Function at 0x1800176e0
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2090]
mov eax, 0x2190
call fcn.180001020
sub rsp, rax
mov rax, qword [0x180051010]
xor rax, rsp
mov qword [rbp + 0x2080], rax
mov rbx, qword [rbp + 0x20f8]
xor eax, eax
mov r13d, dword [rbp + 0x20f0]
mov r15d, r9d
mov qword [rbp - 0x78], rdx
mov rdi, r8
mov qword [rbp - 0x80], rcx
mov qword [rbp - 0x38], rbx
mov qword [rsp + 0x60], 0xffffffffffffffff
mov dword [rsp + 0x70], 0xc0000365
mov dword [rsp + 0x74], eax
mov qword [rsp + 0x78], 0xffffffffffffffd5
cmp r9d, 2
je 0x1800178bc
mov rax, qword [0x180052f48]
test rax, rax
je 0x1800178bc
mov qword [rbp - 0x60], rcx
xorps xmm0, xmm0
mov qword [rbp - 0x58], rdx
lea rcx, [rbp - 0x68]
lea rdx, [rbp]
mov dword [rbp - 0x68], 0x30
movdqu xmmword [rbp - 0x48], xmm0
mov dword [rbp - 0x50], 0x40
call qword [case.0x18001f8e5.0]
mov ecx, eax
test eax, eax
js 0x18001783d
test dword [rbp + 0x30], 0x400
jne 0x1800178b4
mov rax, qword [rbp + 0x28]
movabs r12, 0x5e6684f4b3960000
mov qword [rdi], rax
mov rcx, rbx
mov rax, qword [rbp + 0x20]
mov qword [rdi + 8], rax
imul rax, qword [rbp], 0x64
add rax, r12
mov qword [rdi + 0x28], rax
imul rax, qword [rbp + 8], 0x64
add rax, r12
mov qword [rdi + 0x10], rax
imul rax, qword [rbp + 0x10], 0x64
add rax, r12
mov qword [rdi + 0x18], rax
imul rax, qword [rbp + 0x18], 0x64
add rax, r12
mov qword [rdi + 0x20], rax
call sym.VBoxGINA.dll_nocrt_strlen
mov ecx, dword [rbp + 0x30]
xor esi, esi
and ecx, 0x7fff
mov dword [rsp + 0x20], esi
shl ecx, 0x10
mov r8, rax
xor r9d, r9d
mov rdx, rbx
call fcn.18001ebb0
mov r8d, r15d
mov dword [rdi + 0x30], eax
mov rdx, rdi
mov dword [rdi + 0x34], r15d
xor ecx, ecx
call fcn.180017130
jmp 0x180017f63
add eax, 0x3ffffff3
cmp eax, 0x26
ja 0x18001788a
movabs rdx, 0x4000800001
bt rdx, rax
jae 0x18001788a
mov dword [rsp + 0x30], ecx
lea rax, [rbp]
mov qword [rsp + 0x28], 0x2078
lea rcx, [rbp - 0x68]
mov r9d, r13d
mov qword [rsp + 0x20], rax
mov r8d, r15d
mov rdx, rdi
call fcn.1800171b0
mov ebx, eax
test eax, eax
js 0x1800178a1
jmp 0x180017f63
cmp ecx, 0xc0000022
je 0x1800178ac
cmp ecx, 0xc0000043
je 0x1800178ac
call fcn.18001b490
mov ebx, eax
cmp ebx, 0x34
jne 0x180017f61
jmp 0x1800178b4
mov dword [rsp + 0x70], 0xc0000365
mov rdx, qword [rbp - 0x78]
mov rcx, qword [rbp - 0x80]
mov r14d, dword [0x18005210c]
mov ebx, 0x4020
test r14d, r14d
je 0x1800178d9
test r13b, 2
mov eax, 0x204020
cmove ebx, eax
xor esi, esi
mov qword [rbp - 0x60], rcx
mov dword [rsp + 0x50], esi
lea r9, [rsp + 0x70]
mov qword [rsp + 0x48], rsi
lea r8, [rbp - 0x68]
mov dword [rsp + 0x40], ebx
lea rcx, [rsp + 0x60]
mov qword [rbp - 0x58], rdx
xorps xmm0, xmm0
mov r12d, 1
mov dword [rbp - 0x68], 0x30
mov dword [rsp + 0x38], r12d
mov edx, 0x100080
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rsi
mov dword [rbp - 0x50], 0x40
movdqu xmmword [rbp - 0x48], xmm0
call qword [sym.imp.ntdll.dll_NtCreateFile]
cmp eax, 0xc000000d
je 0x18001794d
cmp eax, 0xc00000f7
jne 0x1800179aa
cmp r14d, 0xffffffff
jne 0x1800179aa
bt ebx, 0x15
jae 0x1800179aa
mov dword [rsp + 0x50], esi
lea r9, [rsp + 0x70]
mov qword [rsp + 0x48], rsi
lea r8, [rbp - 0x68]
btr ebx, 0x15
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x40], ebx
mov edx, 0x100080
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ntdll.dll_NtCreateFile]
cmp eax, 0xc000000d
je 0x1800179aa
mov dword [0x18005210c], esi
movabs r12, 0x5e6684f4b3960000
test eax, eax
js 0x180017bed
mov rcx, qword [rsp + 0x60]
lea r8, [rsp + 0x68]
mov r9d, 8
mov dword [rsp + 0x20], 0x23
lea rdx, [rsp + 0x70]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jns 0x1800179f1
mov ebx, esi
mov eax, esi
mov dword [rsp + 0x6c], ebx
mov dword [rsp + 0x68], eax
jmp 0x1800179f9
mov ebx, dword [rsp + 0x6c]
mov eax, dword [rsp + 0x68]
bt eax, 0xa
jae 0x180017a94
cmp ebx, 0xa000000c
je 0x180017a94
test r13b, 2
jne 0x180017a94
mov dword [rsp + 0x50], esi
lea r9, [rsp + 0x70]
mov qword [rsp + 0x48], rsi
lea r8, [rbp - 0x68]
mov dword [rsp + 0x40], 0x4020
lea rcx, [rbp - 0x20]
mov dword [rsp + 0x38], 1
mov edx, 0x100080
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x70], 0xc0000365
mov qword [rsp + 0x78], 0xffffffffffffffd5
call qword [sym.imp.ntdll.dll_NtCreateFile]
test eax, eax
js 0x180017a90
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov r14, qword [rbp - 0x20]
mov ebx, esi
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x6c], ebx
mov dword [rsp + 0x68], esi
jmp 0x180017a99
mov ebx, dword [rsp + 0x6c]
mov r14, qword [rsp + 0x60]
xor eax, eax
mov dword [rbp - 0x30], 0xc0000365
lea r8, [rbp]
mov dword [rbp - 0x2c], eax
lea rdx, [rbp - 0x30]
mov qword [rbp - 0x28], 0xffffffffffffffd5
mov rcx, r14
mov dword [rsp + 0x20], 0x12
lea r9d, [rax + 0x68]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
jne 0x180017ae9
cmp eax, 0x80000005
je 0x180017ae9
mov ecx, eax
call fcn.18001b490
jmp 0x180017bd7
mov rax, qword [rbp + 0x30]
mov qword [rdi], rax
mov rax, qword [rbp + 0x28]
mov qword [rdi + 8], rax
imul rax, qword [rbp], 0x64
add rax, r12
mov qword [rdi + 0x28], rax
imul rax, qword [rbp + 8], 0x64
add rax, r12
mov qword [rdi + 0x10], rax
imul rax, qword [rbp + 0x10], 0x64
add rax, r12
mov qword [rdi + 0x18], rax
imul rax, qword [rbp + 0x18], 0x64
add rax, r12
mov qword [rdi + 0x20], rax
mov rax, qword [rbp - 0x38]
test rax, rax
je 0x180017b3b
mov rcx, rax
call sym.VBoxGINA.dll_nocrt_strlen
jmp 0x180017b3e
mov rax, rsi
mov ecx, dword [rbp + 0x20]
mov r9d, ebx
mov rdx, qword [rbp - 0x38]
and ecx, 0x7fff
shl ecx, 0x10
mov r8, rax
mov dword [rsp + 0x20], esi
call fcn.18001ebb0
mov dword [rdi + 0x30], eax
mov dword [rdi + 0x34], r15d
cmp r15d, 2
jne 0x180017bca
mov rax, qword [rbp + 0x38]
lea r8, [rbp]
cmp eax, 1
mov qword [rdi + 0x38], 0xffffffffffffffff
mov ecx, 1
mov dword [rdi + 0x44], esi
cmovbe eax, ecx
mov dword [rsp + 0x20], ecx
mov dword [rdi + 0x40], eax
lea rdx, [rbp - 0x30]
mov rax, qword [rbp + 0x40]
mov r9d, 0x800
mov rcx, r14
mov qword [rdi + 0x48], rax
mov qword [rdi + 0x50], rsi
mov dword [rdi + 0x58], esi
call qword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
jne 0x180017bc4
cmp eax, 0x80000005
jne 0x180017bca
mov eax, dword [rbp + 8]
mov dword [rdi + 0x44], eax
mov r8d, r15d
mov rdx, rdi
xor ecx, ecx
call fcn.180017130
mov rcx, qword [rsp + 0x60]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x180017c62
jmp 0x180017f61
cmp eax, 0xc0000024
je 0x180017c27
cmp eax, 0xc0000033
je 0x180017c27
cmp eax, 0xc0000022
je 0x180017c14
cmp eax, 0xc0000043
je 0x180017c14
mov ecx, eax
call fcn.18001b490
mov ebx, eax
jmp 0x180017c59
mov dword [rsp + 0x70], 0xc0000365
mov qword [rsp + 0x78], 0xffffffffffffffd5
jmp 0x180017c62
mov dword [rsp + 0x30], eax
lea rcx, [rbp - 0x68]
lea rax, [rbp]
mov qword [rsp + 0x28], 0x2078
mov r9d, r13d
mov qword [rsp + 0x20], rax
mov r8d, r15d
mov rdx, rdi
call fcn.1800171b0
mov ebx, eax
test eax, eax
jns 0x180017f63
cmp ebx, 0x34
jne 0x180017f61
mov rbx, qword [rbp - 0x78]
movzx r9d, word [rbx]
mov r8, qword [rbx + 8]
mov ecx, r9d
shr rcx, 1
je 0x180017cac
cmp word [r8 + rcx*2 - 2], 0x5c
jne 0x180017c8b
lea rax, [rcx - 1]
mov rcx, rax
test rax, rax
je 0x180017cac
lea rax, [r8 - 2]
lea rax, [rax + rcx*2]
movzx edx, word [rax]
cmp dx, 0x5c
je 0x180017cb1
cmp dx, 0x2f
je 0x180017cac
sub rax, 2
sub rcx, 1
jne 0x180017c93
test rcx, rcx
je 0x180017cc5
movzx eax, cx
mov qword [rbp - 0x70], r8
add ax, ax
mov word [rbp - 0x78], ax
mov word [rbp - 0x76], ax
jmp 0x180017cd7
lea rax, [0x18002c024]
mov dword [rbp - 0x78], 0x40002
mov qword [rbp - 0x70], rax
lea rax, [r8 + rcx*2]
mov dword [rsp + 0x50], esi
mov qword [rbp - 0x10], rax
lea r8, [rbp - 0x68]
movzx eax, word [rbx + 2]
add cx, cx
sub ax, cx
mov qword [rsp + 0x48], rsi
mov word [rbp - 0x16], ax
sub r9w, cx
mov rax, qword [rbp - 0x80]
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x40], 0x4021
xorps xmm0, xmm0
mov qword [rbp - 0x60], rax
mov edx, 0x100001
lea rax, [rbp - 0x78]
mov word [rbp - 0x18], r9w
mov qword [rbp - 0x58], rax
lea r9, [rsp + 0x70]
mov eax, 1
mov dword [rbp - 0x68], 0x30
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rsi
mov dword [rbp - 0x50], 0x40
movdqu xmmword [rbp - 0x48], xmm0
call qword [sym.imp.ntdll.dll_NtCreateFile]
mov r14d, eax
test eax, eax
js 0x180017ef4
mov rax, qword gs:[0x60]
movabs r13, 0x500000000
mov byte [rsp + 0x50], sil
mov ebx, dword [rax + 0x118]
mov rax, qword gs:[0x60]
shl rbx, 0x20
mov ecx, dword [rax + 0x11c]
mov eax, 0x25
or rbx, rcx
mov ecx, 3
cmp rbx, r13
cmovbe eax, ecx
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x48], rcx
xor r9d, r9d
mov rcx, qword [rsp + 0x60]
xor r8d, r8d
mov byte [rsp + 0x40], 1
xor edx, edx
mov dword [rsp + 0x38], eax
lea rax, [rbp]
mov dword [rsp + 0x30], 0x2078
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
test eax, eax
js 0x180017ede
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp - 0x38]
mov qword [rdi], rax
mov rax, qword [rbp + 0x30]
mov qword [rdi + 8], rax
imul rax, qword [rbp + 8], 0x64
add rax, r12
mov qword [rdi + 0x28], rax
imul rax, qword [rbp + 0x10], 0x64
add rax, r12
mov qword [rdi + 0x10], rax
imul rax, qword [rbp + 0x18], 0x64
add rax, r12
mov qword [rdi + 0x18], rax
imul rax, qword [rbp + 0x20], 0x64
add rax, r12
mov qword [rdi + 0x20], rax
call sym.VBoxGINA.dll_nocrt_strlen
mov ecx, dword [rbp + 0x38]
mov r8, rax
mov r9d, dword [rbp + 0x40]
and ecx, 0x7fff
mov rdx, qword [rbp - 0x38]
shl ecx, 0x10
mov dword [rsp + 0x20], esi
call fcn.18001ebb0
mov dword [rdi + 0x30], eax
mov dword [rdi + 0x34], r15d
cmp r15d, 2
jne 0x180017ebf
mov ecx, 1
mov qword [rdi + 0x38], 0xffffffffffffffff
mov qword [rdi + 0x40], rcx
lea r8, [rbp]
mov dword [rsp + 0x20], ecx
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
cmp rbx, r13
mov rax, rsi
mov qword [rdi + 0x50], rsi
cmova rax, qword [rbp + 0x60]
mov r9d, 0x800
mov qword [rdi + 0x48], rax
mov dword [rdi + 0x58], esi
call qword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
test eax, eax
js 0x180017ebf
mov eax, dword [rbp + 8]
mov dword [rdi + 0x44], eax
mov r8d, r15d
mov rdx, rdi
xor ecx, ecx
call fcn.180017130
mov rcx, qword [rsp + 0x60]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x180017f61
mov ecx, eax
call fcn.18001b490
mov rcx, qword [rsp + 0x60]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x180017f61
cmp r14d, 0xc0000033
je 0x180017f06
cmp r14d, 0xc0000024
jne 0x180017f57
mov rax, qword [rbp - 0x80]
lea rcx, [rbp - 0x68]
mov qword [rbp - 0x60], rax
xorps xmm0, xmm0
lea rax, [rbp]
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], 0x2078
mov r9d, r13d
mov r8d, r15d
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov dword [rbp - 0x68], 0x30
mov dword [rbp - 0x50], 0x40
mov qword [rbp - 0x58], rbx
movdqu xmmword [rbp - 0x48], xmm0
call fcn.1800171b0
mov ebx, eax
test eax, eax
jns 0x180017f61
mov ecx, r14d
call fcn.18001b490
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp + 0x2080]
xor rcx, rsp
call fcn.180001160
mov rbx, qword [rsp + 0x21e8]
add rsp, 0x2190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret