Function at 0x210144c70
Capabilities:
Get disk information
Get file attributes
Set file attributes
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x458
lea rbp, [rsp + 0x80]
mov edi, dword [rcx + 0x14]
mov byte [rbp + 0x2f], 1
lea r15, [rbp + 0x48]
mov r12, rcx
mov rsi, rdx
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov rcx, r15
mov dword [rbp + 0x430], r8d
lea r13, [rbp + 0x50]
mov dword [rbp + 0x438], r9d
mov eax, dword [rax - 0x2cc8]
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov dword [rbp + 0x48], eax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov qword [rbp + 0x40], 0
mov eax, dword [rax - 0x2cc4]
mov dword [rbp + 0x4c], eax
call method.tmp_pathbuf.w_get__
mov dword [rsp + 0x20], 9
mov rcx, qword [rsi]
mov rdx, r13
mov r9d, 0x10000
mov r8, rax
mov rbx, rax
call sym.NtQueryInformationFile
mov r14d, eax
test eax, eax
js 0x2101450b0
cmp dword [rbx], 2
je 0x210145050
lea eax, [rdi - 3]
mov dword [rbp + 0x70], 0x2000000
mov dword [rbp + 0x18], eax
lea rax, [rbp + 0x1d0]
mov qword [rbp + 0x78], rax
test byte [r12 + 0x18], 1
je 0x210144f80
mov r10d, 0
mov r11d, 0
lea rdi, [rbp + 0x70]
test dword [r12], 0x100
mov qword [rbp + 0x10], 0
mov word [rbp + 6], r10w
mov word [rbp + 8], r11w
jne 0x210145348
lea rdx, str..msys
test byte [r12 + 8], 4
je 0x210144da1
cmp dword [r12 + 0x14], 5
lea rax, [0x2102ab678]
cmovne rdx, rax
mov rcx, rdi
call sym.RtlAppendUnicodeToString
mov dword [rsp + 0x20], 6
mov rcx, qword [rsi]
mov r8, rbx
mov r9d, 8
mov rdx, r13
call sym.NtQueryInformationFile
mov r14d, eax
test eax, eax
js 0x210145110
mov rcx, qword [rbx]
mov r8d, 1
mov rdx, rdi
call sym.RtlInt64ToHexUnicodeString
xor edx, edx
mov rcx, r12
call method.path_conv.get_nt_native_path__UNICODE_STRING_
xor ecx, ecx
mov rdx, rax
call sym.hash_path_name_unsigned_long___UNICODE_STRING_
mov r8d, 1
mov rdx, rdi
mov rcx, rax
call sym.RtlInt64ToHexUnicodeString
movzx r9d, word [rbp + 0x70]
mov rax, qword [rbp + 0x30]
mov byte [rbx], 1
lea r14, [rbx + 0x14]
mov rdx, qword [rbp + 0x78]
mov rcx, r14
mov dword [rbx + 0x10], r9d
mov r8, r9
mov qword [rbx + 8], rax
mov dword [rbp], r9d
call sym.msys_2.0.dll_memcpy
mov r9d, dword [rbp]
mov r8, rbx
mov rdx, r13
mov dword [rsp + 0x20], 0xa
mov rcx, qword [rsi]
lea eax, [r9 + 0x16]
mov r9d, eax
mov dword [rbp], eax
call sym.NtSetInformationFile
mov r8d, eax
cmp eax, 0xc000003a
je 0x2101453d0
test r8d, r8d
js 0x2101453e2
test dword [r12], 0x100
jne 0x2101453b0
mov dword [rsp + 0x20], 0xd
lea r10, [rbp + 0x2f]
mov rcx, qword [rsi]
mov r9d, 1
mov r8, r10
mov rdx, r13
mov qword [rbp + 0x18], r10
call sym.NtSetInformationFile
mov r11d, eax
cmp eax, 0xc0000101
je 0x210145490
test eax, eax
je 0x210145930
cmp eax, 0xc00000d5
mov r10, qword [rbp + 0x18]
je 0x210145870
lea r14, [0x210273880]
test byte [0x210273880], 1
jne 0x21014544b
mov rcx, qword [rsi]
test dword [rbp + 0x430], 0x100
je 0x210145390
test r11d, r11d
js 0x210145548
mov eax, dword [r12]
cmp eax, 0xffffffff
je 0x210144f09
test al, 0x10
jne 0x210144f5c
test eax, eax
jne 0x210144f09
mov eax, pe_nt_image_headers64
mov dword [rsp + 0x20], 4
lea rdx, [rbp + 0x90]
mov r9d, 0x28
lea r8, [rbp + 0xd0]
mov qword [rbp + 0xe8], 0
mov qword [rbp + 0xe0], 0
mov qword [rbp + 0xd8], 0
mov qword [rbp + 0xd0], 0
mov dword [rbp + 0xf0], eax
call sym.NtSetInformationFile
mov rcx, qword [rsi]
mov r13d, 2
call sym.NtClose
mov qword [rsi], 0
jmp 0x21014516b
xor edx, edx
lea rdi, [rbp + 0x70]
lea r14, [rbp + 0xd0]
mov rcx, r12
call method.path_conv.get_nt_native_path__UNICODE_STRING_
mov r8d, 7
lea rdx, str.__C:_
mov rcx, qword [rax + 8]
call sym.msys_2.0.dll_wcsncmp
lea rdx, str._RECYCLE.BIN_
mov rcx, rdi
test eax, eax
lea rax, str._Recycle.Bin_
cmovne rax, rdx
mov rdx, rax
mov qword [rbp + 0x10], rax
call sym.RtlAppendUnicodeToString
mov edx, dword [rbx]
lea rcx, [rbx + 4]
mov r8d, 1
mov qword [rbp + 0x88], rcx
mov eax, edx
mov word [rbp + 0x82], dx
mov word [rbp + 0x80], dx
movzx edx, word [rbp + 0x70]
mov qword [rbp + 0xd8], rcx
mov rcx, r14
cmp ax, dx
cmova eax, edx
mov rdx, rdi
mov word [rbp + 0xd2], ax
mov word [rbp + 0xd0], ax
call sym.RtlEqualUnicodeString
test al, al
jne 0x210145050
lea rax, [rbp + 0x80]
mov r8d, 1
mov rdx, rdi
sub word [rbp + 0x70], 2
mov rcx, rax
mov qword [rbp + 8], rax
call sym.RtlEqualUnicodeString
test al, al
je 0x210145190
nop dword [rax + rax]
mov rcx, qword [rbp + 0x30]
mov r13d, 1
test rcx, rcx
je 0x2101450cd
call sym.NtClose
test byte [0x210273880], 1
jne 0x2101450d6
mov edx, dword [rbp + 0x48]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov dword [rax - 0x2cc8], edx
mov edx, dword [rbp + 0x4c]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov dword [rax - 0x2cc4], edx
mov eax, r13d
lea rsp, [rbp + 0x3d8]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov r13d, 1
test byte [0x210273880], 1
jne 0x210145138
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x21014506d
call sym.NtClose
test byte [0x210273880], 1
je 0x21014506d
xor edx, edx
mov rcx, r12
call method.path_conv.get_nt_native_path__UNICODE_STRING_
mov dword [rsp + 0x28], r13d
mov edx, 0x40
lea r9, str._S__return_bin_status__d
mov qword [rsp + 0x20], rax
lea r8, str.bin_status_try_to_bin_path_conv__void__ACCESS_MASK__ULONG_
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x21014506d
test byte [0x210273880], 1
jne 0x210145690
mov rcx, qword [rbp + 0x30]
mov r13d, 1
test rcx, rcx
jne 0x2101450c8
jmp 0x21014506d
xor edx, edx
mov rcx, r12
call method.path_conv.get_nt_native_path__UNICODE_STRING_
mov dword [rsp + 0x28], r14d
mov edx, 0x40
lea r9, str.NtQueryInformationFile___S__FileNameInformation__failed__status___y
mov qword [rsp + 0x20], rax
lea r8, str.bin_status_try_to_bin_path_conv__void__ACCESS_MASK__ULONG_
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
mov rcx, qword [rbp + 0x30]
test rcx, rcx
jne 0x21014505f
test byte [0x210273880], 1
je 0x21014506d
jmp 0x2101450d6
xor edx, edx
mov rcx, r12
call method.path_conv.get_nt_native_path__UNICODE_STRING_
movzx ecx, word [rbp + 0x80]
movzx edx, word [rax]
mov rax, qword [rax + 8]
cmp dx, cx
jbe 0x2101451b9
movzx r8d, cx
sub rdx, r8
add rax, rdx
mov edx, ecx
mov word [rbp + 0xd2], dx
mov r8d, 1
mov rcx, r14
mov word [rbp + 0xd0], dx
mov rdx, qword [rbp + 8]
mov qword [rbp + 0xd8], rax
call sym.RtlEqualUnicodeString
lea rdx, [rbp + 0xa0]
mov qword [rbp - 8], rdx
test al, al
je 0x210145a08
movzx eax, word [rbp + 0x80]
mov r8, qword [rbp + 0x88]
shr ax, 1
jmp 0x210145224
lea edx, [rax - 1]
movzx ecx, dx
cmp word [r8 + rcx*2], 0x5c
je 0x210145950
mov eax, edx
test ax, ax
jne 0x210145210
mov eax, 2
xor edx, edx
mov rcx, r12
mov word [rbp + 0x82], ax
mov word [rbp + 0x80], ax
call method.path_conv.get_nt_native_path__UNICODE_STRING_
movzx edx, word [rax]
mov r8, qword [rax + 8]
shr dx, 1
jmp 0x21014526c
lea eax, [rdx - 1]
movzx ecx, ax
cmp word [r8 + rcx*2], 0x5c
je 0x210145960
mov edx, eax
test dx, dx
jne 0x210145258
mov edx, 2
mov word [rbp + 0x62], dx
lea r10, [rbp + 0x60]
lea rcx, [rbp + 0x30]
mov r9, r13
sub dx, word [rbp + 0x80]
mov dword [rsp + 0x28], 0x4000
mov dword [rsp + 0x20], 7
add edx, 2
mov qword [rbp + 0x68], r8
mov r8, qword [rbp - 8]
mov word [rbp + 0x60], dx
mov edx, 0x20
mov qword [rbp + 0xb0], r10
mov qword [rbp + 8], r10
mov dword [rbp + 0xa0], 0x30
mov qword [rbp + 0xa8], 0
mov dword [rbp + 0xb8], 0x40
mov qword [rbp + 0xc0], 0
mov qword [rbp + 0xc8], 0
call sym.NtOpenFile
mov r10, qword [rbp + 8]
test eax, eax
js 0x210145bc0
movzx eax, word [rbp + 0x70]
add qword [rbp + 0x78], 2
sub eax, 2
cmp dword [rbp + 0x18], 1
mov word [rbp + 8], ax
jbe 0x210145be2
xor ecx, ecx
mov word [rbp + 0x70], ax
mov word [rbp + 6], cx
lea rdx, [0x2102ab754]
mov rcx, rdi
call sym.RtlAppendUnicodeToString
test dword [r12], 0x100
je 0x210144d81
nop word [rax + rax]
xor edx, edx
mov rcx, r12
call method.path_conv.get_nt_native_path__UNICODE_STRING_
movzx ecx, word [rax]
mov rdx, qword [rax + 8]
shr cx, 1
jmp 0x210145375
lea eax, [rcx - 1]
movzx r8d, ax
cmp word [rdx + r8*2], 0x5c
je 0x210145440
mov ecx, eax
test cx, cx
jne 0x210145360
mov ecx, 2
add rdx, rcx
mov rcx, rdi
call sym.RtlAppendUnicodeToString
jmp 0x210144e06
mov dword [rbp + 0x18], r11d
call sym.NtClose
mov r11d, dword [rbp + 0x18]
mov qword [rsi], 0
test r11d, r11d
js 0x210145557
nop dword [rax]
mov rcx, qword [rbp + 0x30]
mov r13d, 2
test rcx, rcx
jne 0x21014505f
jmp 0x2101450cd
mov r8d, 0xc000003a
test byte [r12 + 0x18], 1
je 0x2101456d0
test byte [0x210273880], 1
je 0x21014511d
xor edx, edx
mov rcx, r12
mov dword [rbp + 0x18], r8d
mov r13d, 1
call method.path_conv.get_nt_native_path__UNICODE_STRING_
mov r8d, dword [rbp + 0x18]
mov qword [rsp + 0x28], rdi
lea r9, str.Move__S_to__S_failed__status___y
mov qword [rsp + 0x20], rax
mov edx, 0x40
lea rcx, [0x210273880]
mov dword [rsp + 0x30], r8d
lea r8, str.bin_status_try_to_bin_path_conv__void__ACCESS_MASK__ULONG_
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x21014516b
movzx ecx, cx
add rcx, rcx
jmp 0x21014537f
xor edx, edx
mov rcx, r12
mov dword [rbp + 0x18], eax
call method.path_conv.get_nt_native_path__UNICODE_STRING_
mov r11d, dword [rbp + 0x18]
mov rcx, r14
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rax
lea r9, str.Setting_delete_disposition_on__S___S__failed__status___y
mov edx, 0x40
lea r8, str.bin_status_try_to_bin_path_conv__void__ACCESS_MASK__ULONG_
mov dword [rsp + 0x30], r11d
call method.strace.prntf_unsigned_int__char_const__char_const__..._
mov r11d, dword [rbp + 0x18]
jmp 0x210144ed7
mov qword [rbx + 8], 0
xor edx, edx
mov rcx, r12
call method.path_conv.get_nt_native_path__UNICODE_STRING_
xor edx, edx
mov rcx, r12
movzx eax, word [rax]
mov dword [rbx + 0x10], eax
call method.path_conv.get_nt_native_path__UNICODE_STRING_
xor edx, edx
mov rcx, r12
movzx r8d, word [rax]
mov qword [rbp + 0x18], r8
call method.path_conv.get_nt_native_path__UNICODE_STRING_
mov r8, qword [rbp + 0x18]
mov rcx, r14
mov rdx, qword [rax + 8]
call sym.msys_2.0.dll_memcpy
mov eax, dword [rbx + 0x10]
mov r8, rbx
mov rdx, r13
mov dword [rsp + 0x20], 0xa
mov rcx, qword [rsi]
add eax, 0x16
mov r9d, eax
mov dword [rbp], eax
call sym.NtSetInformationFile
test eax, eax
jns 0x210145c2b
lea r14, [0x210273880]
test byte [0x210273880], 1
je 0x210145548
xor edx, edx
mov rcx, r12
call method.path_conv.get_nt_native_path__UNICODE_STRING_
mov dword [rsp + 0x30], 0xc0000101
mov rcx, r14
lea r9, str.Renaming_dir__S_back_to__S_failed__status___y
mov qword [rsp + 0x28], rax
lea r8, str.bin_status_try_to_bin_path_conv__void__ACCESS_MASK__ULONG_
mov edx, 0x40
mov qword [rsp + 0x20], rdi
call method.strace.prntf_unsigned_int__char_const__char_const__..._
nop dword [rax]
mov rcx, qword [rsi]
call sym.NtClose
mov qword [rsi], 0
mov eax, dword [r12]
cmp eax, 0xffffffff
je 0x210145568
test al, 0x10
jne 0x2101453b0
cmp dword [r12 + 0x14], 6
je 0x2101453b0
test byte [r12 + 0x18], 1
jne 0x210145970
lea rax, [rbp + 0x80]
movdqa xmm0, xmmword [rbp + 0x70]
mov qword [rbp + 8], rax
movaps xmmword [rbp + 0x80], xmm0
mov rsi, qword [rbp + 8]
lea rdx, [0x2102ab932]
mov rcx, rsi
call sym.RtlAppendUnicodeToString
mov dword [rsp + 0x50], 0
mov r9, r13
mov rax, qword [rbp + 0x30]
mov qword [rsp + 0x48], 0
lea rcx, [rbp + 0x40]
lea r8, [rbp + 0xa0]
mov edx, 0x10000
mov dword [rsp + 0x40], 0x1040
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov qword [rsp + 0x20], 0
mov qword [rbp + 0xb0], rsi
mov dword [rbp + 0xa0], 0x30
mov qword [rbp + 0xa8], rax
mov dword [rbp + 0xb8], 0
mov qword [rbp + 0xc0], 0
mov qword [rbp + 0xc8], 0
call sym.NtCreateFile
mov esi, eax
test eax, eax
js 0x210145ae0
mov rcx, qword [rbp + 0x40]
mov r9d, dword [rbp]
mov r8, rbx
mov rdx, r13
mov dword [rsp + 0x20], 0xa
call sym.NtSetInformationFile
mov rcx, qword [rbp + 0x40]
mov ebx, eax
call sym.NtClose
test ebx, ebx
jns 0x2101453b0
test byte [0x210273880], 1
jne 0x210145c3d
mov r13d, 2
jmp 0x2101450bf
xor edx, edx
mov rcx, r12
call method.path_conv.get_nt_native_path__UNICODE_STRING_
mov dword [rsp + 0x28], r14d
lea r9, str.NtQueryInformationFile___S__FileInternalInformation__failed__status___y
mov qword [rsp + 0x20], rax
lea r8, str.bin_status_try_to_bin_path_conv__void__ACCESS_MASK__ULONG_
mov edx, 0x40
lea rcx, [0x210273880]
mov r13d, 1
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x21014516b
mov rcx, qword [rbp + 0x30]
call sym.NtClose
lea rax, [rbp + 0x60]
lea rcx, [rbp + 0x30]
mov r9, r13
mov dword [rsp + 0x28], 0x4000
mov edx, 4
mov dword [rsp + 0x20], 7
mov qword [rbp + 0xb0], rax
lea rax, [rbp + 0xa0]
mov r8, rax
mov qword [rbp - 8], rax
mov dword [rbp + 0xa0], 0x30
mov qword [rbp + 0xa8], 0
mov dword [rbp + 0xb8], 0x40
mov qword [rbp + 0xc0], 0
mov qword [rbp + 0xc8], 0
call sym.NtOpenFile
test eax, eax
js 0x210145b38
mov rax, qword [rbp + 0x30]
mov r8d, 1
mov edx, 1
sub rsp, 0x120
lea rcx, [rsp + 0x60]
mov qword [rbx + 8], rax
mov dword [rbp + 0xa0], 0x30
mov qword [rbp + 0xa8], rax
mov dword [rbp + 0xb8], 0x40
mov qword [rbp + 0xb0], rdi
call sym._recycler_sd_void__bool__bool_
cmp dword [rbp + 0x18], 2
lea r11, [rbp + 0x38]
mov r9, r13
sbb edx, edx
mov dword [rsp + 0x50], 0
mov r8, qword [rbp - 8]
mov rcx, r11
mov qword [rsp + 0x48], 0
and edx, 0xfffffffe
mov dword [rsp + 0x40], 1
add edx, 0x20002
mov dword [rsp + 0x38], 3
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 0x16
mov qword [rsp + 0x20], 0
mov qword [rbp + 0xc0], rax
movzx eax, word [rbp + 8]
mov qword [rbp + 0xc8], 0
mov qword [rbp + 8], r11
mov word [rbp + 0x70], ax
call sym.NtCreateFile
mov r11, qword [rbp + 8]
test eax, eax
js 0x210145d3e
cmp qword [rbp + 0x58], 1
je 0x210145c6a
cmp dword [rbp + 0x18], 1
jbe 0x210145c81
cmp qword [rbp + 0x58], 2
je 0x210145dfb
mov rcx, qword [rbp + 0x38]
call sym.NtClose
mov r9d, dword [rbp]
mov r8, rbx
mov rdx, r13
mov dword [rsp + 0x20], 0xa
mov rcx, qword [rsi]
call sym.NtSetInformationFile
mov r8d, eax
jmp 0x210144e63
mov rax, qword [rsi]
mov edx, dword [rbp + 0x430]
lea rcx, [rbp + 0x40]
mov r9, r13
mov dword [rsp + 0x20], 7
lea r8, [rbp + 0xa0]
mov qword [rbp + 0xa8], rax
lea rax, [0x210298360]
mov qword [rbp + 0xb0], rax
mov eax, dword [rbp + 0x438]
mov qword [rbp + 0x18], r10
mov dword [rsp + 0x28], eax
mov dword [rbp + 0xa0], 0x30
mov dword [rbp + 0xb8], 0
mov qword [rbp + 0xc0], 0
mov qword [rbp + 0xc8], 0
call sym.NtOpenFile
mov r11d, dword [rbp + 0x430]
mov r10, qword [rbp + 0x18]
and r11d, 0x100
test eax, eax
jns 0x210145b60
lea r14, [0x210273880]
test byte [0x210273880], 1
jne 0x210145d60
mov rcx, qword [rsi]
test r11d, r11d
jne 0x210145548
call sym.NtClose
mov qword [rsi], 0
jmp 0x210145557
test dword [rbp + 0x430], 0x100
je 0x210144f5c
mov rcx, qword [rsi]
jmp 0x210144ef3
add eax, eax
jmp 0x21014522e
add edx, edx
jmp 0x210145276
mov rcx, r15
call method.tmp_pathbuf.w_get__
xor edx, edx
mov rcx, r12
mov dword [rbp + 0x80], 0xfffe0000
mov qword [rbp + 0x88], rax
call method.path_conv.get_nt_native_path__UNICODE_STRING_
mov rdx, rax
lea rax, [rbp + 0x80]
mov rcx, rax
mov qword [rbp + 8], rax
call sym.RtlCopyUnicodeString
movzx eax, word [rbp + 0x80]
mov r8, qword [rbp + 0x88]
shr ax, 1
jmp 0x2101459d4
lea edx, [rax - 1]
movzx ecx, dx
cmp word [r8 + rcx*2], 0x5c
je 0x210145c36
mov eax, edx
test ax, ax
jne 0x2101459c0
mov eax, 2
mov rcx, qword [rbp + 8]
mov word [rbp + 0x80], ax
mov rdx, rdi
mov eax, 0xfffffffe
mov word [rbp + 0x82], ax
call sym.RtlAppendUnicodeStringToString
jmp 0x210145597
xor r8d, r8d
mov r9d, 0x3a
xor edx, edx
mov rcx, r12
mov word [rbp + 0xa4], r8w
mov dword [rbp + 0xa0], 0
mov word [rbp + 0xa2], r9w
call method.path_conv.get_nt_native_path__UNICODE_STRING_
mov rcx, r15
mov rax, qword [rax + 8]
movzx eax, word [rax + 8]
mov word [rbp + 0xa0], ax
call method.tmp_pathbuf.w_get__
mov rcx, qword [rbp - 8]
mov r8d, 0x8000
mov rdx, rax
mov qword [rbp + 8], rax
call sym.QueryDosDeviceW
mov r9, qword [rbp + 8]
test eax, eax
je 0x2101451f3
mov rcx, r9
mov r8d, 4
lea rdx, [0x2102ab726]
call sym.msys_2.0.dll_wcsncmp
mov r9, qword [rbp + 8]
test eax, eax
jne 0x2101451f3
movzx r8d, word [rbp + 0x80]
mov rdx, qword [rbp + 0x88]
lea rcx, [r9 + 0xc]
shr r8, 1
call sym.msys_2.0.dll_wcsncpy
mov r9, qword [rbp + 8]
mov rdx, r14
mov rcx, r12
movzx eax, word [rbp + 0x80]
mov qword [rbp + 0xd8], r9
add eax, 0xc
mov word [rbp + 0xd2], ax
mov word [rbp + 0xd0], ax
call method.path_conv.set_nt_native_path__UNICODE_STRING_
jmp 0x2101451f3
test byte [0x210273880], 1
je 0x21014567d
xor edx, edx
mov rcx, r12
call method.path_conv.get_nt_native_path__UNICODE_STRING_
mov dword [rsp + 0x38], esi
lea r9, str.Creating_file__S_for_overwriting__S___S__failed__status___y
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 8]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
lea r8, str.bin_status_try_to_bin_path_conv__void__ACCESS_MASK__ULONG_
mov edx, 0x40
mov rcx, r14
mov r13d, 2
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x21014516b
test byte [0x210273880], 1
je 0x21014511d
mov dword [rsp + 0x28], eax
lea r9, str.NtOpenFile___S__failed__status___y
mov qword [rsp + 0x20], rdi
jmp 0x2101456ab
mov rcx, qword [rsi]
mov dword [rbp + 0x18], r11d
mov qword [rbp + 0x10], r10
call sym.NtClose
mov rcx, qword [rbp + 0x40]
mov r8, qword [rbp + 0x10]
mov rdx, r13
mov r9d, 1
mov qword [rsi], rcx
mov dword [rsp + 0x20], 0xd
call sym.NtSetInformationFile
mov r11d, dword [rbp + 0x18]
test eax, eax
js 0x210145da3
mov rcx, qword [rsi]
test r11d, r11d
jne 0x210144ef3
call sym.NtClose
mov r13d, 2
mov qword [rsi], 0
jmp 0x21014516b
test byte [0x210273880], 1
je 0x21014511d
mov dword [rsp + 0x28], eax
lea r9, str.NtOpenFile___S__failed__status___y
mov qword [rsp + 0x20], r10
jmp 0x2101456ab
mov rax, qword [0x21023d810]
xor r8d, r8d
mov qword [rbp + 0x98], r14
lea r14, [rbp + 0x90]
mov dword [rbp + 0x90], 0x1000000
mov rcx, r14
mov rdx, qword [rax + 0x4740]
call sym.RtlConvertSidToUnicodeString
mov rdx, r14
mov rcx, rdi
call sym.RtlAppendUnicodeStringToString
movzx eax, word [rbp + 0x70]
mov word [rbp + 6], ax
jmp 0x210145325
mov r13d, 3
jmp 0x21014516b
add eax, eax
jmp 0x2101459de
xor edx, edx
mov rcx, r12
call method.path_conv.get_nt_native_path__UNICODE_STRING_
mov rsi, qword [rbp + 8]
mov dword [rsp + 0x38], ebx
lea r9, str.Overwriting__S___S__with__S_failed__status___y
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x20], rdi
jmp 0x210145b15
mov edx, dword [r12 + 4]
test edx, edx
je 0x210145ef8
cmp dword [rbp + 0x18], 1
ja 0x21014583c
mov rcx, qword [rbp + 0x38]
mov qword [rbp + 0x18], r11
call sym.NtClose
movzx eax, word [rbp + 6]
xor edx, edx
sub rsp, 0x120
lea rcx, [rsp + 0x60]
mov r8d, 1
mov dword [rbp + 0xa0], 0x30
mov word [rbp + 0x70], ax
mov rax, qword [rbp + 0x30]
mov dword [rbp + 0xb8], 0x40
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0xb0], rdi
call sym._recycler_sd_void__bool__bool_
mov dword [rsp + 0x50], 0
mov r9, r13
mov r8, qword [rbp - 8]
mov qword [rsp + 0x48], 0
mov rcx, qword [rbp + 0x18]
mov edx, 0x20002
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], 3
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 0x16
mov qword [rsp + 0x20], 0
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xc8], 0
call sym.NtCreateFile
test eax, eax
jns 0x210145831
test byte [0x210273880], 1
je 0x21014511d
mov dword [rsp + 0x28], eax
lea r9, str.NtCreateFile___S__failed__status___y
mov qword [rsp + 0x20], rdi
jmp 0x2101456ab
xor edx, edx
mov rcx, r12
mov dword [rbp + 0x18], r11d
mov dword [rbp + 0x10], eax
call method.path_conv.get_nt_native_path__UNICODE_STRING_
mov r8d, dword [rbp + 0x10]
mov edx, 0x40
mov rcx, r14
mov qword [rsp + 0x20], rax
lea r9, str.NtOpenFile___S__for_reopening_in_renamed_case_failed__status___y
mov dword [rsp + 0x28], r8d
lea r8, str.bin_status_try_to_bin_path_conv__void__ACCESS_MASK__ULONG_
call method.strace.prntf_unsigned_int__char_const__char_const__..._
mov r11d, dword [rbp + 0x18]
jmp 0x21014590f
lea r14, [0x210273880]
test byte [0x210273880], 1
je 0x21014590f
xor edx, edx
mov rcx, r12
mov dword [rbp + 0x10], eax
call method.path_conv.get_nt_native_path__UNICODE_STRING_
mov r8d, dword [rbp + 0x10]
mov qword [rsp + 0x20], rdi
mov rcx, r14
mov qword [rsp + 0x28], rax
lea r9, str.Setting_delete_disposition__S___S__in_renamed_case_failed__status___y
mov edx, 0x40
mov dword [rsp + 0x30], r8d
lea r8, str.bin_status_try_to_bin_path_conv__void__ACCESS_MASK__ULONG_
call method.strace.prntf_unsigned_int__char_const__char_const__..._
mov r11d, dword [rbp + 0x18]
jmp 0x21014590f
lea rax, [rbp + 0x80]
lea rdx, str.desktop.ini
mov rcx, rax
mov qword [rbp + 8], rax
call sym.RtlInitUnicodeString
mov rax, qword [rbp + 0x38]
xor r8d, r8d
xor edx, edx
sub rsp, 0x120
mov dword [rbp + 0xa0], 0x30
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 8]
lea rcx, [rsp + 0x60]
mov dword [rbp + 0xb8], 0x40
mov qword [rbp + 0xb0], rax
call sym._recycler_sd_void__bool__bool_
mov dword [rsp + 0x50], 0
mov r9, r13
mov r8, qword [rbp - 8]
mov qword [rsp + 0x48], 0
lea rcx, [rbp + 0x40]
mov edx, 0x120116
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 6
mov qword [rsp + 0x20], 0
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xc8], 0
call sym.NtCreateFile
test eax, eax
jns 0x210145f7c
test byte [0x210273880], 1
je 0x21014583c
mov dword [rsp + 0x28], eax
lea r9, str.NtCreateFile___S__failed__status___y
lea r8, str.bin_status_try_to_bin_path_conv__void__ACCESS_MASK__ULONG_
mov edx, 0x40
mov qword [rsp + 0x20], rdi
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x21014583c
mov rcx, r15
mov qword [rbp - 0x10], r11
call method.tmp_pathbuf.w_get__
mov dword [rsp + 0x20], 9
mov rcx, qword [rbp + 0x38]
mov rdx, r13
mov r9d, 0x10000
mov r8, rax
mov qword [rbp + 8], rax
call sym.NtQueryInformationFile
mov r11, qword [rbp - 0x10]
test eax, eax
js 0x210145827
mov r10, qword [rbp + 8]
mov rcx, r14
mov qword [rbp - 0x18], r11
mov r8d, dword [r10]
lea rdx, [r10 + 6]
mov qword [rbp + 8], rdx
shr r8, 1
sub r8, 1
mov word [rdx + r8*2], 0
mov qword [rbp - 0x10], r8
call sym.msys_2.0.dll_wcpncpy
mov rcx, qword [rbp + 0x10]
mov r8, qword [rbp - 0x10]
mov rdx, qword [rbp + 8]
add rcx, 2
call sym.msys_2.0.dll_wcpncpy
mov r11, qword [rbp - 0x18]
jmp 0x210145827
lea rax, str._.ShellClassInfo__r_nCLSID645FF040_5081_101B_9F08_00AA002F954E_r_nLocalizedResourceName__SystemRoot__system32_shell32.dll__8964_r_n
mov rcx, qword [rbp + 0x40]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x40], 0
xor r8d, r8d
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0x81
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
call sym.NtWriteFile
test eax, eax
js 0x210145fca
mov rcx, qword [rbp + 0x40]
call sym.NtClose
jmp 0x21014583c
test byte [0x210273880], 1
je 0x210145fbc
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 8]
mov edx, 0x40
lea r9, str.NtWriteFile___S__failed__status___y
lea r8, str.bin_status_try_to_bin_path_conv__void__ACCESS_MASK__ULONG_
lea rcx, [0x210273880]
mov qword [rsp + 0x20], rax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x210145fbc