Function at 0x14002be20
Capabilities:
Get file attributes

Disassembly:
push rbp
push r12
push r13
push r14
lea rbp, [rsp - 0x3f]
sub rsp, 0xb8
mov rax, qword [0x1400a0f20]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r12d, r8d
mov r14, rdx
mov r13, rcx
cmp rcx, 0x1000
jb 0x14002c1e2
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x14002c1e2
test r8d, 0xfffffff0
jne 0x14002c1db
mov eax, r8d
shr eax, 1
xor eax, r8d
test al, 1
je 0x14002c1db
mov rcx, rdx
mov qword [rsp + 0xa8], rdi
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
jne 0x14002c1d4
lea rax, [rbp - 0x31]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x25]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
test eax, eax
je 0x14002bef4
cmp dword [rbp - 0x31], 1
jne 0x14002c1d4
xor edi, edi
lea r8, [rbp - 0x29]
mov dword [rsp + 0x30], edi
lea rdx, [rbp - 0x2d]
mov qword [rsp + 0x28], rdi
xor r9d, r9d
mov rcx, r14
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
test eax, eax
jne 0x14002bf06
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14001ee80
jmp 0x14002c160
mov eax, dword [rbp - 0x2d]
test al, 1
jne 0x14002c1d4
test al, 2
jne 0x14002c1d4
cmp dword [rbp - 0x29], 1
ja 0x14002c1d4
lea rdx, [0x140054850]
mov qword [rsp + 0xb0], rsi
mov ecx, 0x98
call fcn.14001ed50
mov rsi, rax
test rax, rax
jne 0x14002bf4c
lea eax, [rsi - 8]
jmp 0x14002c158
mov qword [rsp + 0xf8], rbx
lea rcx, [rax + 0x60]
mov qword [rsp + 0xa0], r15
call fcn.140030d50
mov ebx, eax
test eax, eax
js 0x14002c13e
mov edx, 1
xor r9d, r9d
mov r8d, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rsi + 0x38], rax
test rax, rax
je 0x14002c135
movzx eax, r12b
mov dword [rsi], 0x19570528
and al, 1
mov qword [rsi + 8], r14
mov byte [rsi + 0x10], al
lea rcx, [rbp - 0x11]
mov eax, r12d
mov qword [rsi + 0x58], rdi
shr eax, 3
xor edx, edx
and al, 1
mov qword [rbp - 0x39], 0xffffffffffffffff
mov byte [rsi + 0x11], al
mov r15d, r12d
shr r15d, 2
movzx eax, r15b
lea r8d, [rdx + 0x28]
and al, 1
mov byte [rsi + 0x16], al
call sym.NetMonitor.exe_nocrt_memset
cmp qword [0x1400a9858], rdi
je 0x14002c02c
xor edx, edx
lea rcx, [rbp - 0x21]
lea r8d, [rdx + 0x10]
call sym.NetMonitor.exe_nocrt_memset
xor edx, edx
lea rcx, [rbp - 0x11]
lea r8d, [rdx + 0x28]
call sym.NetMonitor.exe_nocrt_memset
mov rcx, qword [rsi + 8]
lea r8, [rbp - 0x11]
mov r9d, 0x28
mov dword [rsp + 0x20], 0x18
lea rdx, [rbp - 0x21]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
js 0x14002c02c
and r15d, 1
jmp 0x14002c0c6
cmp byte [rsi + 0x10], 0
mov eax, 0x80000000
mov edi, 0x40000080
cmovne edi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 0
lea r9, [rbp - 0x39]
and r15d, 1
mov rcx, rax
mov dword [rsp + 0x28], r15d
mov r8, rbx
mov rdx, r14
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x14002c0e4
mov rax, qword [rbp - 0x39]
lea rcx, [rbp - 0x21]
xor edx, edx
mov qword [rsi + 8], rax
lea r8d, [rdx + 0x10]
call sym.NetMonitor.exe_nocrt_memset
xor edx, edx
lea rcx, [rbp - 0x11]
lea r8d, [rdx + 0x28]
call sym.NetMonitor.exe_nocrt_memset
mov rcx, qword [rsi + 8]
lea r8, [rbp - 0x11]
mov r9d, 0x28
mov dword [rsp + 0x20], 0x18
lea rdx, [rbp - 0x21]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
js 0x14002c0d3
mov byte [rsi + 0x11], 0
cmp qword [rbp - 0x39], 0xffffffffffffffff
jne 0x14002c18a
jmp 0x14002c0ec
mov rcx, qword [rbp - 0x39]
mov ebx, 0xffffffda
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14002c11b
mov qword [rbp - 0x39], 0xffffffffffffffff
mov rax, qword [0x1400a9858]
mov r8d, r15d
mov edx, 1
mov rcx, r14
call qword [case.0x14004be35.0]
test eax, eax
jne 0x14002c183
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14001ee80
mov ebx, eax
test eax, eax
jns 0x14002c183
mov rcx, qword [rbp - 0x39]
cmp rcx, 0xffffffffffffffff
je 0x14002c12b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsi + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsi + 0x60]
call fcn.140030bb0
mov rcx, rsi
call fcn.14001ed80
mov eax, ebx
mov rbx, qword [rsp + 0xf8]
mov r15, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xa8]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140001250
add rsp, 0xb8
pop r14
pop r13
pop r12
pop rbp
ret
cmp qword [rbp - 0x39], 0xffffffffffffffff
je 0x14002c1c9
test r12b, 8
jne 0x14002c1c9
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp r14, rax
je 0x14002c1c9
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp r14, rax
je 0x14002c1c9
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp r14, rax
je 0x14002c1c9
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r13], rsi
xor eax, eax
jmp 0x14002c148
mov eax, 0xfffffffc
jmp 0x14002c160
mov eax, 0xfffffffe
jmp 0x14002c168
mov eax, 0xfffffffa
jmp 0x14002c168