Function at 0x140027cc0
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2090]
mov eax, 0x2190
call fcn.140001110
sub rsp, rax
mov rax, qword [0x1400a0f20]
xor rax, rsp
mov qword [rbp + 0x2080], rax
mov rbx, qword [rbp + 0x20f8]
xor eax, eax
mov r13d, dword [rbp + 0x20f0]
mov r15d, r9d
mov qword [rbp - 0x78], rdx
mov rdi, r8
mov qword [rbp - 0x80], rcx
mov qword [rbp - 0x38], rbx
mov qword [rsp + 0x60], 0xffffffffffffffff
mov dword [rsp + 0x70], 0xc0000365
mov dword [rsp + 0x74], eax
mov qword [rsp + 0x78], 0xffffffffffffffd5
cmp r9d, 2
je 0x140027e9c
mov rax, qword [0x1400a98b8]
test rax, rax
je 0x140027e9c
mov qword [rbp - 0x60], rcx
xorps xmm0, xmm0
mov qword [rbp - 0x58], rdx
lea rcx, [rbp - 0x68]
lea rdx, [rbp]
mov dword [rbp - 0x68], 0x30
movdqu xmmword [rbp - 0x48], xmm0
mov dword [rbp - 0x50], 0x40
call qword [case.0x14004be35.0]
mov ecx, eax
test eax, eax
js 0x140027e1d
test dword [rbp + 0x30], 0x400
jne 0x140027e94
mov rax, qword [rbp + 0x28]
movabs r12, 0x5e6684f4b3960000
mov qword [rdi], rax
mov rcx, rbx
mov rax, qword [rbp + 0x20]
mov qword [rdi + 8], rax
imul rax, qword [rbp], 0x64
add rax, r12
mov qword [rdi + 0x28], rax
imul rax, qword [rbp + 8], 0x64
add rax, r12
mov qword [rdi + 0x10], rax
imul rax, qword [rbp + 0x10], 0x64
add rax, r12
mov qword [rdi + 0x18], rax
imul rax, qword [rbp + 0x18], 0x64
add rax, r12
mov qword [rdi + 0x20], rax
call sym.NetMonitor.exe_nocrt_strlen
mov ecx, dword [rbp + 0x30]
xor esi, esi
and ecx, 0x7fff
mov dword [rsp + 0x20], esi
shl ecx, 0x10
mov r8, rax
xor r9d, r9d
mov rdx, rbx
call fcn.1400419b0
mov r8d, r15d
mov dword [rdi + 0x30], eax
mov rdx, rdi
mov dword [rdi + 0x34], r15d
xor ecx, ecx
call fcn.140027560
jmp 0x140028543
add eax, 0x3ffffff3
cmp eax, 0x26
ja 0x140027e6a
movabs rdx, 0x4000800001
bt rdx, rax
jae 0x140027e6a
mov dword [rsp + 0x30], ecx
lea rax, [rbp]
mov qword [rsp + 0x28], 0x2078
lea rcx, [rbp - 0x68]
mov r9d, r13d
mov qword [rsp + 0x20], rax
mov r8d, r15d
mov rdx, rdi
call fcn.1400275e0
mov ebx, eax
test eax, eax
js 0x140027e81
jmp 0x140028543
cmp ecx, 0xc0000022
je 0x140027e8c
cmp ecx, 0xc0000043
je 0x140027e8c
call fcn.1400392e0
mov ebx, eax
cmp ebx, 0x34
jne 0x140028541
jmp 0x140027e94
mov dword [rsp + 0x70], 0xc0000365
mov rdx, qword [rbp - 0x78]
mov rcx, qword [rbp - 0x80]
mov r14d, dword [0x1400a0f3c]
mov ebx, 0x4020
test r14d, r14d
je 0x140027eb9
test r13b, 2
mov eax, 0x204020
cmove ebx, eax
xor esi, esi
mov qword [rbp - 0x60], rcx
mov dword [rsp + 0x50], esi
lea r9, [rsp + 0x70]
mov qword [rsp + 0x48], rsi
lea r8, [rbp - 0x68]
mov dword [rsp + 0x40], ebx
lea rcx, [rsp + 0x60]
mov qword [rbp - 0x58], rdx
xorps xmm0, xmm0
mov r12d, 1
mov dword [rbp - 0x68], 0x30
mov dword [rsp + 0x38], r12d
mov edx, 0x100080
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rsi
mov dword [rbp - 0x50], 0x40
movdqu xmmword [rbp - 0x48], xmm0
call qword [sym.imp.ntdll.dll_NtCreateFile]
cmp eax, 0xc000000d
je 0x140027f2d
cmp eax, 0xc00000f7
jne 0x140027f8a
cmp r14d, 0xffffffff
jne 0x140027f8a
bt ebx, 0x15
jae 0x140027f8a
mov dword [rsp + 0x50], esi
lea r9, [rsp + 0x70]
mov qword [rsp + 0x48], rsi
lea r8, [rbp - 0x68]
btr ebx, 0x15
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x40], ebx
mov edx, 0x100080
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ntdll.dll_NtCreateFile]
cmp eax, 0xc000000d
je 0x140027f8a
mov dword [0x1400a0f3c], esi
movabs r12, 0x5e6684f4b3960000
test eax, eax
js 0x1400281cd
mov rcx, qword [rsp + 0x60]
lea r8, [rsp + 0x68]
mov r9d, 8
mov dword [rsp + 0x20], 0x23
lea rdx, [rsp + 0x70]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jns 0x140027fd1
mov ebx, esi
mov eax, esi
mov dword [rsp + 0x6c], ebx
mov dword [rsp + 0x68], eax
jmp 0x140027fd9
mov ebx, dword [rsp + 0x6c]
mov eax, dword [rsp + 0x68]
bt eax, 0xa
jae 0x140028074
cmp ebx, 0xa000000c
je 0x140028074
test r13b, 2
jne 0x140028074
mov dword [rsp + 0x50], esi
lea r9, [rsp + 0x70]
mov qword [rsp + 0x48], rsi
lea r8, [rbp - 0x68]
mov dword [rsp + 0x40], 0x4020
lea rcx, [rbp - 0x20]
mov dword [rsp + 0x38], 1
mov edx, 0x100080
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x70], 0xc0000365
mov qword [rsp + 0x78], 0xffffffffffffffd5
call qword [sym.imp.ntdll.dll_NtCreateFile]
test eax, eax
js 0x140028070
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov r14, qword [rbp - 0x20]
mov ebx, esi
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x6c], ebx
mov dword [rsp + 0x68], esi
jmp 0x140028079
mov ebx, dword [rsp + 0x6c]
mov r14, qword [rsp + 0x60]
xor eax, eax
mov dword [rbp - 0x30], 0xc0000365
lea r8, [rbp]
mov dword [rbp - 0x2c], eax
lea rdx, [rbp - 0x30]
mov qword [rbp - 0x28], 0xffffffffffffffd5
mov rcx, r14
mov dword [rsp + 0x20], 0x12
lea r9d, [rax + 0x68]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
jne 0x1400280c9
cmp eax, 0x80000005
je 0x1400280c9
mov ecx, eax
call fcn.1400392e0
jmp 0x1400281b7
mov rax, qword [rbp + 0x30]
mov qword [rdi], rax
mov rax, qword [rbp + 0x28]
mov qword [rdi + 8], rax
imul rax, qword [rbp], 0x64
add rax, r12
mov qword [rdi + 0x28], rax
imul rax, qword [rbp + 8], 0x64
add rax, r12
mov qword [rdi + 0x10], rax
imul rax, qword [rbp + 0x10], 0x64
add rax, r12
mov qword [rdi + 0x18], rax
imul rax, qword [rbp + 0x18], 0x64
add rax, r12
mov qword [rdi + 0x20], rax
mov rax, qword [rbp - 0x38]
test rax, rax
je 0x14002811b
mov rcx, rax
call sym.NetMonitor.exe_nocrt_strlen
jmp 0x14002811e
mov rax, rsi
mov ecx, dword [rbp + 0x20]
mov r9d, ebx
mov rdx, qword [rbp - 0x38]
and ecx, 0x7fff
shl ecx, 0x10
mov r8, rax
mov dword [rsp + 0x20], esi
call fcn.1400419b0
mov dword [rdi + 0x30], eax
mov dword [rdi + 0x34], r15d
cmp r15d, 2
jne 0x1400281aa
mov rax, qword [rbp + 0x38]
lea r8, [rbp]
cmp eax, 1
mov qword [rdi + 0x38], 0xffffffffffffffff
mov ecx, 1
mov dword [rdi + 0x44], esi
cmovbe eax, ecx
mov dword [rsp + 0x20], ecx
mov dword [rdi + 0x40], eax
lea rdx, [rbp - 0x30]
mov rax, qword [rbp + 0x40]
mov r9d, 0x800
mov rcx, r14
mov qword [rdi + 0x48], rax
mov qword [rdi + 0x50], rsi
mov dword [rdi + 0x58], esi
call qword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
jne 0x1400281a4
cmp eax, 0x80000005
jne 0x1400281aa
mov eax, dword [rbp + 8]
mov dword [rdi + 0x44], eax
mov r8d, r15d
mov rdx, rdi
xor ecx, ecx
call fcn.140027560
mov rcx, qword [rsp + 0x60]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x140028242
jmp 0x140028541
cmp eax, 0xc0000024
je 0x140028207
cmp eax, 0xc0000033
je 0x140028207
cmp eax, 0xc0000022
je 0x1400281f4
cmp eax, 0xc0000043
je 0x1400281f4
mov ecx, eax
call fcn.1400392e0
mov ebx, eax
jmp 0x140028239
mov dword [rsp + 0x70], 0xc0000365
mov qword [rsp + 0x78], 0xffffffffffffffd5
jmp 0x140028242
mov dword [rsp + 0x30], eax
lea rcx, [rbp - 0x68]
lea rax, [rbp]
mov qword [rsp + 0x28], 0x2078
mov r9d, r13d
mov qword [rsp + 0x20], rax
mov r8d, r15d
mov rdx, rdi
call fcn.1400275e0
mov ebx, eax
test eax, eax
jns 0x140028543
cmp ebx, 0x34
jne 0x140028541
mov rbx, qword [rbp - 0x78]
movzx r9d, word [rbx]
mov r8, qword [rbx + 8]
mov ecx, r9d
shr rcx, 1
je 0x14002828c
cmp word [r8 + rcx*2 - 2], 0x5c
jne 0x14002826b
lea rax, [rcx - 1]
mov rcx, rax
test rax, rax
je 0x14002828c
lea rax, [r8 - 2]
lea rax, [rax + rcx*2]
movzx edx, word [rax]
cmp dx, 0x5c
je 0x140028291
cmp dx, 0x2f
je 0x14002828c
sub rax, 2
sub rcx, 1
jne 0x140028273
test rcx, rcx
je 0x1400282a5
movzx eax, cx
mov qword [rbp - 0x70], r8
add ax, ax
mov word [rbp - 0x78], ax
mov word [rbp - 0x76], ax
jmp 0x1400282b7
lea rax, [0x140064f2c]
mov dword [rbp - 0x78], 0x40002
mov qword [rbp - 0x70], rax
lea rax, [r8 + rcx*2]
mov dword [rsp + 0x50], esi
mov qword [rbp - 0x10], rax
lea r8, [rbp - 0x68]
movzx eax, word [rbx + 2]
add cx, cx
sub ax, cx
mov qword [rsp + 0x48], rsi
mov word [rbp - 0x16], ax
sub r9w, cx
mov rax, qword [rbp - 0x80]
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x40], 0x4021
xorps xmm0, xmm0
mov qword [rbp - 0x60], rax
mov edx, 0x100001
lea rax, [rbp - 0x78]
mov word [rbp - 0x18], r9w
mov qword [rbp - 0x58], rax
lea r9, [rsp + 0x70]
mov eax, 1
mov dword [rbp - 0x68], 0x30
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rsi
mov dword [rbp - 0x50], 0x40
movdqu xmmword [rbp - 0x48], xmm0
call qword [sym.imp.ntdll.dll_NtCreateFile]
mov r14d, eax
test eax, eax
js 0x1400284d4
mov rax, qword gs:[0x60]
movabs r13, 0x500000000
mov byte [rsp + 0x50], sil
mov ebx, dword [rax + 0x118]
mov rax, qword gs:[0x60]
shl rbx, 0x20
mov ecx, dword [rax + 0x11c]
mov eax, 0x25
or rbx, rcx
mov ecx, 3
cmp rbx, r13
cmovbe eax, ecx
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x48], rcx
xor r9d, r9d
mov rcx, qword [rsp + 0x60]
xor r8d, r8d
mov byte [rsp + 0x40], 1
xor edx, edx
mov dword [rsp + 0x38], eax
lea rax, [rbp]
mov dword [rsp + 0x30], 0x2078
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
test eax, eax
js 0x1400284be
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp - 0x38]
mov qword [rdi], rax
mov rax, qword [rbp + 0x30]
mov qword [rdi + 8], rax
imul rax, qword [rbp + 8], 0x64
add rax, r12
mov qword [rdi + 0x28], rax
imul rax, qword [rbp + 0x10], 0x64
add rax, r12
mov qword [rdi + 0x10], rax
imul rax, qword [rbp + 0x18], 0x64
add rax, r12
mov qword [rdi + 0x18], rax
imul rax, qword [rbp + 0x20], 0x64
add rax, r12
mov qword [rdi + 0x20], rax
call sym.NetMonitor.exe_nocrt_strlen
mov ecx, dword [rbp + 0x38]
mov r8, rax
mov r9d, dword [rbp + 0x40]
and ecx, 0x7fff
mov rdx, qword [rbp - 0x38]
shl ecx, 0x10
mov dword [rsp + 0x20], esi
call fcn.1400419b0
mov dword [rdi + 0x30], eax
mov dword [rdi + 0x34], r15d
cmp r15d, 2
jne 0x14002849f
mov ecx, 1
mov qword [rdi + 0x38], 0xffffffffffffffff
mov qword [rdi + 0x40], rcx
lea r8, [rbp]
mov dword [rsp + 0x20], ecx
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
cmp rbx, r13
mov rax, rsi
mov qword [rdi + 0x50], rsi
cmova rax, qword [rbp + 0x60]
mov r9d, 0x800
mov qword [rdi + 0x48], rax
mov dword [rdi + 0x58], esi
call qword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
test eax, eax
js 0x14002849f
mov eax, dword [rbp + 8]
mov dword [rdi + 0x44], eax
mov r8d, r15d
mov rdx, rdi
xor ecx, ecx
call fcn.140027560
mov rcx, qword [rsp + 0x60]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x140028541
mov ecx, eax
call fcn.1400392e0
mov rcx, qword [rsp + 0x60]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x140028541
cmp r14d, 0xc0000033
je 0x1400284e6
cmp r14d, 0xc0000024
jne 0x140028537
mov rax, qword [rbp - 0x80]
lea rcx, [rbp - 0x68]
mov qword [rbp - 0x60], rax
xorps xmm0, xmm0
lea rax, [rbp]
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], 0x2078
mov r9d, r13d
mov r8d, r15d
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov dword [rbp - 0x68], 0x30
mov dword [rbp - 0x50], 0x40
mov qword [rbp - 0x58], rbx
movdqu xmmword [rbp - 0x48], xmm0
call fcn.1400275e0
mov ebx, eax
test eax, eax
jns 0x140028541
mov ecx, r14d
call fcn.1400392e0
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp + 0x2080]
xor rcx, rsp
call fcn.140001250
mov rbx, qword [rsp + 0x21e8]
add rsp, 0x2190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret