{"type": "func", "start": 6443668740, "end": 6443669055, "name": "convert_to_stat_mode", "pseudocode": "// \n// convert_to_stat_mode from 0x180129504 to 0x18012963f (315 bytes)\n// \n// 3 xrefs:\n// > common_stat<_stat64i32> @ 0x1801291ad\n// > common_stat_handle_file_opened<_stat64i32> @ 0x1801292bd\n// > @ 0x180202a98\n// \n// This function is hookable on this platform!\n// \n// Using BromaIDA 8.0.0 @ https://github.com/Stazzical/BromaIDA\n// Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings\n// \n\nunsigned __int16 __fastcall convert_to_stat_mode(__int16 a1, const wchar_t *a2)\n{\n char v2; // di\n bool v5; // zf\n char v6; // dl\n const wchar_t *v7; // rcx\n __int16 v8; // ax\n unsigned __int16 v9; // bx\n wchar_t *v10; // rax\n const wchar_t *v11; // rsi\n unsigned __int16 v12; // ax\n\n v2 = 1;\n if ( (a1 & 0x10) != 0 )\n goto LABEL_15;\n if ( !a2 )\n goto LABEL_14;\n if ( (unsigned __int16)(*a2 - 65) > 0x19u && (*a2 < 0x61u || *a2 > 0x7Au) || (v5 = a2[1] == 58, v6 = 1, !v5) )\n v6 = 0;\n v7 = a2;\n if ( v6 )\n v7 = a2 + 2;\n if ( !*v7 || (*v7 == 92 || *v7 == 47) && !v7[1] )\nLABEL_15:\n v8 = 16704;\n else\nLABEL_14:\n v8 = -32512;\n v9 = v8 | ~(a1 << 7) & 0x80;\n if ( !a2\n || (v10 = wcsrchr(a2, 0x2Eu), (v11 = v10) == nullptr)\n || wcsicmp(v10, L\".exe\") && wcsicmp(v11, L\".cmd\") && wcsicmp(v11, L\".bat\") && wcsicmp(v11, L\".com\") )\n {\n v2 = 0;\n }\n v12 = v9 | 0x40;\n if ( !v2 )\n v12 = v9;\n return v12 | (v12 >> 3) & 0x38 | ((unsigned __int16)(v12 | (v12 >> 3) & 0x38) >> 6) & 7;\n}", "assembly": "; \n; convert_to_stat_mode from 0x180129504 to 0x18012963f (315 bytes)\n; \n; 3 xrefs:\n; > common_stat<_stat64i32> @ 0x1801291ad\n; > common_stat_handle_file_opened<_stat64i32> @ 0x1801292bd\n; > @ 0x180202a98\n; \n; This function is hookable on this platform!\n; \n; Using BromaIDA 8.0.0 @ https:;github.com/Stazzical/BromaIDA\n; Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https:;github.com/geode-sdk/bindings\n; \n\nmov [rsp+arg_0], rbx ; +0x0, 0x180129504\nmov [rsp+arg_8], rbp ; +0x5, 0x180129509\nmov [rsp+arg_10], rsi ; +0xa, 0x18012950e\npush rdi ; +0xf, 0x180129513\nsub rsp, 20h ; +0x10, 0x180129514\nmov eax, ecx ; +0x14, 0x180129518\nxor ebp, ebp ; +0x16, 0x18012951a\nshr eax, 4 ; +0x18, 0x18012951c\nmov dil, 1 ; +0x1b, 0x18012951f\nmov r8, rdx ; +0x1e, 0x180129522\nmov ebx, ecx ; +0x21, 0x180129525\ntest dil, al ; +0x23, 0x180129527\njnz short loc_180129582 ; +0x26, 0x18012952a\ntest rdx, rdx ; +0x28, 0x18012952c\njz short loc_18012957B ; +0x2b, 0x18012952f\nmovzx eax, word ptr [rdx] ; +0x2d, 0x180129531\nsub ax, 41h ; 'A' ; +0x30, 0x180129534\ncmp ax, 19h ; +0x34, 0x180129538\njbe short loc_18012954A ; +0x38, 0x18012953c\ncmp word ptr [rdx], 61h ; 'a' ; +0x3a, 0x18012953e\njb short loc_180129554 ; +0x3e, 0x180129542\ncmp word ptr [rdx], 7Ah ; 'z' ; +0x40, 0x180129544\nja short loc_180129554 ; +0x44, 0x180129548\ncmp word ptr [rdx+2], 3Ah ; ':' ; +0x46, 0x18012954a\nmov dl, dil ; +0x4b, 0x18012954f\njz short loc_180129557 ; +0x4e, 0x180129552\nmov dl, bpl ; +0x50, 0x180129554\ntest dl, dl ; +0x53, 0x180129557\nlea rax, [r8+4] ; +0x55, 0x180129559\nmov rcx, r8 ; +0x59, 0x18012955d\ncmovnz rcx, rax ; +0x5c, 0x180129560\ncmp [rcx], bp ; +0x60, 0x180129564\njz short loc_180129582 ; +0x63, 0x180129567\ncmp word ptr [rcx], 5Ch ; '\\' ; +0x65, 0x180129569\njz short loc_180129575 ; +0x69, 0x18012956d\ncmp word ptr [rcx], 2Fh ; '/' ; +0x6b, 0x18012956f\njnz short loc_18012957B ; +0x6f, 0x180129573\ncmp [rcx+2], bp ; +0x71, 0x180129575\njz short loc_180129582 ; +0x75, 0x180129579\nmov eax, 8100h ; +0x77, 0x18012957b\njmp short loc_180129587 ; +0x7c, 0x180129580\nmov eax, 4140h ; +0x7e, 0x180129582\nshl bx, 7 ; +0x83, 0x180129587\nmov ecx, 80h ; +0x87, 0x18012958b\nnot bx ; +0x8c, 0x180129590\nand bx, cx ; +0x8f, 0x180129593\nor bx, ax ; +0x92, 0x180129596\ntest r8, r8 ; +0x95, 0x180129599\njz short loc_1801295FD ; +0x98, 0x18012959c\nlea edx, [rcx-52h]; Ch ; +0x9a, 0x18012959e\nmov rcx, r8; Str ; +0x9d, 0x1801295a1\ncall wcsrchr ; +0xa0, 0x1801295a4\nmov rsi, rax ; +0xa5, 0x1801295a9\ntest rax, rax ; +0xa8, 0x1801295ac\njz short loc_1801295FD ; +0xab, 0x1801295af\nlea rdx, aExe ; +0xad, 0x1801295b1\nmov rcx, rax; String1 ; +0xb4, 0x1801295b8\ncall _wcsicmp ; +0xb7, 0x1801295bb\ntest eax, eax ; +0xbc, 0x1801295c0\njz short loc_180129600 ; +0xbe, 0x1801295c2\nlea rdx, aCmd ; +0xc0, 0x1801295c4\nmov rcx, rsi; String1 ; +0xc7, 0x1801295cb\ncall _wcsicmp ; +0xca, 0x1801295ce\ntest eax, eax ; +0xcf, 0x1801295d3\njz short loc_180129600 ; +0xd1, 0x1801295d5\nlea rdx, aBat ; +0xd3, 0x1801295d7\nmov rcx, rsi; String1 ; +0xda, 0x1801295de\ncall _wcsicmp ; +0xdd, 0x1801295e1\ntest eax, eax ; +0xe2, 0x1801295e6\njz short loc_180129600 ; +0xe4, 0x1801295e8\nlea rdx, aCom ; +0xe6, 0x1801295ea\nmov rcx, rsi; String1 ; +0xed, 0x1801295f1\ncall _wcsicmp ; +0xf0, 0x1801295f4\ntest eax, eax ; +0xf5, 0x1801295f9\njz short loc_180129600 ; +0xf7, 0x1801295fb\nmov dil, bpl ; +0xf9, 0x1801295fd\nmov rbp, [rsp+28h+arg_8] ; +0xfc, 0x180129600\nmovzx eax, bx ; +0x101, 0x180129605\nmov rsi, [rsp+28h+arg_10] ; +0x104, 0x180129608\nor ax, 40h ; +0x109, 0x18012960d\ntest dil, dil ; +0x10d, 0x180129611\ncmovz ax, bx ; +0x110, 0x180129614\nmov rbx, [rsp+28h+arg_0] ; +0x114, 0x180129618\nmovzx ecx, ax ; +0x119, 0x18012961d\nshr cx, 3 ; +0x11c, 0x180129620\nand cx, 38h ; +0x120, 0x180129624\nor cx, ax ; +0x124, 0x180129628\nmovzx eax, cx ; +0x127, 0x18012962b\nshr ax, 6 ; +0x12a, 0x18012962e\nand ax, 7 ; +0x12e, 0x180129632\nor ax, cx ; +0x132, 0x180129636\nadd rsp, 20h ; +0x135, 0x180129639\npop rdi ; +0x139, 0x18012963d\nretn ; +0x13a, 0x18012963e", "xrefs": ["common_stat<_stat64i32> @ 0x1801291ad", "common_stat_handle_file_opened<_stat64i32> @ 0x1801292bd", " @ 0x180202a98"], "is_objc": false, "is_arm32": false, "is_arm64": false, "bida_info": "8.0.0 @ https://github.com/Stazzical/BromaIDA", "bindings_info": "commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings"}