Function at 0x7fff25db7520
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xd0
mov rax, qword gs:[0x60]
lea r9, [rbp - 0x39]
xor r12d, r12d
lea rdx, [rbp - 0x19]
xor r8d, r8d
mov r14, rcx
mov dil, r12b
mov r15, qword [rax + 0x2c8]
movabs rax, 0x100000000
and r15, rax
call qword [sym.imp.ntdll.dll_RtlDosPathNameToRelativeNtPathName_U]
nop dword [rax + rax]
test al, al
je 0x7fff25dfa582
mov rsi, qword [rbp - 0x11]
cmp word [rbp - 0x39], r12w
jne 0x7fff25dfa5fc
mov eax, r12d
mov qword [rbp - 0x29], rax
mov qword [rbp - 1], rax
lea r9, [rbp - 0x49]
lea rax, [rbp - 0x19]
mov dword [rsp + 0x28], 0x204021
xorps xmm0, xmm0
mov qword [rbp + 7], rax
lea r8, [rbp - 9]
mov dword [rbp - 9], 0x30
mov edx, 0x110080
mov dword [rbp + 0xf], 0x40
lea rcx, [rbp - 0x69]
mov dword [rsp + 0x20], 7
movdqu xmmword [rbp + 0x17], xmm0
call qword [sym.imp.ntdll.dll_NtOpenFile]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x7fff25db770c
mov rcx, qword [rbp - 0x69]
lea r8, [rbp - 0x51]
mov r13d, 8
mov dword [rsp + 0x20], 0x23
mov r9d, r13d
lea rdx, [rbp - 0x49]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x7fff25dfa67d
mov rax, qword [rbp - 0x51]
bt eax, 0xa
jb 0x7fff25dfa6d9
lea rcx, [rbp - 0x39]
call qword [sym.imp.ntdll.dll_RtlReleaseRelativeName]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
test r15, r15
jne 0x7fff25db76de
mov rcx, qword [rbp - 0x69]
lea r9d, [r15 + 4]
lea r8, [rbp + 0x77]
mov dword [rbp + 0x77], 7
lea rdx, [rbp - 0x49]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
mov ebx, eax
mov eax, 0x80000000
lea ecx, [rbx + rax]
test eax, ecx
je 0x7fff25db76d6
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
test ebx, ebx
js 0x7fff25db7746
mov eax, 1
mov rbx, qword [rsp + 0x110]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp ebx, 0xc0000121
je 0x7fff25db769d
mov rcx, qword [rbp - 0x69]
lea r8, [rbp + 0x6f]
mov r9d, 1
mov byte [rbp + 0x6f], 1
lea rdx, [rbp - 0x49]
mov dword [rsp + 0x20], 0xd
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
mov ebx, eax
jmp 0x7fff25db769d
cmp ebx, 0xc000000d
je 0x7fff25dfa60e
lea rcx, [rbp - 0x39]
call qword [sym.imp.ntdll.dll_RtlReleaseRelativeName]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov ecx, ebx
call fcn.7fff25d6b370
xor eax, eax
jmp 0x7fff25db76ba
mov ecx, 3
jmp 0x7fff25dfa5ea
lea rcx, [rbp - 0x39]
call qword [sym.imp.ntdll.dll_RtlReleaseRelativeName]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov ecx, 8
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
nop
jmp 0x7fff25db774d
movups xmm0, xmmword [rbp - 0x39]
mov rax, qword [rbp - 0x29]
movdqu xmmword [rbp - 0x19], xmm0
jmp 0x7fff25db7597
mov dword [rsp + 0x28], 0x4021
lea r9, [rbp - 0x49]
lea r8, [rbp - 9]
mov dword [rsp + 0x20], 7
mov edx, 0x110000
lea rcx, [rbp - 0x69]
call qword [sym.imp.ntdll.dll_NtOpenFile]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jmp 0x7fff25dfa672
mov dword [rsp + 0x28], 0x204021
lea r9, [rbp - 0x49]
lea r8, [rbp - 9]
mov dword [rsp + 0x20], 7
mov edx, 0x110000
lea rcx, [rbp - 0x69]
call qword [sym.imp.ntdll.dll_NtOpenFile]
nop dword [rax + rax]
mov ebx, eax
test ebx, ebx
jns 0x7fff25db7631
jmp 0x7fff25db7718
cmp ebx, 0xc0000002
je 0x7fff25db7631
cmp ebx, 0xc000000d
je 0x7fff25db7631
lea rcx, [rbp - 0x39]
call qword [sym.imp.ntdll.dll_RtlReleaseRelativeName]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
nop
jmp 0x7fff25db7746
mov ecx, dword [rbp - 0x4d]
cmp ecx, 0xa0000003
jne 0x7fff25dfa9cf
mov rcx, qword gs:[0x60]
mov edi, 0x4000
mov edx, dword [0x7fff25fd0c80]
mov r8d, edi
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x7fff25dfa75d
lea rcx, [rbp - 0x39]
call qword [sym.imp.ntdll.dll_RtlReleaseRelativeName]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov ecx, r13d
jmp 0x7fff25dfa5ea
mov rcx, qword [rbp - 0x69]
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x38], r12
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov edx, 0x900a8
mov qword [rsp + 0x20], rbx
call sym.KERNELBASE.dll_DeviceIoControl
test eax, eax
je 0x7fff25dfa9ab
movzx ecx, word [rbx + 0xa]
lea rdx, [rbx + 0x10]
mov word [rbp - 0x5f], cx
mov r13d, 0x5c
mov word [rbp - 0x61], cx
movzx eax, word [rbx + 8]
add rdx, rax
mov qword [rbp - 0x59], rdx
cmp cx, 0x60
je 0x7fff25dfa7cd
cmp cx, 0x62
jne 0x7fff25dfa9ab
cmp word [rax + rbx + 0x70], r13w
jne 0x7fff25dfa9ab
cmp word [rdx], r13w
jne 0x7fff25dfa9ab
cmp word [rax + rbx + 0x12], 0x3f
je 0x7fff25dfa7eb
cmp word [rax + rbx + 0x12], r13w
jne 0x7fff25dfa9ab
cmp word [rax + rbx + 0x14], 0x3f
jne 0x7fff25dfa9ab
cmp word [rax + rbx + 0x16], r13w
jne 0x7fff25dfa9ab
cmp word [rax + rbx + 0x18], 0x56
jne 0x7fff25dfa9ab
cmp word [rax + rbx + 0x1a], 0x6f
jne 0x7fff25dfa9ab
cmp word [rax + rbx + 0x1c], 0x6c
jne 0x7fff25dfa9ab
cmp word [rax + rbx + 0x1e], 0x75
jne 0x7fff25dfa9ab
cmp word [rax + rbx + 0x20], 0x6d
jne 0x7fff25dfa9ab
cmp word [rax + rbx + 0x22], 0x65
jne 0x7fff25dfa9ab
cmp word [rax + rbx + 0x24], 0x7b
jne 0x7fff25dfa9ab
mov cx, 0x2d
cmp word [rax + rbx + 0x36], cx
jne 0x7fff25dfa9ab
cmp word [rax + rbx + 0x40], cx
jne 0x7fff25dfa9ab
cmp word [rax + rbx + 0x4a], cx
jne 0x7fff25dfa9ab
cmp word [rax + rbx + 0x54], cx
jne 0x7fff25dfa9ab
cmp word [rax + rbx + 0x6e], 0x7d
jne 0x7fff25dfa9ab
mov rdx, r14
lea rcx, [rbp - 0x61]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jns 0x7fff25dfa90f
lea rcx, [rbp - 0x39]
call qword [sym.imp.ntdll.dll_RtlReleaseRelativeName]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov ecx, edi
jmp 0x7fff25db7748
mov rcx, qword gs:[0x60]
movzx r8d, word [rbp - 0x61]
mov edx, dword [0x7fff25fd0c80]
add r8, 4
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x7fff25dfa589
movzx r8d, word [rbp - 0x61]
mov rcx, rax
mov rdx, qword [rbp - 0x59]
call sub.ntdll.dll_memcpy
movzx eax, word [rbp - 0x61]
shr rax, 1
mov word [rdi + rax*2], r12w
movzx ecx, word [rbp - 0x61]
mov rax, qword [rbp - 0x59]
shr rcx, 1
cmp word [rax + rcx*2 - 2], r13w
je 0x7fff25dfa985
mov word [rdi + rcx*2], r13w
movzx eax, word [rbp - 0x61]
shr rax, 1
mov word [rdi + rax*2 + 2], r12w
mov rcx, rdi
call sym.KERNELBASE.dll_DeleteVolumeMountPointW
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rax, qword [rbp - 0x51]
jmp 0x7fff25dfa9df
cmp ecx, 0xa000000c
je 0x7fff25dfa9df
cmp ecx, 0xa0000019
jne 0x7fff25dfa9e2
mov dil, 1
bt eax, 0xa
jae 0x7fff25db7631
test dil, dil
jne 0x7fff25db7631
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
lea r9, [rbp - 0x49]
mov dword [rsp + 0x28], 0x4021
lea r8, [rbp - 9]
mov dword [rsp + 0x20], 7
mov edx, 0x110000
lea rcx, [rbp - 0x69]
call qword [sym.imp.ntdll.dll_NtOpenFile]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x7fff25db7631
lea ecx, [rax + 0x3ffffd8a]
test ecx, 0xfffffffc
jne 0x7fff25dfa670
cmp eax, 0xc0000277
je 0x7fff25dfa670
jmp 0x7fff25dfa641