Function at 0x7fff25d902b4
Capabilities:
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov r14d, r8d
mov r15, rdx
mov r13, rcx
or qword [rax - 0xd0], 0xffffffffffffffff
or qword [rax - 0xc8], 0xffffffffffffffff
xor ecx, ecx
mov dword [rax - 0xb8], ecx
mov qword [rax - 0xb0], rcx
mov qword [rax - 0xc0], rcx
mov dword [rax - 0x88], 1
mov dword [rax - 0x8c], ecx
mov qword [rax - 0x80], rcx
mov dword [rax - 0x90], ecx
mov edi, 0x1000
mov dword [rax - 0xd8], edi
mov r8d, edi
mov rcx, qword gs:[0x60]
mov edx, dword [0x7fff25fd0c80]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
mov qword [rsp + 0xb8], rax
xor edx, edx
test rax, rax
je 0x7fff25d9043f
mov dword [rsp + 0x20], 0x16
mov edi, dword [rsp + 0x90]
mov r9d, edi
mov r8, rax
lea rdx, [rsp + 0xf8]
mov rcx, r13
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
mov dword [rsp + 0x188], eax
xor edx, edx
test eax, eax
js 0x7fff25d903f5
cmp eax, 0x80000005
je 0x7fff25d90327
cmp eax, 0xc0000023
je 0x7fff25d90327
test rbx, rbx
je 0x7fff25d90449
test eax, eax
js 0x7fff25d90457
mov qword [rsp + 0xd0], rbx
mov rsi, qword [rsp + 0xa8]
lea r12, [rbx + 4]
cmp dword [r12], 2
jbe 0x7fff25d903dd
cmp word [rbx + 0x1a], 0x3a
jne 0x7fff25d90466
cmp dword [rbx], edx
jne 0x7fff25d907d8
mov dword [rsp + 0xb0], 1
jmp 0x7fff25d907ea
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0xb8]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
xor edx, edx
mov ebx, edx
mov qword [rsp + 0xb8], rdx
mov eax, dword [rsp + 0x90]
lea edi, [rax + rax]
mov dword [rsp + 0x90], edi
mov eax, dword [rsp + 0x188]
jmp 0x7fff25d90398
mov eax, 0xc0000017
jmp 0x7fff25d903a6
cmp eax, 0xc000000d
je 0x7fff25d903e5
cmp eax, 0xc0000002
je 0x7fff25d903e5
test r14b, 1
jne 0x7fff25d903e5
mov ecx, eax
call fcn.7fff25d6b370
jmp 0x7fff25d903f0
test rsi, rsi
jne 0x7fff25d90568
mov ebx, 0x1000
mov dword [rsp + 0x90], ebx
mov r8d, ebx
mov rcx, qword gs:[0x60]
mov edx, dword [0x7fff25fd0c80]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rsi, rax
mov qword [rsp + 0xa8], rax
xor edx, edx
test rax, rax
je 0x7fff25d9054a
mov ebx, dword [rsp + 0x90]
lea r9d, [rbx - 2]
mov dword [rsp + 0x20], 0x16
mov r8, rax
lea rdx, [rsp + 0xf8]
mov rcx, r15
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
mov dword [rsp + 0x188], eax
xor edx, edx
test eax, eax
jns 0x7fff25d90532
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0xa8]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
xor edx, edx
mov esi, edx
mov qword [rsp + 0xa8], rdx
mov eax, dword [rsp + 0x90]
lea ebx, [rax + rax]
mov dword [rsp + 0x90], ebx
mov eax, dword [rsp + 0x188]
cmp eax, 0x80000005
je 0x7fff25d9047b
cmp eax, 0xc0000023
je 0x7fff25d9047b
jmp 0x7fff25d9054f
mov eax, 0xc0000017
test rsi, rsi
je 0x7fff25d90457
test eax, eax
js 0x7fff25d90457
mov rbx, qword [rsp + 0xd0]
mov rdi, rsi
mov qword [rsp + 0xf0], rsi
mov r15d, 1
mov eax, dword [rdi + 4]
cmp dword [r12], eax
jne 0x7fff25d9067c
mov r8d, eax
shr r8, 1
lea rdx, [rdi + 0x18]
lea rcx, [rbx + 0x18]
call qword [sym.imp.ntdll.dll__wcsnicmp]
nop dword [rax + rax]
xor edx, edx
test eax, eax
jne 0x7fff25d9067c
mov r15d, edx
cmp r15d, 1
jne 0x7fff25d907cb
lea rax, [rbx + 0x18]
mov qword [rsp + 0xc8], rax
movzx eax, word [r12]
mov word [rsp + 0xc0], ax
mov word [rsp + 0xc2], ax
mov dword [rsp + 0x108], 0x30
mov qword [rsp + 0x110], r13
mov dword [rsp + 0x120], edx
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x118], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x128], xmm0
mov dword [rsp + 0x28], 0x24
mov dword [rsp + 0x20], 7
lea r9, [rsp + 0xf8]
lea r8, [rsp + 0x108]
mov r12d, 0x80100000
mov edx, r12d
lea rcx, [rsp + 0x98]
call qword [sym.imp.ntdll.dll_NtOpenFile]
nop dword [rax + rax]
xor edx, edx
test eax, eax
jns 0x7fff25d90696
test r15b, r14b
je 0x7fff25d9045d
cmp dword [rbx], edx
je 0x7fff25d903e5
mov eax, dword [rbx]
add rbx, rax
mov qword [rsp + 0xd0], rbx
mov r15, qword [rsp + 0x178]
jmp 0x7fff25d903c7
cmp dword [rdi], edx
je 0x7fff25d905ad
mov eax, dword [rdi]
add rdi, rax
mov qword [rsp + 0xf0], rdi
jmp 0x7fff25d90579
movzx ecx, word [rsp + 0xc0]
shr rcx, 1
mov rax, qword [rsp + 0xc8]
movzx edi, word [rax + rcx*2]
mov word [rax + rcx*2], dx
or qword [rsp + 0xa0], 0xffffffffffffffff
lea rax, [rbx + 8]
lea rcx, [rsp + 0xd8]
mov qword [rsp + 0x80], rcx
mov dword [rsp + 0x78], edx
mov dword [rsp + 0x70], edx
mov dword [rsp + 0x68], edx
mov qword [rsp + 0x60], rdx
lea rcx, [rsp + 0xe8]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0xdc]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rdx
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edx
mov r15, qword [rsp + 0x178]
mov qword [rsp + 0x20], r15
mov r9, qword [rsp + 0xc8]
mov r8d, r12d
lea rdx, [rsp + 0x98]
xor ecx, ecx
call fcn.7fff25d947e8
test eax, eax
jne 0x7fff25d9076d
movzx ecx, word [rsp + 0xc0]
shr rcx, 1
mov rax, qword [rsp + 0xc8]
mov word [rax + rcx*2], di
test r14b, 1
je 0x7fff25d903f0
movzx ecx, word [rsp + 0xc0]
shr rcx, 1
mov rax, qword [rsp + 0xc8]
mov word [rax + rcx*2], di
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
or qword [rsp + 0x98], 0xffffffffffffffff
mov rcx, qword [rsp + 0xa0]
cmp rcx, 0xffffffffffffffff
je 0x7fff25d907c4
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
or qword [rsp + 0xa0], 0xffffffffffffffff
xor edx, edx
jmp 0x7fff25d903dd
mov r15, qword [rsp + 0x178]
jmp 0x7fff25d903dd
mov eax, dword [rbx]
add rbx, rax
mov qword [rsp + 0xd0], rbx
jmp 0x7fff25d903c7
mov rcx, qword [rsp + 0x98]
cmp rcx, 0xffffffffffffffff
jne 0x7fff25df0c58
mov rcx, qword [rsp + 0xa0]
cmp rcx, 0xffffffffffffffff
jne 0x7fff25df0c6a
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0xb8]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0xa8]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov eax, dword [rsp + 0xb0]
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
nop
jmp 0x7fff25d907fc
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
nop
jmp 0x7fff25d9080e