Function at 0x1000d4c94
Capabilities:
Clear file content
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1a8
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rdi, qword [rsp + 0x210]
mov rbp, r9
mov r14, r8
mov r12, rdx
mov rsi, rcx
mov rbx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rbx, rax
je 0x1000d4d09
test byte [rbx + 0x1c], 4
je 0x1000d4d09
cmp byte [rbx + 0x19], 4
jb 0x1000d4d09
mov rcx, qword [rbx + 0x10]
lea r8, [0x100003148]
mov edx, 0x19
call fcn.10001c854
mov rbx, qword [0x1001653b8]
xor r13d, r13d
lea rcx, [rsp + 0x180]
xor edx, edx
lea r8d, [r13 + 0x10]
mov qword [rsp + 0xb8], r13
mov dword [rsp + 0x84], r13d
mov qword [rsp + 0xb0], r13
mov qword [rsp + 0xa8], r13
mov dword [rsp + 0x9c], r13d
mov dword [rsp + 0x88], r13d
mov r15, r13
mov dword [rsp + 0x8c], r13d
mov dword [rsp + 0x98], r13d
mov qword [rsp + 0x90], r13
mov qword [rsp + 0xa0], r13
mov byte [rsp + 0x80], r13b
mov qword [rsp + 0x158], r13
mov qword [rsp + 0x160], r13
mov dword [rsp + 0x168], r13d
mov qword [rsp + 0x170], r13
mov qword [rsp + 0x178], r13
call sub.msvcrt.dll_memset
lea rax, [0x1001653b8]
cmp rbx, rax
je 0x1000d4ddb
test byte [rbx + 0x1c], 4
je 0x1000d4ddb
cmp byte [rbx + 0x19], 4
jb 0x1000d4ddb
mov rcx, qword [rbx + 0x10]
lea edx, [r13 + 0x1a]
lea r8, [0x100003148]
mov r9, r12
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbp
call fcn.1000d3f80
xor eax, eax
lea rcx, [rsp + 0x100]
xor edx, edx
lea r8d, [rax + 0x30]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], rax
call sub.msvcrt.dll_memset
xor r11d, r11d
lea rcx, [rsp + 0xe0]
lea r8d, [r11 + 0x20]
xor edx, edx
mov qword [rsp + 0xd0], r11
mov qword [rsp + 0xd8], r11
call sub.msvcrt.dll_memset
xor edx, edx
lea r8d, [rdx + 0x28]
lea rcx, [rsp + 0x130]
call sub.msvcrt.dll_memset
cmp rbp, r13
je 0x1000d4ea6
lea rcx, [rsp + 0x158]
mov r8, rdi
mov rdx, rbp
call fcn.1000d43b0
mov ebx, eax
cmp eax, r13d
je 0x1000d4ea6
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000d53e0
test byte [rcx + 0x1c], 4
je 0x1000d53e0
cmp byte [rcx + 0x19], 2
jb 0x1000d53e0
mov edx, 0x1b
mov eax, dword [rdi]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003148]
mov r9d, ebx
mov dword [rsp + 0x20], eax
call fcn.10001d914
jmp 0x1000d53e0
mov rax, rbp
lea r9, [rsp + 0xa0]
mov rdx, r14
neg rax
lea rax, [rsp + 0x158]
mov rcx, rsi
sbb r13, r13
mov qword [rsp + 0x20], rdi
and r13, rax
mov r8, r13
call fcn.1000d4a48
mov ebx, eax
test eax, eax
je 0x1000d4f10
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000d53e0
test byte [rcx + 0x1c], 4
je 0x1000d53e0
cmp byte [rcx + 0x19], 2
jb 0x1000d53e0
mov edx, 0x1c
jmp 0x1000d4e88
lea rdx, [rsp + 0xc0]
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
xor ebx, ebx
cmp al, bl
jne 0x1000d4f3d
mov dword [rdi], 0x7b
mov ebx, 2
jmp 0x1000d53e0
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x40], 0x48
mov dword [rsp + 0x38], 5
lea rax, [rsp + 0xc0]
mov dword [rsp + 0x30], ebx
lea r9, [rsp + 0xd0]
lea r8, [rsp + 0x100]
mov edx, 0xc0100080
mov rcx, rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x100], 0x30
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x108], rbx
mov dword [rsp + 0x118], 0x40
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x120], rbx
mov qword [rsp + 0x128], rbx
call qword [sym.imp.ntdll.dll_NtCreateFile]
cmp eax, ebx
jge 0x1000d502c
mov ecx, eax
mov qword [rsi], rbx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ebx, 7
mov dword [rdi], eax
mov rcx, qword [0x1001653b8]
lea rdx, [0x1001653b8]
cmp rcx, rdx
je 0x1000d53e0
test byte [rcx + 0x1c], 4
je 0x1000d53e0
cmp byte [rcx + 0x19], 2
jb 0x1000d53e0
mov r9, qword [rsp + 0xc8]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x28], eax
lea edx, [rbx + 0x16]
lea r8, [0x100003148]
mov dword [rsp + 0x20], ebx
call fcn.1000d4084
jmp 0x1000d53e0
mov rcx, qword [rsi]
lea r8, [rsp + 0x130]
lea rdx, [rsp + 0xd0]
mov r9d, 0x28
mov dword [rsp + 0x20], 4
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
cmp eax, ebx
jge 0x1000d50a9
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [rdi], eax
mov rcx, qword [0x1001653b8]
lea rdx, [0x1001653b8]
cmp rcx, rdx
je 0x1000d53db
test byte [rcx + 0x1c], 4
je 0x1000d53db
cmp byte [rcx + 0x19], 2
jb 0x1000d53db
mov edx, 0x1e
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003148]
mov r9d, eax
call fcn.10001c878
jmp 0x1000d53db
bt dword [rsp + 0x150], 0xb
jae 0x1000d516c
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000d50ef
test byte [rcx + 0x1c], 4
je 0x1000d50ef
cmp byte [rcx + 0x19], 4
jb 0x1000d50ef
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003148]
mov edx, 0x1f
mov r9, r12
call fcn.10001db08
mov rdx, qword [rsi]
mov rcx, rsi
call fcn.1000d4934
mov dword [rdi], eax
cmp eax, ebx
je 0x1000d5135
mov rcx, qword [0x1001653b8]
lea rdx, [0x1001653b8]
cmp rcx, rdx
je 0x1000d53db
test byte [rcx + 0x1c], 4
je 0x1000d53db
cmp byte [rcx + 0x19], 2
jb 0x1000d53db
mov edx, 0x20
jmp 0x1000d5091
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000d516c
test byte [rcx + 0x1c], 4
je 0x1000d516c
cmp byte [rcx + 0x19], 4
jb 0x1000d516c
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003148]
mov edx, 0x21
mov r9, r12
call fcn.10001db08
mov qword [rsp + 0x70], rdi
lea rax, [rsp + 0x98]
xor r9d, r9d
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x8c]
xor r8d, r8d
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0xa8]
mov rdx, r14
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x9c]
mov rcx, rsi
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x84]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rbx
call fcn.1000db27c
mov ebx, eax
test eax, eax
jne 0x1000d53e0
mov edx, dword [rsp + 0x84]
test rbp, rbp
jne 0x1000d521b
mov eax, dword [rsp + 0x8c]
imul rax, rax, 0x200200
add rdx, rax
mov rcx, qword [rsi]
mov r12d, 0x200
xor r9d, r9d
add rdx, r12
xor r8d, r8d
mov qword [rsi + 0x158], rdx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1000d53d3
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x1000d53d3
mov r8d, dword [rsp + 0x84]
mov rdx, qword [rsp + 0xb8]
mov r9, rdi
mov rcx, rsi
call fcn.1000dbc54
mov ebx, eax
test eax, eax
jne 0x1000d53e0
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_LocalFree]
and qword [rsp + 0x90], r15
test rbp, rbp
je 0x1000d52a0
mov rcx, rsi
call fcn.1000da6ec
jmp 0x1000d53e0
mov edx, 0x20000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r15, rax
test rax, rax
jne 0x1000d52c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov ebx, 3
jmp 0x1000d53e0
lea rbx, [rax + 0xffff]
and rbx, 0xffffffffffff0000
jne 0x1000d52df
mov dword [rdi], 0x57
jmp 0x1000d52bd
mov r8, r12
xor edx, edx
mov rcx, rbx
call sub.msvcrt.dll_memset
xor r9d, r9d
movabs r11, 0x8080808080808080
lea ebp, [r9 + 1]
xor r8d, r8d
xor ecx, ecx
mov edx, ebp
mov byte [rbx], r11b
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xf8], rax
test rax, rax
je 0x1000d53d3
mov eax, dword [rsi + 0xb8]
mov rcx, qword [rsi]
lea r9, [rsp + 0xe0]
shl eax, 9
mov r8d, r12d
mov rdx, rbx
mov qword [rsi + 0x38], rax
mov dword [rsp + 0xf0], eax
shr rax, 0x20
mov dword [rsp + 0xf4], eax
call fcn.1000d3658
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0xe0]
mov r9d, ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x1000d5381
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 5
mov dword [rdi], eax
jmp 0x1000d53e0
mov eax, dword [rsi + 0xb8]
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0xe0]
add eax, ebp
mov rcx, rsi
shl eax, 9
mov qword [rsi + 0x38], rax
call fcn.1000dc304
mov ebx, eax
test eax, eax
jne 0x1000d53e0
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0xe0]
mov r9d, ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x1000d5293
jmp 0x1000d5372
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov ebx, 7
mov rax, qword gs:[0x30]
mov r8, qword [rsp + 0xc8]
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000d5476
test byte [rcx + 0x1c], 4
je 0x1000d5476
cmp byte [rcx + 0x19], 4
jb 0x1000d5476
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003148]
mov edx, 0x22
call fcn.10001c854
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.10014e600
add rsp, 0x1a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret