Function at 0x140022080
Capabilities:
Get file attributes

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x3f]
sub rsp, 0x98
xor esi, esi
mov rdi, rcx
cmp qword [rcx + 0xa0], rsi
jne 0x1400221df
mov dword [rcx + 0x9c], 0x40000
lea r9d, [rsi + 8]
mov rcx, qword [rcx + 0x60]
lea r8, [rbp + 0x67]
xor eax, eax
mov dword [rbp + 0x27], 0xc0000365
lea rdx, [rbp + 0x27]
mov dword [rbp + 0x2b], eax
mov qword [rbp + 0x2f], 0xffffffffffffffd5
mov qword [rbp + 0x67], rsi
mov dword [rsp + 0x20], 4
call qword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
test eax, eax
js 0x14002210d
test byte [rbp + 0x6b], 0x10
jne 0x14002210d
mov eax, dword [rbp + 0x67]
cmp eax, 0x2e
ja 0x140022105
movabs rcx, 0x410000140000
bt rcx, rax
jb 0x14002210d
mov eax, dword [rdi + 0x9c]
jmp 0x14002211c
mov dword [rdi + 0x9c], 0x10000
mov eax, 0x10000
mov ecx, eax
lea rdx, [0x140054850]
call fcn.14001ed20
mov qword [rdi + 0xa0], rax
mov rbx, rax
test rax, rax
jne 0x140022182
mov eax, dword [rdi + 0x9c]
nop
shr eax, 2
lea rdx, [0x140054850]
mov ecx, eax
mov dword [rdi + 0x9c], ecx
call fcn.14001ed20
mov qword [rdi + 0xa0], rax
mov rbx, rax
test rax, rax
jne 0x140022182
mov eax, dword [rdi + 0x9c]
cmp eax, 0x1000
ja 0x140022140
lea eax, [rbx - 8]
add rsp, 0x98
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov dword [rbx + 8], esi
lea rdx, [rbp + 0x17]
mov r9d, dword [rdi + 0x9c]
xor eax, eax
mov rcx, qword [rdi + 0x60]
mov r8, rbx
mov dword [rbp + 0x1b], eax
mov eax, 0x800
cmp r9d, eax
mov dword [rbp + 0x17], 0xc0000365
mov qword [rbp + 0x1f], 0xffffffffffffffd5
cmovae r9d, eax
mov dword [rsp + 0x20], 1
call qword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
test eax, eax
js 0x1400221d9
cmp dword [rbp + 0x17], esi
jl 0x1400221d9
mov eax, dword [rbx + 8]
mov dword [rdi + 0xa8], eax
jmp 0x1400221df
mov dword [rdi + 0xa8], esi
mov r9d, dword [rdi + 0x88]
xor eax, eax
mov qword [rsp + 0xc8], r12
mov qword [rsp + 0xd0], r14
mov qword [rsp + 0x90], r15
mov dword [rbp + 7], 0xc0000365
mov dword [rbp + 0xb], eax
mov qword [rbp + 0xf], 0xffffffffffffffd5
test r9d, r9d
je 0x1400222a8
movzx r10d, byte [rdi + 0x5e]
mov r8d, dword [rdi + 0x9c]
mov rdx, qword [rdi + 0xa0]
mov rcx, qword [rdi + 0x60]
cmp r9d, 0x4c
jne 0x140022267
lea r9, [rbp + 0xf]
mov qword [rbp + 0xf], rsi
mov qword [rsp + 0x30], r9
lea rax, [rdi + 0x8c]
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov byte [rsp + 0x20], r10b
call qword [sym.imp.ntdll.dll_NtQueryDirectoryObject]
mov dword [rbp + 7], eax
jmp 0x1400224bf
mov rax, qword [rdi + 0x80]
mov byte [rsp + 0x50], r10b
mov qword [rsp + 0x48], rax
lea rax, [rbp + 7]
mov byte [rsp + 0x40], sil
mov dword [rsp + 0x38], r9d
xor r9d, r9d
mov dword [rsp + 0x30], r8d
xor r8d, r8d
mov qword [rsp + 0x28], rdx
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
jmp 0x1400224bf
mov rax, qword gs:[0x60]
mov r12d, 3
mov edx, dword [rax + 0x118]
mov rax, qword gs:[0x60]
shl rdx, 0x20
mov ecx, dword [rax + 0x11c]
movabs rax, 0x500000000
or rdx, rcx
mov ecx, 0x25
cmp rdx, rax
movzx eax, byte [rdi + 0x5e]
mov byte [rsp + 0x50], al
mov rax, qword [rdi + 0x80]
cmovbe ecx, r12d
mov qword [rsp + 0x48], rax
xor r9d, r9d
mov eax, dword [rdi + 0x9c]
xor r8d, r8d
mov byte [rsp + 0x40], sil
xor edx, edx
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], eax
mov rax, qword [rdi + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 7]
mov dword [rdi + 0x88], ecx
mov rcx, qword [rdi + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
test eax, eax
jns 0x140022471
movzx r14d, byte [rdi + 0x5e]
mov r15d, 0x278
cmp eax, 0xc0000003
je 0x140022362
cmp eax, 0xc00000f6
je 0x140022362
test esi, esi
je 0x140022369
mov dword [rdi + 0x88], r12d
mov ebx, dword [rdi + 0x9c]
cmp eax, 0xc000000d
je 0x140022388
cmp eax, 0xc00000f5
je 0x140022388
cmp eax, 0xc00000c3
je 0x140022388
test esi, esi
je 0x140022399
shr ebx, 1
mov r14b, 1
mov eax, ebx
mov ebx, 0x10000
cmp eax, ebx
cmovbe ebx, eax
mov rax, qword [rdi + 0x80]
xor r9d, r9d
mov rcx, qword [rdi + 0x60]
xor r8d, r8d
mov byte [rsp + 0x50], r14b
xor edx, edx
mov qword [rsp + 0x48], rax
mov eax, dword [rdi + 0x88]
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x38], eax
mov rax, qword [rdi + 0xa0]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
lea rax, [rbp + 7]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
test eax, eax
jns 0x14002246b
nop dword [rax]
cmp ebx, dword [rdi + 0x9c]
je 0x1400224b4
cmp ebx, r15d
jbe 0x1400224b4
mov ecx, dword [rdi + 0x88]
shr ebx, 3
cmp ebx, 0x400
jae 0x140022422
cmp ecx, 0x25
mov ebx, 0x268
cmove ebx, r15d
mov rax, qword [rdi + 0x80]
xor r9d, r9d
mov byte [rsp + 0x50], r14b
xor r8d, r8d
mov qword [rsp + 0x48], rax
xor edx, edx
mov rax, qword [rdi + 0xa0]
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x38], ecx
mov rcx, qword [rdi + 0x60]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
lea rax, [rbp + 7]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
test eax, eax
js 0x1400223f0
mov dword [rdi + 0x9c], ebx
mov rax, qword [rdi + 0xa0]
mov qword [rdi + 0x90], rax
mov eax, dword [rbp + 0xf]
mov dword [rdi + 0x98], eax
xor eax, eax
mov word [rdi + 0x5d], 1
mov r14, qword [rsp + 0xd0]
mov r12, qword [rsp + 0xc8]
mov r15, qword [rsp + 0x90]
add rsp, 0x98
pop rdi
pop rsi
pop rbx
pop rbp
ret
inc esi
cmp esi, 2
jb 0x140022350
test eax, eax
jns 0x140022471
cmp eax, 0x80000006
je 0x1400224e1
cmp eax, 0x8000001a
je 0x1400224e1
cmp eax, 0xc000000f
je 0x1400224e1
mov ecx, eax
call fcn.1400392e0
jmp 0x140022490
mov eax, 0xffffff37
jmp 0x140022490