Function at 0x7fff25d91560
Capabilities:
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r15
sub rsp, 0x70
mov ebx, edx
xor esi, esi
xor edx, edx
xor r10d, r10d
xor ebp, ebp
xor r11b, r11b
mov rdi, rcx
lea r15d, [rdx + 1]
cmp ebx, 0xe
jg 0x7fff25d91663
je 0x7fff25d916cd
mov ecx, ebx
test ebx, ebx
je 0x7fff25d91695
sub ecx, r15d
je 0x7fff25d916a3
sub ecx, r15d
je 0x7fff25d916bf
sub ecx, 5
je 0x7fff25df0e8e
sub ecx, r15d
je 0x7fff25d9172b
sub ecx, r15d
je 0x7fff25d916b1
sub ecx, r15d
je 0x7fff25df0e80
sub ecx, r15d
je 0x7fff25df0e72
lea r10d, [rdx + 2]
cmp ecx, r10d
jne 0x7fff25df0ebe
lea eax, [rdx + 0x74]
lea r10d, [rdx + 0x37]
cmp eax, r9d
ja 0x7fff25df0ec5
mov rcx, rdi
test esi, esi
jne 0x7fff25d91749
test edx, edx
jne 0x7fff25d916de
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x20], r10d
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
test eax, eax
jns 0x7fff25d91655
mov ecx, eax
call fcn.7fff25d6b370
xor eax, eax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
cmp ebx, 7
je 0x7fff25df0f47
mov eax, r15d
jmp 0x7fff25d91639
mov ecx, ebx
sub ecx, 0xf
je 0x7fff25df0f11
sub ecx, r15d
je 0x7fff25d91739
sub ecx, r15d
je 0x7fff25df0f03
sub ecx, r15d
jne 0x7fff25df0e9c
lea eax, [rcx + 0x18]
lea r10d, [rcx + 0x3b]
jmp 0x7fff25d915fa
mov eax, 0x28
lea r10d, [rax - 0x24]
jmp 0x7fff25d915fa
mov eax, 0x18
lea r10d, [rax - 0x13]
jmp 0x7fff25d915fa
mov eax, 8
lea r10d, [rax + 0x1b]
jmp 0x7fff25d915fa
mov eax, 8
lea r10d, [rax + 1]
jmp 0x7fff25d915fa
mov eax, 0x48
lea r10d, [rax - 0x46]
mov edx, r15d
jmp 0x7fff25d915fa
mov byte [rsp + 0x50], r11b
lea rax, [rsp + 0x60]
and qword [rsp + 0x48], 0
xor edx, edx
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x38], r10d
mov dword [rsp + 0x30], r9d
xor r9d, r9d
mov qword [rsp + 0x28], r8
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
nop dword [rax + rax]
cmp eax, 0x103
jne 0x7fff25d9162c
jmp 0x7fff25df0f22
mov eax, 0x10
lea r10d, [rax + 0xc]
jmp 0x7fff25d915fa
mov ebp, 0xb
mov esi, r15d
lea eax, [rbp + 0x11]
jmp 0x7fff25d915fa
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
nop dword [rax + rax]
jmp 0x7fff25d9162c
mov eax, 0x70
lea r10d, [rax - 0x4b]
jmp 0x7fff25df0f1a
mov eax, 0x70
lea r10d, [rax - 0x4b]
jmp 0x7fff25d916d6
mov eax, 0x20
lea r10d, [rax - 0xa]
jmp 0x7fff25d915fa
sub ecx, r15d
je 0x7fff25df0ef5
sub ecx, r15d
je 0x7fff25df0eea
sub ecx, 3
je 0x7fff25df0edc
cmp ecx, r15d
jne 0x7fff25df0ebe
mov eax, 8
lea r10d, [rax + 0x28]
jmp 0x7fff25d915fa
mov ecx, 0x57
jmp 0x7fff25df0eca
mov ecx, 0x18
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
nop
jmp 0x7fff25d91637
mov eax, 4
lea r10d, [rax + 0x43]
jmp 0x7fff25d915fa
mov eax, 0x60
lea r10d, [rax - 0x24]
jmp 0x7fff25df0f1a
mov eax, 0x60
lea r10d, [rax - 0x24]
jmp 0x7fff25d916d6
mov eax, 4
lea r10d, [rax + 0xd]
jmp 0x7fff25d915fa
mov eax, 0x48
lea r10d, [rax - 0x46]
mov r11b, r15b
jmp 0x7fff25d916d6
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
nop dword [rax + rax]
test eax, eax
js 0x7fff25d91630
mov eax, dword [rsp + 0x60]
jmp 0x7fff25d9162c
cmp qword [rsp + 0x68], 0
jne 0x7fff25d9165e
mov ecx, 0xc0000011
jmp 0x7fff25d91632