Function at 0x1400166c0
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r13
push r14
lea rbp, [rsp - 0x30]
sub rsp, 0x130
movaps xmmword [rsp + 0x120], xmm6
mov rax, qword [0x140155040]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov rsi, rcx
lea rdx, [0x140155e90]
mov rcx, qword [0x1401590d8]
xor r13d, r13d
xor r8d, r8d
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x80], r13
movups xmm6, xmmword [rcx]
call fcn.140061480
cmp rax, 0xffffffffffffffff
je 0x14001681f
add rax, rax
cmp rax, 2
jne 0x14001681f
mov rdx, qword [0x140159180]
mov ecx, 0x14
call fcn.1400601a0
psrldq xmm6, 8
mov rdi, rax
lea rcx, [rax + 0x10]
mov qword [rax], 2
mov qword [rax + 8], rcx
movq rax, xmm6
mov word [rcx + 2], r13w
test rax, rax
je 0x14001676f
mov rcx, qword [rdi + 8]
movzx eax, word [rax]
mov word [rcx], ax
mov rax, qword [0x140155e90]
mov rbx, qword [rdi]
add rax, 8
mov rdx, qword [0x140159180]
add rbx, rax
lea rcx, [rbx + 0x12]
call fcn.1400601a0
mov r14, rax
mov qword [rbp - 0x60], rax
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rbx + rcx], r13w
mov rbx, qword [rax + 8]
mov rdx, qword [0x140112410]
mov qword [rbx], rdx
add rbx, 8
mov r8, qword [rdi]
mov rcx, rbx
mov rdx, qword [rdi + 8]
call fcn.1400e6ce0
add rbx, qword ds:[rdi]
mov r8, qword [0x140155e90]
mov rcx, rbx
mov rdx, qword [0x140155e98]
call fcn.1400e6ce0
lea rcx, [rdi - 0x10]
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400167ff
call fcn.1400602c0
mov rcx, r14
call fcn.1400774e0
cmp eax, 4
je 0x14001684f
lea rcx, [r14 - 0x10]
lock xadd dword [rcx + 8], edi
cmp edi, 1
jne 0x14001681f
call fcn.1400602c0
mov eax, 0xc0000001
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.1400c6a20
mov rbx, qword [rsp + 0x178]
movaps xmm6, xmmword [rsp + 0x120]
add rsp, 0x130
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
mov rax, qword [0x1401590d8]
mov qword ss:[rsp + 0x168], r12
test rax, rax
je 0x14001686b
mov rdx, qword [rax + 8]
jmp 0x14001686e
mov rdx, r13
mov dword [rsp + 0x38], 0x60
lea rcx, [rbp - 0x70]
mov dword [rsp + 0x30], 1
mov r8d, 0x100080
mov dword [rsp + 0x28], 7
mov dword [rsp + 0x20], 0x80
call fcn.140076e00
mov r12, qword [rbp - 0x70]
mov ebx, eax
test eax, eax
js 0x140017408
mov dword [rsp + 0x48], 0x24
xor eax, eax
mov dword [rbp - 0x20], eax
xorps xmm0, xmm0
lea rax, [rbp - 0x40]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], r13d
lea rax, [rbp - 0x50]
mov qword [rsp + 0x30], r13
xor edx, edx
mov dword [rsp + 0x28], 0x90360
mov rcx, r12
mov qword [rsp + 0x20], rax
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
call qword [sym.imp.ntdll.dll_NtFsControlFile]
cmp eax, 0x103
jne 0x14001690d
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov r9d, 8
mov dword [rsp + 0x20], 6
lea r8, [rbp + 8]
mov rcx, r12
lea rdx, [rbp - 0x50]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov ebx, eax
test eax, eax
js 0x140017408
mov dword [rsp + 0x30], 0x20
lea rcx, [rbp - 0x80]
mov dword [rsp + 0x28], 1
mov r8d, 0x100180
mov rdx, r14
mov dword [rsp + 0x20], 3
mov qword [rsp + 0x170], r15
call fcn.140076fe0
mov r15, qword [rbp - 0x80]
mov ebx, eax
test eax, eax
js 0x1400173ee
mov rax, qword [rbp + 8]
mov edx, 4
mov rcx, qword [0x140159238]
mov r8d, 0x2000000
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp - 0x10], 2
mov dword [rbp - 0x14], 0xf7ff
mov dword [rbp - 0x18], 1
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor edx, edx
mov r8d, 0x2000000
mov rcx, rax
mov qword [rbp - 0x58], rax
mov rdi, rax
call fcn.1400e6910
mov ebx, 0xc000a004
lea r12, str.::_DATA
mov dword [rsp + 0x50], ebx
nop word [rax + rax]
mov dword ss:[rsp + 0x48], 0x2000000
lea rax, [rbp - 0x18]
mov qword [rsp + 0x40], rdi
xor r9d, r9d
mov dword [rsp + 0x38], 0x20
xor r8d, r8d
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp - 0x50]
mov dword [rsp + 0x28], 0x90277
mov rcx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtFsControlFile]
mov dword [rsp + 0x78], eax
mov ecx, eax
cmp eax, 0x103
jne 0x140016a52
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
test eax, eax
mov ecx, eax
cmovns ecx, dword [rbp - 0x50]
mov dword [rsp + 0x78], ecx
test ecx, ecx
js 0x1400173d9
mov r14d, dword [rdi + 4]
add r14, rdi
mov qword [rbp - 0x68], r14
je 0x1400173bc
nop dword [rax + rax]
cmp dword [r14], 1
jne 0x1400173d3
mov r15d, dword [r14 + 0x1c]
lea rcx, [0x140112420]
mov rdx, qword [r14 + 0x10]
add r15, r14
mov ebx, dword [r14 + 0x20]
mov r8, rdx
mov qword [rbp - 0x78], r15
add rbx, r14
call fcn.140062000
mov r8, rax
lea rdx, str.File_reference_number
mov rcx, rsi
call fcn.140015960
mov rdx, rax
or dword [rax], 4
mov rcx, qword [rsi + 0x58]
call fcn.1400626c0
mov eax, dword [r14 + 0xc]
lea rcx, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x68], rax
mov edx, 1
mov dword [rsp + 0x58], 9
call fcn.14007c0a0
mov r8, rax
lea rdx, str.File_attributes
mov rcx, rsi
call fcn.140015960
mov rdx, rax
or dword [rax], 4
mov rcx, qword [rsi + 0x58]
call fcn.1400626c0
mov eax, dword [r14 + 8]
lea rcx, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x68], rax
mov edx, 1
mov dword [rsp + 0x58], 9
call fcn.14007c0a0
mov r8, rax
lea rdx, str.File_entry_flags
mov rcx, rsi
call fcn.140015960
mov rdx, rax
or dword [rax], 4
mov rcx, qword [rsi + 0x58]
call fcn.1400626c0
mov rcx, rbx
call fcn.140015f00
mov r8, rax
lea rdx, str.Creation_time
mov rcx, rsi
call fcn.140015960
mov rdx, rax
or dword [rax], 4
mov rcx, qword [rsi + 0x58]
call fcn.1400626c0
lea rcx, [rbx + 0x10]
call fcn.140015f00
mov r8, rax
lea rdx, str.Write_time
mov rcx, rsi
call fcn.140015960
mov rdx, rax
or dword [rax], 4
mov rcx, qword [rsi + 0x58]
call fcn.1400626c0
lea rcx, [rbx + 0x18]
call fcn.140015f00
mov r8, rax
lea rdx, str.Change_time
mov rcx, rsi
call fcn.140015960
mov rdx, rax
or dword [rax], 4
mov rcx, qword [rsi + 0x58]
call fcn.1400626c0
mov rax, qword [rbx + 0x30]
xor r8d, r8d
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x58], 9
mov edx, 1
lea rcx, [rsp + 0x58]
call fcn.14007c0a0
mov r8, rax
lea rdx, str.LastUsn
mov rcx, rsi
call fcn.140015960
mov rdx, rax
or dword [rax], 4
mov rcx, qword [rsi + 0x58]
call fcn.1400626c0
mov eax, dword [rbx + 0x28]
lea rcx, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x68], rax
mov edx, 1
mov dword [rsp + 0x58], 9
call fcn.14007c0a0
mov r8, rax
lea rdx, str.OwnerId
mov rcx, rsi
call fcn.140015960
mov rdx, rax
or dword [rax], 4
mov rcx, qword [rsi + 0x58]
call fcn.1400626c0
mov eax, dword [rbx + 0x2c]
lea rcx, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x68], rax
mov edx, 1
mov dword [rsp + 0x58], 9
call fcn.14007c0a0
mov r8, rax
lea rdx, str.SecurityId
mov rcx, rsi
call fcn.140015960
mov rdx, rax
or dword [rax], 4
mov rcx, qword [rsi + 0x58]
call fcn.1400626c0
movsxd rax, dword ds:[rbx + 0x38]
lea rcx, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x68], rax
mov edx, 1
mov dword [rsp + 0x58], 9
call fcn.14007c0a0
mov r8, rax
lea rdx, str.StorageReserveId
mov rcx, rsi
call fcn.140015960
mov rdx, rax
or dword [rax], 4
mov rcx, qword [rsi + 0x58]
call fcn.1400626c0
mov ecx, dword [rbp - 0x3c]
call fcn.140016620
mov r8, rax
lea rdx, str.Attribute_list_size
mov rcx, rsi
call fcn.140015960
mov rdx, rax
or dword [rax], 4
mov rcx, qword [rsi + 0x58]
call fcn.1400626c0
mov ecx, dword [rbp - 0x38]
call fcn.140016620
mov r8, rax
lea rdx, str.Metadata_space_used
mov rcx, rsi
call fcn.140015960
mov rdx, rax
or dword [rax], 4
mov rcx, qword [rsi + 0x58]
call fcn.1400626c0
mov ecx, dword [rbp - 0x34]
call fcn.140016620
mov r8, rax
lea rdx, str.Metadata_space_allocated
mov rcx, rsi
call fcn.140015960
mov rdx, rax
or dword [rax], 4
mov rcx, qword [rsi + 0x58]
call fcn.1400626c0
mov eax, dword [rbp - 0x30]
lea rcx, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x68], rax
mov edx, 1
mov dword [rsp + 0x58], 0x10009
call fcn.14007c0a0
mov r8, rax
lea rdx, str.Number_of_file_records
mov rcx, rsi
call fcn.140015960
mov rdx, rax
or dword [rax], 4
mov rcx, qword [rsi + 0x58]
call fcn.1400626c0
mov eax, dword [rbp - 0x2c]
lea rcx, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x68], rax
mov edx, 1
mov dword [rsp + 0x58], 0x10009
call fcn.14007c0a0
mov r8, rax
lea rdx, str.Number_of_resident_attributes
mov rcx, rsi
call fcn.140015960
mov rdx, rax
or dword [rax], 4
mov rcx, qword [rsi + 0x58]
call fcn.1400626c0
mov eax, dword [rbp - 0x28]
lea rcx, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x68], rax
mov edx, 1
mov dword [rsp + 0x58], 0x10009
call fcn.14007c0a0
mov r8, rax
lea rdx, str.Number_of_nonresident_attributes
mov rcx, rsi
call fcn.140015960
mov rdx, rax
or dword [rax], 4
mov rcx, qword [rsi + 0x58]
call fcn.1400626c0
mov eax, dword ds:[r14 + 0x18]
test eax, eax
je 0x140016f63
lea rdi, [r14 + rax]
lea r15, str.UNKNOWN
mov eax, dword [rdi + 0x10]
cmp eax, 2
jb 0x140016e9a
mov rdx, qword [0x140159180]
lea rcx, [rax + 0x12]
mov ebx, eax
lea r12, [rdi + 0x18]
call fcn.1400601a0
mov r14, rax
mov qword [rax], rbx
add rax, 0x10
mov qword [r14 + 8], rax
mov word [rbx + rax], r13w
test r12, r12
je 0x140016ea2
mov rcx, qword [r14 + 8]
mov r8d, ebx
mov rdx, r12
call fcn.1400e6ce0
jmp 0x140016ea2
call fcn.140061980
mov r14, rax
xor r8d, r8d
lea rdx, str.Filename
mov rcx, rsi
call fcn.140015960
mov rdx, rax
mov rbx, rax
or dword [rax], 4
mov rcx, qword [rsi + 0x58]
call fcn.1400626c0
mov eax, dword [rdi + 4]
test eax, eax
jne 0x140016ed6
lea rdx, str.HLINK_Name
jmp 0x140016ef0
test al, 1
je 0x140016ee3
lea rdx, str.NTFS_Name
jmp 0x140016ef0
test al, 2
lea rdx, str.DOS_Name
cmove rdx, r15
mov r8, r14
mov rcx, rsi
call fcn.140015960
mov rdx, rax
or dword [rax], 4
mov qword [rax + 0x58], rbx
mov rcx, qword [rbx + 0x60]
call fcn.1400626c0
mov rdx, qword ds:[rdi + 8]
lea rcx, [0x140112420]
mov r8, rdx
call fcn.140062000
mov r8, rax
lea rdx, str.Parent_ID
mov rcx, rsi
call fcn.140015960
mov rdx, rax
or dword [rax], 4
mov qword [rax + 0x58], rbx
mov rcx, qword [rbx + 0x60]
call fcn.1400626c0
mov eax, dword [rdi]
test eax, eax
je 0x140016f58
add rdi, rax
jmp 0x140016e53
mov r15, qword [rbp - 0x78]
lea r12, str.::_DATA
cmp dword [r15], 1
jne 0x140017366
nop dword [rax]
xor r8d, r8d
lea rdx, str.Stream
mov rcx, rsi
call fcn.140015960
mov rdx, rax
mov r14, rax
or dword [rax], 4
mov rcx, qword [rsi + 0x58]
call fcn.1400626c0
cmp dword ds:[r15 + 0x24], 0x80
jne 0x140017052
mov rax, r12
mov rcx, r12
and rax, 0xfffffffffffffff1
xorps xmm1, xmm1
and ecx, 0xf
je 0x140016fd9
movdqu xmm0, xmmword [rax]
pcmpeqw xmm0, xmm1
pmovmskb edx, xmm0
shr edx, cl
bsf ecx, edx
mov dword [rbp - 0x78], ecx
je 0x140016fd5
mov eax, ecx
shr rax, 1
jmp 0x140017017
add rax, 0x10
movdqu xmm0, xmmword [rax]
pcmpeqw xmm0, xmm1
pmovmskb ecx, xmm0
bsf edx, ecx
mov dword [rbp - 0x78], edx
jne 0x140017009
nop dword [rax]
movdqu xmm0, xmmword [rax + 0x10]
add rax, 0x10
pcmpeqw xmm0, xmm1
pmovmskb ecx, xmm0
bsf edx, ecx
mov dword [rbp - 0x78], edx
je 0x140016ff0
sub rax, r12
mov ecx, edx
sar rax, 1
shr rcx, 1
add rax, rcx
mov rdx, qword [0x140159180]
lea rbx, [rax + rax]
lea rcx, [rbx + 0x12]
call fcn.1400601a0
mov r8, rbx
mov rdx, r12
mov rdi, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rbx + rcx], r13w
mov rcx, qword [rax + 8]
call fcn.1400e6ce0
mov r8, rdi
jmp 0x140017097
mov edi, dword [r15 + 0x2c]
lea r12, [r15 + 0x30]
mov rdx, qword [0x140159180]
lea rcx, [rdi + 0x12]
call fcn.1400601a0
mov rbx, rax
mov qword [rax], rdi
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rdi + rcx], r13w
test r12, r12
je 0x140017094
mov rcx, qword [rax + 8]
mov r8d, edi
mov rdx, r12
call fcn.1400e6ce0
mov r8, rbx
lea rdx, str.Name
mov rcx, rsi
call fcn.140015960
mov r13d, 0x60
mov rcx, r14
mov r8d, r13d
mov rdx, rax
mov r12, r14
mov qword [rax + 0x58], r14
or dword [rax], 4
mov rcx, qword [rcx + r13]
call fcn.1400626c0
mov eax, dword [r15 + 0x28]
lea rcx, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x68], rax
mov edx, 1
mov dword [rsp + 0x58], 9
call fcn.14007c0a0
mov r8, rax
lea rdx, [0x1401126f8]
mov rcx, rsi
call fcn.140015960
mov rdx, rax
or dword [rax], 4
mov qword [rax + 0x58], r14
mov rcx, qword [r14 + r13]
call fcn.1400626c0
mov edx, dword ds:[r15 + 0x24]
lea rcx, str.0x_x
call fcn.140062000
mov r8, rax
lea rdx, str.Attribute_typecode
mov rcx, rsi
call fcn.140015960
mov rdx, rax
or dword [rax], 4
mov qword [rax + 0x58], r14
mov rcx, qword [r14 + r13]
call fcn.1400626c0
mov ecx, dword [r15 + 8]
call fcn.140016040
mov r8, rax
lea rdx, str.Flags
mov rcx, rsi
call fcn.140015960
mov rdx, rax
or dword [rax], 4
mov qword [rax + 0x58], r14
mov rcx, qword [r14 + r13]
call fcn.1400626c0
mov rcx, qword ds:[r15 + 0x18]
call fcn.140016620
mov r8, rax
lea rdx, str.Size
mov rcx, rsi
call fcn.140015960
mov rdx, rax
or dword [rax], 4
mov qword [rax + 0x58], r14
mov rcx, qword [r14 + r13]
call fcn.1400626c0
mov rcx, qword [r15 + 0x10]
call fcn.140016620
mov r8, rax
lea rdx, str.Allocated_Size
mov rcx, rsi
call fcn.140015960
mov rdx, rax
or dword [rax], 4
mov qword [rax + 0x58], r14
mov rcx, qword [r14 + r13]
call fcn.1400626c0
mov eax, dword ds:[r15 + 0x20]
test eax, eax
je 0x1400172ed
cmp dword [r15 + rax], 1
lea rbx, [r15 + rax]
jne 0x1400172ed
cmp dword ds:[r15 + 0x24], 0x80
jne 0x140017230
mov rcx, qword [rbx + 0x10]
call fcn.140016620
mov r8, rax
lea rdx, str.Valid_Data_Length
mov rcx, rsi
call fcn.140015960
mov rdx, rax
or dword [rax], 4
mov qword [rax + 0x58], r14
mov rcx, qword [r14 + r13]
call fcn.1400626c0
cmp dword [r15 + 0x24], 0xe0
jne 0x1400172ed
mov edi, dword [rbx + 0x10]
add rdi, rbx
je 0x1400172ed
nop word [rax + rax]
xor r8d, r8d
lea rdx, str.Extended_Attributes
mov rcx, rsi
call fcn.140015960
mov rdx, rax
mov rbx, rax
or dword [rax], 4
mov qword [rax + 0x58], r14
mov rcx, qword [r14 + 0x60]
call fcn.1400626c0
movzx edx, byte [rdi + 5]
lea rcx, [rdi + 8]
call fcn.1400622e0
mov r8, rax
lea rdx, str.Name
mov rcx, rsi
call fcn.140015960
mov rdx, rax
or dword [rax], 4
mov qword [rax + 0x58], rbx
mov rcx, qword [rbx + 0x60]
call fcn.1400626c0
movzx ecx, word [rdi + 6]
call fcn.140016620
mov r8, rax
lea rdx, str.Size
mov rcx, rsi
call fcn.140015960
mov rdx, rax
or dword [rax], 4
mov qword [rax + 0x58], rbx
mov rcx, qword [rbx + 0x60]
call fcn.1400626c0
mov eax, dword ds:[rdi]
test eax, eax
je 0x1400172ed
add rdi, rax
jne 0x140017250
mov eax, dword [r15 + 0xc]
test eax, eax
je 0x14001733e
mov edx, dword [rax + r15 + 8]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x68], rdx
xor r8d, r8d
mov edx, 1
mov dword [rsp + 0x58], 9
call fcn.14007c0a0
mov r8, rax
lea rdx, str.Extents
mov rcx, rsi
call fcn.140015960
mov rdx, rax
or dword [rax], 4
mov qword [rax + 0x58], r14
mov rcx, qword [r14 + 0x60]
call fcn.1400626c0
mov eax, dword [r15 + 4]
test eax, eax
je 0x140017372
add r15, rax
lea r12, str.::_DATA
mov r13d, 0
cmp dword [r15], 1
je 0x140016f70
mov ebx, dword [rsp + 0x50]
mov ecx, ebx
mov dword [rsp + 0x78], ebx
jmp 0x14001737a
mov ecx, dword [rsp + 0x78]
mov ebx, dword [rsp + 0x50]
mov r14, qword [rbp - 0x68]
mov eax, dword [r14 + 4]
test eax, eax
je 0x1400173a6
add r14, rax
lea r12, str.::_DATA
mov qword [rbp - 0x68], r14
mov r13d, 0
jne 0x140016a70
mov r15, qword [rbp - 0x80]
xor r13d, r13d
test ecx, ecx
js 0x1400173d9
mov rdi, qword [rbp - 0x58]
lea r12, str.::_DATA
mov eax, dword ds:[rbp - 0x14]
test al, 1
je 0x1400169e0
and eax, 0xfffffffe
mov dword [rbp - 0x14], eax
jmp 0x1400169e0
mov r15, qword [rbp - 0x80]
jmp 0x1400173e5
cmp ecx, 0xc0000011
mov ebx, ecx
cmove ebx, r13d
mov r12, qword [rbp - 0x70]
mov edi, 0xffffffff
test r15, r15
je 0x1400173fc
mov rcx, r15
call qword [sym.imp.ntdll.dll_NtClose]
mov r14, qword [rbp - 0x60]
mov r15, qword [rsp + 0x170]
test r12, r12
je 0x140017416
mov rcx, r12
call qword [sym.imp.ntdll.dll_NtClose]
lea rcx, [r14 - 0x10]
lock xadd dword [rcx + 8], edi
mov r12, qword [rsp + 0x168]
cmp edi, 1
jne 0x140017431
call fcn.1400602c0
mov eax, ebx
jmp 0x140016824