// // common_stat_handle_file_opened<_stat64i32> from 0x180129214 to 0x1801293bc (424 bytes) // // 2 xrefs: // > common_stat<_stat64i32> @ 0x180129152 // > @ 0x180202a74 // // This function is hookable on this platform! // // Using BromaIDA 8.0.0 @ https://github.com/Stazzical/BromaIDA // Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings // char __fastcall common_stat_handle_file_opened<_stat64i32>(wchar_t *a1, int a2, void *a3, __int64 a4) { DWORD v8; // ecx DWORD v9; // eax unsigned __int16 v10; // ax FILETIME ftLastWriteTime; // rcx __int64 v12; // rax FILETIME ftLastAccessTime; // rcx __int64 v14; // rax __int64 v15; // rdx FILETIME ftCreationTime; // rcx DWORD LastError; // eax __int16 v19; // ax DWORD TotalBytesAvail; // [rsp+30h] [rbp-50h] BYREF struct _BY_HANDLE_FILE_INFORMATION FileInformation; // [rsp+38h] [rbp-48h] BYREF v8 = GetFileType(a3) & 0xFFFF7FFF; if ( v8 != 1 ) { if ( v8 - 2 <= 1 ) { *(_WORD *)(a4 + 8) = 1; v19 = 4096; *(_DWORD *)(a4 + 16) = a2; *(_DWORD *)a4 = a2; if ( v8 == 2 ) v19 = 0x2000; *(_WORD *)(a4 + 6) = v19; if ( v8 != 2 && PeekNamedPipe(a3, nullptr, 0, nullptr, &TotalBytesAvail, nullptr) ) *(_DWORD *)(a4 + 20) = TotalBytesAvail; return 1; } if ( !v8 ) { *errno() = 9; return 0; } goto LABEL_14; } *(_WORD *)(a4 + 8) = 1; if ( a1 ) { TotalBytesAvail = 0; if ( !get_drive_number_from_path(a1, (int *)&TotalBytesAvail) ) return 0; v9 = TotalBytesAvail - 1; *(_DWORD *)(a4 + 16) = TotalBytesAvail - 1; *(_DWORD *)a4 = v9; } memset(&FileInformation, 0, sizeof(FileInformation)); if ( !GetFileInformationByHandle(a3, &FileInformation) ) { LABEL_14: LastError = GetLastError(); _acrt_errno_map_os_error(LastError); return 0; } v10 = convert_to_stat_mode(FileInformation.dwFileAttributes, a1); ftLastWriteTime = FileInformation.ftLastWriteTime; *(_WORD *)(a4 + 6) = v10; v12 = ((__int64 (__fastcall *)(_QWORD, _QWORD))convert_filetime_to_time_t<__int64>)(ftLastWriteTime, 0); ftLastAccessTime = FileInformation.ftLastAccessTime; *(_QWORD *)(a4 + 32) = v12; v14 = ((__int64 (__fastcall *)(_QWORD, _QWORD))convert_filetime_to_time_t<__int64>)(ftLastAccessTime, v12); v15 = *(_QWORD *)(a4 + 32); ftCreationTime = FileInformation.ftCreationTime; *(_QWORD *)(a4 + 24) = v14; *(_QWORD *)(a4 + 40) = ((__int64 (__fastcall *)(_QWORD, _QWORD))convert_filetime_to_time_t<__int64>)( ftCreationTime, v15); *(_DWORD *)(a4 + 20) = 0; if ( FileInformation.nFileSizeHigh || FileInformation.nFileSizeLow > 0x7FFFFFFF ) { *errno() = 132; return 0; } *(_DWORD *)(a4 + 20) = FileInformation.nFileSizeLow; return 1; }