Function at 0x17278
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x420
mov rax, qword [0x0002b100]
xor rax, rsp
mov qword [rsp + 0x410], rax
xor r15d, r15d
mov edi, ecx
mov esi, 8
lea rbx, [0x01870160]
cmp qword [0x01870168], r15
jne 0x173cc
mov eax, 0xa2
mov word [rsp + 0x90], si
lea rbp, [0x00026330]
mov word [rsp + 0x80], ax
mov eax, 0xa4
lea r8, [r11 - 0x3b8]
mov word [rsp + 0x82], ax
lea rax, [0x000261b0]
lea rdx, [rsp + 0x70]
mov qword [r11 - 0x3c0], rax
mov eax, 0xba
lea rcx, [r11 - 0x3c8]
mov word [rsp + 0x70], ax
mov eax, 0xbc
mov r9, rbp
mov word [rsp + 0x72], ax
lea rax, [0x00026260]
mov qword [rsp + 0x78], rax
lea eax, [rsi + 2]
mov word [rsp + 0x92], ax
lea rax, [0x00026320]
mov qword [r11 - 0x3b0], rax
call fcn.00016a5c
cmp al, r15b
je 0x173ae
mov eax, 0x3f0
lea r9, [rsp + 0x90]
lea r8, [rsp + 0x70]
mov word [0x01870162], ax
lea rax, [0x01877180]
lea rdx, [rsp + 0x80]
mov qword [0x01870168], rax
lea rax, [0x000260a0]
mov rcx, rbx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call fcn.00016704
cmp al, r15b
je 0x173ae
cmp word [0x01870160], r15w
jne 0x173cc
mov word [0x01870162], r15w
mov word [0x01870160], r15w
mov qword [0x01870168], r15
xor al, al
jmp 0x17e76
mov eax, 0x54
lea r9, [rsp + 0x90]
lea r8, [rsp + 0x70]
mov word [rsp + 0x80], ax
mov eax, 0x56
lea rdx, [rsp + 0x80]
mov word [rsp + 0x82], ax
lea rax, [0x00027380]
xor ecx, ecx
mov qword [rsp + 0x88], rax
mov eax, 0x6c
mov qword [rsp + 0x28], r15
mov word [rsp + 0x70], ax
mov eax, 0x6e
mov qword [rsp + 0x20], r15
mov word [rsp + 0x72], ax
lea rax, [0x000273e0]
mov qword [rsp + 0x78], rax
mov eax, 0x16
lea ebp, [rax + 2]
mov word [rsp + 0x90], ax
lea rax, [0x00027450]
mov qword [rsp + 0x98], rax
mov word [rsp + 0x92], bp
call fcn.00016704
cmp al, r15b
je 0x1746e
mov al, 1
jmp 0x17e76
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x40], 0x20
mov qword [rsp + 0xd0], rbx
mov ebx, 1
lea r9, [rsp + 0xb0]
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
lea r8, [rsp + 0xc0]
lea rcx, [rsp + 0x68]
mov edx, 0x80000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov qword [rsp + 0x20], r15
mov dword [rsp + 0xc0], 0x30
mov qword [rsp + 0xc8], r15
mov dword [rsp + 0xd8], 0x240
mov qword [rsp + 0xe0], r15
mov qword [rsp + 0xe8], r15
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
cmp eax, r15d
jl 0x173c5
mov rcx, qword [rsp + 0x68]
lea r8, [rsp + 0xf0]
lea rdx, [rsp + 0xb0]
mov r9d, ebp
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
cmp eax, r15d
jl 0x17e69
mov r12, qword [rsp + 0xf8]
cmp r12, rsi
jl 0x17e69
mov ecx, 0x6020000
call fcn.00024fc4
lea rsi, [r12 + 0x208]
cmp rsi, r15
je 0x1755d
mov rcx, rsi
call fcn.00012db4
mov rbp, rax
jmp 0x17560
mov rbp, r15
cmp rbp, r15
je 0x17e69
mov r8, rsi
xor edx, edx
mov rcx, rbp
call fcn.00025100
mov eax, dword [rsp + 0xf8]
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0xb0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov rcx, qword [rsp + 0x68]
cmp eax, r15d
jge 0x175d2
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov edx, 0x5246
mov rcx, rbp
call fcn.00012ebc
jmp 0x17e74
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov r13d, 0x7e
lea rcx, [rsp + 0x192]
mov r8, r13
xor edx, edx
mov byte [rsp + 0x61], r15b
mov word [rsp + 0x190], r15w
call fcn.00025100
lea esi, [r13 - 0x3f]
lea rcx, [rsp + 0x111]
mov r8, rsi
xor edx, edx
mov byte [rsp + 0x110], r15b
call fcn.00025100
lea rcx, [rsp + 0x212]
mov r8, r13
xor edx, edx
mov word [rsp + 0x210], r15w
call fcn.00025100
lea rcx, [rsp + 0x151]
mov r8, rsi
xor edx, edx
mov byte [rsp + 0x150], r15b
call fcn.00025100
lea rcx, [rsp + 0x312]
mov r8, r13
xor edx, edx
mov word [rsp + 0x310], r15w
call fcn.00025100
lea rcx, [rsp + 0x2d1]
mov r8, rsi
xor edx, edx
call fcn.00025100
lea rcx, [rsp + 0x392]
mov r8, r13
xor edx, edx
mov word [rsp + 0x390], r15w
call fcn.00025100
lea rcx, [rsp + 0x291]
mov r8, rsi
xor edx, edx
call fcn.00025100
mov r11, r15
lea rdx, [0x00010000]
lea r8d, [r13 - 0x7c]
movzx eax, word [r11 + rdx + 0x17470]
mov word [rsp + r11 + 0x310], ax
add r11, r8
cmp ax, r15w
jne 0x176b9
mov rax, qword [rdx + 0x17490]
lea rcx, [rsp + 0x2d0]
mov qword [rcx], rax
movzx eax, word [rdx + 0x17498]
mov word [rcx + 8], ax
mov al, byte [rdx + 0x1749a]
mov byte [rcx + 0xa], al
mov rcx, r15
movzx eax, word [rcx + rdx + 0x174a0]
mov word [rsp + rcx + 0x390], ax
add rcx, r8
cmp ax, r15w
jne 0x176fd
sub edi, ebx
mov rax, qword [rdx + 0x174c0]
lea rcx, [rsp + 0x290]
mov qword [rcx], rax
movzx eax, word [rdx + 0x174c8]
mov word [rcx + 8], ax
mov al, byte [rdx + 0x174ca]
mov byte [rcx + 0xa], al
je 0x17b75
sub edi, ebx
je 0x17afa
sub edi, ebx
je 0x17a7d
sub edi, ebx
je 0x17a06
sub edi, ebx
je 0x17993
sub edi, ebx
je 0x1791e
sub edi, r8d
je 0x178a4
sub edi, ebx
je 0x17819
cmp edi, ebx
jne 0x175c0
mov rcx, r15
movzx eax, word [rcx + rdx + 0x17800]
mov word [rsp + rcx + 0x190], ax
add rcx, r8
cmp ax, r15w
jne 0x17788
mov rax, qword [rdx + 0x17830]
lea rcx, [rsp + 0x110]
mov qword [rcx], rax
mov rax, qword [rdx + 0x17838]
mov qword [rcx + 8], rax
mov eax, dword [rdx + 0x17840]
mov dword [rcx + 0x10], eax
mov rcx, r15
movzx eax, word [rcx + rdx + 0x17850]
mov word [rsp + rcx + 0x210], ax
add rcx, r8
cmp ax, r15w
jne 0x177ca
mov rax, qword [rdx + 0x17880]
lea rcx, [rsp + 0x150]
mov qword [rcx], rax
mov rax, qword [rdx + 0x17888]
mov qword [rcx + 8], rax
movzx eax, word [rdx + 0x17890]
mov word [rcx + 0x10], ax
mov al, byte [rdx + 0x17892]
mov byte [rcx + 0x12], al
jmp 0x17be4
mov rcx, r15
movzx eax, word [rcx + rdx + 0x17760]
mov word [rsp + rcx + 0x190], ax
add rcx, r8
cmp ax, r15w
jne 0x1781c
mov rax, qword [rdx + 0x17790]
lea rcx, [rsp + 0x110]
mov qword [rcx], rax
mov rax, qword [rdx + 0x17798]
mov qword [rcx + 8], rax
movzx eax, word [rdx + 0x177a0]
mov word [rcx + 0x10], ax
mov rcx, r15
movzx eax, word [rcx + rdx + 0x177b0]
mov word [rsp + rcx + 0x210], ax
add rcx, r8
cmp ax, r15w
jne 0x17860
mov rax, qword [rdx + 0x177e0]
lea rcx, [rsp + 0x150]
mov qword [rcx], rax
mov rax, qword [rdx + 0x177e8]
mov qword [rcx + 8], rax
mov al, byte [rdx + 0x177f0]
mov byte [rcx + 0x10], al
jmp 0x17be4
mov rcx, r15
movzx eax, word [rcx + rdx + 0x17700]
mov word [rsp + rcx + 0x190], ax
add rcx, r8
cmp ax, r15w
jne 0x178a7
movdqu xmm0, xmmword [0x00027720]
mov rcx, r15
movdqu xmmword [rsp + 0x110], xmm0
movzx eax, word [rcx + rdx + 0x17730]
mov word [rsp + rcx + 0x210], ax
add rcx, r8
cmp ax, r15w
jne 0x178d4
mov rax, qword [rdx + 0x17750]
lea rcx, [rsp + 0x150]
mov qword [rcx], rax
mov eax, dword [rdx + 0x17758]
mov dword [rcx + 8], eax
movzx eax, word [rdx + 0x1775c]
mov word [rcx + 0xc], ax
mov al, byte [rdx + 0x1775e]
jmp 0x17af2
mov rcx, r15
movzx eax, word [rcx + rdx + 0x176a0]
mov word [rsp + rcx + 0x190], ax
add rcx, r8
cmp ax, r15w
jne 0x17921
mov rax, qword [rdx + 0x176c0]
lea rcx, [rsp + 0x110]
mov qword [rcx], rax
movzx eax, word [rdx + 0x176c8]
mov word [rcx + 8], ax
mov rcx, r15
movzx eax, word [rcx + rdx + 0x176d0]
mov word [rsp + rcx + 0x210], ax
add rcx, r8
cmp ax, r15w
jne 0x1795a
mov rax, qword [rdx + 0x176f0]
lea rcx, [rsp + 0x150]
mov qword [rcx], rax
mov al, byte [rdx + 0x176f8]
mov byte [rcx + 8], al
jmp 0x17be4
mov rcx, r15
movzx eax, word [rcx + rdx + 0x17670]
mov word [rsp + rcx + 0x190], ax
add rcx, r8
cmp ax, r15w
jne 0x17996
movabs rax, 0x70706170775c5b
mov rcx, r15
mov qword [rsp + 0x110], rax
movzx eax, word [rcx + rdx + 0x17680]
mov word [rsp + rcx + 0x210], ax
add rcx, r8
cmp ax, r15w
jne 0x179c4
mov eax, dword [rdx + 0x17690]
lea rcx, [rsp + 0x150]
mov dword [rcx], eax
movzx eax, word [rdx + 0x17694]
mov word [rcx + 4], ax
mov al, byte [rdx + 0x17696]
mov byte [rcx + 6], al
jmp 0x17be4
mov rcx, r15
movzx eax, word [rcx + rdx + 0x17610]
mov word [rsp + rcx + 0x190], ax
add rcx, r8
cmp ax, r15w
jne 0x17a09
movdqu xmm0, xmmword [0x00027630]
mov rcx, r15
movdqu xmmword [rsp + 0x110], xmm0
movzx eax, word [rcx + rdx + 0x17640]
mov word [rsp + rcx + 0x210], ax
add rcx, r8
cmp ax, r15w
jne 0x17a36
mov rax, qword [rdx + 0x17660]
lea rcx, [rsp + 0x150]
mov qword [rcx], rax
mov eax, dword [rdx + 0x17668]
mov dword [rcx + 8], eax
movzx eax, word [rdx + 0x1766c]
mov word [rcx + 0xc], ax
mov al, byte [rdx + 0x1766e]
jmp 0x17af2
mov rcx, r15
movzx eax, word [rcx + rdx + 0x175b0]
mov word [rsp + rcx + 0x190], ax
add rcx, r8
cmp ax, r15w
jne 0x17a80
movdqu xmm0, xmmword [0x000275d0]
mov rcx, r15
movdqu xmmword [rsp + 0x110], xmm0
movzx eax, word [rcx + rdx + 0x175e0]
mov word [rsp + rcx + 0x210], ax
add rcx, r8
cmp ax, r15w
jne 0x17aad
mov rax, qword [rdx + 0x17600]
lea rcx, [rsp + 0x150]
mov qword [rcx], rax
mov eax, dword [rdx + 0x17608]
mov dword [rcx + 8], eax
movzx eax, word [rdx + 0x1760c]
mov word [rcx + 0xc], ax
mov al, byte [rdx + 0x1760e]
mov byte [rcx + 0xe], al
jmp 0x17be4
mov rcx, r15
movzx eax, word [rcx + rdx + 0x17550]
mov word [rsp + rcx + 0x190], ax
add rcx, r8
cmp ax, r15w
jne 0x17afd
mov rax, qword [rdx + 0x17570]
lea rcx, [rsp + 0x110]
mov qword [rcx], rax
mov eax, dword [rdx + 0x17578]
mov dword [rcx + 8], eax
mov rcx, r15
movzx eax, word [rcx + rdx + 0x17580]
mov word [rsp + rcx + 0x210], ax
add rcx, r8
cmp ax, r15w
jne 0x17b34
mov rax, qword [rdx + 0x175a0]
lea rcx, [rsp + 0x150]
mov qword [rcx], rax
movzx eax, word [rdx + 0x175a8]
mov word [rcx + 8], ax
mov al, byte [rdx + 0x175aa]
mov byte [rcx + 0xa], al
jmp 0x17be4
mov rcx, r15
movzx eax, word [rcx + rdx + 0x174d0]
mov word [rsp + rcx + 0x190], ax
add rcx, r8
cmp ax, r15w
jne 0x17b78
mov rax, qword [rdx + 0x17500]
lea rcx, [rsp + 0x110]
mov qword [rcx], rax
mov rax, qword [rdx + 0x17508]
mov qword [rcx + 8], rax
mov al, byte [rdx + 0x17510]
mov byte [rcx + 0x10], al
mov rcx, r15
movzx eax, word [rcx + rdx + 0x17520]
mov word [rsp + rcx + 0x210], ax
add rcx, r8
cmp ax, r15w
jne 0x17bba
movdqu xmm0, xmmword [0x00027540]
movdqu xmmword [rsp + 0x150], xmm0
or rdx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x190]
mov rcx, rdx
mov r13b, r15b
mov r14b, r15b
repne scasw ax, word [rdi]
lea rdi, [rsp + 0x210]
mov rsi, r15
not rcx
sub rcx, rbx
mov r9, rcx
mov qword [rsp + 0xa8], rcx
mov rcx, rdx
repne scasw ax, word [rdi]
lea rdi, [rsp + 0x310]
not rcx
sub rcx, rbx
mov r10, rcx
mov qword [rsp + 0x70], rcx
mov rcx, rdx
repne scasw ax, word [rdi]
lea rdi, [rsp + 0x390]
not rcx
sub rcx, rbx
mov qword [rsp + 0xa0], rcx
mov rcx, rdx
repne scasw ax, word [rdi]
mov rax, r12
not rcx
sub rcx, rbx
cmp byte [rbp + 5], r15b
sete r8b
mov qword [rsp + 0x80], rcx
mov dl, r8b
mov byte [rsp + 0x60], r8b
neg dl
sbb edx, edx
neg edx
add edx, ebx
movsxd rcx, edx
xor edx, edx
div rcx
mov ecx, r10d
cmp r9d, r10d
cmovg ecx, r9d
mov r15, rax
mov qword [rsp + 0x90], rax
movsxd rcx, ecx
sub r15, rcx
je 0x17dee
mov rdi, rsi
cmp rsi, r15
jae 0x17d54
lea r12, [rsi + rbp]
lea rsi, [rbp + rsi*2]
test r8b, r8b
movsxd r8, r10d
je 0x17cfe
lea rdx, [rsp + 0x210]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe__wcsnicmp]
test eax, eax
je 0x17cf9
movsxd r8, dword [rsp + 0xa8]
lea rdx, [rsp + 0x190]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe__wcsnicmp]
test eax, eax
jne 0x17d30
add rdi, rbx
jmp 0x17d5d
lea rdx, [rsp + 0x150]
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe__strnicmp]
test eax, eax
je 0x17cf9
movsxd r8, dword [rsp + 0xa8]
lea rdx, [rsp + 0x110]
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe__strnicmp]
test eax, eax
je 0x17d4e
add rdi, rbx
add rsi, 2
add r12, rbx
cmp rdi, r15
jae 0x17d54
mov r8b, byte [rsp + 0x60]
mov r10, qword [rsp + 0x70]
jmp 0x17cbf
mov r13b, bl
add rdi, rbx
test r13b, r13b
je 0x17dee
mov rax, qword [rsp + 0x90]
mov cl, byte [rsp + 0x60]
xor r13b, r13b
dec rax
mov rsi, rdi
cmp rdi, rax
jae 0x17d99
test cl, cl
je 0x17d83
cmp word [rbp + rsi*2], 0x5b
jmp 0x17d87
cmp byte [rsi + rbp], 0x5b
je 0x17d91
add rsi, rbx
cmp rsi, rax
jmp 0x17d75
mov r13b, bl
jmp 0x17e3f
mov r14b, bl
mov rsi, rax
jmp 0x17e3f
movsxd r8, dword [rsp + 0xa0]
test cl, cl
je 0x17e01
movsxd rax, edi
lea rdx, [rsp + 0x310]
lea r12, [rbp + rax*2]
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe__wcsnicmp]
test eax, eax
je 0x17dea
movsxd r8, dword [rsp + 0x80]
lea rdx, [rsp + 0x390]
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe__wcsnicmp]
test eax, eax
jne 0x17e39
mov byte [rsp + 0x61], bl
mov edx, 0x5246
mov rcx, rbp
call fcn.00012ebc
mov al, byte [rsp + 0x61]
jmp 0x17e76
movsxd r12, edi
lea rdx, [rsp + 0x2d0]
add r12, rbp
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe__strnicmp]
test eax, eax
je 0x17dea
movsxd r8, dword [rsp + 0x80]
lea rdx, [rsp + 0x290]
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe__strnicmp]
test eax, eax
je 0x17e49
mov cl, byte [rsp + 0x60]
add edi, ebx
cmp edi, esi
jl 0x17da4
jmp 0x17e50
mov byte [rsp + 0x61], bl
mov r14b, bl
test r14b, r14b
jne 0x17dee
cmp rsi, r15
jae 0x17dee
mov r8b, byte [rsp + 0x60]
mov r10, qword [rsp + 0x70]
jmp 0x17caa
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, bl
mov rcx, qword [rsp + 0x410]
xor rcx, rsp
call fcn.00024bb0
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret