Function at 0x14005eea0
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2090]
mov eax, 0x2190
call fcn.140001130
sub rsp, rax
mov rax, qword [0x1400f54e0]
xor rax, rsp
mov qword [rbp + 0x2080], rax
mov rbx, qword [rbp + 0x20f8]
xor eax, eax
mov r13d, dword [rbp + 0x20f0]
mov r15d, r9d
mov qword [rbp - 0x78], rdx
mov rdi, r8
mov qword [rbp - 0x80], rcx
mov qword [rbp - 0x38], rbx
mov qword [rsp + 0x60], 0xffffffffffffffff
mov dword [rsp + 0x70], 0xc0000365
mov dword [rsp + 0x74], eax
mov qword [rsp + 0x78], 0xffffffffffffffd5
cmp r9d, 2
je 0x14005f07c
mov rax, qword [0x140105c98]
test rax, rax
je 0x14005f07c
mov qword [rbp - 0x60], rcx
xorps xmm0, xmm0
mov qword [rbp - 0x58], rdx
lea rcx, [rbp - 0x68]
lea rdx, [rbp]
mov dword [rbp - 0x68], 0x30
movdqu xmmword [rbp - 0x48], xmm0
mov dword [rbp - 0x50], 0x40
call qword [case.0x140035d81.0]
mov ecx, eax
test eax, eax
js 0x14005effd
test dword [rbp + 0x30], 0x400
jne 0x14005f074
mov rax, qword [rbp + 0x28]
movabs r12, 0x5e6684f4b3960000
mov qword [rdi], rax
mov rcx, rbx
mov rax, qword [rbp + 0x20]
mov qword [rdi + 8], rax
imul rax, qword [rbp], 0x64
add rax, r12
mov qword [rdi + 0x28], rax
imul rax, qword [rbp + 8], 0x64
add rax, r12
mov qword [rdi + 0x10], rax
imul rax, qword [rbp + 0x10], 0x64
add rax, r12
mov qword [rdi + 0x18], rax
imul rax, qword [rbp + 0x18], 0x64
add rax, r12
mov qword [rdi + 0x20], rax
call sym.vkat.exe_nocrt_strlen
mov ecx, dword [rbp + 0x30]
xor esi, esi
and ecx, 0x7fff
mov dword [rsp + 0x20], esi
shl ecx, 0x10
mov r8, rax
xor r9d, r9d
mov rdx, rbx
call fcn.14005e460
mov r8d, r15d
mov dword [rdi + 0x30], eax
mov rdx, rdi
mov dword [rdi + 0x34], r15d
xor ecx, ecx
call fcn.14005e740
jmp 0x14005f723
add eax, 0x3ffffff3
cmp eax, 0x26
ja 0x14005f04a
movabs rdx, 0x4000800001
bt rdx, rax
jae 0x14005f04a
mov dword [rsp + 0x30], ecx
lea rax, [rbp]
mov qword [rsp + 0x28], 0x2078
lea rcx, [rbp - 0x68]
mov r9d, r13d
mov qword [rsp + 0x20], rax
mov r8d, r15d
mov rdx, rdi
call fcn.14005e7c0
mov ebx, eax
test eax, eax
js 0x14005f061
jmp 0x14005f723
cmp ecx, 0xc0000022
je 0x14005f06c
cmp ecx, 0xc0000043
je 0x14005f06c
call fcn.140060810
mov ebx, eax
cmp ebx, 0x34
jne 0x14005f721
jmp 0x14005f074
mov dword [rsp + 0x70], 0xc0000365
mov rdx, qword [rbp - 0x78]
mov rcx, qword [rbp - 0x80]
mov r14d, dword [0x1400f5548]
mov ebx, 0x4020
test r14d, r14d
je 0x14005f099
test r13b, 2
mov eax, 0x204020
cmove ebx, eax
xor esi, esi
mov qword [rbp - 0x60], rcx
mov dword [rsp + 0x50], esi
lea r9, [rsp + 0x70]
mov qword [rsp + 0x48], rsi
lea r8, [rbp - 0x68]
mov dword [rsp + 0x40], ebx
lea rcx, [rsp + 0x60]
mov qword [rbp - 0x58], rdx
xorps xmm0, xmm0
mov r12d, 1
mov dword [rbp - 0x68], 0x30
mov dword [rsp + 0x38], r12d
mov edx, 0x100080
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rsi
mov dword [rbp - 0x50], 0x40
movdqu xmmword [rbp - 0x48], xmm0
call qword [sym.imp.ntdll.dll_NtCreateFile]
cmp eax, 0xc000000d
je 0x14005f10d
cmp eax, 0xc00000f7
jne 0x14005f16a
cmp r14d, 0xffffffff
jne 0x14005f16a
bt ebx, 0x15
jae 0x14005f16a
mov dword [rsp + 0x50], esi
lea r9, [rsp + 0x70]
mov qword [rsp + 0x48], rsi
lea r8, [rbp - 0x68]
btr ebx, 0x15
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x40], ebx
mov edx, 0x100080
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ntdll.dll_NtCreateFile]
cmp eax, 0xc000000d
je 0x14005f16a
mov dword [0x1400f5548], esi
movabs r12, 0x5e6684f4b3960000
test eax, eax
js 0x14005f3ad
mov rcx, qword [rsp + 0x60]
lea r8, [rsp + 0x68]
mov r9d, 8
mov dword [rsp + 0x20], 0x23
lea rdx, [rsp + 0x70]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jns 0x14005f1b1
mov ebx, esi
mov eax, esi
mov dword [rsp + 0x6c], ebx
mov dword [rsp + 0x68], eax
jmp 0x14005f1b9
mov ebx, dword [rsp + 0x6c]
mov eax, dword [rsp + 0x68]
bt eax, 0xa
jae 0x14005f254
cmp ebx, 0xa000000c
je 0x14005f254
test r13b, 2
jne 0x14005f254
mov dword [rsp + 0x50], esi
lea r9, [rsp + 0x70]
mov qword [rsp + 0x48], rsi
lea r8, [rbp - 0x68]
mov dword [rsp + 0x40], 0x4020
lea rcx, [rbp - 0x20]
mov dword [rsp + 0x38], 1
mov edx, 0x100080
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x70], 0xc0000365
mov qword [rsp + 0x78], 0xffffffffffffffd5
call qword [sym.imp.ntdll.dll_NtCreateFile]
test eax, eax
js 0x14005f250
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov r14, qword [rbp - 0x20]
mov ebx, esi
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x6c], ebx
mov dword [rsp + 0x68], esi
jmp 0x14005f259
mov ebx, dword [rsp + 0x6c]
mov r14, qword [rsp + 0x60]
xor eax, eax
mov dword [rbp - 0x30], 0xc0000365
lea r8, [rbp]
mov dword [rbp - 0x2c], eax
lea rdx, [rbp - 0x30]
mov qword [rbp - 0x28], 0xffffffffffffffd5
mov rcx, r14
mov dword [rsp + 0x20], 0x12
lea r9d, [rax + 0x68]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
jne 0x14005f2a9
cmp eax, 0x80000005
je 0x14005f2a9
mov ecx, eax
call fcn.140060810
jmp 0x14005f397
mov rax, qword [rbp + 0x30]
mov qword [rdi], rax
mov rax, qword [rbp + 0x28]
mov qword [rdi + 8], rax
imul rax, qword [rbp], 0x64
add rax, r12
mov qword [rdi + 0x28], rax
imul rax, qword [rbp + 8], 0x64
add rax, r12
mov qword [rdi + 0x10], rax
imul rax, qword [rbp + 0x10], 0x64
add rax, r12
mov qword [rdi + 0x18], rax
imul rax, qword [rbp + 0x18], 0x64
add rax, r12
mov qword [rdi + 0x20], rax
mov rax, qword [rbp - 0x38]
test rax, rax
je 0x14005f2fb
mov rcx, rax
call sym.vkat.exe_nocrt_strlen
jmp 0x14005f2fe
mov rax, rsi
mov ecx, dword [rbp + 0x20]
mov r9d, ebx
mov rdx, qword [rbp - 0x38]
and ecx, 0x7fff
shl ecx, 0x10
mov r8, rax
mov dword [rsp + 0x20], esi
call fcn.14005e460
mov dword [rdi + 0x30], eax
mov dword [rdi + 0x34], r15d
cmp r15d, 2
jne 0x14005f38a
mov rax, qword [rbp + 0x38]
lea r8, [rbp]
cmp eax, 1
mov qword [rdi + 0x38], 0xffffffffffffffff
mov ecx, 1
mov dword [rdi + 0x44], esi
cmovbe eax, ecx
mov dword [rsp + 0x20], ecx
mov dword [rdi + 0x40], eax
lea rdx, [rbp - 0x30]
mov rax, qword [rbp + 0x40]
mov r9d, 0x800
mov rcx, r14
mov qword [rdi + 0x48], rax
mov qword [rdi + 0x50], rsi
mov dword [rdi + 0x58], esi
call qword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
jne 0x14005f384
cmp eax, 0x80000005
jne 0x14005f38a
mov eax, dword [rbp + 8]
mov dword [rdi + 0x44], eax
mov r8d, r15d
mov rdx, rdi
xor ecx, ecx
call fcn.14005e740
mov rcx, qword [rsp + 0x60]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x14005f422
jmp 0x14005f721
cmp eax, 0xc0000024
je 0x14005f3e7
cmp eax, 0xc0000033
je 0x14005f3e7
cmp eax, 0xc0000022
je 0x14005f3d4
cmp eax, 0xc0000043
je 0x14005f3d4
mov ecx, eax
call fcn.140060810
mov ebx, eax
jmp 0x14005f419
mov dword [rsp + 0x70], 0xc0000365
mov qword [rsp + 0x78], 0xffffffffffffffd5
jmp 0x14005f422
mov dword [rsp + 0x30], eax
lea rcx, [rbp - 0x68]
lea rax, [rbp]
mov qword [rsp + 0x28], 0x2078
mov r9d, r13d
mov qword [rsp + 0x20], rax
mov r8d, r15d
mov rdx, rdi
call fcn.14005e7c0
mov ebx, eax
test eax, eax
jns 0x14005f723
cmp ebx, 0x34
jne 0x14005f721
mov rbx, qword [rbp - 0x78]
movzx r9d, word [rbx]
mov r8, qword [rbx + 8]
mov ecx, r9d
shr rcx, 1
je 0x14005f46c
cmp word [r8 + rcx*2 - 2], 0x5c
jne 0x14005f44b
lea rax, [rcx - 1]
mov rcx, rax
test rax, rax
je 0x14005f46c
lea rax, [r8 - 2]
lea rax, [rax + rcx*2]
movzx edx, word [rax]
cmp dx, 0x5c
je 0x14005f471
cmp dx, 0x2f
je 0x14005f46c
sub rax, 2
sub rcx, 1
jne 0x14005f453
test rcx, rcx
je 0x14005f485
movzx eax, cx
mov qword [rbp - 0x70], r8
add ax, ax
mov word [rbp - 0x78], ax
mov word [rbp - 0x76], ax
jmp 0x14005f497
lea rax, [0x1400b8924]
mov dword [rbp - 0x78], 0x40002
mov qword [rbp - 0x70], rax
lea rax, [r8 + rcx*2]
mov dword [rsp + 0x50], esi
mov qword [rbp - 0x10], rax
lea r8, [rbp - 0x68]
movzx eax, word [rbx + 2]
add cx, cx
sub ax, cx
mov qword [rsp + 0x48], rsi
mov word [rbp - 0x16], ax
sub r9w, cx
mov rax, qword [rbp - 0x80]
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x40], 0x4021
xorps xmm0, xmm0
mov qword [rbp - 0x60], rax
mov edx, 0x100001
lea rax, [rbp - 0x78]
mov word [rbp - 0x18], r9w
mov qword [rbp - 0x58], rax
lea r9, [rsp + 0x70]
mov eax, 1
mov dword [rbp - 0x68], 0x30
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rsi
mov dword [rbp - 0x50], 0x40
movdqu xmmword [rbp - 0x48], xmm0
call qword [sym.imp.ntdll.dll_NtCreateFile]
mov r14d, eax
test eax, eax
js 0x14005f6b4
mov rax, qword gs:[0x60]
movabs r13, 0x500000000
mov byte [rsp + 0x50], sil
mov ebx, dword [rax + 0x118]
mov rax, qword gs:[0x60]
shl rbx, 0x20
mov ecx, dword [rax + 0x11c]
mov eax, 0x25
or rbx, rcx
mov ecx, 3
cmp rbx, r13
cmovbe eax, ecx
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x48], rcx
xor r9d, r9d
mov rcx, qword [rsp + 0x60]
xor r8d, r8d
mov byte [rsp + 0x40], 1
xor edx, edx
mov dword [rsp + 0x38], eax
lea rax, [rbp]
mov dword [rsp + 0x30], 0x2078
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
test eax, eax
js 0x14005f69e
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp - 0x38]
mov qword [rdi], rax
mov rax, qword [rbp + 0x30]
mov qword [rdi + 8], rax
imul rax, qword [rbp + 8], 0x64
add rax, r12
mov qword [rdi + 0x28], rax
imul rax, qword [rbp + 0x10], 0x64
add rax, r12
mov qword [rdi + 0x10], rax
imul rax, qword [rbp + 0x18], 0x64
add rax, r12
mov qword [rdi + 0x18], rax
imul rax, qword [rbp + 0x20], 0x64
add rax, r12
mov qword [rdi + 0x20], rax
call sym.vkat.exe_nocrt_strlen
mov ecx, dword [rbp + 0x38]
mov r8, rax
mov r9d, dword [rbp + 0x40]
and ecx, 0x7fff
mov rdx, qword [rbp - 0x38]
shl ecx, 0x10
mov dword [rsp + 0x20], esi
call fcn.14005e460
mov dword [rdi + 0x30], eax
mov dword [rdi + 0x34], r15d
cmp r15d, 2
jne 0x14005f67f
mov ecx, 1
mov qword [rdi + 0x38], 0xffffffffffffffff
mov qword [rdi + 0x40], rcx
lea r8, [rbp]
mov dword [rsp + 0x20], ecx
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
cmp rbx, r13
mov rax, rsi
mov qword [rdi + 0x50], rsi
cmova rax, qword [rbp + 0x60]
mov r9d, 0x800
mov qword [rdi + 0x48], rax
mov dword [rdi + 0x58], esi
call qword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
test eax, eax
js 0x14005f67f
mov eax, dword [rbp + 8]
mov dword [rdi + 0x44], eax
mov r8d, r15d
mov rdx, rdi
xor ecx, ecx
call fcn.14005e740
mov rcx, qword [rsp + 0x60]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x14005f721
mov ecx, eax
call fcn.140060810
mov rcx, qword [rsp + 0x60]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x14005f721
cmp r14d, 0xc0000033
je 0x14005f6c6
cmp r14d, 0xc0000024
jne 0x14005f717
mov rax, qword [rbp - 0x80]
lea rcx, [rbp - 0x68]
mov qword [rbp - 0x60], rax
xorps xmm0, xmm0
lea rax, [rbp]
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], 0x2078
mov r9d, r13d
mov r8d, r15d
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov dword [rbp - 0x68], 0x30
mov dword [rbp - 0x50], 0x40
mov qword [rbp - 0x58], rbx
movdqu xmmword [rbp - 0x48], xmm0
call fcn.14005e7c0
mov ebx, eax
test eax, eax
jns 0x14005f721
mov ecx, r14d
call fcn.140060810
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp + 0x2080]
xor rcx, rsp
call fcn.140001270
mov rbx, qword [rsp + 0x21e8]
add rsp, 0x2190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret