Function at 0x7fff25dca940
Capabilities:
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
mov r15, r9
mov r12, r8
mov dword [rsp + 0x60], 0xc000000d
xor r13d, r13d
mov edi, r13d
mov qword [rsp + 0x68], r13
lea esi, [r13 + 0x60]
mov dword [rax + 0x10], esi
or qword [rax - 0x80], 0xffffffffffffffff
mov ebx, r13d
mov qword [rsp + 0x70], rbx
test edx, edx
jne 0x7fff25e01668
xor r9d, r9d
xor r8d, r8d
lea rdx, [rax - 0x68]
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
nop dword [rax + rax]
test al, al
je 0x7fff25e0166f
mov dword [rsp + 0xa0], 0x30
mov qword [rsp + 0xa8], r13
mov dword [rsp + 0xb8], 0x40
lea rax, [rsp + 0x90]
mov qword [rsp + 0xb0], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xc0], xmm0
mov dword [rsp + 0x50], r13d
mov qword [rsp + 0x48], r13
mov dword [rsp + 0x40], 0x200020
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x80]
lea r8, [rsp + 0xa0]
mov edx, 0x100080
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntdll.dll_NtCreateFile]
nop dword [rax + rax]
mov edx, eax
mov dword [rsp + 0x60], eax
test eax, eax
jne 0x7fff25dcabd7
xor r8d, r8d
mov rcx, qword [rsp + 0x78]
call fcn.7fff25dcafc8
mov rbx, rax
mov qword [rsp + 0x70], rax
mov r14, rax
test rax, rax
je 0x7fff25dcabb7
mov qword [rsp + 0x78], r13
test rdi, rdi
jne 0x7fff25dcab81
movsxd r8, esi
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rdi, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x7fff25dcabc9
mov dword [rsp + 0x20], 0x2e
mov r9d, dword [rsp + 0x108]
mov r8, rax
lea rdx, [rsp + 0x80]
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rbx]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
mov edx, eax
mov dword [rsp + 0x60], eax
mov esi, dword [rdi]
mov dword [rsp + 0x108], esi
cmp eax, 0x80000005
je 0x7fff25dcaa71
test eax, eax
jne 0x7fff25dcabd7
cmp qword [rsp + 0x88], r13
je 0x7fff25dcabbe
mov qword [rbx + 8], rdi
mov rax, qword [rsp + 0x88]
mov dword [rbx + 0x18], eax
mov rax, qword [rsp + 0x88]
mov dword [rbx + 0x1c], eax
mov qword [rsp + 0x68], r13
mov rsi, qword [rbx + 8]
lea r8, [rsp + 0x68]
mov rdx, qword [rsi + 0x10]
mov rcx, qword [rbx]
call fcn.7fff25dcae4c
mov edx, eax
mov dword [rsp + 0x60], eax
mov rdi, qword [rsp + 0x68]
test eax, eax
js 0x7fff25dcabd7
mov r9, r15
mov r8, r12
lea rdx, [rsi + 8]
mov rcx, rdi
call fcn.7fff25dcad78
mov edx, eax
mov dword [rsp + 0x60], eax
test eax, eax
js 0x7fff25dcabd7
mov rcx, qword [rbx + 8]
cmp dword [rsi + 8], r13d
jbe 0x7fff25dcabad
mov eax, dword [rsi + 8]
add rcx, 8
add rcx, rax
mov qword [r14 + 0x10], rcx
jmp 0x7fff25dcabd7
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0x68]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov esi, dword [rsp + 0x108]
jmp 0x7fff25dcaa7a
mov rax, qword [rsp + 0x88]
jmp 0x7fff25dcab78
mov edx, 0xc000009a
jmp 0x7fff25dcabc3
mov edx, 0xc0000011
mov dword [rsp + 0x60], edx
jmp 0x7fff25dcabd7
mov edx, 0xc000009a
mov dword [rsp + 0x60], edx
mov rbx, qword [rsp + 0x70]
cmp word [rsp + 0x90], r13w
je 0x7fff25dcac13
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0x98]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov edx, dword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
test rdi, rdi
je 0x7fff25dcac41
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0x68]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov edx, dword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
test edx, edx
jne 0x7fff25dcac66
mov rax, rbx
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, edx
call fcn.7fff25d6b370
mov rcx, qword [rsp + 0x78]
cmp rcx, 0xffffffffffffffff
je 0x7fff25dcac84
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
test rbx, rbx
je 0x7fff25dcac91
mov rcx, rbx
call sym.KERNELBASE.dll_FindClose
or rbx, 0xffffffffffffffff
jmp 0x7fff25dcac45
mov ebx, 0x51647c12
movabs byte [0xaa76edd98251d711], al
out dx, al
xor ch, byte [0x7fff4aa6cff7]
test dword [rbx + rbp*4], ebx
push rsp
xor ecx, esi
sub dword [rax + riz + 0x6a085f4a], 0xc7df5a8e
ret
xchg dword [rsi - 0x7e6dd34f], ebx
xor byte [rdx + 0x652c9b53], ch
stosb byte [rdi], al
push rbx
wait
sub al, 0x65
fnsave dword [0x7fffa2965a88]
sbb al, 0x1e
ror dword [rbx], 0xbd
enter 0x7d4e, 0x41
in eax, 7
nop
mov word [rsi + 0x68], es
shl byte [rdi - 0x48659844], 0x8f
xchg edx, eax
adc ch, byte [rbx - 0x40]
xchg byte [rdi - 0x7b5c8511], ch
jmp 0x7fff25e0162c