Function at 0x140055fa0
Capabilities:
Get file attributes

Disassembly:
push rbp
push r12
push r13
push r14
lea rbp, [rsp - 0x3f]
sub rsp, 0xb8
mov rax, qword [0x1400f54e0]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r12d, r8d
mov r14, rdx
mov r13, rcx
cmp rcx, 0x1000
jb 0x140056362
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x140056362
test r8d, 0xfffffff0
jne 0x14005635b
mov eax, r8d
shr eax, 1
xor eax, r8d
test al, 1
je 0x14005635b
mov rcx, rdx
mov qword [rsp + 0xa8], rdi
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
jne 0x140056354
lea rax, [rbp - 0x31]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x25]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
test eax, eax
je 0x140056074
cmp dword [rbp - 0x31], 1
jne 0x140056354
xor edi, edi
lea r8, [rbp - 0x29]
mov dword [rsp + 0x30], edi
lea rdx, [rbp - 0x2d]
mov qword [rsp + 0x28], rdi
xor r9d, r9d
mov rcx, r14
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
test eax, eax
jne 0x140056086
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14005db40
jmp 0x1400562e0
mov eax, dword [rbp - 0x2d]
test al, 1
jne 0x140056354
test al, 2
jne 0x140056354
cmp dword [rbp - 0x29], 1
ja 0x140056354
lea rdx, [0x1400a1620]
mov qword [rsp + 0xb0], rsi
mov ecx, 0x98
call fcn.140041920
mov rsi, rax
test rax, rax
jne 0x1400560cc
lea eax, [rsi - 8]
jmp 0x1400562d8
mov qword [rsp + 0xf8], rbx
lea rcx, [rax + 0x60]
mov qword [rsp + 0xa0], r15
call fcn.140051a00
mov ebx, eax
test eax, eax
js 0x1400562be
mov edx, 1
xor r9d, r9d
mov r8d, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rsi + 0x38], rax
test rax, rax
je 0x1400562b5
movzx eax, r12b
mov dword [rsi], 0x19570528
and al, 1
mov qword [rsi + 8], r14
mov byte [rsi + 0x10], al
lea rcx, [rbp - 0x11]
mov eax, r12d
mov qword [rsi + 0x58], rdi
shr eax, 3
xor edx, edx
and al, 1
mov qword [rbp - 0x39], 0xffffffffffffffff
mov byte [rsi + 0x11], al
mov r15d, r12d
shr r15d, 2
movzx eax, r15b
lea r8d, [rdx + 0x28]
and al, 1
mov byte [rsi + 0x16], al
call sym.vkat.exe_nocrt_memset
cmp qword [0x140105c38], rdi
je 0x1400561ac
xor edx, edx
lea rcx, [rbp - 0x21]
lea r8d, [rdx + 0x10]
call sym.vkat.exe_nocrt_memset
xor edx, edx
lea rcx, [rbp - 0x11]
lea r8d, [rdx + 0x28]
call sym.vkat.exe_nocrt_memset
mov rcx, qword [rsi + 8]
lea r8, [rbp - 0x11]
mov r9d, 0x28
mov dword [rsp + 0x20], 0x18
lea rdx, [rbp - 0x21]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
js 0x1400561ac
and r15d, 1
jmp 0x140056246
cmp byte [rsi + 0x10], 0
mov eax, 0x80000000
mov edi, 0x40000080
cmovne edi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 0
lea r9, [rbp - 0x39]
and r15d, 1
mov rcx, rax
mov dword [rsp + 0x28], r15d
mov r8, rbx
mov rdx, r14
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x140056264
mov rax, qword [rbp - 0x39]
lea rcx, [rbp - 0x21]
xor edx, edx
mov qword [rsi + 8], rax
lea r8d, [rdx + 0x10]
call sym.vkat.exe_nocrt_memset
xor edx, edx
lea rcx, [rbp - 0x11]
lea r8d, [rdx + 0x28]
call sym.vkat.exe_nocrt_memset
mov rcx, qword [rsi + 8]
lea r8, [rbp - 0x11]
mov r9d, 0x28
mov dword [rsp + 0x20], 0x18
lea rdx, [rbp - 0x21]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
js 0x140056253
mov byte [rsi + 0x11], 0
cmp qword [rbp - 0x39], 0xffffffffffffffff
jne 0x14005630a
jmp 0x14005626c
mov rcx, qword [rbp - 0x39]
mov ebx, 0xffffffda
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14005629b
mov qword [rbp - 0x39], 0xffffffffffffffff
mov rax, qword [0x140105c38]
mov r8d, r15d
mov edx, 1
mov rcx, r14
call qword [case.0x140035d81.0]
test eax, eax
jne 0x140056303
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14005db40
mov ebx, eax
test eax, eax
jns 0x140056303
mov rcx, qword [rbp - 0x39]
cmp rcx, 0xffffffffffffffff
je 0x1400562ab
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsi + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsi + 0x60]
call fcn.140051860
mov rcx, rsi
call fcn.140041950
mov eax, ebx
mov rbx, qword [rsp + 0xf8]
mov r15, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xa8]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140001270
add rsp, 0xb8
pop r14
pop r13
pop r12
pop rbp
ret
cmp qword [rbp - 0x39], 0xffffffffffffffff
je 0x140056349
test r12b, 8
jne 0x140056349
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp r14, rax
je 0x140056349
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp r14, rax
je 0x140056349
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp r14, rax
je 0x140056349
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r13], rsi
xor eax, eax
jmp 0x1400562c8
mov eax, 0xfffffffc
jmp 0x1400562e0
mov eax, 0xfffffffe
jmp 0x1400562e8
mov eax, 0xfffffffa
jmp 0x1400562e8