Function at 0x21007f9c0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x148
mov rax, qword [rcx]
mov rax, qword [rax + 0x2a0]
mov rbx, rdx
lea rdx, [method.fhandler_base.get_stat_handle__]
mov rsi, rcx
cmp rax, rdx
jne 0x21007fec8
mov rax, qword [rcx + 0x130]
test rax, rax
je 0x21007fe90
lea rdx, [rbx + 0x30]
lea rcx, [rsi + 0x140]
mov qword [rsp + 0xd0], rax
mov edi, dword [rsi + 0x80]
call sym.to_timestruc_t__LARGE_INTEGER__timespec_
lea r12, [rsi + 0x148]
lea rdx, [rbx + 0x40]
mov rcx, r12
call sym.to_timestruc_t__LARGE_INTEGER__timespec_
cmp qword [rsi + 0x150], 0
lea rdx, [rbx + 0x50]
je 0x21007fbd0
lea rcx, [rsi + 0x150]
lea r12, [rsi + 0x138]
call sym.to_timestruc_t__LARGE_INTEGER__timespec_
lea rdx, [rbx + 0x70]
mov rcx, r12
call sym.to_timestruc_t__LARGE_INTEGER__timespec_
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x70]
mov dword [rbx], eax
mov eax, dword [rsi + 0x80]
cmp eax, 0xffffffff
je 0x21007fb70
test al, 0x10
je 0x21007fb70
mov eax, dword [rsi + 0x170]
mov qword [rbx + 0x28], 0
lea r12, [rsi + 0x80]
mov word [rbx + 0x14], ax
mov rax, qword [rsi + 0x20]
test rax, rax
je 0x21007fbf0
mov dword [rbx + 0x60], 0x10000
mov rcx, qword [rsp + 0xd0]
mov qword [rbx + 8], rax
mov rax, qword [rsi + 0x160]
test rax, rax
jne 0x21007fe68
mov qword [rbx + 0x68], 0
mov dword [rbx + 0x10], 0
mov eax, dword [rsi + 0x80]
cmp eax, 0xffffffff
je 0x21007fc60
test al, 0x10
je 0x21007fc60
mov dword [rbx + 0x10], 0x4000
lea rax, [rbx + 0x1c]
mov rdx, r12
lea r9, [rbx + 0x18]
mov qword [rsp + 0x20], rax
lea r8, [rbx + 0x10]
call sym.get_file_attribute_void__path_conv__unsigned_int__unsigned_int__unsigned_int_
mov edx, dword [rbx + 0x10]
test eax, eax
jne 0x21007fc90
cmp edi, 0xffffffff
je 0x21007fb2f
and edi, 1
jne 0x21007fed0
movzx eax, byte [0x210273880]
test dh, 0xf0
jne 0x21007fb4e
cmp byte [rsi + 0x1cd], 0
jne 0x21007ff30
or dh, 0x80
mov dword [rbx + 0x10], edx
and eax, 1
test al, al
jne 0x21007fd1c
xor eax, eax
add rsp, 0x148
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, qword [rsi + 0x168]
mov eax, dword [rsi + 0x170]
lea r12, [rsi + 0x80]
mov qword [rbx + 0x28], rdx
mov word [rbx + 0x14], ax
mov rax, qword [rsi + 0x20]
test rax, rax
je 0x21007fbf0
mov qword [rbx + 8], rax
mov rcx, qword [rsp + 0xd0]
mov dword [rbx + 0x60], 0x10000
mov rax, qword [rsi + 0x160]
test rdx, rdx
je 0x21007fac7
test rax, rax
jle 0x21007fc10
add rax, 0x3ff
sar rax, 0xa
mov qword [rbx + 0x68], rax
jmp 0x21007fad8
mov rcx, r12
call sym.to_timestruc_t__LARGE_INTEGER__timespec_
lea rdx, [rbx + 0x70]
lea rcx, [rsi + 0x138]
jmp 0x21007fa60
xor edx, edx
mov rcx, r12
call method.path_conv.get_nt_native_path__UNICODE_STRING_
xor ecx, ecx
mov rdx, rax
call sym.hash_path_name_unsigned_long___UNICODE_STRING_
mov qword [rsi + 0x20], rax
mov rdx, qword [rbx + 0x28]
jmp 0x21007fb95
jne 0x21007fe70
test rcx, rcx
je 0x21007fc40
cmp byte [rsi + 0x1cd], 0
je 0x210080010
cmp dword [rsi + 0x1b0], 0xc3
je 0x210080010
nop dword [rax + rax]
lea rax, [rdx + 0x7fe]
add rdx, 0x3ff
cmovns rax, rdx
sar rax, 0xa
mov qword [rbx + 0x68], rax
jmp 0x21007fad8
test byte [rsi + 0x11c], 0x10
jne 0x210080070
cmp dword [rsi + 0x1b0], 0x1e0078
jne 0x21007fafd
mov dword [rbx + 0x10], 0xc000
jmp 0x21007fafd
cmp edi, 0xffffffff
je 0x21007fc9e
and edi, 1
jne 0x21007ff20
or edx, 0x1a4
mov dword [rbx + 0x10], edx
mov eax, dword [rsi + 0x80]
cmp eax, 0xffffffff
je 0x21007fe10
test al, 0x10
je 0x21007fe10
or edx, 0x40c9
mov dword [rbx + 0x10], edx
movzx eax, byte [0x210273880]
mov ecx, dword [rsi + 0x118]
and eax, 1
and ecx, 0x50
jne 0x21007feb8
mov rcx, qword [0x21023d810]
mov ecx, dword [rcx + 0x48b0]
not ecx
and edx, ecx
mov dword [rbx + 0x10], edx
test byte [rsi + 0x119], 0x20
jne 0x21007fb51
test byte [rsi + 0x98], 2
je 0x21007fb51
and edx, 0xfffffff8
mov dword [rbx + 0x10], edx
test al, al
je 0x21007fb59
mov r11, qword [rbx + 0x78]
mov r10, qword [rbx + 0x70]
xor edx, edx
mov rcx, r12
mov r9, qword [rbx + 0x48]
mov r8, qword [rbx + 0x40]
mov rdi, qword [rbx + 8]
mov rax, qword [rbx + 0x28]
mov qword [rsp + 0xb8], r11
mov r15, qword [rbx + 0x58]
mov r14, qword [rbx + 0x50]
mov qword [rsp + 0xb0], r10
mov r13, qword [rbx + 0x38]
mov rbp, qword [rbx + 0x30]
mov qword [rsp + 0xa8], r9
mov qword [rsp + 0xa0], r8
mov esi, dword [rbx + 0x10]
mov qword [rsp + 0x98], rax
call method.path_conv.get_nt_native_path__UNICODE_STRING_
mov qword [rsp + 0x40], rdi
mov r9, qword [rsp + 0xa8]
mov edx, 0x10
mov r8, qword [rsp + 0xa0]
mov r11, qword [rsp + 0xb8]
mov qword [rsp + 0x60], r15
lea rcx, [0x210273880]
mov r10, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0x98]
mov qword [rsp + 0x70], r9
lea r9, str.0__fstat___S___p__st_size_D__st_mode0_o__st_ino_Dst_atim_lx._lx_st_ctim_lx._lx_st_mtim_lx._lx_st_birthtim_lx._lx
mov qword [rsp + 0x68], r8
lea r8, str.int_fhandler_base::fstat_helper_stat_
mov qword [rsp + 0x80], r11
mov qword [rsp + 0x78], r10
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x21007fb59
test dh, 0xf0
jne 0x21007fcc7
cmp byte [rsi + 0x1cd], 0
je 0x21007ff60
mov eax, dword [rsi + 0x1b0]
cmp eax, 0xc3
je 0x21007ff60
mov dword [rbx + 0x20], eax
mov edx, dword [rsi + 0x1c8]
mov dword [rbx], eax
movzx eax, byte [0x210273880]
mov dword [rbx + 0x10], edx
mov ecx, dword [rsi + 0x118]
mov qword [rbx + 0x28], 0
and eax, 1
jmp 0x21007fcd7
jg 0x21007fbbd
xor edx, edx
cmp edi, 0xffffffff
je 0x21007fc40
test edi, 0xa00
je 0x21007fc40
jmp 0x21007fc16
mov rax, qword [rcx + 0x18]
jmp 0x21007fa03
test eax, 0x150
je 0x2100800d8
movzx eax, byte [0x210273880]
and eax, 1
nop dword [rax]
or edx, 0x49
mov dword [rbx + 0x10], edx
jmp 0x21007fce0
call rax
jmp 0x21007fa03
mov eax, dword [rsi + 0x80]
cmp eax, 0xffffffff
je 0x21007fee3
test al, 0x10
jne 0x21007fb2f
movzx eax, byte [0x210273880]
test byte [rsi + 0x11c], 0x10
jne 0x21007fb36
cmp byte [rsi + 0x1cd], 0
je 0x2100800f0
mov ecx, dword [rsi + 0x1b0]
cmp ecx, 0xc3
je 0x2100800f0
and dh, 0xf0
je 0x21007ff42
jmp 0x21007fb4e
or edx, 0x124
mov dword [rbx + 0x10], edx
jmp 0x21007fca7
mov ecx, dword [rsi + 0x1b0]
cmp ecx, 0xc3
je 0x21007fb48
mov edx, dword [rsi + 0x1c8]
mov dword [rbx + 0x20], ecx
and eax, 1
mov dword [rbx], ecx
mov dword [rbx + 0x10], edx
mov qword [rbx + 0x28], 0
jmp 0x21007fb51
or dh, 0x80
mov dword [rbx + 0x10], edx
mov eax, dword [rsi + 0x118]
test al, 0x50
jne 0x21007fea0
xor edx, edx
mov rcx, r12
call method.path_conv.get_nt_native_path__UNICODE_STRING_
mov rdi, rax
movzx eax, word [0x210298320]
movzx edx, word [rdi]
cmp ax, dx
jae 0x2100800c8
movzx ecx, dx
movzx edx, ax
sub rcx, rdx
add rcx, qword [rdi + 8]
lea r13, [rsp + 0x110]
mov qword [rsp + 0x118], rcx
mov r8d, 1
lea rdx, [0x210298320]
mov rcx, r13
mov word [rsp + 0x112], ax
mov word [rsp + 0x110], ax
call sym.RtlEqualUnicodeString
test al, al
je 0x2100801c0
mov ecx, dword [rsi + 0x118]
or ecx, 0x10
mov dword [rsi + 0x118], ecx
test ecx, 0x150
je 0x2100800d8
movzx eax, byte [0x210273880]
mov edx, dword [rbx + 0x10]
and eax, 1
jmp 0x21007fcd7
mov dword [rsp + 0x20], 0x1c
lea rdx, [rsp + 0xe0]
mov r9d, 0x10
lea r8, [rsp + 0xf0]
call sym.NtQueryInformationFile
test eax, eax
jne 0x2100800b0
mov rdx, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0xd0]
lea rax, [rdx + 0x7fe]
add rdx, 0x3ff
cmovns rax, rdx
sar rax, 0xa
mov qword [rbx + 0x68], rax
jmp 0x21007fad8
mov eax, dword [rsi + 0x108]
lea r9, [rbx + 0x18]
xor r8d, r8d
mov rdx, r12
mov dword [rbx + 0x10], 0xa1ff
mov qword [rbx + 0x28], rax
lea rax, [rbx + 0x1c]
mov qword [rsp + 0x20], rax
call sym.get_file_attribute_void__path_conv__unsigned_int__unsigned_int__unsigned_int_
movzx eax, byte [0x210273880]
and eax, 1
jmp 0x21007fb51
mov rdx, qword [rbx + 0x28]
mov rcx, qword [rsp + 0xd0]
jmp 0x21007fc40
mov rcx, qword [rdi + 8]
mov eax, edx
jmp 0x21007ffa1
mov eax, dword [sym.msys_2.0.dll__check_for_executable]
test eax, eax
jne 0x210080100
mov ecx, dword [rsi + 0x118]
jmp 0x21007fff9
and dl, 0x6d
mov dword [rbx + 0x10], edx
jmp 0x21007fb36
test byte [rsi + 0x98], 0x10
mov rdx, qword [rsp + 0xd0]
mov dword [rsp + 0x110], 0x30
mov eax, dword [rsi + 0x84]
jne 0x21008031e
mov qword [rsp + 0x118], rdx
mov dword [rsp + 0x128], eax
lea rax, [0x210298360]
mov dword [rsp + 0x28], 0x4020
lea rbp, [rsp + 0x100]
lea rcx, [rsp + 0xd0]
mov edx, 0x100001
mov dword [rsp + 0x20], 7
mov r9, rbp
lea r8, [rsp + 0x110]
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x130], 0
mov qword [rsp + 0x138], 0
call sym.NtOpenFile
mov edi, eax
test eax, eax
jns 0x210080273
movzx eax, byte [0x210273880]
and eax, 1
jne 0x210080340
mov ecx, dword [rsi + 0x118]
mov edx, dword [rbx + 0x10]
jmp 0x21007fcd7
movzx ecx, word [0x210298340]
movzx eax, word [rdi]
mov rdx, qword [rdi + 8]
cmp cx, ax
jae 0x2100801df
movzx r8d, cx
sub rax, r8
add rdx, rax
mov eax, ecx
mov qword [rsp + 0x118], rdx
mov r8d, 1
lea rdx, [0x210298340]
mov rcx, r13
mov word [rsp + 0x112], ax
mov word [rsp + 0x110], ax
call sym.RtlEqualUnicodeString
test al, al
jne 0x21007ffde
movzx ecx, word [0x2102982e0]
movzx eax, word [rdi]
mov rdx, qword [rdi + 8]
cmp cx, ax
jae 0x210080233
movzx r8d, cx
sub rax, r8
add rdx, rax
mov eax, ecx
mov qword [rsp + 0x118], rdx
mov r8d, 1
lea rdx, [0x2102982e0]
mov rcx, r13
mov word [rsp + 0x112], ax
mov word [rsp + 0x110], ax
call sym.RtlEqualUnicodeString
test al, al
jne 0x21007ffde
mov ecx, dword [rsi + 0x118]
jmp 0x21007ffed
lea rax, [rsp + 0xd8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xcd]
mov rcx, qword [rsp + 0xd0]
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x30], 3
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0xd8], 0
call sym.NtReadFile
mov edi, eax
test eax, eax
js 0x210080381
cmp dword [rsp + 0x108], 1
jle 0x210080302
movzx eax, byte [rsp + 0xcd]
cmp al, 0x23
je 0x2100803c5
cmp al, 0x3a
je 0x2100803e3
cmp al, 0x4d
jne 0x210080302
cmp byte [rsp + 0xce], 0x5a
je 0x2100803d3
mov rcx, qword [rsp + 0xd0]
call sym.NtClose
movzx eax, byte [0x210273880]
and eax, 1
jmp 0x2100801ab
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x118], 0
mov dword [rsp + 0x128], eax
call method.path_conv.get_nt_native_path__UNICODE_STRING_
jmp 0x21008013c
xor edx, edx
mov rcx, r12
call method.path_conv.get_nt_native_path__UNICODE_STRING_
mov dword [rsp + 0x20], edi
mov edx, 0x40
lea r9, [0x21028c440]
mov qword [rsp + 0x28], rax
lea r8, str.int_fhandler_base::fstat_helper_stat_
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
movzx eax, byte [0x210273880]
and eax, 1
jmp 0x2100801ab
test byte [0x210273880], 1
je 0x210080302
xor edx, edx
mov rcx, r12
call method.path_conv.get_nt_native_path__UNICODE_STRING_
mov dword [rsp + 0x20], edi
mov edx, 0x40
lea r9, str._y__NtReadFile__S_
mov qword [rsp + 0x28], rax
lea r8, str.int_fhandler_base::fstat_helper_stat_
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x210080302
cmp byte [rsp + 0xce], 0x21
jne 0x210080302
or dword [rsi + 0x118], 0x10
or dword [rbx + 0x10], 0x49
jmp 0x210080302
cmp byte [rsp + 0xce], 0xa
jne 0x210080302
jmp 0x2100803d3