Function at 0x18001e6c0
Capabilities:
Get file attributes

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe0
mov rax, qword [0x1800b2220]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov r15, r9
mov qword [rsp + 0xa8], r8
mov qword [rsp + 0x98], rdx
mov r10, rcx
mov qword [rsp + 0xa0], rcx
mov edi, dword [rsp + 0x158]
mov r13, qword [rsp + 0x140]
or qword [rsp + 0x58], 0xffffffffffffffff
xor ebx, ebx
mov dword [rsp + 0x60], ebx
mov r8d, dword [rsp + 0x148]
mov r14d, r8d
mov r9d, 0x4000
and r14d, r9d
mov ecx, r8d
and ecx, 0x800
mov dword [rsp + 0x90], ecx
mov r11d, 0x8000
and r8d, r11d
mov dword [rsp + 0x148], r8d
mov eax, dword [rsp + 0x150]
cmp eax, 0xffffffff
je 0x18001e7ca
mov esi, eax
and esi, r9d
mov r12d, eax
and r12d, 0x800
and eax, r11d
mov dword [rsp + 0x68], esi
mov dword [rsp + 0x6c], r12d
mov dword [rsp + 0x70], eax
test r14d, r14d
jne 0x18001e7e6
test esi, esi
jne 0x18001e7e6
mov r14, qword [rsp + 0x98]
test ecx, ecx
jne 0x18001ea95
test r12d, r12d
jne 0x18001eb74
mov eax, dword [rsp + 0x148]
mov edx, dword [rsp + 0x70]
test eax, eax
jne 0x18001eb7e
test edx, edx
jne 0x18001ec18
mov ebx, 1
mov rax, qword [rsp + 0x58]
jmp 0x18001ec94
mov esi, ebx
test r14d, r14d
sete sil
mov r12d, ebx
test ecx, ecx
sete r12b
mov eax, ebx
test r8d, r8d
sete al
jmp 0x18001e771
mov rcx, qword [rdx]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
or rcx, 0xffffffffffffffff
mov rax, qword [rsp + 0x98]
mov qword [rax], rcx
xor edx, edx
mov r8d, 0x800
lea rcx, [0x1800883b0]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
nop dword [rax + rax]
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x18001e839
mov ecx, edi
and ecx, 1
jne 0x18001e9b0
jmp 0x18001ec94
test r14d, r14d
je 0x18001e8f2
test esi, esi
jne 0x18001e8ed
lea rdx, [rsp + 0x60]
mov rcx, r15
call sym.KERNEL32.dll_GetEncryptedFileVersionExt
mov r14d, edi
and r14d, 1
test eax, eax
je 0x18001e87a
test r14d, r14d
jne 0x18001e87a
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
jmp 0x18001e7c0
mov eax, dword [rsp + 0x60]
add eax, 0xfffffffb
cmp eax, 1
jbe 0x18001e8c6
lea rdx, str.EncryptFileW
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
test rax, rax
je 0x18001e8be
mov rcx, r13
call qword [case.0x1800532bc.0]
test eax, eax
jne 0x18001e8d8
test r14d, r14d
jne 0x18001e9b0
jmp 0x18001e7c0
test r14d, r14d
jmp 0x18001e9aa
xor r8d, r8d
mov rdx, r13
mov rcx, r15
call fcn.1800376f4
test eax, eax
je 0x18001e8be
mov esi, 1
mov dword [rsp + 0x68], esi
mov r12d, ebx
mov dword [rsp + 0x6c], ebx
jmp 0x18001e9b0
test r14d, r14d
jne 0x18001e964
test esi, esi
je 0x18001e95f
lea rdx, str.DecryptFileW
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov r15, rax
mov r14d, edi
and r14d, 1
test rax, rax
je 0x18001e8be
lea rdx, [rsp + 0x60]
mov rcx, r13
call sym.KERNEL32.dll_GetEncryptedFileVersionExt
test eax, eax
je 0x18001e935
test r14d, r14d
je 0x18001e867
mov eax, dword [rsp + 0x60]
add eax, 0xfffffffb
cmp eax, 1
jbe 0x18001e9b0
xor edx, edx
mov rcx, r13
mov rax, r15
call qword [case.0x1800532bc.0]
test eax, eax
je 0x18001e8be
mov esi, ebx
mov dword [rsp + 0x68], ebx
jmp 0x18001e9b0
test r14d, r14d
je 0x18001e9b0
test esi, esi
je 0x18001e9b0
lea rdx, [rsp + 0x60]
mov rcx, r15
call sym.KERNEL32.dll_GetEncryptedFileVersionExt
test eax, eax
je 0x18001e984
mov ecx, edi
and ecx, 1
je 0x18001e867
mov eax, dword [rsp + 0x60]
add eax, 0xfffffffb
cmp eax, 1
ja 0x18001e9b0
mov r8d, 1
mov rdx, r13
mov rcx, r15
call fcn.1800376f4
test eax, eax
jne 0x18001e9b0
mov eax, edi
and eax, 1
je 0x18001e7c0
mov r13d, 0x60
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], ebx
lea r9, [rsp + 0x80]
mov r15, qword [rsp + 0xa8]
mov r8, r15
mov edx, 0xc0150000
mov r14, qword [rsp + 0x98]
mov rcx, r14
call qword [sym.imp.ntdll.dll_NtOpenFile]
nop dword [rax + rax]
mov edx, eax
mov dword [rsp + 0x64], eax
cmp eax, 0xc0000022
jne 0x18001ea30
mov ecx, edi
and ecx, 1
je 0x18001ea30
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], ebx
lea r9, [rsp + 0x80]
mov r8, r15
mov edx, 0x80150000
mov rcx, r14
call qword [sym.imp.ntdll.dll_NtOpenFile]
nop dword [rax + rax]
mov edx, eax
mov dword [rsp + 0x64], eax
cmp edx, 0xc0000022
jne 0x18001ea6d
mov eax, edi
and eax, 1
je 0x18001ea6d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], ebx
lea r9, [rsp + 0x80]
mov r8, r15
mov edx, 0x80110000
mov rcx, r14
call qword [sym.imp.ntdll.dll_NtOpenFile]
nop dword [rax + rax]
mov edx, eax
mov dword [rsp + 0x64], eax
test edx, edx
jns 0x18001ea81
mov ecx, edx
jmp 0x18001ea77
mov ecx, eax
call sym.KERNEL32.dll_BaseSetLastNTError
jmp 0x18001e7c0
mov ecx, dword [rsp + 0x90]
mov r10, qword [rsp + 0xa0]
jmp 0x18001e78f
test r12d, r12d
jne 0x18001eb67
test esi, esi
jne 0x18001eb67
mov dword [rsp + 0x20], 0x1c
lea r9d, [r12 + 0x10]
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x80]
mov rcx, r10
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
mov dword [rsp + 0x64], eax
test eax, eax
jns 0x18001eaf5
cmp dword [rsp + 0x150], 0xffffffff
je 0x18001e7a0
mov ecx, edi
and ecx, 1
jne 0x18001e7a0
jmp 0x18001ea75
lea rax, [rsp + 0xc8]
jmp 0x18001eb09
mov word [rsp + 0x60], bx
lea rax, [rsp + 0x60]
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], 2
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x9c040
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [r14]
call qword [sym.imp.ntdll.dll_NtFsControlFile]
nop dword [rax + rax]
mov dword [rsp + 0x64], eax
cmp dword [rsp + 0x150], 0xffffffff
je 0x18001e7a0
test eax, eax
jns 0x18001e7a0
jmp 0x18001eae8
test ecx, ecx
jne 0x18001e7a0
jmp 0x18001e797
test esi, esi
jne 0x18001e7a0
jmp 0x18001eaff
test edx, edx
jne 0x18001ec87
mov dword [rsp + 0x48], 0x10
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x9027c
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ntdll.dll_NtFsControlFile]
nop dword [rax + rax]
mov dword [rsp + 0x64], eax
test eax, eax
jns 0x18001ebf9
cmp dword [rsp + 0x150], 0xffffffff
je 0x18001e7bb
and edi, 1
jne 0x18001e7bb
jmp 0x18001ea75
mov qword [rsp + 0x78], rbx
movzx eax, word [rsp + 0xb0]
mov word [rsp + 0x78], ax
mov eax, dword [rsp + 0xb4]
mov dword [rsp + 0x7c], eax
jmp 0x18001ec21
mov word [rsp + 0x78], bx
mov dword [rsp + 0x7c], ebx
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], 8
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x9c280
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [r14]
call qword [sym.imp.ntdll.dll_NtFsControlFile]
nop dword [rax + rax]
mov dword [rsp + 0x64], eax
cmp dword [rsp + 0x150], 0xffffffff
je 0x18001e7bb
test eax, eax
jns 0x18001e7bb
jmp 0x18001ebeb
test eax, eax
jne 0x18001e7bb
jmp 0x18001e7b3
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
jbe 0x180034736
mov eax, ebx
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.180024680
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
nop dword [rax + rax]
nop
jmp 0x18001eca2