Function at 0x14001a07f
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd28
jo 0x140019d7e
jno 0x140019d7e
call 0x1487a28cb
mov rdi, qword [r8 + 8]
test rdi, rdi
je 0x140019dcf
mov r13, r9
mov rsi, r8
mov r14, rdx
mov r15, rcx
lea rbx, [rdx + 8]
mov rbp, qword [rdx + 8]
js 0x140019da0
jns 0x140019da0
call 0x18cd326ec
mov edx, edi
mov rcx, rdx
mov rdx, r15
xor r8d, r8d
call fcn.140019d16
test ax, ax
je 0x140019dd9
mov r12d, eax
call 0x140019dbc
add al, ch
jno 0x140019dc2
jo 0x140019dc2
call 0x1bd2d270e
add edi, dword [rcx + rax - 0x18]
mov qword [rbx], rbp
jge 0x140019dca
jl 0x140019dca
call 0x1400b4ab7
add byte [rsi + 0x41], ah
mov esp, 0xabe90008
or dword [rax], eax
add byte [rax - 0x77], cl
pop rsp
and al, 0x58
jmp 0x14001a77b
mov r12w, 8
jmp 0x14001a784
mov qword [rsp + 0x58], rbx
jns 0x140019de3
js 0x140019de3
call 0x18d182930
mov eax, dword [rsi + 8]
mov rdx, qword [r14]
mov r8, qword [r14 + 8]
dec r8
ja 0x140019df2
jbe 0x140019df2
call 0x1649e2b3e
or byte [rbx], al
add byte [rax], al
lea rbx, [rsp + 0x308]
mov rcx, rbx
call fcn.14001aaa4
movzx r12d, word [rbx + 0x218]
test r12w, r12w
je 0x140019e2c
jo 0x140019e15
jno 0x140019e15
call 0x1417ea195
jl 0x140019e1a
jge 0x140019e1a
call 0x164462966
pop rax
mov rax, qword [rsp + 0x58]
mov qword [rax], rbp
jne 0x140019e27
je 0x140019e27
call 0x1400aee14
add byte [rcx + 3], bh
jmp 0x14001a77b
jns 0x140019e31
js 0x140019e31
call 0x1648e2b7d
lock add byte [rax], al
add byte [rax - 0x73], cl
xchg esp, eax
and al, 8
add eax, dword [rax]
add byte [rcx - 0x48], al
sbb byte [rdx], al
add byte [rax], al
lea rcx, [rsp + 0xf0]
lea rdx, [rsp + 0x308]
mov r8d, 0x218
call fcn.1400027aa
jns 0x140019e51
js 0x140019e51
call 0x1448ce6ba
and eax, 0x30
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x20]
mov rax, qword [rax + 0x48]
lea rdx, [rsp + 0xa8]
mov qword [rdx], rax
lea r8, [rsp + 0xf8]
jg 0x140019e7e
jle 0x140019e7e
call 0x16025e348
add dword [rbp + rcx*4 + 0xd], ecx
setnp dh
dec dword [rax - 0x73]
pushfq
and al, 0xb0
add byte [rax], al
add byte [rax - 0x77], cl
fld1
stosb byte [rdi], al
sldt word [rax]
mov byte [rsp + 0x20], 1
lea r9, [0x140003999]
lea rbx, [rsp + 0xb0]
mov rcx, rbx
call fcn.14001ae44
cmp word [rbx + 8], 0
je 0x140019ec2
jb 0x140019ea6
jae 0x140019ea6
call 0x14176a21e
je 0x140019eab
jne 0x140019eab
call 0x1644629f7
pop rax
mov rax, qword [rsp + 0x58]
mov qword [rax], rbp
jno 0x140019eb8
jo 0x140019eb8
call 0x148bde022
add cl, ch
mov ecx, 0x7a000008
add edi, dword [rbx + 1]
mov r12w, 8
jmp 0x14001a77b
jp 0x140019ec7
jnp 0x140019ec7
call 0x164862a13
mov al, 0
add byte [rax], al
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x60], rax
call 0x140019eda
add al, ch
mov rbx, qword [rsp + 0x58]
mov qword [rbx], rbp
jns 0x140019ee8
js 0x140019ee8
call 0x18cf32834
mov edx, edi
mov rcx, rsi
mov rdx, r15
mov r8w, 0x2a
call fcn.140019d16
test ax, ax
je 0x140019f26
mov r12d, eax
js 0x140019f05
jns 0x140019f05
call 0x1644e2a51
invalid
mov rcx, qword [rsp + 0x60]
call sub.ntdll.dll_NtClose
jl 0x140019f14
jge 0x140019f14
call 0x1417fa297
jg 0x140019f19
jle 0x140019f19
call 0x1bc2d2865
add edi, dword [rbp + 1]
mov qword [rbx], rbp
jl 0x140019f21
jge 0x140019f21
call 0x14009f50e
add byte [rbx + rax + 0x7d], bh
add eax, ebp
jmp 0x14001a77b
jl 0x140019f2b
jge 0x140019f2b
call 0x18cf32877
mov edx, edi
mov rcx, rsi
mov rdx, r15
xor r8d, r8d
call fcn.140019d16
test ax, ax
je 0x140019f6e
mov r12d, eax
jnp 0x140019f46
jp 0x140019f46
call 0x1644e2a92
invalid
mov rcx, qword [rsp + 0x60]
call sub.ntdll.dll_NtClose
jb 0x140019f55
jae 0x140019f55
call 0x14001a141
add byte [rax], al
call 0x164462aa8
pop rax
call 0x140019f5b
add al, ch
mov rax, qword [rsp + 0x58]
mov qword [rax], rbp
jae 0x140019f69
jb 0x140019f69
call 0x14009ad56
add byte [rbp + 3], bh
jmp 0x14001a77b
jge 0x140019f73
jl 0x140019f73
call 0x188082abf
mov dword [rsp + 0x90], eax
mov rax, qword [rsi]
mov qword [rsp + 0x90], rax
mov rax, qword [rsi + 8]
and dword [rsp + 0x74], 0
add rax, rax
add rax, 0xfffffffffffffffe
mov qword [rsp + 0x88], rax
cmp rax, 0xffff
mov rbx, qword [rsp + 0x58]
jbe 0x140019fce
jge 0x140019fa8
jl 0x140019fa8
call 0x1644e2af4
invalid
mov rcx, qword [rsp + 0x60]
call sub.ntdll.dll_NtClose
jbe 0x140019fb7
ja 0x140019fb7
call 0x1417ca335
jp 0x140019fbc
jnp 0x140019fbc
call 0x1bf2d2908
add edi, dword [rsi + 1]
mov qword [rbx], rbp
jg 0x140019fc4
jle 0x140019fc4
call 0x14bbde12e
add cl, ch
lodsd eax, dword [rsi]
invalid
mov r12w, 0xb
jmp 0x14001a77b
mov ebx, 0x800
xor eax, eax
mov qword [rsp + 0x78], rax
xor eax, eax
mov qword [rsp + 0x80], rax
mov r12, qword [rsp + 0x60]
jbe 0x140019fee
ja 0x140019fee
call 0x164862b3a
mov byte [rax], al
add byte [rax], al
mov rax, qword [rsp + 0x88]
mov word [rsp + 0x98], ax
mov word [rsp + 0x9a], ax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0xa0], rax
jnp 0x14001a01b
jp 0x14001a01b
call 0x1848a6050
and al, 0x50
xor eax, eax
mov byte [rsp + 0x50], al
lea rcx, [rsp + 0x98]
mov qword [rsp + 0x48], rcx
mov byte [rsp + 0x40], al
lea rax, [rsp + 0x528]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 0x800
mov rcx, r12
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtQueryDirectoryFile
test eax, eax
jne 0x14001a136
jl 0x14001a079
jge 0x14001a079
call 0x14001a265
add byte [rax], al
call 0x1b8e5d1c9
add edi, dword [rcx + 1]
call 0x14001a07f
add al, ch
xor r12d, r12d
js 0x14001a088
jns 0x14001a088
call 0x1417ba407
jnp 0x14001a08d
jp 0x14001a08d
call 0x1b8e229dd
add edi, dword [rcx + 1]
mov rax, r12
js 0x14001a095
jns 0x14001a095
call 0x14800dde1
add byte [rax], al
cmp rax, 0x7ff
ja 0x140019fe4
je 0x14001a0a6
jne 0x14001a0a6
call 0x168062d35
add eax, 0x8d4c0000
and al, 8
mov ecx, dword [rsp + rax + 0x528]
lea r12, [rax + rcx]
test rcx, rcx
cmove r12, rbx
test byte [rsp + rax + 0x560], 0x10
jne 0x14001a102
add rax, rsp
add rax, 0x528
jo 0x14001a0d0
jno 0x14001a0d0
call 0x17c422c18
mov r8d, dword [rax + 0x3c]
shr r8, 1
cmp rdi, r8
je 0x14001a10c
jne 0x14001a0e1
je 0x14001a0e1
call 0x1b8162e2d
lea rdx, [rax + rdi*2]
add rdx, 0x40
sub r8, rdi
jle 0x14001a0f1
jg 0x14001a0f1
call 0x1644e2e3d
push 0xed9e8
add byte [rax + 0x69247c], al
lea rcx, [rsp + 0x68]
call fcn.14001afd4
cmp byte [rsp + 0x69], 0
jne 0x14001a11b
jnp 0x14001a107
jp 0x14001a107
call 0x12be22a57
test byte [rax - 0x7b76b7ff], dh
and al, 0x80
add byte [rax], al
add cl, ch
insd dword [rdi], dx
invalid
mov rax, r12
jmp 0x14001a090
mov al, 1
mov qword [rsp + 0x80], rax
jmp 0x14001a088
je 0x14001a120
jne 0x14001a120
call 0x164465733
push 0x740444c6
add dword [rax + 0x44894801], esi
and al, 0x78
movzx eax, byte [rsp + 0x68]
mov byte [rsp + rax + 0x74], 1
mov al, 1
mov qword [rsp + 0x78], rax
jmp 0x14001a083
cmp eax, 0x80000006
je 0x14001a183
cmp eax, 0xc000000f
mov rbx, qword [rsp + 0x58]
je 0x14001a214
cmp eax, 0xc0000022
jne 0x14001a238
jne 0x14001a15d
je 0x14001a15d
call 0x128e32aad
pop rbx
adc al, byte [rdx]
add byte [rdi + 3], dh
mov rcx, r12
call sub.ntdll.dll_NtClose
ja 0x14001a16a
jbe 0x14001a16a
call 0x1417ea4ea
jl 0x14001a16f
jge 0x14001a16f
call 0x1282d2abb
add dword [rax], eax
add byte [rax], al
mov qword [rbx], rbp
call 0x14001a178
add al, ch
mov r12w, 9
jmp 0x14001a77b
jb 0x14001a188
jae 0x14001a188
call 0x148bde2f2
add dh, dh
test byte [rax + rax*4], ah
add byte [rax], al
add byte [rcx], al
mov r12w, 8
test byte [rsp + 0x80], 1
mov rbx, qword [rsp + 0x58]
je 0x14001a3fb
ja 0x14001a1a5
jbe 0x14001a1a5
call 0x14fef26f1
test byte [rbx + 0x7f000000], dh
add edi, dword [rsi + 1]
test rbp, rbp
je 0x14001a261
jg 0x14001a1b3
jle 0x14001a1b3
call 0x189082d00
mov ecx, dword [rsi + 8]
mov rax, qword [r14]
mov rcx, qword [r14 + 8]
movzx eax, word [rax + rcx*2 - 2]
cmp eax, 0x2f
je 0x14001a261
cmp eax, 0x5c
je 0x14001a261
jbe 0x14001a1d6
ja 0x14001a1d6
call 0x18cf32b26
mov edx, edi
mov rcx, r14
mov rdx, r15
mov r8w, 0x5c
call fcn.140019d16
test ax, ax
je 0x14001a261
mov r12d, eax
jno 0x14001a1f3
jo 0x14001a1f3
call 0x1644e2d3f
invalid
mov rcx, qword [rsp + 0x60]
call sub.ntdll.dll_NtClose
je 0x14001a202
jne 0x14001a202
call 0x1417da583
jge 0x14001a207
jl 0x14001a207
call 0x1b02d2b53
add esi, dword [rcx + 1]
mov qword [rbx], rbp
jo 0x14001a20f
jno 0x14001a20f
call 0x1400709fc
add byte [rdi + 3], bh
jmp 0x14001a77b
jg 0x14001a219
jle 0x14001a219
call 0x128e32b69
lahf
adc dword [rdx], eax
add byte [rbx + 3], bh
mov rcx, r12
call sub.ntdll.dll_NtClose
jnp 0x14001a226
jp 0x14001a226
call 0x14173a59d
jae 0x14001a22b
jb 0x14001a22b
call 0x1b32d2b77
add esi, dword [rdx + 1]
mov qword [rbx], rbp
jae 0x14001a233
jb 0x14001a233
call 0x13ffe2320
push qword [rsi + 3]
jmp 0x140019eb8
jbe 0x14001a23d
ja 0x14001a23d
call 0x128e32b8d
jnp 0x14001a254
mov rcx, r12
call sub.ntdll.dll_NtClose
add al, byte [rax]
jbe 0x14001a24a
ja 0x14001a24a
call 0x1417fa5cd
jg 0x14001a24f
jle 0x14001a24f
call 0x1b92d2b9b
add edi, dword [rax + 1]
mov qword [rbx], rbp
jns 0x14001a257
js 0x14001a257
call 0x14ebde3c1
add cl, ch
sbb al, byte [0x14372a263]
mov r12w, 0xe
jmp 0x14001a77b
jno 0x14001a266
jo 0x14001a266
call 0x1bb082db6
add edi, dword [rdx + 1]
mov r8, qword [rsi]
jnp 0x14001a26e
jp 0x14001a26e
call 0x18cf32bbe
mov edx, edi
mov rcx, r14
mov rdx, r15
mov r9, rdi
call fcn.140019c74
je 0x14001a281
jne 0x14001a281
call 0x1b4c227eb
and al, 0x41
mov esp, eax
test ax, ax
je 0x14001a2aa
mov r12d, eax
mov rcx, qword [rsp + 0x60]
call sub.ntdll.dll_NtClose
jae 0x14001a298
jb 0x14001a298
call 0x14176a610
je 0x14001a29d
jne 0x14001a29d
call 0x1bf2d2be9
add edi, dword [rsi + 1]
mov qword [rbx], rbp
jg 0x14001a2a5
jle 0x14001a2a5
call 0x140067492
add byte [rcx + rcx*4 - 0xf], cl
jmp 0x14001a77b
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.140019d16
test ax, ax
je 0x14001a2e8
mov r12d, eax
call 0x14001a2c6
add al, ch
mov rcx, qword [rsp + 0x60]
call sub.ntdll.dll_NtClose
jb 0x14001a2d6
jae 0x14001a2d6
call 0x14171a64b
jno 0x14001a2db
jo 0x14001a2db
call 0x1b62d2c27
add esi, dword [rdi + 1]
mov qword [rbx], rbp
jbe 0x14001a2e3
ja 0x14001a2e3
call 0x1400636d0
add byte [rcx + 3], dh
jmp 0x14001a77b
jno 0x14001a2ed
jo 0x14001a2ed
call 0x1b0102e3a
add esi, dword [rcx + 1]
mov rcx, qword [r14]
jo 0x14001a2f5
jno 0x14001a2f5
call 0x164862e41
mov eax, 0x4800000d
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xdb8]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xdb0]
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0xd98]
mov r8, qword [rsp + 0xda0]
mov r9, qword [rsp + 0xda8]
call fcn.14001b1a8
mov r12d, eax
movzx eax, ax
lea ecx, [rax - 8]
cmp ecx, 2
jb 0x14001a3f6
cmp eax, 0x6d
je 0x14001a376
test eax, eax
jne 0x14001a6cc
jp 0x14001a350
jnp 0x14001a350
call 0x1644e2e9c
invalid
jnp 0x14001a37b
je 0x14001a6d1
jne 0x14001a6d1
call 0x1644e321d
invalid