Function at 0x210082090
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xd8
mov rsi, qword [rdx + 0x10]
mov ebp, dword [rsi + 0xf3c0]
mov qword [rsp + 0x130], r8
mov rdi, rcx
mov rbx, rdx
test ebp, ebp
jne 0x210082230
mov eax, dword [rdx + 0x38]
mov r15d, dword [rdx + 0x18]
lea r14, [method.fhandler_base.get_handle__]
lea r13, [rsp + 0x80]
mov rdx, qword [rcx]
mov r8, qword [rdx + 0x280]
test al, 0x20
jne 0x210082480
xor r12d, r12d
test r15d, r15d
sete r12b
test al, 0x40
mov rax, qword [rdx + 0x280]
jne 0x210082628
mov r15d, 3
cmp rax, r14
jne 0x210082637
lea rax, [rdi + 0x18]
mov dword [rsp + 0x50], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], 0xf3c0
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r13
mov rcx, qword [rax]
call sym.NtQueryDirectoryFile
mov r12d, eax
cmp r12d, 0x80000006
jne 0x210082840
mov r12d, 0x80000006
lea rsi, [rsp + 0x90]
nop word [rax + rax]
mov ecx, r12d
call sym.RtlNtStatusToDosError
mov qword [rsp + 0x28], rsi
mov rdx, rbx
mov rcx, rdi
mov dword [rsp + 0x20], ebp
mov r8, qword [rsp + 0x130]
mov r9d, eax
call method.fhandler_disk_file.readdir_helper___DIR__dirent__unsigned_int__unsigned_int___UNICODE_STRING_
mov r12d, eax
test eax, eax
jne 0x210082730
add dword [rbx + 0x18], 1
test byte [0x210273880], 1
je 0x210082810
mov rax, qword [rsp + 0x130]
movzx edx, byte [rax + 0x10]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x130]
lea r9, str._d__readdir__p___p___L__lS______ls____attr__y___type__d_
mov dword [rsp + 0x50], edx
lea r8, str.virtual_int_fhandler_disk_file::readdir_DIR__dirent_
mov edx, 0x10
lea rcx, [0x210273880]
mov dword [rsp + 0x48], ebp
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], r12d
call method.strace.prntf_unsigned_int__char_const__char_const__..._
mov eax, r12d
add rsp, 0xd8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor r12d, r12d
mov eax, ebp
add rax, rsi
mov edx, dword [rax]
add ebp, edx
test edx, edx
cmovne edx, ebp
mov dword [rsi + 0xf3c0], edx
mov edx, dword [rbx + 0x38]
mov ebp, edx
and ebp, 0x20
je 0x210082540
mov esi, dword [rax + 0x3c]
lea rcx, [rax + 0x68]
and edx, 0x10
mov ebp, dword [rax + 0x38]
mov qword [rsp + 0x68], rcx
mov dword [rsp + 0x60], esi
jne 0x2100825d0
mov eax, dword [rsp + 0x60]
mov r13, qword [rbx + 0x20]
mov word [rsp + 0x92], ax
cmp dword [r13 + 0x10], 1
mov word [rsp + 0x90], ax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x98], rax
je 0x210082580
lea rsi, [rsp + 0x90]
mov ecx, dword [r13]
lea r14, [r13 + 0x18]
xor r15d, r15d
test ecx, ecx
jg 0x2100822d2
jmp 0x2100825b0
add r15d, 1
add r14, 0x10
cmp r15d, dword [r13]
jge 0x2100825b0
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call sym.RtlEqualUnicodeString
test al, al
je 0x2100822c0
movsxd r9, r15d
mov byte [r13 + r9 + 0x418], 1
mov r13, qword [rsp + 0x130]
cmp qword [r13 + 8], 0
jne 0x210082178
mov edx, dword [rbx + 0x38]
test dl, 0x10
je 0x210082178
cmp dword [rsp + 0x60], 2
je 0x210082be0
cmp dword [rsp + 0x60], 4
je 0x210082aa0
mov rax, qword [rdi]
lea rcx, [method.fhandler_base.get_handle__]
mov dword [rsp + 0xa0], 0x30
mov rax, qword [rax + 0x280]
cmp rax, rcx
jne 0x210082c21
lea rax, [rdi + 0x18]
mov rax, qword [rax]
and edx, 0x40
mov qword [rsp + 0xb0], rsi
lea r13, [rsp + 0x80]
mov qword [rsp + 0xc0], 0
lea rcx, [rsp + 0x70]
mov qword [rsp + 0xa8], rax
mov eax, dword [rdi + 0x84]
mov qword [rsp + 0xc8], 0
mov dword [rsp + 0xb8], eax
je 0x2100829a8
mov dword [rsp + 0x50], 0x18
mov r9, r13
lea rax, [0x210230dc0]
lea r8, [rsp + 0xa0]
mov qword [rsp + 0x48], rax
mov edx, 0x20000
mov dword [rsp + 0x40], 0x4000
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call sym.NtCreateFile
test eax, eax
js 0x210082178
mov dword [rsp + 0x20], 6
mov rcx, qword [rsp + 0x70]
mov rdx, r13
mov r9d, 8
lea r8, [rsp + 0x78]
call sym.NtQueryInformationFile
mov rcx, qword [rsp + 0x70]
mov r13d, eax
call sym.NtClose
test r13d, r13d
js 0x210082178
mov rax, qword [rsp + 0x78]
test byte [rdi + 0x11a], 8
jne 0x210082c6d
mov rcx, rax
shr rcx, 0x20
jne 0x210082468
test byte [rdi + 0x98], 1
je 0x210082468
mov edx, dword [rdi + 0x94]
cmp edx, 3
je 0x210082c6d
cmp edx, 5
je 0x210082c5d
mov rdx, qword [rsp + 0x130]
mov qword [rdx + 8], rax
jmp 0x210082178
cmp r8, r14
jne 0x2100829d8
xor eax, eax
test r15d, r15d
lea r13, [rsp + 0x80]
mov rcx, qword [rcx + 0x18]
sete al
mov qword [rsp + 0x28], rsi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x50], eax
xor edx, edx
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0x25
mov dword [rsp + 0x30], 0xf3c0
mov qword [rsp + 0x20], r13
call sym.NtQueryDirectoryFile
mov r12d, eax
test eax, eax
jns 0x210082515
cmp r12d, 0x80000006
je 0x210082515
lea eax, [r12 + 0x3fffff45]
and eax, 0xfffffff7
je 0x210082511
cmp r12d, 0xc0000148
je 0x210082511
cmp r12d, 0xc000000d
je 0x210082511
cmp r12d, 0xc0000003
jne 0x210082522
and dword [rbx + 0x38], 0xffffffdf
cmp r12d, 0xc0000148
je 0x210082648
mov eax, dword [rbx + 0x38]
test al, 0x20
jne 0x210082157
mov r15d, dword [rbx + 0x18]
mov rsi, qword [rbx + 0x10]
mov rdx, qword [rdi]
jmp 0x2100820eb
and edx, 0x40
je 0x210082610
mov r13, qword [rbx + 0x20]
lea rsi, [rax + 0xc]
mov eax, dword [rax + 8]
mov qword [rsp + 0x68], rsi
cmp dword [r13 + 0x10], 1
mov dword [rsp + 0x60], eax
mov word [rsp + 0x92], ax
mov word [rsp + 0x90], ax
mov qword [rsp + 0x98], rsi
jne 0x2100822a1
lea rsi, [rsp + 0x90]
xor r8d, r8d
lea rdx, [0x210298280]
mov rcx, rsi
call sym.RtlEqualUnicodeString
test al, al
je 0x210082b78
mov byte [r13 + 0x458], 1
nop word [rax + rax]
mov r13, qword [rsp + 0x130]
cmp qword [r13 + 8], 0
jne 0x210082178
jmp 0x210082303
mov rdx, qword [rax + 0x60]
mov rax, qword [rsp + 0x130]
mov qword [rax + 8], rdx
mov r13, qword [rbx + 0x20]
mov word [rsp + 0x92], si
mov word [rsp + 0x90], si
cmp dword [r13 + 0x10], 1
mov qword [rsp + 0x98], rcx
jne 0x2100822a1
jmp 0x210082580
mov esi, dword [rax + 0x3c]
lea rcx, [rax + 0x5e]
mov ebp, dword [rax + 0x38]
mov qword [rsp + 0x68], rcx
mov dword [rsp + 0x60], esi
jmp 0x2100825e0
mov r15d, 0xc
cmp rax, r14
je 0x210082113
mov rcx, rdi
call rax
jmp 0x210082117
mov r15d, dword [rbx + 0x18]
test r15d, r15d
je 0x210082950
mov rcx, qword [rbx + 0x10]
mov dword [rcx + 0xf3c0], 0
mov r8d, dword [rbx + 0x18]
test r8d, r8d
jle 0x21008295b
mov r8, rcx
xor edx, edx
lea rsi, [rdi + 0x18]
xor r15d, r15d
nop dword [rax]
test edx, edx
jne 0x2100826fd
mov rax, qword [rdi]
xor r12d, r12d
test r15d, r15d
sete r12b
mov rax, qword [rax + 0x280]
cmp rax, r14
jne 0x210082b60
mov rax, rsi
mov dword [rsp + 0x50], r12d
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], r8
xor r8d, r8d
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 3
mov dword [rsp + 0x30], 0xf3c0
mov qword [rsp + 0x20], r13
mov rcx, qword [rax]
call sym.NtQueryDirectoryFile
mov r12d, eax
test eax, eax
js 0x210082c4d
mov r8, qword [rbx + 0x10]
mov edx, dword [r8 + 0xf3c0]
mov rcx, r8
mov eax, edx
mov eax, dword [r8 + rax]
test eax, eax
je 0x210082820
add eax, edx
add r15d, 1
mov dword [rcx + 0xf3c0], eax
cmp dword [rbx + 0x18], r15d
jle 0x210082840
mov edx, eax
jmp 0x210082680
mov eax, dword [rbx + 0x38]
test al, 1
je 0x210082868
test al, 2
je 0x210082770
test byte [0x210273880], 1
je 0x210082213
mov rax, qword [rsp + 0x130]
xor esi, esi
movzx edx, byte [rax + 0x10]
lea rax, [0x21028c836]
jmp 0x2100821cb
mov r12, qword [rsp + 0x130]
mov eax, 0x2e2e
mov word [r12 + 0x18], ax
mov byte [r12 + 0x1a], 0
test byte [rbx + 0x38], 8
je 0x210082bf4
mov rax, qword [rdi]
lea rdx, [method.fhandler_base.get_handle__]
mov rax, qword [rax + 0x280]
cmp rax, rdx
jne 0x210082c3b
lea rax, [rdi + 0x18]
mov dword [rsp + 0x20], 6
mov rcx, qword [rax]
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0xa0]
mov r9d, 8
call sym.NtQueryInformationFile
mov r8d, eax
xor eax, eax
test r8d, r8d
jns 0x210082a40
mov qword [r12 + 8], rax
mov rax, qword [rsp + 0x130]
mov byte [rax + 0x10], 4
add dword [rbx + 0x18], 1
or dword [rbx + 0x38], 2
test byte [0x210273880], 1
jne 0x210082936
nop dword [rax + rax]
xor r12d, r12d
jmp 0x210082213
mov dword [rcx + 0xf3c0], 0
add r15d, 1
cmp dword [rbx + 0x18], r15d
jg 0x210082721
nop dword [rax + rax]
test r12d, r12d
jns 0x210082cb7
test byte [0x210273880], 1
jne 0x210082970
lea rsi, [rsp + 0x90]
jmp 0x210082178
mov r12, qword [rsp + 0x130]
mov edx, 0x2e
mov word [r12 + 0x18], dx
mov rax, qword [rdi]
lea rdx, [method.fhandler_base.get_handle__]
mov rax, qword [rax + 0x280]
cmp rax, rdx
jne 0x210082c0f
lea rax, [rdi + 0x18]
mov dword [rsp + 0x20], 6
mov rcx, qword [rax]
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0xa0]
mov r9d, 8
call sym.NtQueryInformationFile
mov r8d, eax
xor eax, eax
test r8d, r8d
js 0x210082910
test byte [rdi + 0x11a], 8
jne 0x210082910
mov rax, qword [rsp + 0x78]
mov rcx, rax
shr rcx, 0x20
jne 0x210082910
test byte [rdi + 0x98], 1
je 0x210082910
mov edx, dword [rdi + 0x94]
cmp edx, 3
je 0x210082c76
cmp edx, 5
jne 0x210082910
xor edx, edx
cmp dword [rdi + 0x8c], 0x30503ff
cmovbe rax, rdx
nop word [rax + rax]
mov qword [r12 + 8], rax
mov rax, qword [rsp + 0x130]
mov byte [rax + 0x10], 4
add dword [rbx + 0x18], 1
or dword [rbx + 0x38], 1
test byte [0x210273880], 1
je 0x210082810
movzx edx, byte [rax + 0x10]
xor r12d, r12d
add rax, 0x18
jmp 0x2100821cb
mov eax, dword [rbx + 0x38]
test al, 0x20
je 0x210082531
lea rsi, [rsp + 0x90]
test byte [0x210273880], 1
je 0x210082178
mov ecx, r12d
call sym.RtlNtStatusToDosError
mov dword [rsp + 0x20], r12d
mov edx, 0x40
lea r9, str.NtQueryDirectoryFile_failed__status__y__win32_error__u
mov dword [rsp + 0x28], eax
lea r8, str.virtual_int_fhandler_disk_file::readdir_DIR__dirent_
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x210082856
mov dword [rsp + 0x28], 0x204000
mov r9, r13
lea r8, [rsp + 0xa0]
mov edx, 0x20000
mov dword [rsp + 0x20], 7
call sym.NtOpenFile
jmp 0x2100823ee
call r8
xor edx, edx
test r15d, r15d
lea r13, [rsp + 0x80]
sete dl
mov qword [rsp + 0x28], rsi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x50], edx
xor edx, edx
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0x25
mov dword [rsp + 0x30], 0xf3c0
mov qword [rsp + 0x20], r13
mov rcx, qword [rax]
call sym.NtQueryDirectoryFile
mov r12d, eax
test eax, eax
js 0x2100824e0
jmp 0x210082515
test byte [rdi + 0x11a], 8
jne 0x2100827e2
mov rax, qword [rsp + 0x78]
mov rcx, rax
shr rcx, 0x20
jne 0x2100827e2
test byte [rdi + 0x98], 1
je 0x2100827e2
mov edx, dword [rdi + 0x94]
cmp edx, 3
je 0x210082c8f
cmp edx, 5
jne 0x2100827e2
xor edx, edx
cmp dword [rdi + 0x8c], 0x30503ff
cmovbe rax, rdx
jmp 0x2100827e2
mov rax, qword [rsp + 0x68]
cmp word [rax], 0x2e
jne 0x210082325
cmp word [rax + 2], 0x2e
jne 0x210082325
and edx, 8
je 0x210082c96
mov rax, qword [rdi]
lea rdx, [method.fhandler_base.get_handle__]
mov rax, qword [rax + 0x280]
cmp rax, rdx
jne 0x210082c7d
lea rax, [rdi + 0x18]
mov dword [rsp + 0x20], 6
mov rcx, qword [rax]
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0xa0]
mov r9d, 8
call sym.NtQueryInformationFile
mov r8d, eax
xor eax, eax
test r8d, r8d
js 0x210082b52
test byte [rdi + 0x11a], 8
jne 0x210082b52
mov rax, qword [rsp + 0x78]
mov rcx, rax
shr rcx, 0x20
jne 0x210082b52
test byte [rdi + 0x98], 1
je 0x210082b52
mov edx, dword [rdi + 0x94]
cmp edx, 3
je 0x210082cb0
cmp edx, 5
jne 0x210082b52
xor edx, edx
cmp dword [rdi + 0x8c], 0x30503ff
cmovbe rax, rdx
mov qword [r13 + 8], rax
jmp 0x210082178
mov qword [rsp + 0x60], r8
mov rcx, rdi
call rax
mov r8, qword [rsp + 0x60]
jmp 0x2100826a4
xor r8d, r8d
lea rdx, [0x210298260]
mov rcx, rsi
call sym.RtlEqualUnicodeString
test al, al
jne 0x210082c2e
mov rax, qword [0x21025fe40]
movzx edx, word [rsp + 0x90]
mov rax, qword [rax + 0x8618]
shr rdx, 1
sub rax, 2
cmp rdx, rax
jne 0x2100822a9
xor r8d, r8d
lea rdx, [r13 + 0x460]
mov rcx, rsi
call sym.RtlEqualUnicodeString
test al, al
je 0x2100822a9
mov byte [r13 + 0x459], 1
jmp 0x2100825b0
mov rax, qword [rsp + 0x68]
cmp word [rax], 0x2e
jne 0x210082325
jmp 0x210082ac3
mov rcx, qword [rdi + 0x128]
mov edx, 1
call sym.readdir_get_ino_char_const__bool_
mov qword [r12 + 8], rax
jmp 0x2100827e7
mov rcx, rdi
call rax
mov r12, qword [rsp + 0x130]
jmp 0x210082899
mov rcx, rdi
call rax
mov edx, dword [rbx + 0x38]
jmp 0x21008234e
mov byte [r13 + 0x45a], 1
jmp 0x2100825b0
mov rcx, rdi
call rax
mov r12, qword [rsp + 0x130]
jmp 0x2100827b1
cmp eax, 0x80000006
je 0x210082164
jmp 0x21008295b
cmp dword [rdi + 0x8c], 0x30503ff
ja 0x210082468
and dword [rbx + 0x38], 0xffffffef
jmp 0x210082178
xor eax, eax
jmp 0x210082910
mov rcx, rdi
call rax
mov r13, qword [rsp + 0x130]
jmp 0x210082ae1
xor eax, eax
jmp 0x2100827e2
mov rcx, qword [rdi + 0x128]
mov edx, 1
call sym.readdir_get_ino_char_const__bool_
mov qword [r13 + 8], rax
jmp 0x210082178
xor eax, eax
jmp 0x210082b52
mov rsi, qword [rbx + 0x10]
mov ebp, dword [rsi + 0xf3c0]
jmp 0x210082233