Function at 0x210067b60
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x488
movzx eax, byte [rcx + 8]
mov r12, rcx
mov r13, rdx
mov rbx, r8
test al, 0x20
je 0x210067b96
and eax, 0xffffffdf
mov byte [rcx + 8], al
test byte [rcx + 0x2c], 8
je 0x210067bd0
movzx eax, byte [r12 + 8]
and eax, 0xc
cmp al, 8
je 0x210067d10
mov rax, qword [r12]
mov r8, rbx
mov rdx, r13
mov rcx, r12
mov rax, qword [rax + 0x278]
add rsp, 0x488
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp rax
mov eax, dword [rcx + 0x80]
cmp eax, 0xffffffff
je 0x210067be0
test ah, 2
jne 0x210067b90
mov rax, qword [r12]
mov rcx, r12
lea rsi, [rsp + 0x60]
call qword [rax + 0x290]
mov r9d, 0x18
lea r8, [rsp + 0x70]
mov rdx, rsi
mov dword [rsp + 0x20], 5
mov rcx, qword [rax]
call sym.NtQueryInformationFile
test eax, eax
js 0x210067b90
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0x290]
mov r9d, 8
lea r8, [rsp + 0x58]
mov rdx, rsi
mov dword [rsp + 0x20], 0xe
mov rcx, qword [rax]
call sym.NtQueryInformationFile
test eax, eax
js 0x210067b90
mov rax, qword [rsp + 0x78]
add rax, 0x1ffff
cmp rax, qword [rsp + 0x58]
jge 0x210067b90
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0x290]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x48], 0
xor r8d, r8d
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x900c4
mov rcx, qword [rax]
call sym.NtFsControlFile
mov esi, eax
test eax, eax
js 0x210067cbf
or dword [r12 + 0x80], 0x200
test byte [0x210273880], 1
je 0x210067b90
lea rcx, [r12 + 0x80]
xor edx, edx
call method.path_conv.get_nt_native_path__UNICODE_STRING_
mov dword [rsp + 0x20], esi
mov edx, 0x40
lea r9, [0x2102892c8]
mov qword [rsp + 0x28], rax
lea r8, str.virtual_ssize_t_fhandler_base::write_const_void__size_t_
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x210067b90
test byte [0x210273880], 1
jne 0x210067e10
mov r15d, ebx
xor eax, eax
test ebx, ebx
jle 0x210067dee
lea rbp, [rsp + 0x70]
mov r10, qword [r12]
mov rdx, r13
xor esi, esi
mov r14d, 0x400
mov rax, rbp
jmp 0x210067d8d
cmp cl, 0xd
mov byte [rax], cl
sete cl
and cl, r11b
je 0x210067e08
cmp byte [rdx + 1], 0xa
jne 0x210067d78
lea ebx, [r15 - 2]
mov byte [rax + 1], 0xa
lea rdi, [rdx + 2]
test ebx, ebx
lea r8, [rax + 2]
lea r9d, [r14 - 2]
setg cl
test r9d, r9d
jle 0x210067dc8
test cl, cl
je 0x210067dc8
mov r14d, r9d
mov rax, r8
mov rdx, rdi
mov r15d, ebx
lea ebx, [r15 - 1]
movzx ecx, byte [rdx]
lea rdi, [rdx + 1]
test ebx, ebx
lea r8, [rax + 1]
lea r9d, [r14 - 1]
setg r11b
cmp cl, 0xa
jne 0x210067d48
mov edx, 0xa0d
lea r9d, [r14 - 2]
lea r8, [rax + 2]
mov word [rax], dx
test r9d, r9d
jle 0x210067dc8
test r11b, r11b
jne 0x210067d81
nop dword [rax]
mov r14, r8
mov rdx, rbp
mov rcx, r12
sub r14, rbp
mov r8, r14
call qword [r10 + 0x278]
cmp r14, rax
je 0x210067e38
add rsi, rax
cmp rax, 0xffffffffffffffff
cmovne rax, rsi
add rsp, 0x488
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, r11d
jmp 0x210067d78
lea r9, str.text_write
lea r8, str.virtual_ssize_t_fhandler_base::write_const_void__size_t_
mov edx, 0x40
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x210067d1d
mov rsi, rdi
sub rsi, r13
test ebx, ebx
jle 0x210067e54
mov r10, qword [r12]
mov r9d, 0x400
mov r8, rbp
jmp 0x210067d81
mov rax, rsi
jmp 0x210067dee