Function at 0x3a98dfa90
Capabilities:
Get file attributes

Disassembly:
push rbp
mov eax, 0x4168
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
call fcn.3a98e4420
sub rsp, rax
lea rbp, [rsp + 0x80]
mov r15, rdx
mov rsi, r8
test byte [rdx + 0x35], 0x40
jne 0x3a98f4d02
lea rax, [rbp + 0x1c]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x900a8
lea rdi, [rbp + 0xe0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x4000
mov qword [rsp + 0x20], rdi
call fcn.3a98daa10
test eax, eax
js 0x3a98f4cdc
mov edx, dword [rbp + 0x1c]
mov word [rbp + 0x1a], dx
movzx eax, dx
cmp dx, 7
jbe 0x3a98f4d22
mov ecx, dword [rbp + 0xe0]
cmp ecx, 0x80000013
je 0x3a98dfc58
mov r14, qword [rsi]
test byte [r14 + 0x29], 1
je 0x3a98dfbf8
lea r8, [rbp + 0x80]
movzx edx, dx
mov rcx, rdi
mov qword [rbp], rsp
mov qword [rbp - 8], r8
call fcn.3a98c2f60
test eax, eax
jne 0x3a98dfc7d
cmp dword [rbp + 0x80], 0xa000000c
je 0x3a98dfc70
mov rax, qword [rbp + 0xa0]
mov rdx, qword [rbp + 0x90]
and rax, 0xfffffffffffffffe
lea r13, [rdx + rax]
cmp rdx, r13
je 0x3a98dfb81
cmp word [rdx], 0x5c
je 0x3a98dfc90
mov r8, qword [rbp + 0xa8]
mov rbx, r8
shr rbx, 1
lea rax, [rbx + rbx + 0x11]
and rax, 0xfffffffffffffff0
call fcn.3a98e4420
mov rdx, qword [rbp + 0x98]
sub rsp, rax
and r8, 0xfffffffffffffffe
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll_memcpy
xor edx, edx
xor r8d, r8d
mov rcx, r14
mov word [rax + rbx*2], dx
mov edx, 4
mov qword [r14 + 0x58], rax
call fcn.3a98c5280
mov rsp, qword [rbp]
cmp eax, 0xffffffff
jne 0x3a98e0057
and word [r15 + 0x8e], 0xfffe
mov ecx, dword [rbp + 0xe0]
mov r14, qword [rsi]
movzx eax, word [rbp + 0x1a]
nop dword [rax]
movzx edx, word [rbp + 0xe6]
sub eax, 8
mov dword [r15 + 0x88], ecx
lea r9, [rbp + 0xe8]
mov r8, qword [0x3a9979990]
mov rcx, r15
mov word [r15 + 0x8c], dx
mov rdx, qword [r14]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rdx
mov edx, 1
call fcn.3a98b18a0
test al, al
je 0x3a98dfc68
xor eax, eax
lea rsp, [rbp + 0x40e8]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
and dword [r15 + 0x34], 0xfffffbff
jmp 0x3a98dfc3d
mov eax, 0x27
jmp 0x3a98dfc3f
test byte [rbp + 0x88], 1
je 0x3a98dfb5c
mov ecx, dword [rbp + 0xe0]
mov r14, qword [rsi]
movzx eax, word [rbp + 0x1a]
jmp 0x3a98dfbf8
cmp rax, 2
jg 0x3a98e0047
lea r11, [rbp + 0x60]
lea r10, [rbp + 0x28]
mov qword [rbp + 0x38], rdx
xor r8d, r8d
mov rax, qword [r14 + 0xd8]
mov qword [rbp - 0x18], r11
pxor xmm0, xmm0
lea rcx, [rbp + 0x40]
mov qword [rbp - 0x28], rdx
lea rbx, [rbp + 0xb0]
lea r12, [rbp + 0x20]
mov qword [rbp - 0x38], rax
mov rax, qword [r14 + 0xd0]
mov dword [rbp + 0xb0], 0x30
mov qword [rbp + 0xb8], 0
mov dword [rbp + 0xc8], 0
mov qword [rbp + 0x4140], rsi
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x30]
mov qword [rbp + 8], r10
lea r10, [rbp + 0x50]
mov qword [rbp + 0xc0], rax
xor eax, eax
mov word [rbp + 0x30], r8w
mov r8, rdx
mov qword [rbp - 0x20], r14
mov r14, rcx
mov qword [rbp + 0x4138], r15
mov r15, r10
mov qword [rbp - 0x30], rdi
mov rdi, r13
movups xmmword [rbp + 0xd0], xmm0
nop dword [rax]
mov r13, r8
cmp rdi, r8
jne 0x3a98dfd59
jmp 0x3a98dfdd0
add r13, 2
cmp rdi, r13
je 0x3a98dfdd0
cmp word [r13], 0x5c
jne 0x3a98dfd50
jmp 0x3a98dfd6c
add r13, 2
cmp rdi, r13
je 0x3a98dfdd0
cmp word [r13], 0x5c
je 0x3a98dfd68
mov rdx, r13
mov r9, r14
mov rcx, r12
sub rdx, r8
mov r8, rbx
add eax, edx
mov edx, 0xa0
movd xmm2, eax
pshuflw xmm0, xmm2, 0
movd dword [rbp + 0x30], xmm0
mov dword [rsp + 0x28], 0x4000
mov dword [rsp + 0x20], 7
call sub.ntdll.dll_NtOpenFile
mov r8, r13
test eax, eax
jns 0x3a98dfe11
cmp rdi, r13
je 0x3a98e000c
movzx eax, word [rbp + 0x30]
jmp 0x3a98dfd40
mov rdx, r13
mov r9, r14
mov rcx, r12
sub rdx, r8
mov r8, rbx
add eax, edx
mov edx, 0xa0
movd xmm1, eax
pshuflw xmm0, xmm1, 0
movd dword [rbp + 0x30], xmm0
mov dword [rsp + 0x28], 0x4000
mov dword [rsp + 0x20], 7
call sub.ntdll.dll_NtOpenFile
test eax, eax
js 0x3a98e000c
mov rcx, qword [rbp + 0xb8]
test rcx, rcx
je 0x3a98dfe22
call sub.ntdll.dll_NtClose
mov rsi, qword [rbp + 0x20]
xor ecx, ecx
mov qword [rbp + 0x38], r13
mov r9d, 8
mov word [rbp + 0x30], cx
mov rdx, r15
mov qword [rbp + 0xb8], rsi
mov rcx, rsi
mov dword [rsp + 0x20], 6
mov r8, qword [rbp + 8]
call sub.ntdll.dll_NtQueryInformationFile
test eax, eax
js 0x3a98dfe62
mov rax, qword [rbp - 0x10]
cmp qword [rbp + 0x28], rax
je 0x3a98dfe70
mov r8, r13
jmp 0x3a98dfdb9
mov dword [rsp + 0x20], 1
mov r8, qword [rbp - 0x18]
mov r9d, 0x18
mov rdx, r15
mov rcx, rsi
call sub.ntdll.dll_NtQueryVolumeInformationFile
test eax, eax
jns 0x3a98dfe98
cmp eax, 0x80000005
jne 0x3a98dfe62
cmp qword [rbp + 0x58], 0xb
jbe 0x3a98dfe62
mov eax, dword [rbp + 0x68]
cmp qword [rbp - 0x38], rax
jne 0x3a98dfe62
mov rcx, qword [rbp + 0xb8]
mov r14, qword [rbp - 0x20]
mov rbx, r13
mov rdx, qword [rbp - 0x28]
mov r15, qword [rbp + 0x4138]
mov rsi, qword [rbp + 0x4140]
mov rdi, qword [rbp - 0x30]
test rcx, rcx
jne 0x3a98e0035
mov r8, qword [rbp + 0x90]
cmp rdx, rbx
jb 0x3a98dfef1
jmp 0x3a98dfef8
sub rbx, 2
cmp rdx, rbx
jae 0x3a98dfef8
cmp word [rbx - 2], 0x5c
je 0x3a98dfee8
cmp rbx, r8
je 0x3a98dfb81
sub r8, rbx
add r8, qword [rbp + 0xa0]
lea r12, [r8 + 0xc]
and r12, 0xfffffffffffffffe
lea rax, [r12 + 0xf]
and rax, 0xfffffffffffffff0
call fcn.3a98e4420
sub rsp, rax
mov rax, qword [str.__X:]
mov rdx, rbx
lea rcx, [rsp + 0x4c]
lea r13, [rsp + 0x40]
mov qword [rsp + 0x40], rax
mov eax, dword [0x3a99779e8]
mov dword [rsp + 0x48], eax
call sub.msvcrt.dll_memcpy
mov rcx, qword [rbp - 8]
lea r8, [rbp + 0x1a]
mov rdx, rdi
mov qword [rbp + 0x90], r13
lea r13, [rsp + 0x48]
mov qword [rbp + 0xa0], r12
sub r12, 8
mov qword [rbp + 0x98], r13
mov qword [rbp + 0xa8], r12
call fcn.3a98c3030
test eax, eax
je 0x3a98dffa0
mov rsp, qword [rbp]
mov ecx, dword [rbp + 0xe0]
mov r14, qword [rsi]
movzx eax, word [rbp + 0x1a]
jmp 0x3a98dfbf8
mov r8, qword [rbp + 0xa8]
mov rbx, rsp
mov rdi, r8
shr rdi, 1
lea rax, [rdi + rdi + 0x11]
and rax, 0xfffffffffffffff0
call fcn.3a98e4420
mov rdx, qword [rbp + 0x98]
sub rsp, rax
and r8, 0xfffffffffffffffe
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll_memcpy
xor r8d, r8d
mov edx, 3
mov rcx, rax
xor eax, eax
mov word [rcx + rdi*2], ax
mov qword [r14 + 0x58], rcx
mov rcx, r14
call fcn.3a98c5280
mov rsp, rbx
test eax, eax
je 0x3a98e0078
mov rsp, qword [rbp]
cmp eax, 0xffffffff
jne 0x3a98dfc3f
jmp 0x3a98dfbdb
mov rcx, qword [rbp + 0xb8]
mov r14, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x28]
mov r15, qword [rbp + 0x4138]
mov rsi, qword [rbp + 0x4140]
mov rdi, qword [rbp - 0x30]
test rcx, rcx
je 0x3a98e0081
mov rbx, rdx
mov qword [rbp + 8], rdx
call sub.ntdll.dll_NtClose
mov rdx, qword [rbp + 8]
jmp 0x3a98dfed5
cmp word [rdx + 2], 0x5c
jne 0x3a98dfc9a
jmp 0x3a98dfb81
test eax, eax
jne 0x3a98dfc3f
mov ecx, dword [rbp + 0xe0]
mov r14, qword [rsi]
movzx eax, word [rbp + 0x1a]
jmp 0x3a98dfbf8
mov rsp, qword [rbp]
jmp 0x3a98dfbdb
mov r8, qword [rbp + 0x90]
mov rbx, rdx
jmp 0x3a98dfef8
mov rdx, qword [rsi]
mov ecx, eax
mov r8, qword [rdx + 0xb0]
lea rdx, str.__ls_:_Cant_get_reparse_point
add r8, 8
call fcn.3a98f4982
mov eax, 0x33
jmp 0x3a98dfc3f
mov rax, qword [r8]
lea rcx, str.Ignoring_reparse_data_of_encrypted_file___ls_
mov rdx, qword [rax + 0xb0]
add rdx, 8
call fcn.3a98f20cb
nop
jmp 0x3a98dfc3d
mov rax, qword [rsi]
lea rcx, str.__ls_:_reparse_point_buffer_is_too_short
mov rdx, qword [rax + 0xb0]
add rdx, 8
call fcn.3a98f204c
mov eax, 0x1b
jmp 0x3a98dfc3f