Function at 0x180019da0
Capabilities:
Get file attributes

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x120
mov rax, qword [0x18009a918]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov r13, r8
mov r12, rdx
mov qword [rsp + 0x90], rdx
mov qword [rsp + 0x98], r8
test rcx, rcx
je 0x18001a43e
cmp qword [rcx + 8], 0
je 0x18001a43e
test rdx, rdx
jne 0x180019dfe
mov eax, 0xc00000f0
jmp 0x18001a443
test r13, r13
jne 0x180019e0d
mov eax, 0xc00000f1
jmp 0x18001a443
xorps xmm0, xmm0
movups xmmword [rsp + 0x100], xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0xc0], xmm1
movups xmmword [rsp + 0xd0], xmm1
movups xmmword [rsp + 0xe0], xmm1
xor esi, esi
mov qword [rsp + 0xf8], rsi
mov dword [rsp + 0xf0], esi
mov qword [rsp + 0xb8], 0xffffffffffffffff
mov qword [rsp + 0x68], rsi
mov r15d, esi
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], rsi
mov edi, esi
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0xb0], rsi
mov dword [rsp + 0x60], esi
xor r8d, r8d
lea rdx, [rsp + 0x68]
call fcn.18001e910
mov ebx, eax
mov dword [rsp + 0x60], eax
test eax, eax
js 0x180019eb5
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0x68]
call fcn.180024960
mov dword [rsp + 0x60], eax
test eax, eax
jns 0x180019ec1
mov ebx, 0xc00000e5
mov dword [rsp + 0x60], ebx
lea r14, [0x180090f38]
jmp 0x18001a2d5
mov dword [rsp + 0xc0], 0x30
mov qword [rsp + 0xc8], rsi
mov dword [rsp + 0xd8], 0x40
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xd0], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xe0], xmm0
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x40], 0x200000
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x100]
lea r8, [rsp + 0xc0]
mov edx, 0x60081
lea rcx, [rsp + 0xb8]
mov rax, qword [0x18009b478]
call qword [0x18007d538]
mov ebx, eax
mov dword [rsp + 0x60], eax
test eax, eax
jns 0x180019fb0
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x180019eb5
test byte [rcx + 0x1c], 1
je 0x180019eb5
cmp byte [rcx + 0x19], 2
jb 0x180019eb5
mov edx, 0x17
mov dword [rsp + 0x20], ebx
lea r9, str.ZwCreateFile_through_trufos
lea r8, [0x180091008]
mov rcx, qword [rcx + 0x10]
call fcn.1800012d0
lea r14, [0x180090f38]
jmp 0x18001a2d5
cmp byte [0x18009b380], 0
je 0x180019feb
mov eax, 0x3dd
lea r14, [0x180090f38]
mov qword [rsp + 0x28], r14
mov word [rsp + 0x20], ax
xor r9d, r9d
mov edx, 0x208
mov r8d, 0x4843573a
lea rcx, [0x18009cc40]
call fcn.18004b960
jmp 0x18001a00e
xor edx, edx
mov r8d, 0x208
mov rcx, qword [0x18009ccf0]
mov rax, qword [0x18009b430]
call qword [0x18007d538]
lea r14, [0x180090f38]
mov qword [rsp + 0xa8], rax
test rax, rax
jne 0x18001a029
mov ebx, 0xc000009a
mov dword [rsp + 0x60], ebx
jmp 0x18001a2d5
lea rcx, [0x180090a08]
call fcn.18003b600
mov rdi, rax
mov qword [rsp + 0x78], rax
test rax, rax
jne 0x18001a050
mov ebx, 0xc000009a
mov dword [rsp + 0x60], ebx
jmp 0x18001a2d5
mov esi, 0x4000
mov dword [rsp + 0x70], esi
cmp byte [0x18009b380], 0
je 0x18001a08a
mov eax, 0x3ee
mov qword [rsp + 0x28], r14
mov word [rsp + 0x20], ax
xor r9d, r9d
mov edx, esi
mov r8d, 0x4d54533a
lea rcx, [0x18009cc40]
call fcn.18004b960
jmp 0x18001a0a3
xor edx, edx
mov r8, rsi
mov rcx, qword [0x18009ccf0]
mov rax, qword [0x18009b430]
call qword [0x18007d538]
mov qword [rsp + 0xa0], rax
test rax, rax
je 0x18001a2ca
mov dword [rsp + 0x60], 0x80000005
nop dword [rax]
mov dword [rsp + 0x20], 0x16
mov r9d, esi
mov r8, rax
lea rdx, [rsp + 0x100]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov ebx, eax
mov dword [rsp + 0x60], eax
cmp eax, 0x80000005
jne 0x18001a1bc
mov r8, qword [rsp + 0xa0]
test r8, r8
je 0x18001a152
cmp byte [0x18009b380], 0
je 0x18001a132
mov r9d, 0x401
mov qword [rsp + 0x20], r14
mov r8d, 0x4d54533a
lea rdx, [rsp + 0xa0]
lea rcx, [0x18009cc40]
call fcn.18004be40
jmp 0x18001a148
xor edx, edx
mov rcx, qword [0x18009ccf0]
mov rax, qword [0x18009b440]
call qword [0x18007d538]
xor eax, eax
mov qword [rsp + 0xa0], rax
add esi, 0x4000
mov dword [rsp + 0x70], esi
cmp byte [0x18009b380], 0
je 0x18001a18d
mov qword [rsp + 0x28], r14
mov eax, 0x403
mov word [rsp + 0x20], ax
xor r9d, r9d
mov r8d, 0x4d54533a
mov edx, esi
lea rcx, [0x18009cc40]
call fcn.18004b960
jmp 0x18001a1a6
mov r8d, esi
xor edx, edx
mov rcx, qword [0x18009ccf0]
mov rax, qword [0x18009b430]
call qword [0x18007d538]
mov qword [rsp + 0xa0], rax
test rax, rax
je 0x18001a2ca
jmp 0x18001a0c0
test eax, eax
js 0x18001a2d3
cmp qword [rsp + 0x108], 0
jne 0x18001a1ec
xor esi, esi
mov qword [r12], rsi
mov dword [r13], esi
mov rcx, rdi
call fcn.18003b630
mov ebx, esi
mov dword [rsp + 0x60], ebx
jmp 0x18001a2d5
mov rbx, qword [rsp + 0xa0]
mov qword [rsp + 0x88], rbx
nop dword [rax]
mov r8d, dword [rbx + 4]
lea rdx, [rbx + 0x18]
mov rcx, qword [rsp + 0xa8]
call fcn.18005f360
mov esi, dword [rbx + 4]
shr esi, 1
mov rax, qword [rsp + 0xa8]
xor edx, edx
mov word [rax + rsi*2], dx
lea rdx, str.::_DATA
mov rcx, qword [rsp + 0xa8]
call fcn.180063b60
test eax, eax
je 0x18001a2a2
cmp esi, 6
jbe 0x18001a279
lea eax, [rsi - 6]
lea rsi, [rax + rax]
mov rcx, qword [rsp + 0xa8]
add rcx, rsi
lea rdx, str.:_DATA
call fcn.180063b60
test eax, eax
jne 0x18001a279
mov rax, qword [rsp + 0xa8]
xor ecx, ecx
mov word [rsi + rax], cx
add dword [rbx + 4], 0xfffffff4
mov r8d, dword [rbx + 4]
add r8d, 2
mov r9d, 1
mov rdx, qword [rsp + 0xa8]
mov rcx, rdi
call fcn.18003b690
inc r15d
mov dword [rsp + 0x80], r15d
mov eax, dword [rbx]
test eax, eax
jne 0x18001a2ba
xor esi, esi
mov ebx, esi
mov dword [rsp + 0x60], ebx
mov qword [r12], rdi
mov dword [r13], r15d
jmp 0x18001a2d5
add rbx, rax
mov qword [rsp + 0x88], rbx
jmp 0x18001a200
mov ebx, 0xc000009a
mov dword [rsp + 0x60], ebx
xor esi, esi
test ebx, ebx
jns 0x18001a322
mov qword [r12], rsi
mov dword [r13], esi
test rdi, rdi
je 0x18001a322
mov rax, qword [rdi + 8]
test rax, rax
je 0x18001a2fc
nop
mov rdi, rax
mov rax, qword [rax + 8]
test rax, rax
jne 0x18001a2f0
mov rsi, qword [rdi]
test rsi, rsi
je 0x18001a31a
mov rcx, rdi
mov rdi, rsi
call fcn.18003b850
mov rax, qword [rsi]
mov rsi, rax
test rax, rax
jne 0x18001a304
mov rcx, rdi
call fcn.18003b850
mov rcx, qword [rsp + 0xb8]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x18001a341
mov rax, qword [0x18009b4c8]
call qword [0x18007d538]
mov edx, 0x46d
mov r8, r14
lea rcx, [rsp + 0xf0]
call fcn.18004a4f0
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x18001a368
mov rcx, rax
call fcn.18001ee30
cmp qword [rsp + 0xb0], 0
je 0x18001a388
mov edx, 0x476
mov r8, r14
lea rcx, [rsp + 0xb0]
call fcn.18004a470
mov r8, qword [rsp + 0xa0]
test r8, r8
je 0x18001a3e5
cmp byte [0x18009b380], 0
je 0x18001a3c5
mov r9d, 0x47b
mov qword [rsp + 0x20], r14
mov r8d, 0x4d54533a
lea rdx, [rsp + 0xa0]
lea rcx, [0x18009cc40]
call fcn.18004be40
jmp 0x18001a3db
xor edx, edx
mov rcx, qword [0x18009ccf0]
mov rax, qword [0x18009b440]
call qword [0x18007d538]
xor eax, eax
mov qword [rsp + 0xa0], rax
mov r8, qword [rsp + 0xa8]
test r8, r8
je 0x18001a43a
cmp byte [0x18009b380], 0
je 0x18001a424
mov r9d, 0x480
mov qword [rsp + 0x20], r14
mov r8d, 0x4843573a
lea rdx, [rsp + 0xa8]
lea rcx, [0x18009cc40]
call fcn.18004be40
mov eax, ebx
jmp 0x18001a443
xor edx, edx
mov rcx, qword [0x18009ccf0]
mov rax, qword [0x18009b440]
call qword [0x18007d538]
mov eax, ebx
jmp 0x18001a443
mov eax, 0xc00000ef
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.18005e1d0
add rsp, 0x120
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret