Function at 0x29328
Capabilities:
Get file attributes
Hash data with md5
Read file on windows
Set file attributes

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x120
xor r13d, r13d
mov rbx, rcx
mov r12, rdx
lea rcx, [rax - 0xc0]
lea r8d, [r13 + 0x28]
xor edx, edx
mov dword [rsp + 0x68], 0x67452301
mov dword [rax + 0x20], 0xefcdab89
mov dword [rax + 0x18], 0x98badcfe
mov dword [rax + 8], 0x10325476
mov qword [rsp + 0x60], r13
mov dword [rax - 0xc8], r13d
call fcn.000554c0
xor eax, eax
lea r8d, [r13 + 0x14]
lea rcx, [rsp + 0xc4]
xor edx, edx
mov dword [rsp + 0x78], r13d
mov dword [rsp + 0x7c], eax
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x70], r13d
mov dword [rsp + 0x74], eax
mov dword [rsp + 0xc0], r13d
call fcn.000554c0
cmp rbx, r13
je 0x29778
cmp qword [rbx + 8], r13
je 0x29778
mov dword [rsp + 0x50], r13d
mov qword [rsp + 0x48], r13
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 1
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x90]
lea rcx, [rsp + 0x60]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x90], 0x30
mov qword [rsp + 0x98], r13
mov qword [rsp + 0x20], r13
mov dword [rsp + 0xa8], 0x240
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xb0], r13
mov qword [rsp + 0xb8], r13
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
cmp eax, r13d
jl 0x2977d
mov rcx, qword [rsp + 0x60]
lea r9d, [r13 + 0x18]
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x78]
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov rcx, qword [rsp + 0x60]
cmp eax, r13d
mov ebx, eax
jge 0x29492
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
jmp 0x2977d
mov ebx, dword [rsp + 0xc8]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x78]
mov eax, ebx
mov r9d, 8
mov dword [rsp + 0x70], r13d
shr eax, 0x1d
mov dword [rsp + 0x20], 0xe
mov dword [rsp + 0x8c], eax
mov eax, ebx
and eax, 0x1fffffff
shl eax, 3
mov dword [rsp + 0x88], eax
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
cmp eax, r13d
mov edi, eax
jge 0x294f2
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
jmp 0x2977d
mov r14d, 0x40
lea rcx, [rsp + 0xe0]
xor edx, edx
mov r8, r14
call fcn.000554c0
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0xe0]
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
cmp eax, r13d
mov edi, eax
jl 0x294e0
mov edi, ebx
mov esi, r13d
shr edi, 6
cmp edi, r13d
jbe 0x295f1
lea rax, [rsp + 0x160]
lea r9, [rsp + 0x170]
lea r8, [rsp + 0x178]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
call fcn.0002881c
lea rcx, [rsp + 0xe0]
mov r8, r14
xor edx, edx
call fcn.000554c0
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0xe0]
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
cmp eax, r13d
mov ebp, eax
jge 0x295e7
cmp eax, 0xc0000011
jne 0x29769
inc esi
cmp esi, edi
jb 0x2955b
mov eax, ebx
and ebx, 0x3f
and eax, 0x3f
mov byte [rsp + rax + 0xe0], 0x80
cmp bl, 0x37
jbe 0x29647
lea rax, [rsp + 0x160]
lea r9, [rsp + 0x170]
lea r8, [rsp + 0x178]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
call fcn.0002881c
lea rcx, [rsp + 0xe0]
mov r8, r14
xor edx, edx
call fcn.000554c0
mov rax, qword [rsp + 0x88]
lea r9, [rsp + 0x170]
lea r8, [rsp + 0x178]
mov qword [rsp + 0x118], rax
lea rax, [rsp + 0x160]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
call fcn.0002881c
mov r11d, dword [rsp + 0x160]
mov ecx, dword [rsp + 0x170]
mov r8d, ecx
mov edi, 0xff0000
mov ebx, 0xff00
and r8d, edi
mov r10d, r11d
mov eax, r11d
shr eax, 0x10
and r10d, edi
or r10d, eax
mov eax, r11d
shl r11d, 0x10
and eax, ebx
shr r10d, 8
or eax, r11d
shl eax, 8
or r10d, eax
mov eax, ecx
shr eax, 0x10
mov dword [rsp + 0x30], r10d
or r8d, eax
mov eax, ecx
shl ecx, 0x10
and eax, ebx
shr r8d, 8
or eax, ecx
mov ecx, dword [rsp + 0x178]
shl eax, 8
mov edx, ecx
or r8d, eax
mov eax, ecx
and edx, edi
shr eax, 0x10
mov dword [rsp + 0x28], r8d
lea r8, str._08X_08X_08X_08X
or edx, eax
mov eax, ecx
shl ecx, 0x10
and eax, ebx
shr edx, 8
or eax, ecx
mov ecx, dword [rsp + 0x68]
shl eax, 8
mov r9d, ecx
or edx, eax
mov eax, ecx
and r9d, edi
shr eax, 0x10
mov dword [rsp + 0x20], edx
mov edx, 0x21
or r9d, eax
mov eax, ecx
shl ecx, 0x10
and eax, ebx
shr r9d, 8
or eax, ecx
mov rcx, r12
shl eax, 8
or r9d, eax
call fcn.00012738
mov rcx, qword [rsp + 0x60]
cmp eax, r13d
mov ebx, eax
jl 0x29485
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor eax, eax
jmp 0x2977d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebp
jmp 0x2977d
mov eax, 0xc0000001
add rsp, 0x120
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret