Function at 0x7fff25d71a70
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xb0
mov rax, qword gs:[0x60]
lea r9, [rbp - 0x31]
xor r15d, r15d
lea rdx, [rbp - 0x41]
xor r8d, r8d
mov sil, r15b
mov r14, qword [rax + 0x2c8]
movabs rax, 0x100000000
and r14, rax
call qword [sym.imp.ntdll.dll_RtlDosPathNameToRelativeNtPathName_U_WithStatus]
nop dword [rax + rax]
test eax, eax
js 0x7fff25de7604
mov rdi, qword [rbp - 0x39]
cmp word [rbp - 0x31], r15w
jne 0x7fff25d71c73
mov eax, r15d
mov qword [rbp - 0x21], rax
mov qword [rbp - 9], rax
lea r9, [rbp - 0x51]
lea rax, [rbp - 0x41]
mov dword [rsp + 0x28], 0x204040
xorps xmm0, xmm0
mov qword [rbp - 1], rax
mov r13d, 7
mov dword [rbp - 0x11], 0x30
lea r8, [rbp - 0x11]
mov dword [rbp + 7], 0x40
mov edx, 0x10080
mov dword [rsp + 0x20], r13d
lea rcx, [rbp + 0x7f]
movdqu xmmword [rbp + 0xf], xmm0
call qword [sym.imp.ntdll.dll_NtOpenFile]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x7fff25d71c26
mov rcx, qword [rbp + 0x7f]
lea r9d, [r13 + 1]
lea r8, [rbp - 0x59]
mov dword [rsp + 0x20], 0x23
lea rdx, [rbp - 0x51]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x7fff25de763d
mov ecx, dword [rbp - 0x59]
and ecx, 0x400
jne 0x7fff25de7699
test ecx, ecx
jne 0x7fff25de76c0
lea rcx, [rbp - 0x31]
call qword [sym.imp.ntdll.dll_RtlReleaseRelativeName]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
test r14, r14
jne 0x7fff25de7755
mov rcx, qword [rbp + 0x7f]
lea r9d, [r14 + 4]
lea r8, [rbp + 0x77]
mov dword [rbp + 0x77], r13d
lea rdx, [rbp - 0x51]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
mov ebx, eax
mov eax, 0x80000000
lea ecx, [rbx + rax]
test eax, ecx
je 0x7fff25d71c19
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
test ebx, ebx
js 0x7fff25d71c68
mov eax, 1
add rsp, 0xb0
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp ebx, 0xc0000121
je 0x7fff25d71bed
jmp 0x7fff25de7755
cmp ebx, 0xc000000d
je 0x7fff25de7630
cmp ebx, 0xc0000022
je 0x7fff25d71c85
lea rcx, [rbp - 0x31]
call qword [sym.imp.ntdll.dll_RtlReleaseRelativeName]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov ecx, ebx
call fcn.7fff25d6b370
xor eax, eax
jmp 0x7fff25d71c06
movups xmm0, xmmword [rbp - 0x31]
mov rax, qword [rbp - 0x21]
movdqu xmmword [rbp - 0x41], xmm0
jmp 0x7fff25d71adf
mov dword [rsp + 0x28], 0x204040
lea r9, [rbp - 0x51]
mov dword [rsp + 0x20], r13d
lea r8, [rbp - 0x11]
mov edx, 0x10000
lea rcx, [rbp + 0x7f]
call qword [sym.imp.ntdll.dll_NtOpenFile]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x7fff25d71c3a
jmp 0x7fff25d71b80
cmp eax, 0xc0000017
je 0x7fff25de7629
cmp eax, 0xc000009a
je 0x7fff25de7629
mov ecx, 3
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
nop
jmp 0x7fff25d71c6f
mov ecx, eax
jmp 0x7fff25d71c6a
mov dword [rsp + 0x28], 0x4040
jmp 0x7fff25d71c8d
cmp ebx, 0xc0000002
je 0x7fff25d71b80
cmp ebx, 0xc000000d
je 0x7fff25d71b80
lea rcx, [rbp - 0x31]
call qword [sym.imp.ntdll.dll_RtlReleaseRelativeName]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
nop
jmp 0x7fff25d71c68
mov eax, dword [rbp - 0x55]
add eax, 0x5ffffffd
cmp eax, 0x16
ja 0x7fff25d71b78
mov edx, 0x400201
bt edx, eax
jae 0x7fff25d71b78
mov sil, 1
jmp 0x7fff25d71b78
test sil, sil
jne 0x7fff25d71b80
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
lea r9, [rbp - 0x51]
mov dword [rsp + 0x28], 0x4040
lea r8, [rbp - 0x11]
mov dword [rsp + 0x20], r13d
mov edx, 0x10000
lea rcx, [rbp + 0x7f]
call qword [sym.imp.ntdll.dll_NtOpenFile]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x7fff25d71b80
lea ecx, [rax + 0x3ffffd8a]
test ecx, 0xfffffffc
jne 0x7fff25de774e
cmp eax, 0xc0000277
je 0x7fff25de774e
mov dword [rsp + 0x28], 0x204040
lea r9, [rbp - 0x51]
lea r8, [rbp - 0x11]
mov dword [rsp + 0x20], r13d
mov edx, 0x10000
lea rcx, [rbp + 0x7f]
call qword [sym.imp.ntdll.dll_NtOpenFile]
nop dword [rax + rax]
mov ebx, eax
test ebx, ebx
jmp 0x7fff25d71cb3
mov rcx, qword [rbp + 0x7f]
lea r8, [rbp + 0x6f]
mov r9d, 1
mov byte [rbp + 0x6f], 1
lea rdx, [rbp - 0x51]
mov dword [rsp + 0x20], 0xd
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
mov ebx, eax
jmp 0x7fff25d71bed