Function at 0x210102ef0
Capabilities:
Get disk information
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x3f8
mov rax, qword [0x21025fe48]
mov r12d, dword [rax + 0x9c0c]
mov qword [rsp + 0x448], rdx
mov rbp, rcx
mov r14, r9
mov qword [rsp + 0x450], r8
mov dword [rsp + 0x78], 0x40
test r12d, r12d
jne 0x210102f44
mov eax, dword [rcx + 0x1010]
shr eax, 8
and eax, 0x40
mov dword [rsp + 0x78], eax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
lea r13, [rsp + 0xb0]
mov r15, rbp
lea rsi, [rsp + 0x120]
lea rbx, [rsp + 0xc0]
mov eax, dword [rax - 0x2cc8]
mov dword [rsp + 0xa8], eax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov eax, dword [rax - 0x2cc4]
mov dword [rsp + 0xb0], 0xfffe0000
mov dword [rsp + 0xac], eax
lea rax, [rsp + 0xa8]
mov rcx, rax
mov qword [rsp + 0x80], rax
call method.tmp_pathbuf.w_get__
mov qword [rsp + 0x100], r13
mov qword [rsp + 0xb8], rax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0xf0], 0x30
mov qword [rsp + 0xf8], 0
mov dword [rsp + 0x108], eax
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x118], 0
mov byte [rsp + 0x7f], 0
mov byte [r15], 0
mov rcx, rsi
mov rdx, qword [rsp + 0x448]
mov byte [r15 + 0x1028], 0
mov r8, qword [rsp + 0x450]
mov dword [r15 + 0x101c], 1
mov dword [r15 + 0x102a], 0
mov dword [r15 + 0x1030], 0
mov dword [r15 + 0x100c], 0
mov qword [rsp + 0x98], 0
call method.suffix_scan.has_char_const__suffix_info_const_
mov rdx, rax
sub rdx, qword [rsp + 0x448]
mov qword [r15 + 0x1000], rax
mov dword [r15 + 0x1008], edx
movzx eax, byte [rax]
cmp qword [rsp + 0x140], 0xff
mov byte [rsp + 0x7e], al
ja 0x210103cdb
lea rax, [0x210230dc0]
mov dword [rsp + 0x70], 0x18
lea r12, [0x210273880]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x98]
lea rdi, [rsp + 0xf0]
mov qword [rsp + 0x60], rax
mov rcx, rsi
call method.suffix_scan.next__
test eax, eax
je 0x210103c40
mov r8d, dword [r15 + 0x1010]
mov rcx, qword [rsp + 0x148]
mov rdx, r13
mov dword [r15 + 0x1024], 0
shr r8d, 0x12
and r8d, 1
call sym.get_nt_native_path_char_const___UNICODE_STRING__bool_
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x21010311b
call sym.NtClose
mov qword [rsp + 0x98], 0
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x40], 0x204000
mov r9, rbx
mov r8, rdi
mov dword [rsp + 0x38], 1
mov rcx, qword [rsp + 0x60]
mov edx, 0x20088
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x68]
mov dword [rsp + 0x30], 7
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call sym.NtCreateFile
mov ebp, eax
test byte [r12], 1
jne 0x210103530
test ebp, ebp
js 0x210103410
mov ebp, dword [r14]
mov rcx, qword [rsp + 0x98]
test ebp, ebp
jne 0x210103238
mov r8, rcx
mov rdx, r13
mov rcx, r14
call method.fs_info.update__UNICODE_STRING__void_
test al, al
jne 0x210103230
mov eax, dword [r15 + 0x1018]
mov rdx, qword [r15 + 0x1000]
cmp byte [rdx], 0
setne dl
cmp byte [rsp + 0x7e], 0
mov byte [r15 + 0x1020], dl
jne 0x2101031d3
test dl, dl
jne 0x210103920
test ah, 4
jne 0x210103cee
mov r8d, eax
mov ecx, dword [rsp + 0x130]
and r8d, 0x11
cmp r8d, 1
je 0x2101038c8
cmp ecx, 4
jle 0x2101032c8
test dl, dl
je 0x2101032c8
mov dword [r15 + 0x1018], 0xffffffff
test byte [r15 + 0x1015], 0x20
jne 0x2101030c3
mov dword [r15 + 0x1024], 2
jmp 0x2101030c3
mov rcx, qword [rsp + 0x98]
mov rax, qword [rsp + 0x460]
cmp dword [r14 + 0xc], 6
lea rdx, [rax + 8]
je 0x210103560
call sym.file_get_fai_void___FILE_ALL_INFORMATION_
mov ebp, eax
test eax, eax
js 0x21010356f
cmp dword [r14 + 0xc], 6
mov rax, qword [rsp + 0x460]
jne 0x210103880
mov eax, dword [rax + 8]
mov rdx, qword [r15 + 0x1000]
mov dword [rsp + 0x88], eax
and eax, 7
cmp eax, 2
sete al
movzx eax, al
shl eax, 4
mov dword [r15 + 0x1018], eax
cmp byte [rdx], 0
setne dl
cmp byte [rsp + 0x7e], 0
mov byte [r15 + 0x1020], dl
jne 0x2101032b4
test dl, dl
jne 0x210103920
mov ecx, dword [rsp + 0x130]
cmp ecx, 4
jg 0x2101031fd
nop dword [rax]
and eax, 0x14
mov rbp, r15
cmp eax, 4
je 0x210103990
cmp dword [r14 + 0xc], 6
je 0x210103950
cmp byte [0x210230a08], 0
je 0x2101032fd
mov eax, dword [rbp + 0x1014]
and eax, 5
cmp eax, 1
je 0x210103a28
mov dword [rbp + 0x101c], 0
test byte [0x210273880], 1
je 0x210103890
cmp byte [rbp + 0x1028], 0
lea rax, str.is_a_device
jne 0x21010332b
lea rax, str.not_a_symlink
mov qword [rsp + 0x20], rax
mov edx, 0x10
mov rcx, r12
xor r15d, r15d
lea r9, [0x2102a1983]
lea r8, str.int_symlink_info::check_char__const_suffix_info__fs_info__path_conv_handle_
call method.strace.prntf_unsigned_int__char_const__char_const__..._
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x210103373
test byte [rbp + 0x1015], 0x10
je 0x2101038b8
mov rax, qword [rsp + 0x460]
mov qword [rax], rcx
test byte [0x210273880], 1
je 0x2101033c2
mov eax, dword [rbp + 0x100c]
lea r9, str._d__symlink.check__s___p___mount_flags__y__path_flags__y_
mov edx, 0x10
mov rcx, r12
lea r8, str.int_symlink_info::check_char__const_suffix_info__fs_info__path_conv_handle_
mov dword [rsp + 0x40], eax
mov eax, dword [rbp + 0x1010]
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x148]
mov dword [rsp + 0x20], r15d
mov qword [rsp + 0x28], rax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
mov edx, dword [rsp + 0xa8]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov dword [rax - 0x2cc8], edx
mov edx, dword [rsp + 0xac]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov dword [rax - 0x2cc4], edx
mov eax, r15d
add rsp, 0x3f8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp ebp, 0xc000004f
sete al
cmp ebp, 0xc0000022
je 0x210103438
test al, al
jne 0x210103438
lea edx, [rbp + 0x3fffff45]
and edx, 0xfffffff7
je 0x210103438
cmp ebp, 0xc000000d
jne 0x21010347e
mov rcx, qword [rsp + 0x60]
mov r9, rbx
mov r8, rdi
mov edx, 0x20080
mov dword [rsp + 0x28], 0x204000
mov dword [rsp + 0x20], 7
cmp ebp, 0xc00000bb
je 0x210103800
test al, al
jne 0x210103800
call sym.NtOpenFile
mov ebp, eax
test byte [r12], 1
jne 0x210103823
cmp ebp, 0xc0000034
jne 0x210103853
cmp byte [rsp + 0x7f], 0
jne 0x210103590
mov rax, qword [r15 + 0x1000]
cmp byte [rax], 0
jne 0x210103590
movzx edx, byte [rax - 1]
cmp dl, 0x5c
je 0x210103590
test byte [r15 + 0x1012], 4
jne 0x210103590
cmp dl, 0x2e
je 0x2101034fc
cmp dl, 0x20
setne dl
sub rax, 1
test dl, dl
je 0x2101034fc
mov rdx, qword [rsp + 0x448]
jmp 0x2101034e9
cmp rdx, rax
ja 0x21010410f
sub rax, 1
cmp byte [rax], 0x5c
jne 0x2101034e0
cmp byte [rax + 1], 0x20
jne 0x210103590
xor r8d, r8d
mov rdx, r13
mov rcx, r14
call method.fs_info.update__UNICODE_STRING__void_
cmp byte [r14 + 0x10], 0
jns 0x210103590
or dword [r15 + 0x1010], 0x40000
mov byte [rsp + 0x7f], 1
jmp 0x210103005
mov qword [rsp + 0x28], r13
mov edx, 0x40
mov rcx, r12
lea r9, str._y__NtCreateFile___S_
mov dword [rsp + 0x20], eax
lea r8, str.int_symlink_info::check_char__const_suffix_info__fs_info__path_conv_handle_
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x210103178
call sym.nfs_fetch_fattr3_void__fattr3_
mov ebp, eax
test eax, eax
jns 0x21010325e
cmp ebp, 0xc000003a
sete al
cmp ebp, 0xc0000279
sete dl
or eax, edx
test byte [r12], 1
je 0x2101035d0
jmp 0x21010359d
test byte [r12], 1
je 0x210103205
xor eax, eax
mov qword [rsp + 0x28], r13
mov edx, 0x40
mov rcx, r12
lea r9, str._y__NtQueryInformationFile___S_
mov dword [rsp + 0x20], ebp
lea r8, str.int_symlink_info::check_char__const_suffix_info__fs_info__path_conv_handle_
mov byte [rsp + 0x88], al
call method.strace.prntf_unsigned_int__char_const__char_const__..._
movzx eax, byte [rsp + 0x88]
mov dword [r15 + 0x1018], 0xffffffff
test al, al
jne 0x210103c60
cmp ebp, 0xc00000be
je 0x210103c60
mov eax, ebp
and eax, 0xffffffdf
cmp eax, 0xc0000013
je 0x210103c60
cmp ebp, 0xc00000cc
je 0x210103c60
cmp ebp, 0xc0000034
je 0x210103210
cmp ebp, 0xc000000f
je 0x210103210
movzx r9d, word [rsp + 0xb0]
mov r8, qword [rsp + 0xb8]
mov eax, r9d
shr ax, 1
jmp 0x210103654
lea edx, [rax - 1]
movzx ecx, dx
cmp word [r8 + rcx*2], 0x5c
je 0x210103938
mov eax, edx
test ax, ax
jne 0x210103640
mov eax, 2
mov ecx, 2
mov edx, r9d
mov qword [rsp + 0xd8], r8
add r8, rax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x28], 0x4021
sub edx, ecx
mov r9, rbx
mov dword [rsp + 0x20], 7
mov word [rsp + 0xd2], cx
mov word [rsp + 0xd0], cx
lea rcx, [rsp + 0xa0]
mov word [rsp + 0xe2], dx
mov word [rsp + 0xe0], dx
mov edx, 0x100001
mov qword [rsp + 0xe8], r8
lea r8, [rsp + 0x150]
mov dword [rsp + 0x168], eax
lea rax, [rsp + 0xd0]
mov dword [rsp + 0x150], 0x30
mov qword [rsp + 0x158], 0
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x170], 0
mov qword [rsp + 0x178], 0
call sym.NtOpenFile
test eax, eax
js 0x210103dbd
mov dword [rsp + 0x50], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rax, [rsp + 0xe0]
mov dword [rsp + 0x40], 1
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x180]
mov dword [rsp + 0x38], 0x25
mov dword [rsp + 0x30], 0x270
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call sym.NtQueryDirectoryFile
mov r8, qword [rsp + 0xa0]
mov rcx, r14
mov rdx, r13
mov ebp, eax
call method.fs_info.update__UNICODE_STRING__void_
mov rcx, qword [rsp + 0xa0]
call sym.NtClose
test ebp, ebp
jns 0x210103deb
test byte [r12], 1
jne 0x2101039f0
cmp ebp, 0xc000000f
je 0x210103210
mov dword [r15 + 0x1018], 0
mov rbp, r15
mov rax, qword [rbp + 0x1000]
cmp byte [rax], 0
setne byte [rbp + 0x1020]
mov dword [rbp + 0x101c], 0
test byte [0x210273880], 1
je 0x210103890
lea r12, [0x210273880]
jmp 0x210103314
call sym.NtOpenFile
test byte [r12], 1
mov dword [rsp + 0x70], 0
mov qword [rsp + 0x68], 0
mov ebp, eax
je 0x21010347e
mov qword [rsp + 0x28], r13
mov edx, 0x40
mov rcx, r12
lea r9, str._y__NtOpenFile__no_EAs__S_
mov dword [rsp + 0x20], ebp
lea r8, str.int_symlink_info::check_char__const_suffix_info__fs_info__path_conv_handle_
call method.strace.prntf_unsigned_int__char_const__char_const__..._
cmp ebp, 0xc0000034
je 0x21010348a
cmp ebp, 0xc0000201
je 0x210103cbb
cmp ebp, 0xc0000715
je 0x210103cbb
test ebp, ebp
js 0x21010356f
jmp 0x210103180
mov eax, dword [rax + 0x28]
mov dword [r15 + 0x1018], eax
jmp 0x2101031b0
mov rcx, qword [rsp + 0x98]
xor r15d, r15d
lea r12, [0x210273880]
test rcx, rcx
je 0x2101033c2
test byte [rbp + 0x1015], 0x10
jne 0x210103368
call sym.NtClose
jmp 0x210103373
cmp ecx, 4
jle 0x2101032c8
mov dword [rsp + 0x28], 0x4020
mov r9, rbx
mov r8, rdi
mov edx, 0x80100000
mov dword [rsp + 0x20], 7
lea rcx, [rsp + 0x180]
call sym.NtOpenFile
test eax, eax
jns 0x210103be8
cmp byte [r15 + 0x1020], 0
jne 0x210103205
mov rbp, r15
jmp 0x2101032e2
mov edx, 1
test al, 0x10
je 0x2101031d3
jmp 0x210103205
lea ecx, [rax + rax]
movzx eax, ax
add rax, rax
jmp 0x210103663
mov rax, qword [rsp + 0x460]
mov eax, dword [rax + 8]
mov dword [rsp + 0x60], eax
and eax, 7
cmp eax, 5
jne 0x2101032e2
mov rdx, qword [rsp + 0x98]
mov rcx, r15
call method.symlink_info.check_nfs_symlink_void_
mov r15d, eax
test eax, eax
jne 0x21010334e
jmp 0x2101032e2
mov dword [rsp + 0x28], 0x4020
mov r9, rbx
mov r8, rdi
mov edx, 0x80100000
mov dword [rsp + 0x20], 7
lea rcx, [rsp + 0x180]
call sym.NtOpenFile
test eax, eax
js 0x2101032e2
mov rdx, qword [rsp + 0x180]
mov rcx, r15
call method.symlink_info.check_sysfile_void_
mov rcx, qword [rsp + 0x180]
mov r15d, eax
call sym.NtClose
test r15d, r15d
je 0x2101032e2
jmp 0x21010334e
mov rax, qword [rsp + 0x88]
mov dword [rsp + 0x20], ebp
mov rcx, r12
lea r9, str._y__NtQueryDirectoryFile__S_
lea r8, str.int_symlink_info::check_char__const_suffix_info__fs_info__path_conv_handle_
mov edx, 0x40
mov qword [rsp + 0x28], rax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2101037ab
mov rcx, qword [rsp + 0x80]
call method.tmp_pathbuf.w_get__
mov rcx, qword [rsp + 0x98]
xor r9d, r9d
mov r8d, 0x8000
mov rdx, rax
mov r15, rax
call sym.GetFinalPathNameByHandleW
test eax, eax
je 0x2101032fd
lea edx, [rax - 1]
mov r8, qword [rsp + 0xb8]
lea r9, [r15 + rdx*2]
mov rcx, rdx
movzx edx, word [rsp + 0xb0]
movzx ebx, word [r9]
sub edx, 1
movsxd rdx, edx
and rdx, 0xfffffffffffffffe
cmp word [r8 + rdx], 0x5c
je 0x210103d62
cmp bx, 0x5c
je 0x210103d39
mov r8d, dword [rsp + 0x78]
mov ecx, 0x3f
add eax, eax
xor esi, esi
mov word [r15 + 2], cx
lea r14, [rsp + 0xe0]
mov rcx, r13
test r8d, r8d
mov rdx, r14
mov word [rsp + 0xe2], ax
setne sil
mov word [rsp + 0xe0], ax
mov r8d, esi
mov qword [rsp + 0xe8], r15
call sym.RtlEqualUnicodeString
test al, al
jne 0x2101037d6
movzx edx, word [0x210298220]
movzx eax, word [rsp + 0xe0]
lea rdi, [0x210298220]
lea rbx, [rsp + 0x180]
mov r8d, 1
mov rcx, rbx
cmp ax, dx
cmova eax, edx
mov rdx, rdi
mov word [rsp + 0x182], ax
mov word [rsp + 0x180], ax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x188], rax
call sym.RtlEqualUnicodeString
test al, al
je 0x210103b8e
movzx edx, word [0x210298220]
movzx eax, word [rsp + 0xb0]
mov r8d, 1
mov rcx, rbx
cmp ax, dx
cmova eax, edx
mov rdx, rdi
mov word [rsp + 0x182], ax
mov word [rsp + 0x180], ax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x188], rax
call sym.RtlEqualUnicodeString
test al, al
je 0x210103f14
mov r13, qword [rsp + 0xb8]
mov r8, r15
mov dword [rbp + 0x101c], 1
mov r9, 0xffffffffffffffff
mov dword [rsp + 0x20], 0
mov edx, 0x8000
mov rcx, r13
call sym._sys_wcstombs_char__unsigned_long__wchar_t_const__unsigned_long__bool_
mov rdx, r13
mov rcx, rbp
call method.symlink_info.posixify_char_
cmp word [rsp + 0xb0], 0xe
mov r15d, eax
je 0x210103e7c
neg r15d
jmp 0x21010334e
mov rdx, qword [rsp + 0x180]
mov rcx, r15
call method.symlink_info.check_shortcut_void_
mov rcx, qword [rsp + 0x180]
mov ebp, eax
call sym.NtClose
test ebp, ebp
je 0x210103901
mov rax, r15
mov r15d, ebp
cmp word [rax], 0x5c3a
mov rbp, rax
jne 0x21010334e
mov rdx, rax
mov rcx, rax
call method.symlink_info.parse_device_char_const_
test al, al
je 0x21010334e
jmp 0x2101032e2
mov qword [rsp + 0x440], r15
mov r15d, eax
mov rbp, qword [rsp + 0x440]
jmp 0x21010334e
mov rbp, r15
test byte [r15 + 0x1015], 0x20
jne 0x210103c78
mov dword [r15 + 0x1024], 2
cmp byte [rbp + 0x1020], 0
je 0x2101032fd
cmp byte [rsp + 0x7e], 0
jne 0x2101032fd
mov rax, qword [rbp + 0x1000]
mov byte [rax], 0
mov byte [rbp + 0x1020], 0
mov qword [rbp + 0x1000], 0
mov dword [rbp + 0x1008], 0
jmp 0x2101037d6
mov rbp, r15
test byte [r15 + 0x1015], 0x20
jne 0x210103d26
mov dword [r15 + 0x1024], 0x5c
xor r15d, r15d
jmp 0x21010334e
mov dword [r15 + 0x1024], 0x5b
mov rbp, r15
jmp 0x2101037d6
movzx r8d, byte [r14 + 0x10]
mov rdx, qword [rsp + 0x98]
mov rcx, r15
mov rbp, r15
and r8d, 1
call method.symlink_info.check_reparse_point_void__bool_
mov r15d, eax
test eax, eax
jle 0x210103d9a
mov rax, qword [rsp + 0x460]
and dword [rax + 0x28], 0xffffffef
jmp 0x21010334e
mov dword [r15 + 0x1018], 0x80
xor r15d, r15d
jmp 0x21010334e
xor r11d, r11d
mov word [r9], r11w
movzx eax, word [rsp + 0xb0]
sub eax, 1
cdqe
and rax, 0xfffffffffffffffe
cmp word [r8 + rax], 0x5c
mov eax, ecx
jne 0x210103a97
sub ecx, 1
cmp word [r15 + rcx*2], 0x5c
je 0x210103a97
cmp eax, 0x7ffe
ja 0x210103a97
lea edx, [rax + 1]
mov r9d, 0x5c
mov eax, eax
xor r10d, r10d
mov word [r15 + rax*2], r9w
mov eax, edx
mov word [r15 + rax*2], r10w
mov eax, edx
jmp 0x210103a97
je 0x210103e60
and dword [rbp + 0x1014], 0xffffefff
xor r8d, r8d
mov rdx, r13
mov rcx, r14
call method.fs_info.update__UNICODE_STRING__void_
jmp 0x2101032e2
mov rbp, r15
test byte [0x210273880], 1
jne 0x210103ed0
cmp word [rsp + 0xe0], 0
je 0x210103e8f
mov dword [rbp + 0x1018], 0x10
jmp 0x2101037c5
mov eax, dword [rsp + 0x1b8]
mov rdi, qword [rsp + 0x460]
mov rbp, r15
movdqu xmm0, xmmword [rsp + 0x188]
movdqu xmm1, xmmword [rsp + 0x198]
mov dword [r15 + 0x1018], eax
mov rax, qword [rsp + 0x460]
movups xmmword [rax + 8], xmm0
movups xmmword [rax + 0x18], xmm1
mov eax, dword [r15 + 0x1018]
mov dword [rdi + 0x40], 1
mov dword [rdi + 0x28], eax
mov rax, qword [rsp + 0x1b0]
mov qword [rdi + 0x30], rax
mov rax, qword [rsp + 0x1a8]
mov qword [rdi + 0x38], rax
mov rax, qword [rsp + 0x1e0]
mov qword [rdi + 0x48], rax
jmp 0x2101037c5
test byte [rbp + 0x100c], 8
jne 0x2101032fd
and dword [rbp + 0x1014], 0xffffefff
jmp 0x2101032e2
and dword [rbp + 0x1018], 0xffffffef
or dword [rbp + 0x100c], 0x10
jmp 0x21010334e
mov dword [rbp + 0x1018], 0
mov edx, 0xd
mov ecx, eax
call sym.geterrno_from_nt_status_int__int_
test byte [rbp + 0x1015], 0x20
je 0x210103f09
cmp eax, 0x5b
je 0x210103f09
cmp eax, 5
je 0x210103f09
cmp eax, 2
je 0x2101037c5
mov dword [rbp + 0x1018], pe_nt_image_headers64
jmp 0x2101037c5
mov rdi, qword [rsp + 0x88]
mov dword [rsp + 0x20], eax
mov rcx, r12
lea r9, str._y__NtOpenFile__S_
lea r8, str.int_symlink_info::check_char__const_suffix_info__fs_info__path_conv_handle_
mov edx, 0x40
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x28], rdi
call method.strace.prntf_unsigned_int__char_const__char_const__..._
mov eax, dword [rsp + 0x60]
jmp 0x210103dcd
mov dword [rbp + 0x1024], eax
jmp 0x2101037c5
xor eax, eax
mov edx, 0x3a
mov dword [rsp + 0xd0], 0
mov word [rsp + 0xd4], ax
mov rax, qword [rsp + 0xb8]
mov word [rsp + 0xd2], dx
movzx ecx, word [rax + 8]
call sym.msys_2.0.dll_towupper
mov r8d, 0x104
mov rdx, rbx
mov word [rsp + 0xd0], ax
lea rax, [rsp + 0xd0]
mov rcx, rax
mov qword [rsp + 0x70], rax
call sym.QueryDosDeviceW
cmp eax, 2
jle 0x2101037d6
lea ecx, [rax - 3]
movsxd rdx, ecx
mov dword [rsp + 0x60], ecx
cmp word [rsp + rdx*2 + 0x180], 0x5c
je 0x210103f92
sub eax, 2
mov dword [rsp + 0x60], eax
movzx edx, word [0x210298220]
movzx r10d, word [rsp + 0x60]
lea rcx, [rsp + 0x150]
mov r8d, 1
mov qword [rsp + 0x158], rbx
mov eax, edx
shr ax, 1
sub eax, 1
mov word [rsp + 0x68], ax
lea eax, [r10 + r10]
cmp ax, dx
cmova eax, edx
mov rdx, rdi
mov word [rsp + 0x152], ax
mov word [rsp + 0x150], ax
call sym.RtlEqualUnicodeString
test al, al
je 0x21010408e
movzx eax, word [rsp + 0x68]
mov ecx, dword [rsp + 0x60]
lea rdx, [rax + rax]
mov rdi, rax
sub ecx, eax
add rdx, rbx
movsxd rbx, ecx
lea rcx, [rdi + rdi]
add rcx, qword [rsp + 0xe8]
mov r8, rbx
call sym.msys_2.0.dll_wcsncasecmp
test eax, eax
jne 0x2101037d6
mov rdx, qword [rsp + 0xe8]
movzx eax, word [rsp + 0xd0]
add rbx, rdi
add rbx, rbx
mov word [rdx + 8], ax
lea rdi, [rdx + rbx]
sub rbx, 0xc
mov word [rdx + 0xa], 0x3a
mov rcx, rdi
mov qword [rsp + 0x60], rdx
call sym.msys_2.0.dll_wcslen
mov rdx, qword [rsp + 0x60]
lea r8, [rax + rax + 2]
lea rcx, [rdx + 0xc]
mov rdx, rdi
call sym.msys_2.0.dll_memmove
mov r8d, esi
mov rdx, r14
mov rcx, r13
sub word [rsp + 0xe0], bx
call sym.RtlEqualUnicodeString
test al, al
je 0x210103b8e
jmp 0x2101037d6
mov edx, 0x3b
mov rcx, rbx
call sym.msys_2.0.dll_wcschr
test rax, rax
je 0x2101037d6
movsxd rdx, dword [rsp + 0x60]
lea r9, [rax + 6]
mov qword [rsp + 0x60], r9
mov rdi, rdx
add rdx, rdx
add rdx, rbx
cmp r9, rdx
jae 0x2101037d6
mov rdx, qword [rsp + 0x70]
lea rcx, [rax + 2]
mov r8d, 2
call sym.msys_2.0.dll_wcsncmp
test eax, eax
jne 0x2101037d6
mov rcx, qword [rsp + 0x60]
mov edx, 0x5c
call sym.msys_2.0.dll_wcschr
mov rdx, rax
test rax, rax
je 0x2101037d6
sub rax, rbx
sar rax, 1
sub edi, eax
mov ecx, edi
movzx edi, word [rsp + 0x68]
jmp 0x210104001
lea r9, str.p___path
lea r8, str.int_symlink_info::check_char__const_suffix_info__fs_info__path_conv_handle_
mov edx, 0xd1f
lea rcx, str._usr_src_MSYS2_packages_msys2_runtime_src_msys2_runtime_winsup_cygwin_path.cc
call sym.msys_2.0.dll___assert_func
nop
nop