{"type": "func", "start": 6443667988, "end": 6443668412, "name": "common_stat_handle_file_opened<_stat64i32>", "pseudocode": "// \n// common_stat_handle_file_opened<_stat64i32> from 0x180129214 to 0x1801293bc (424 bytes)\n// \n// 2 xrefs:\n// > common_stat<_stat64i32> @ 0x180129152\n// > @ 0x180202a74\n// \n// This function is hookable on this platform!\n// \n// Using BromaIDA 8.0.0 @ https://github.com/Stazzical/BromaIDA\n// Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings\n// \n\nchar __fastcall common_stat_handle_file_opened<_stat64i32>(wchar_t *a1, int a2, void *a3, __int64 a4)\n{\n DWORD v8; // ecx\n DWORD v9; // eax\n unsigned __int16 v10; // ax\n FILETIME ftLastWriteTime; // rcx\n __int64 v12; // rax\n FILETIME ftLastAccessTime; // rcx\n __int64 v14; // rax\n __int64 v15; // rdx\n FILETIME ftCreationTime; // rcx\n DWORD LastError; // eax\n __int16 v19; // ax\n DWORD TotalBytesAvail; // [rsp+30h] [rbp-50h] BYREF\n struct _BY_HANDLE_FILE_INFORMATION FileInformation; // [rsp+38h] [rbp-48h] BYREF\n\n v8 = GetFileType(a3) & 0xFFFF7FFF;\n if ( v8 != 1 )\n {\n if ( v8 - 2 <= 1 )\n {\n *(_WORD *)(a4 + 8) = 1;\n v19 = 4096;\n *(_DWORD *)(a4 + 16) = a2;\n *(_DWORD *)a4 = a2;\n if ( v8 == 2 )\n v19 = 0x2000;\n *(_WORD *)(a4 + 6) = v19;\n if ( v8 != 2 && PeekNamedPipe(a3, nullptr, 0, nullptr, &TotalBytesAvail, nullptr) )\n *(_DWORD *)(a4 + 20) = TotalBytesAvail;\n return 1;\n }\n if ( !v8 )\n {\n *errno() = 9;\n return 0;\n }\n goto LABEL_14;\n }\n *(_WORD *)(a4 + 8) = 1;\n if ( a1 )\n {\n TotalBytesAvail = 0;\n if ( !get_drive_number_from_path(a1, (int *)&TotalBytesAvail) )\n return 0;\n v9 = TotalBytesAvail - 1;\n *(_DWORD *)(a4 + 16) = TotalBytesAvail - 1;\n *(_DWORD *)a4 = v9;\n }\n memset(&FileInformation, 0, sizeof(FileInformation));\n if ( !GetFileInformationByHandle(a3, &FileInformation) )\n {\nLABEL_14:\n LastError = GetLastError();\n _acrt_errno_map_os_error(LastError);\n return 0;\n }\n v10 = convert_to_stat_mode(FileInformation.dwFileAttributes, a1);\n ftLastWriteTime = FileInformation.ftLastWriteTime;\n *(_WORD *)(a4 + 6) = v10;\n v12 = ((__int64 (__fastcall *)(_QWORD, _QWORD))convert_filetime_to_time_t<__int64>)(ftLastWriteTime, 0);\n ftLastAccessTime = FileInformation.ftLastAccessTime;\n *(_QWORD *)(a4 + 32) = v12;\n v14 = ((__int64 (__fastcall *)(_QWORD, _QWORD))convert_filetime_to_time_t<__int64>)(ftLastAccessTime, v12);\n v15 = *(_QWORD *)(a4 + 32);\n ftCreationTime = FileInformation.ftCreationTime;\n *(_QWORD *)(a4 + 24) = v14;\n *(_QWORD *)(a4 + 40) = ((__int64 (__fastcall *)(_QWORD, _QWORD))convert_filetime_to_time_t<__int64>)(\n ftCreationTime,\n v15);\n *(_DWORD *)(a4 + 20) = 0;\n if ( FileInformation.nFileSizeHigh || FileInformation.nFileSizeLow > 0x7FFFFFFF )\n {\n *errno() = 132;\n return 0;\n }\n *(_DWORD *)(a4 + 20) = FileInformation.nFileSizeLow;\n return 1;\n}", "assembly": "; \n; common_stat_handle_file_opened<_stat64i32> from 0x180129214 to 0x1801293bc (424 bytes)\n; \n; 2 xrefs:\n; > common_stat<_stat64i32> @ 0x180129152\n; > @ 0x180202a74\n; \n; This function is hookable on this platform!\n; \n; Using BromaIDA 8.0.0 @ https:;github.com/Stazzical/BromaIDA\n; Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https:;github.com/geode-sdk/bindings\n; \n\nmov [rsp-28h+arg_8], rbx ; +0x0, 0x180129214\npush rbp ; +0x5, 0x180129219\npush rsi ; +0x6, 0x18012921a\npush rdi ; +0x7, 0x18012921b\npush r14 ; +0x8, 0x18012921c\npush r15 ; +0xa, 0x18012921e\nmov rbp, rsp ; +0xc, 0x180129220\nsub rsp, 80h ; +0xf, 0x180129223\nmov rax, cs:__security_cookie ; +0x16, 0x18012922a\nxor rax, rsp ; +0x1d, 0x180129231\nmov [rbp+var_10], rax ; +0x20, 0x180129234\nmov rdi, rcx ; +0x24, 0x180129238\nmov rbx, r9 ; +0x27, 0x18012923b\nmov rcx, r8; hFile ; +0x2a, 0x18012923e\nmov rsi, r8 ; +0x2d, 0x180129241\nmov r14d, edx ; +0x30, 0x180129244\ncall cs:GetFileType ; +0x33, 0x180129247\nmov ecx, eax ; +0x39, 0x18012924d\nmov r15d, 1 ; +0x3b, 0x18012924f\nbtr ecx, 0Fh ; +0x41, 0x180129255\ncmp ecx, r15d ; +0x45, 0x180129259\njnz loc_18012931F ; +0x48, 0x18012925c\nmov [rbx+8], r15w ; +0x4e, 0x180129262\ntest rdi, rdi ; +0x53, 0x180129267\njz short loc_18012928E ; +0x56, 0x18012926a\nand [rbp+TotalBytesAvail], 0 ; +0x58, 0x18012926c\nlea rdx, [rbp+TotalBytesAvail]; int * ; +0x5c, 0x180129270\nmov rcx, rdi; wchar_t * ; +0x60, 0x180129274\ncall ?get_drive_number_from_path@@YA_NQEB_WAEAH@Z ; +0x63, 0x180129277\ntest al, al ; +0x68, 0x18012927c\njz loc_180129336 ; +0x6a, 0x18012927e\nmov eax, [rbp+TotalBytesAvail] ; +0x70, 0x180129284\ndec eax ; +0x73, 0x180129287\nmov [rbx+10h], eax ; +0x75, 0x180129289\nmov [rbx], eax ; +0x78, 0x18012928c\nxorps xmm0, xmm0 ; +0x7a, 0x18012928e\nlea rdx, [rbp+FileInformation]; lpFileInformation ; +0x7d, 0x180129291\nxor eax, eax ; +0x81, 0x180129295\nmov rcx, rsi; hFile ; +0x83, 0x180129297\nmovups xmmword ptr [rbp+FileInformation.dwFileAttributes], xmm0 ; +0x86, 0x18012929a\nmov [rbp+FileInformation.nFileIndexLow], eax ; +0x8a, 0x18012929e\nmovups xmmword ptr [rbp+FileInformation.ftLastAccessTime.dwHighDateTime], xmm0 ; +0x8d, 0x1801292a1\nmovups xmmword ptr [rbp+FileInformation.nFileSizeHigh], xmm0 ; +0x91, 0x1801292a5\ncall cs:GetFileInformationByHandle ; +0x95, 0x1801292a9\ntest eax, eax ; +0x9b, 0x1801292af\njz loc_18012933A ; +0x9d, 0x1801292b1\nmov ecx, [rbp+FileInformation.dwFileAttributes]; int ; +0xa3, 0x1801292b7\nmov rdx, rdi; wchar_t * ; +0xa6, 0x1801292ba\ncall ?convert_to_stat_mode@@YAGHQEB_W@Z ; +0xa9, 0x1801292bd\nmov rcx, qword ptr [rbp+FileInformation.ftLastWriteTime.dwLowDateTime] ; +0xae, 0x1801292c2\nxor edx, edx ; +0xb2, 0x1801292c6\nmov [rbx+6], ax ; +0xb4, 0x1801292c8\ncall ??$convert_filetime_to_time_t@_J@@YA_JU_FILETIME@@_J@Z ; +0xb8, 0x1801292cc\nmov rcx, qword ptr [rbp+FileInformation.ftLastAccessTime.dwLowDateTime] ; +0xbd, 0x1801292d1\nmov rdx, rax ; +0xc1, 0x1801292d5\nmov [rbx+20h], rax ; +0xc4, 0x1801292d8\ncall ??$convert_filetime_to_time_t@_J@@YA_JU_FILETIME@@_J@Z ; +0xc8, 0x1801292dc\nmov rdx, [rbx+20h] ; +0xcd, 0x1801292e1\nmov rcx, qword ptr [rbp+FileInformation.ftCreationTime.dwLowDateTime] ; +0xd1, 0x1801292e5\nmov [rbx+18h], rax ; +0xd5, 0x1801292e9\ncall ??$convert_filetime_to_time_t@_J@@YA_JU_FILETIME@@_J@Z ; +0xd9, 0x1801292ed\nmov [rbx+28h], rax ; +0xde, 0x1801292f2\nand dword ptr [rbx+14h], 0 ; +0xe2, 0x1801292f6\ncmp [rbp+FileInformation.nFileSizeHigh], 0 ; +0xe6, 0x1801292fa\njnz short loc_180129312 ; +0xea, 0x1801292fe\nmov eax, [rbp+FileInformation.nFileSizeLow] ; +0xec, 0x180129300\ncmp eax, 7FFFFFFFh ; +0xef, 0x180129303\nja short loc_180129312 ; +0xf4, 0x180129308\nmov [rbx+14h], eax ; +0xf6, 0x18012930a\njmp loc_180129396 ; +0xf9, 0x18012930d\ncall _errno ; +0xfe, 0x180129312\nmov dword ptr [rax], 84h ; +0x103, 0x180129317\njmp short loc_180129336 ; +0x109, 0x18012931d\nlea eax, [rcx-2] ; +0x10b, 0x18012931f\ncmp eax, r15d ; +0x10e, 0x180129322\njbe short loc_180129349 ; +0x111, 0x180129325\ntest ecx, ecx ; +0x113, 0x180129327\njnz short loc_18012933A ; +0x115, 0x180129329\ncall _errno ; +0x117, 0x18012932b\nmov dword ptr [rax], 9 ; +0x11c, 0x180129330\nxor al, al ; +0x122, 0x180129336\njmp short loc_180129399 ; +0x124, 0x180129338\ncall cs:GetLastError ; +0x126, 0x18012933a\nmov ecx, eax ; +0x12c, 0x180129340\ncall __acrt_errno_map_os_error ; +0x12e, 0x180129342\njmp short loc_180129336 ; +0x133, 0x180129347\ncmp ecx, 2 ; +0x135, 0x180129349\nmov [rbx+8], r15w ; +0x138, 0x18012934c\nmov eax, 1000h ; +0x13d, 0x180129351\nmov [rbx+10h], r14d ; +0x142, 0x180129356\nmov edx, 2000h ; +0x146, 0x18012935a\nmov [rbx], r14d ; +0x14b, 0x18012935f\ncmovz ax, dx ; +0x14e, 0x180129362\nmov [rbx+6], ax ; +0x152, 0x180129366\njz short loc_180129396 ; +0x156, 0x18012936a\nand [rsp+80h+var_58], 0 ; +0x158, 0x18012936c\nlea rcx, [rbp+TotalBytesAvail] ; +0x15e, 0x180129372\nmov [rsp+80h+lpTotalBytesAvail], rcx; lpTotalBytesAvail ; +0x162, 0x180129376\nxor r9d, r9d; lpBytesRead ; +0x167, 0x18012937b\nmov rcx, rsi; hNamedPipe ; +0x16a, 0x18012937e\nxor r8d, r8d; nBufferSize ; +0x16d, 0x180129381\nxor edx, edx; lpBuffer ; +0x170, 0x180129384\ncall cs:PeekNamedPipe ; +0x172, 0x180129386\ntest eax, eax ; +0x178, 0x18012938c\njz short loc_180129396 ; +0x17a, 0x18012938e\nmov ecx, [rbp+TotalBytesAvail] ; +0x17c, 0x180129390\nmov [rbx+14h], ecx ; +0x17f, 0x180129393\nmov al, r15b ; +0x182, 0x180129396\nmov rcx, [rbp+var_10] ; +0x185, 0x180129399\nxor rcx, rsp; StackCookie ; +0x189, 0x18012939d\ncall __security_check_cookie ; +0x18c, 0x1801293a0\nmov rbx, [rsp+80h+arg_8] ; +0x191, 0x1801293a5\nadd rsp, 80h ; +0x199, 0x1801293ad\npop r15 ; +0x1a0, 0x1801293b4\npop r14 ; +0x1a2, 0x1801293b6\npop rdi ; +0x1a4, 0x1801293b8\npop rsi ; +0x1a5, 0x1801293b9\npop rbp ; +0x1a6, 0x1801293ba\nretn ; +0x1a7, 0x1801293bb", "xrefs": ["common_stat<_stat64i32> @ 0x180129152", " @ 0x180202a74"], "is_objc": false, "is_arm32": false, "is_arm64": false, "bida_info": "8.0.0 @ https://github.com/Stazzical/BromaIDA", "bindings_info": "commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings"}