Function at 0x14002c510
Capabilities:
Get file attributes

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x3a8
xor eax, eax
xor r15d, r15d
mov r14, rcx
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x70], r15d
mov r13, rdx
lea r8d, [r15 + 0x3c]
lea rcx, [r11 - 0x2c4]
xor edx, edx
mov esi, 0x800b0100
mov qword [r11 - 0x358], rax
mov qword [r11 - 0x350], rax
mov qword [r11 - 0x348], rax
mov qword [r11 - 0x340], rax
mov qword [r11 - 0x338], rax
mov qword [r11 - 0x330], rax
mov qword [r11 - 0x328], rax
mov qword [r11 - 0x320], rax
mov dword [r11 - 0x2c8], r15d
call fcn.14009e740
mov eax, 0x38ee
mov word [rsp + 0x64], ax
mov eax, 0x11d1
lea rdx, [rsp + 0xc8]
xor r9d, r9d
xor r8d, r8d
mov rcx, r14
mov word [rsp + 0x66], ax
mov dword [rsp + 0x60], 0xf750e6c3
mov byte [rsp + 0x68], 0x85
mov byte [rsp + 0x69], 0xe5
mov byte [rsp + 0x6a], r15b
mov byte [rsp + 0x6b], 0xc0
mov byte [rsp + 0x6c], 0x4f
mov byte [rsp + 0x6d], 0xc2
mov byte [rsp + 0x6e], 0x95
mov byte [rsp + 0x6f], 0xee
mov qword [rsp + 0x3f8], r15
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
lea edi, [r15 + 1]
test al, al
je 0x14002c4f1
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], edi
lea rax, [rsp + 0xc8]
mov dword [rsp + 0x30], 5
lea r9, [rsp + 0x178]
lea r8, [rsp + 0xd8]
lea rcx, [rsp + 0xc0]
mov edx, 0x120089
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0xd8], 0x30
mov qword [rsp + 0x20], r15
mov qword [rsp + 0xe0], r15
mov dword [rsp + 0xf0], 0x40
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf8], r15
mov qword [rsp + 0x100], r15
call qword [sym.imp.ntdll.dll_NtCreateFile]
xor edx, edx
mov ebx, eax
mov rax, qword gs:[0x30]
mov r8, qword [rsp + 0xd0]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test ebx, ebx
js 0x14002c4f1
mov rbx, qword [rsp + 0xc0]
lea r9d, [r15 + 0x18]
lea r8, [rsp + 0x150]
lea rdx, [rsp + 0x168]
mov rcx, rbx
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
js 0x14002c4e8
cmp qword [rsp + 0x158], 0x2000000
jg 0x14002c4e8
mov rcx, qword [0x1400d8fb0]
xor edx, edx
mov r8d, pe_nt_image_headers64
mov qword [rsp + 0x3e0], rbp
mov dword [rsp + 0x3f0], 0x100
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbp, rax
test rax, rax
jne 0x14002c1b7
mov ecx, 0xc000009a
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
lea rdx, [rsp + 0x3f0]
xor r9d, r9d
mov r8, rax
mov rcx, rbx
call qword [0x1400d83e0]
test eax, eax
jne 0x14002c244
mov rcx, qword [0x1400d8fb0]
mov r8, rbp
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ecx, dword [rsp + 0x3f0]
call sym.ProcessHacker.exe_PhAllocate
lea rdx, [rsp + 0x3f0]
xor r9d, r9d
mov r8, rax
mov rcx, rbx
mov rbp, rax
call qword [0x1400d83e0]
test eax, eax
jne 0x14002c244
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [0x1400d8fb0]
mov r8, rbp
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, edi
mov rbp, qword [rsp + 0x3e0]
add rsp, 0x3a8
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
ret
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x3f8]
xor r8d, r8d
call qword [0x1400d8410]
test eax, eax
je 0x14002c217
mov eax, dword [rsp + 0x3f0]
mov qword [rsp + 0x3a0], r12
lea ecx, [rax + rax + 1]
add rcx, rcx
call sym.ProcessHacker.exe_PhAllocate
mov r9d, r15d
mov rbx, rax
mov eax, dword [rsp + 0x3f0]
test eax, eax
je 0x14002c2d8
mov rdx, rbp
mov r8, rbx
lea r10, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
movzx ecx, byte [rdx]
inc r9d
inc rdx
shr rcx, 4
add r8, 4
movsx eax, byte [rcx + r10]
mov word [r8 - 4], ax
movzx eax, byte [rdx - 1]
and eax, 0xf
movsx eax, byte [rax + r10]
mov word [r8 - 2], ax
mov eax, dword [rsp + 0x3f0]
cmp r9d, eax
jb 0x14002c2a0
add eax, eax
xor r9d, r9d
mov rdx, rbp
mov word [rbx + rax*2], r15w
mov r8d, dword [rsp + 0x3f0]
mov rcx, qword [rsp + 0x3f8]
mov qword [rsp + 0x20], r15
call qword [0x1400d8400]
mov rcx, qword [0x1400d8fb0]
mov r8, rbp
xor edx, edx
mov r12, rax
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test r12, r12
je 0x14002c442
lea rcx, [rsp + 0x194]
xor edx, edx
mov r8d, 0x208
mov dword [rsp + 0x190], r15d
call fcn.14009e740
lea rdx, [rsp + 0x190]
xor r8d, r8d
mov rcx, r12
call qword [0x1400d83f8]
test eax, eax
je 0x14002c42e
cmp dword [0x1400d8fc0], 0x3c
lea rax, [rsp + 0x194]
mov dword [rsp + 0x110], 0x40
mov qword [rsp + 0x118], rax
lea rax, [rsp + 0x110]
mov qword [rsp + 0x128], r14
mov qword [rsp + 0x120], rbx
mov dword [rsp + 0x70], 0x50
mov dword [rsp + 0x88], 2
mov qword [rsp + 0x98], rax
mov dword [rsp + 0x8c], edi
mov dword [rsp + 0x90], 2
mov dword [rsp + 0xa0], edi
jb 0x14002c3d2
bts dword [rsp + 0xb8], 0xc
jmp 0x14002c3da
or dword [rsp + 0xb8], 0x10
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [0x1400d8408]
mov esi, eax
test r13, r13
je 0x14002c411
cmp eax, 0x800b0100
je 0x14002c40d
mov rcx, qword [rsp + 0xa8]
call fcn.14002bcd0
mov qword [r13], rax
jmp 0x14002c411
mov qword [r13], r15
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x60]
xor ecx, ecx
mov dword [rsp + 0xa0], 2
call qword [0x1400d8408]
mov rcx, qword [rsp + 0x3f8]
xor r8d, r8d
mov rdx, r12
call qword [0x1400d83d8]
mov rcx, qword [0x1400d8fb0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rsp + 0x3f8]
xor edx, edx
call qword [0x1400d83e8]
cmp esi, 0x800b010c
mov r12, qword [rsp + 0x3a0]
jg 0x14002c4b8
cmp esi, 0x800b010c
je 0x14002c4ac
cmp esi, 0x80092026
je 0x14002c4a0
cmp esi, 0x800b0100
je 0x14002c4e1
cmp esi, 0x800b0101
jne 0x14002c4c4
mov edi, 3
mov eax, edi
jmp 0x14002c22b
mov edi, 6
mov eax, edi
jmp 0x14002c22b
mov edi, 4
mov eax, edi
jmp 0x14002c22b
cmp esi, 0x800b0111
je 0x14002c4dc
test esi, esi
je 0x14002c4d0
mov edi, 6
mov eax, edi
jmp 0x14002c22b
mov edi, 2
mov eax, edi
jmp 0x14002c22b
mov edi, 5
mov eax, edi
jmp 0x14002c22b
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
add rsp, 0x3a8
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [0x1400d18f0], 1
mov rbx, rdx
mov rdi, rcx
je 0x14002c5d8
mov ecx, 2
xor eax, eax
lock cmpxchg dword [0x1400d18f0], ecx
test eax, eax
je 0x14002c562
sub eax, 1
je 0x14002c5d8
cmp eax, 1
jne 0x14002c5d8
lea rcx, [0x1400d18f8]
xor edx, edx
call sym.ProcessHacker.exe_PhfWaitForEvent
jmp 0x14002c5d8
call fcn.14002b940
mov r11d, 1
xchg dword [0x1400d18f0], r11d
mov edx, dword [0x1400d18f8]
test dl, 1
jne 0x14002c5d8
lea ecx, [rdx + 1]
mov eax, edx
lock cmpxchg dword [0x1400d18f8], ecx
cmp eax, edx
jne 0x14002c574
mov rcx, qword [0x1400d1900]
test rcx, rcx
je 0x14002c5a4
xor edx, edx
call qword [sym.imp.ntdll.dll_NtSetEvent]
mov eax, 0xfffffffe
lock xadd dword [0x1400d18f8], eax
sub eax, 2
test eax, 0xfffffffe
jne 0x14002c5d8
mov rcx, qword [0x1400d1900]
test rcx, rcx
je 0x14002c5d8
call qword [sym.imp.ntdll.dll_NtClose]
mov qword [0x1400d1900], 0
cmp qword [0x1400d83e0], 0
je 0x14002c665
cmp qword [0x1400d8410], 0
je 0x14002c665
cmp qword [0x1400d8400], 0
je 0x14002c665
cmp qword [0x1400d83f8], 0
je 0x14002c665
cmp qword [0x1400d83d8], 0
je 0x14002c665
cmp qword [0x1400d83e8], 0
je 0x14002c665
cmp qword [0x1400d8408], 0
je 0x14002c665
cmp qword [0x1400d8418], 0
je 0x14002c665
cmp qword [0x1400d83f0], 0
je 0x14002c665
cmp qword [0x1400d83d0], 0
je 0x14002c665
mov rdx, rbx
mov rcx, rdi
call fcn.14002bdb0
cmp eax, 1
jne 0x14002c667
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14002bf90
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret