a98f4d46
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_CloseEncryptedFileRaw]
cmp qword [rsp + 0xa8], 0
je 0x3a98e090a
mov rax, qword [rsp + 0x78]
mov rdx, qword [rbx + 0x20]
lea r8, [rax + rax]
mov qword [rsp + 0x88], rdx
lea rcx, [r8 + 0x1a]
mov qword [rsp + 0x80], r8
call fcn.3a98cd930
mov r15, rax
test rax, rax
je 0x3a98e0879
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x88]
mov qword [rax], 1
mov qword [rax + 8], r8
test rdx, rdx
je 0x3a98e085d
add qword [rdx], 1
mov qword [r15 + 0x10], rdx
mov r8, qword [rsp + 0x78]
lea rcx, [r15 + 0x18]
mov rdx, qword [rsp + 0x70]
call fcn.3a98e46d0
xor ecx, ecx
mov word [rax], cx
mov rax, qword [rbx]
mov rdx, r15
mov r9d, 2
mov rcx, r13
mov r8, qword [rsp + 0xa8]
mov rax, qword [rax + 8]
mov qword [rsp + 0x28], rax
mov rax, qword [0x3a9979990]
mov qword [rsp + 0x20], rax
call fcn.3a98df6d0
mov edx, 0x3f
mov r15d, eax
mov rax, qword [rsp + 0x70]
mov word [rax + 2], dx
test r15d, r15d
je 0x3a98e02ea
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x3a98e0193
call sub.ntdll.dll_NtClose
jmp 0x3a98e0193
mov r15d, 0x27
mov rcx, qword [rsp + 0x70]
call fcn.3a98cd960
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x3a98e0193
call sub.ntdll.dll_NtClose
jmp 0x3a98e0193
mov r8d, 0x4e1
lea rdx, str.src_win32_capture.c
lea rcx, str.size___0
call qword [sym.imp.msvcrt.dll__wassert]
jmp 0x3a98e080b
mov r15d, 0x27
jmp 0x3a98e08ef
cmp eax, 0x80000006
jne 0x3a98f4d7b
mov rcx, qword [rsp + 0x70]
call fcn.3a98cd960
jmp 0x3a98e03b2
mov rdi, qword [rsp + 0x70]
mov ecx, eax
lea rdx, str.Failed_to_read_raw_encrypted_data_from___ls_
mov r15d, 0x32
mov r8, rdi
call fcn.3a98f4925
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_CloseEncryptedFileRaw]
mov word [rdi + 2], 0x3f
jmp 0x3a98e08c4
mov rdx, qword [rbx]
mov ecx, eax
mov r15d, 0x32
mov r8, qword [rdx + 0xb0]
lea rdx, str.__ls_:_Cant_read_directory
add r8, 8
call fcn.3a98f4982
mov rcx, qword [rsp + 0x70]
call fcn.3a98cd960
nop
jmp 0x3a98e08ef
mov rdi, qword [rsp + 0x70]
lea rdx, str.Failed_to_open_encrypted_file___ls__for_raw_read
mov ecx, eax
mov r15d, 0x2f
mov r8, rdi
call fcn.3a98f4925
mov word [rdi + 2], 0x3f
jmp 0x3a98e08c4
mov rdx, qword [rbx]
mov ecx, eax
mov r8, qword [rdx + 0xb0]
lea rdx, str.__ls_:_Cant_get_file_information
add r8, 8
call fcn.3a98f4982
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x3a98f4e02
call sub.ntdll.dll_NtClose
mov r15d, 0x3f
jmp 0x3a98e0193
mov rdx, qword [rbx]
mov ecx, eax
mov r8, qword [rdx + 0xb0]
lea rdx, str.__ls_:_Cant_open_directory
add r8, 8
call fcn.3a98f4982
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x3a98f4e3b
call sub.ntdll.dll_NtClose
mov r15d, 0x2f
jmp 0x3a98e0193
mov rdx, qword [rbx]
mov rdx, qword [rdx + 0xb0]
add rdx, 8
cmp eax, 0xc0000056
jne 0x3a98f4e83
lea rcx, str.__ls_:_Deletion_pending__skipping_file
call fcn.3a98f20cb
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x3a98e037a
call sub.ntdll.dll_NtClose
nop
jmp 0x3a98e037a
cmp eax, 0xc0000043
jne 0x3a98f4ea5
lea rcx, str.Cant_open___ls_:_n________File_is_in_use_by_another_process__Consider_using_snapshot__VSS__mode.
call fcn.3a98f204c
mov rcx, qword [rsp + 0x98]
test rcx, rcx
jne 0x3a98f4e36
jmp 0x3a98f4e3b
mov ecx, eax
mov r8, rdx
lea rdx, str.__ls_:_Cant_open_file
mov dword [rsp + 0x60], eax
call fcn.3a98f4982
mov eax, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x98]
cmp eax, 0xc0210000
jne 0x3a98f4e9e
test rcx, rcx
je 0x3a98f4ed7
call sub.ntdll.dll_NtClose
mov r15d, 0x52
jmp 0x3a98e0193