Function at 0x18000d080
Capabilities:
Get file attributes

Disassembly:
sub rsp, 0x2a8
lea rdx, str.__C:ProgramDataMicrosoft_achatgptx.dat
lea rcx, [rsp + 0xc8]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x128], 0
mov dword [rsp + 0x124], 0
mov dword [rsp + 0x144], 0
mov dword [rsp + 0x12c], 0
mov dword [rsp + 0xe0], 0
mov dword [rsp + 0xdc], 0
mov dword [rsp + 0xd8], 0
mov dword [rsp + 0x14c], 0
movabs rax, 0xfffff78000000014
mov rax, qword [rax]
mov qword [rsp + 0x108], rax
lea rdx, [rsp + 0x118]
lea rcx, [rsp + 0x108]
call qword [sym.imp.ntoskrnl.exe_ExSystemTimeToLocalTime]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x118]
call qword [sym.imp.ntoskrnl.exe_RtlTimeToTimeFields]
movsx r11d, word [rsp + 0x60]
mov dword [rsp + 0x128], r11d
movsx eax, word [rsp + 0x62]
mov dword [rsp + 0x124], eax
movsx eax, word [rsp + 0x64]
mov dword [rsp + 0x144], eax
movsx eax, word [rsp + 0x66]
mov dword [rsp + 0x12c], eax
movsx eax, word [rsp + 0x60]
mov dword [rsp + 0xe0], eax
movsx eax, word [rsp + 0x62]
mov dword [rsp + 0xdc], eax
movsx eax, word [rsp + 0x64]
mov dword [rsp + 0xd8], eax
movsx eax, word [rsp + 0x66]
mov dword [rsp + 0x14c], eax
mov edx, 1
lea rcx, str.cursystime
call fcn.18000eb50
mov r8d, 0xa
xor edx, edx
lea rcx, [rsp + 0xf8]
call fcn.1800105d0
mov r9d, 0xa
mov r8d, 0xa
lea rdx, [rsp + 0xf8]
mov ecx, dword [rsp + 0x128]
call sub.ntoskrnl.exe__itoa_s
mov edx, 1
lea rcx, [rsp + 0xf8]
call fcn.18000eb50
mov r8d, 0xa
xor edx, edx
lea rcx, [rsp + 0xf8]
call fcn.1800105d0
mov r9d, 0xa
mov r8d, 0xa
lea rdx, [rsp + 0xf8]
mov ecx, dword [rsp + 0x124]
call sub.ntoskrnl.exe__itoa_s
mov edx, 1
lea rcx, [rsp + 0xf8]
call fcn.18000eb50
mov r8d, 0xa
xor edx, edx
lea rcx, [rsp + 0xf8]
call fcn.1800105d0
mov r9d, 0xa
mov r8d, 0xa
lea rdx, [rsp + 0xf8]
mov ecx, dword [rsp + 0x144]
call sub.ntoskrnl.exe__itoa_s
mov edx, 1
lea rcx, [rsp + 0xf8]
call fcn.18000eb50
mov r8d, 0xa
xor edx, edx
lea rcx, [rsp + 0xf8]
call fcn.1800105d0
mov r9d, 0xa
mov r8d, 0xa
lea rdx, [rsp + 0xf8]
mov ecx, dword [rsp + 0x12c]
call sub.ntoskrnl.exe__itoa_s
mov edx, 1
lea rcx, [rsp + 0xf8]
call fcn.18000eb50
mov dword [rsp + 0x70], 0x30
mov qword [rsp + 0x78], 0
mov dword [rsp + 0x88], 0x240
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0x40
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x130]
lea r8, [rsp + 0x70]
mov edx, 2
lea rcx, [rsp + 0x110]
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov dword [rsp + 0x148], eax
cmp dword [rsp + 0x148], 0
jl 0x18000d56f
mov dword [rsp + 0x20], 4
mov r9d, 0x28
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0x130]
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov dword [rsp + 0x148], eax
cmp dword [rsp + 0x148], 0
jge 0x18000d3cb
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [rsp + 0x148]
jmp 0x18000d708
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x280], rax
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x280]
call qword [sym.imp.ntoskrnl.exe_RtlTimeToTimeFields]
movsx r11d, word [rsp + 0xe8]
mov dword [rsp + 0xe0], r11d
movsx eax, word [rsp + 0xea]
mov dword [rsp + 0xdc], eax
movsx eax, word [rsp + 0xec]
mov dword [rsp + 0xd8], eax
movsx eax, word [rsp + 0xee]
mov dword [rsp + 0x14c], eax
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov edx, 1
lea rcx, str.curfiletime
call fcn.18000eb50
mov r8d, 0xa
xor edx, edx
lea rcx, [rsp + 0xf8]
call fcn.1800105d0
mov r9d, 0xa
mov r8d, 0xa
lea rdx, [rsp + 0xf8]
mov ecx, dword [rsp + 0xe0]
call sub.ntoskrnl.exe__itoa_s
mov edx, 1
lea rcx, [rsp + 0xf8]
call fcn.18000eb50
mov r8d, 0xa
xor edx, edx
lea rcx, [rsp + 0xf8]
call fcn.1800105d0
mov r9d, 0xa
mov r8d, 0xa
lea rdx, [rsp + 0xf8]
mov ecx, dword [rsp + 0xdc]
call sub.ntoskrnl.exe__itoa_s
mov edx, 1
lea rcx, [rsp + 0xf8]
call fcn.18000eb50
mov r8d, 0xa
xor edx, edx
lea rcx, [rsp + 0xf8]
call fcn.1800105d0
mov r9d, 0xa
mov r8d, 0xa
lea rdx, [rsp + 0xf8]
mov ecx, dword [rsp + 0xd8]
call sub.ntoskrnl.exe__itoa_s
mov edx, 1
lea rcx, [rsp + 0xf8]
call fcn.18000eb50
mov r8d, 0xa
xor edx, edx
lea rcx, [rsp + 0xf8]
call fcn.1800105d0
mov r9d, 0xa
mov r8d, 0xa
lea rdx, [rsp + 0xf8]
mov ecx, dword [rsp + 0x14c]
call sub.ntoskrnl.exe__itoa_s
mov edx, 1
lea rcx, [rsp + 0xf8]
call fcn.18000eb50
jmp 0x18000d5f5
cmp dword [rsp + 0x148], 0xc0000034
jne 0x18000d5f5
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0x40
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x130]
lea r8, [rsp + 0x70]
mov edx, 2
lea rcx, [rsp + 0x110]
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov dword [rsp + 0x148], eax
cmp dword [rsp + 0x148], 0
jl 0x18000d5f5
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov edx, dword [rsp + 0x128]
imul edx, edx, 0x16d
mov eax, dword [rsp + 0x124]
imul eax, eax, 0x1f
mov ecx, dword [rsp + 0x144]
add ecx, edx
add eax, ecx
imul eax, eax, 0x18
add eax, dword [rsp + 0x12c]
mov dword [rsp + 0x150], eax
mov edx, dword [rsp + 0xe0]
imul edx, edx, 0x16d
mov eax, dword [rsp + 0xdc]
imul eax, eax, 0x1f
mov ecx, dword [rsp + 0xd8]
add ecx, edx
add eax, ecx
imul eax, eax, 0x18
add eax, dword [rsp + 0x14c]
mov dword [rsp + 0x120], eax
mov ecx, dword [rsp + 0x120]
mov eax, dword [rsp + 0x150]
sub eax, ecx
mov dword [rsp + 0x140], eax
mov edx, 1
lea rcx, [0x180011d08]
call fcn.18000eb50
mov r8d, 0xa
xor edx, edx
lea rcx, [rsp + 0xf8]
call fcn.1800105d0
mov r9d, 0xa
mov r8d, 0xa
lea rdx, [rsp + 0xf8]
mov ecx, dword [rsp + 0x140]
call sub.ntoskrnl.exe__itoa_s
mov edx, 1
lea rcx, [rsp + 0xf8]
call fcn.18000eb50
cmp dword [rsp + 0x140], 0x48
jle 0x18000d6f1
mov dword [0x180013894], 1
mov edx, 1
lea rcx, [0x180011d18]
call fcn.18000eb50
jmp 0x18000d702
mov edx, 1
lea rcx, [0x180011d28]
call fcn.18000eb50
mov eax, dword [0x180013894]
add rsp, 0x2a8
ret