Function at 0x7fff25d8fe10
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x210
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rsp + 0x200], rax
mov rbx, r9
mov rsi, r8
mov r14, rdx
mov rdi, rcx
mov dword [rsp + 0x48], 0x10
call fcn.7fff25dcf540
xor r15d, r15d
test al, al
je 0x7fff25d8ffa7
lea r9, [rsp + 0x48]
lea r8, [rsp + 0xc8]
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.ext_ms_win_kernel32_file_l1_1_0.dll_BasepGetComputerNameFromNtPath]
nop dword [rax + rax]
test eax, eax
jne 0x7fff25d8ff9a
mov dword [rsp + 0x38], 0x1040000
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntdll.dll_RtlUnicodeStringToOemString]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
js 0x7fff25d90105
cmp word [rsp + 0x38], 0x1e
ja 0x7fff25d8ffb1
movzx ebx, word [rsp + 0x38]
mov r8d, ebx
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0xa4]
call sub.ntdll.dll_memcpy
mov byte [rsp + rbx + 0xa4], r15b
movzx eax, word [rsp + 0x38]
inc eax
mov dword [rsp + 0xa0], eax
mov qword [rsp + 0x98], rsi
mov dword [rsp + 0x20], 0x24
mov r9d, 0x30
lea r8, [rsp + 0x98]
lea rdx, [rsp + 0x50]
mov rcx, qword [rdi]
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x30], eax
cmp eax, 0xc0000022
jne 0x7fff25d90105
mov rcx, qword [rdi]
call sym.KERNELBASE.dll_CloseHandle
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 7
lea r9, [rsp + 0x50]
mov r8, r14
mov edx, 0x100180
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtOpenFile]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x7fff25d8ffbf
mov qword [rdi], 0xffffffffffffffff
jmp 0x7fff25d90105
mov dword [rsp + 0xa0], r15d
jmp 0x7fff25d8ff0d
mov eax, 0x32
jmp 0x7fff25d8fe74
mov ebx, 0x80000005
mov dword [rsp + 0x30], ebx
jmp 0x7fff25d90105
mov dword [rsp + 0x20], 4
mov r9d, 0x28
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x50]
mov rcx, qword [rdi]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
js 0x7fff25d90105
mov esi, dword [rsp + 0x90]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], rax
mov eax, esi
and eax, 0xfffffffe
mov dword [rsp + 0x90], eax
mov dword [rsp + 0x20], 4
mov r9d, 0x28
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x50]
mov rcx, qword [rdi]
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
js 0x7fff25d90105
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 7
lea r9, [rsp + 0x50]
mov r8, r14
mov edx, 0x40100000
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntdll.dll_NtOpenFile]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
js 0x7fff25d900d2
mov rcx, qword [rdi]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x38]
mov qword [rdi], rcx
mov dword [rsp + 0x20], 0x24
mov r9d, 0x30
lea r8, [rsp + 0x98]
lea rdx, [rsp + 0x50]
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x30], eax
test ebx, ebx
jns 0x7fff25d90105
mov dword [rsp + 0x90], esi
mov dword [rsp + 0x20], 4
mov r9d, 0x28
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x50]
mov rcx, qword [rdi]
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
nop
mov eax, ebx
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.7fff25dce640
add rsp, 0x210
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret