Function at 0x1fe82
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x45c
mov eax, dword [0x27424]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x43c], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x434], eax
push 0x400
lea eax, [ebp - 0x418]
xor ebx, ebx
push eax
mov dword [ebp - 0x438], esi
mov dword [ebp - 0x40c], ebx
call fcn.0001e090
mov eax, dword [esi + 4]
cmp word [eax], 0x5c
sete byte [ebp - 0x405]
cmp byte [ebp - 0x405], bl
jne 0x1fef5
push 0x2253a
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
push edi
push esi
mov esi, dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea eax, [ebp - 0x418]
push eax
call esi
mov edi, dword [sym.imp.ntoskrnl.exe_ZwCreateFile]
push ebx
push ebx
push 0x868
push 1
push 3
push 0x80
lea eax, [ebp - 0x418]
mov dword [ebp - 0x428], eax
push ebx
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x430]
push eax
push 0x80000000
lea eax, [ebp - 0x40c]
push eax
mov dword [ebp - 0x430], 0x18
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x424], 0x240
mov dword [ebp - 0x420], ebx
mov dword [ebp - 0x41c], ebx
call edi
cmp eax, ebx
mov dword [ebp - 0x410], eax
jge 0x20066
cmp byte [ebp - 0x405], bl
jne 0x200ed
xor eax, eax
mov word [ebp - 0x418], ax
push 0x22520
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
push dword [ebp - 0x438]
lea eax, [ebp - 0x418]
push eax
call esi
push ebx
push ebx
push 0x868
push 1
push 3
push 0x80
lea eax, [ebp - 0x418]
mov dword [ebp - 0x428], eax
push ebx
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x430]
push eax
push 0x80000000
lea eax, [ebp - 0x40c]
push eax
mov dword [ebp - 0x430], 0x18
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x424], 0x240
mov dword [ebp - 0x420], ebx
mov dword [ebp - 0x41c], ebx
call edi
cmp eax, ebx
mov dword [ebp - 0x410], eax
jge 0x20066
push 0x400
lea eax, [ebp - 0x404]
push ebx
push eax
call sub.ntoskrnl.exe_memset
push dword [ebp - 0x410]
lea eax, [ebp - 0x404]
push dword [ebp - 0x414]
push dword [ebp - 0x418]
push 0x22506
push 0x3ff
push eax
call fcn.0001e2a6
add esp, 0x24
lea eax, [ebp - 0x404]
push eax
call fcn.0001c9b0
jmp 0x200ed
push 5
push 0x18
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x444]
push eax
push dword [ebp - 0x40c]
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
cmp eax, ebx
mov dword [ebp - 0x410], eax
jge 0x200c1
push 0x400
lea eax, [ebp - 0x404]
push ebx
push eax
call sub.ntoskrnl.exe_memset
push dword [ebp - 0x410]
lea eax, [ebp - 0x404]
push 0x224f0
push 0x3ff
push eax
call fcn.0001e2a6
add esp, 0x1c
jmp 0x20055
push dword [ebp - 0x434]
mov eax, dword [ebp - 0x454]
push dword [ebp - 0x450]
mov ecx, dword [ebp - 0x43c]
push eax
push dword [ebp - 0x40c]
mov dword [ecx], eax
call fcn.0001f0f0
mov dword [ebp - 0x410], eax
pop edi
cmp dword [ebp - 0x40c], ebx
je 0x20108
push dword [ebp - 0x40c]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov dword [ebp - 0x40c], ebx
lea eax, [ebp - 0x418]
push eax
call fcn.0001e0d2
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x410]
pop esi
xor ecx, ebp
pop ebx
call fcn.00020898
leave
ret 0xc