Function at 0x14016b6c0
Capabilities:
Get file attributes
Read file on windows
Set file attributes
Write file on windows

Disassembly:
push rbp
push rbx
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xf0
mov rax, qword [0x1402bf040]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rbx, rdx
xor r15d, r15d
mov qword [rsp + 0x40], r15
mov rdx, rcx
mov dword [rsp + 0x38], 0x64
lea rcx, [rbp - 0x59]
mov dword [rsp + 0x30], 1
xor r9d, r9d
mov dword [rsp + 0x28], 7
mov r8d, 0x100081
mov dword [rsp + 0x20], 0x80
call sym.SystemInformer.exe_PhCreateFileWin32Ex
nop
test eax, eax
jns 0x14016b72c
lfence
jmp 0x14016b991
mov qword [rsp + 0xe8], rdi
lea r8, [rbp + 7]
mov qword [rsp + 0xe0], r14
lea rdx, [rbp - 0x41]
mov r14, qword [rbp - 0x59]
mov r9d, 0x28
mov rcx, r14
mov dword [rsp + 0x20], 4
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov edi, eax
test eax, eax
js 0x14016b976
mov r9d, 0x18
mov dword [rsp + 0x20], 5
lea r8, [rbp - 0x11]
mov rcx, r14
lea rdx, [rbp - 0x41]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov edi, eax
test eax, eax
js 0x14016b976
movups xmm0, xmmword [rbp - 0x11]
lea r9, [rbp - 0x19]
mov qword [rsp + 0x40], r15
movsd xmm1, qword [rbp - 1]
lea rcx, [rbp - 0x49]
mov dword [rsp + 0x38], 0x64
mov r8d, 0x120116
movups xmmword [rbp - 0x41], xmm0
mov rax, qword [rbp - 0x39]
mov rdx, rbx
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 1
mov qword [rbp - 0x19], rax
movsd qword [rbp - 0x31], xmm1
mov dword [rsp + 0x20], 0x80
call sym.SystemInformer.exe_PhCreateFileWin32Ex
mov edi, eax
test eax, eax
js 0x14016b976
mov dword ss:[rsp + 0x28], 4
lea r9, [rbp - 0x41]
xor r8d, r8d
mov dword [rsp + 0x20], 0x1000
lea rdx, [rbp - 0x51]
mov qword [rbp - 0x41], 0x2000
mov rcx, 0xffffffffffffffff
mov qword [rbp - 0x51], r15
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
js 0x14016b971
mov rdi, qword [rbp - 0x51]
test rdi, rdi
je 0x14016b971
mov qword [rsp + 0x40], r15
lea rax, [rbp - 0x29]
mov qword [rsp + 0x38], r15
xor r9d, r9d
mov dword [rsp + 0x30], 0x2000
xor r8d, r8d
mov qword [rsp + 0x28], rdi
xor edx, edx
mov rcx, r14
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x120], rsi
call qword [sym.imp.ntdll.dll_NtReadFile]
mov ebx, eax
test eax, eax
js 0x14016b91c
lfence
mov r14, qword [rbp - 0x59]
nop word [rax + rax]
mov rax, qword [rbp - 0x21]
test rax, rax
je 0x14016b91c
mov rsi, qword [rbp - 0x49]
xor r9d, r9d
mov qword [rsp + 0x40], r15
xor r8d, r8d
mov qword [rsp + 0x38], r15
xor edx, edx
mov dword [rsp + 0x30], eax
mov rcx, rsi
lea rax, [rbp - 0x29]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov ebx, eax
test eax, eax
js 0x14016b920
cmp qword [rbp - 0x21], r15
je 0x14016b920
lfence
mov r14, qword [rbp - 0x59]
lea rax, [rbp - 0x29]
mov qword [rsp + 0x40], r15
xor r9d, r9d
mov qword [rsp + 0x38], r15
xor r8d, r8d
mov dword [rsp + 0x30], 0x2000
xor edx, edx
mov qword [rsp + 0x28], rdi
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtReadFile]
mov ebx, eax
test eax, eax
jns 0x14016b890
mov rsi, qword [rbp - 0x49]
mov rcx, rdi
call sym.SystemInformer.exe_PhFreePage
cmp ebx, 0xc0000011
mov edi, r15d
mov rcx, rsi
cmovne edi, ebx
test edi, edi
js 0x14016b959
mov r9d, 0x28
mov dword [rsp + 0x20], 4
lea r8, [rbp + 7]
lea rdx, [rbp - 0x41]
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
jmp 0x14016b95e
call fcn.140161aa0
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtClose]
mov rsi, qword [rsp + 0x120]
jmp 0x14016b976
mov edi, 0xc0000017
mov rcx, r14
call qword [sym.imp.ntdll.dll_NtClose]
mov r14, qword [rsp + 0xe0]
mov eax, edi
mov rdi, qword [rsp + 0xe8]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1401e4a20
add rsp, 0xf0
pop r15
pop rbx
pop rbp
ret