Function at 0x18000bc20
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x18009a918]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov r15, rdx
mov rbx, rcx
cmp byte [0x18009c8c4], 0
jne 0x18000bc82
mov eax, 0xe8000001
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.18005e1d0
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
cmp rbx, 0xffffffffffffffff
jne 0x18000bc98
lea ecx, [rbx + 7]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 0xc00000ef
jmp 0x18000bc5a
test r15, r15
jne 0x18000bcae
lea ecx, [r15 + 0x57]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 0xc00000f0
jmp 0x18000bc5a
cmp rbx, 1
jne 0x18000bcce
mov ecx, 0x80000006
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 0x80000006
jmp 0x18000bc5a
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x78], rbx
xor r12d, r12d
mov qword [rsp + 0x68], r12
mov byte [rsp + 0x60], r12b
add rcx, 0x28
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lock inc dword [0x18009d6e0]
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18000bd34
test byte [rcx + 0x1c], 1
je 0x18000bd34
cmp byte [rcx + 0x19], 5
jb 0x18000bd34
lea edx, [r12 + 0x10]
mov r9, rbx
lea r8, [0x180090ba0]
mov rcx, qword [rcx + 0x10]
call fcn.18000a910
cmp qword [rbx + 8], 0
jne 0x18000bdc3
cmp byte [0x18009b380], 0
je 0x18000bd7a
mov ecx, 0x2f2
lea rax, str.E:_buildsARK23181_2_trufos_dll_fileWalk.c
mov qword [rsp + 0x28], rax
mov word [rsp + 0x20], cx
xor r9d, r9d
mov edx, 0x1000
mov r8d, 0x4e49423a
lea rcx, [0x18009cc40]
call fcn.18004b960
jmp 0x18000bd96
xor edx, edx
mov r8d, 0x1000
mov rcx, qword [0x18009ccf0]
mov rax, qword [0x18009b430]
call qword [0x18007d538]
mov qword [rbx + 8], rax
test rax, rax
je 0x18000be58
xor edx, edx
mov r8d, 0x1000
mov rcx, rax
call fcn.18005f850
mov rax, qword [rbx + 8]
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 0x1000
mov rdi, qword [rsp + 0x68]
movzx r14d, byte [rsp + 0x60]
nop
test r14b, r14b
jne 0x18000bec1
mov rdi, qword [rbx + 0x10]
cmp qword [rbx + 8], rdi
jne 0x18000be75
mov byte [rsp + 0x50], r14b
mov qword [rsp + 0x48], r12
mov byte [rsp + 0x40], r14b
mov dword [rsp + 0x38], 3
mov eax, dword [rbx + 0x18]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdi
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbx]
call qword [sym.imp.ntdll.dll_ZwQueryDirectoryFile]
mov esi, eax
cmp eax, 0x80000005
jne 0x18000be80
mov rcx, rdi
mov qword [rsp + 0x70], rcx
mov rdx, r12
nop dword [rax]
mov eax, dword [rcx]
test eax, eax
je 0x18000be6d
mov rdx, rcx
shr rax, 2
lea rcx, [rcx + rax*4]
mov qword [rsp + 0x70], rcx
jmp 0x18000be40
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, 0xc000009a
jmp 0x18000bf9a
test rdx, rdx
je 0x18000be75
mov dword [rdx], r12d
mov eax, dword [rdi]
test eax, eax
je 0x18000be99
add rax, rdi
jmp 0x18000be9d
test eax, eax
jns 0x18000be75
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x18000bf9a
mov rax, qword [rbx + 8]
mov qword [rbx + 0x10], rax
test dword [rdi + 0x38], 0x440000
je 0x18000beb4
mov eax, dword [rbx + 0x20]
and eax, 1
test al, al
je 0x18000bebc
mov r14b, 1
mov byte [rsp + 0x60], r14b
jmp 0x18000bdd0
mov eax, dword [rdi + 0x38]
mov dword [r15], eax
mov rax, qword [rdi + 8]
mov qword [r15 + 4], rax
mov rax, qword [rdi + 0x10]
mov qword [r15 + 0xc], rax
mov rax, qword [rdi + 0x18]
mov qword [r15 + 0x14], rax
mov eax, dword [rdi + 0x2c]
mov dword [r15 + 0x1c], eax
mov eax, dword [rdi + 0x28]
mov dword [r15 + 0x20], eax
mov edx, dword [rdi + 0x3c]
lea r9, [rdi + 0x5e]
test r9, r9
je 0x18000bf1a
cmp edx, 2
jb 0x18000bf1a
cmp word [r9], 0x2e
jne 0x18000bf12
cmp edx, 2
jbe 0x18000bf1a
cmp word [r9 + 2], 0x2e
je 0x18000bf1a
mov rcx, r9
call fcn.180007e70
movsx edx, byte [rdi + 0x44]
lea rsi, [rdi + 0x46]
test rsi, rsi
je 0x18000bf46
cmp edx, 2
jb 0x18000bf46
cmp word [rsi], 0x2e
jne 0x18000bf3e
cmp edx, 2
jbe 0x18000bf46
cmp word [rsi + 2], 0x2e
je 0x18000bf46
mov rcx, rsi
call fcn.180007e70
mov r8d, dword [rdi + 0x3c]
lea rcx, [r15 + 0x2c]
mov rdx, r9
call fcn.18005f360
mov eax, dword [rdi + 0x3c]
shr rax, 1
mov word [r15 + rax*2 + 0x2c], r12w
movsx r8, byte [rdi + 0x44]
lea rcx, [r15 + 0x234]
mov rdx, rsi
call fcn.18005f360
movsx rax, byte [rdi + 0x44]
shr rax, 1
mov word [r15 + rax*2 + 0x234], r12w
test dword [rdi + 0x38], 0x400
je 0x18000bf97
mov eax, dword [rdi + 0x40]
mov dword [r15 + 0x24], eax
mov esi, r12d
lea rcx, [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
jmp 0x18000bc5a