Function at 0x7c810cd9
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [ebp + 0x18]
dec eax
je 0x7c8307cd
dec eax
je 0x7c8113b8
dec eax
jne 0x7c812cd3
mov dword [ebp - 8], 1
push esi
mov esi, dword [ebp + 8]
push edi
push esi
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
xor eax, eax
inc eax
cmp word [ebp - 0x18], ax
jbe 0x7c810d2b
movzx ecx, word [ebp - 0x18]
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0x5c
je 0x7c831bdc
xor edi, edi
mov dword [ebp - 0x10], edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push eax
call fcn.7c810ef1
cmp eax, edi
jne 0x7c81ef75
lea eax, [ebp - 0x40]
push eax
push edi
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
test al, al
je 0x7c835136
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x40]
cmp ax, di
jne 0x7c83550a
mov dword [ebp - 0x38], edi
mov eax, dword [ebp - 0x38]
push ebx
mov ebx, dword [ebp + 0x1c]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x18]
mov ecx, ebx
shr ecx, 0x12
mov dword [ebp - 0x50], eax
mov eax, ebx
not ecx
and ecx, 0x40
and eax, 0x1f0000
test eax, 0x100000
mov dword [ebp - 0x58], 0x18
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], edi
jne 0x7c83072e
mov byte [ebp - 0x2c], 1
mov dword [ebp - 0x30], 2
mov byte [ebp - 0x2b], 1
lea eax, [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x14]
cmp eax, edi
mov dword [ebp - 0x34], 0xc
jne 0x7c81148b
cmp dword [ebp + 0x20], edi
mov esi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebp + 0x14], edi
jne 0x7c83079a
mov eax, ebx
shr eax, 4
mov ecx, 0x8000000
and eax, ecx
mov edx, ebx
and edx, 0x20000000
or eax, edx
shr eax, 1
mov edx, ebx
and edx, ecx
or eax, edx
shr eax, 8
mov ecx, ebx
and ecx, 0x10000000
or eax, ecx
shr eax, 6
mov dword [ebp + 0x20], ebx
and dword [ebp + 0x20], 0x2000000
or eax, dword [ebp + 0x20]
mov ecx, ebx
shr ecx, 0x19
not ecx
and ecx, 0x20
shr eax, 0xb
or eax, ecx
test ebx, 0x4000000
mov ecx, dword [ebp + 0xc]
jne 0x7c830824
mov edx, 0x200000
test edx, ebx
jne 0x7c830775
test ebx, 0x100000
jne 0x7c830758
cmp dword [ebp + 0x20], 0
jne 0x7c83077c
or eax, 0x40
push dword [ebp + 0x14]
and ebx, 0x7fa7
push edi
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x20]
push dword [ebp + 0x10]
or ecx, 0x100080
push ebx
push 0
push eax
lea eax, [ebp - 0x58]
push eax
push ecx
lea eax, [ebp + 8]
push eax
call dword [sym.imp.ntdll.dll_NtCreateFile]
mov ebx, eax
mov eax, dword fs:[0x18]
push dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call esi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
xor edi, edi
push edi
push dword [eax + 0x18]
call esi
cmp ebx, edi
jl 0x7c81160c
cmp dword [ebp + 0x18], 2
je 0x7c8113a4
cmp dword [ebp + 0x18], 4
je 0x7c812ce6
push edi
call fcn.7c80935e
cmp dword [ebp + 0x18], 5
je 0x7c83d60f
mov eax, dword [ebp + 8]
pop ebx
pop edi
pop esi
leave
ret 0x1c
cmp dword [ebp - 0x1c], 3
jne 0x7c810ec8
push 0xb7
jmp 0x7c810ed3
mov dword [ebp - 8], 5
jmp 0x7c810d00
cmp dword [eax + 8], edi
mov edx, dword [eax + 4]
mov dword [ebp - 0x48], edx
je 0x7c810dd1
or ecx, 2
mov dword [ebp - 0x4c], ecx
jmp 0x7c810dd1
push ebx
call fcn.7c809419
cmp ebx, 0xc0000035
je 0x7c82e8fb
cmp ebx, 0xc00000ba
jne 0x7c811636
cmp dword [ebp - 0x10], edi
jne 0x7c83d608
push 5
call fcn.7c80935e
or eax, 0xffffffff
jmp 0x7c810ee5
dec eax
jne 0x7c83d510
mov dword [ebp - 8], 3
jmp 0x7c810d00
cmp dword [ebp - 0x1c], 1
je 0x7c8113ae
jmp 0x7c810ed2
mov edx, dword [ebp + 0x14]
or dword [ebp + 8], 0xffffffff
xor ecx, ecx
cmp edx, edi
jne 0x7c83d537
push 3
push ecx
push dword [ebp + 0xc]
push dword [eax + 4]
call sym.KERNEL32.dll_OpenConsoleW
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x7c836617
push edi
call fcn.7c80935e
mov eax, dword [ebp + 8]
jmp 0x7c810ee6
push 0x50
jmp 0x7c811631
and eax, 0xffefffff
test eax, 0x40000
jne 0x7c830762
mov byte [ebp - 0x2c], 0
test eax, 0x80000
jne 0x7c8358a6
mov byte [ebp - 0x2b], 0
shr eax, 0x10
mov dword [ebp - 0x30], eax
jmp 0x7c810db9
or eax, 0x400000
jmp 0x7c810e55
mov byte [ebp - 0x2c], 1
and eax, 0xfffbffff
jmp 0x7c83073e
or eax, edx
jmp 0x7c810e49
test bl, 0x10
je 0x7c810e62
jmp 0x7c83d5ea
push 7
push 4
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x20]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jl 0x7c810de3
jmp 0x7c83d53f
mov dword [ebp - 8], 2
jmp 0x7c810d00
or eax, 0x1000
or ecx, 0x10000
jmp 0x7c810e3c
ficom word [ecx - 0x14]
dec ebx
push ds
mov cl, 0x11
mov esp, dword [edx + 0x4c]
sbb al, 0xc6
mov cl, 0x14
sub dl, byte [eax - 0x47]
hlt
int1
pop ss
jae 0x7c831c0c
inc esp
movsb byte es:[edi], byte [esi]
cmp byte [ebx + 0x60], bl
or al, 0xe
outsd dx, dword [esi]
mov ds, word [esi + 0x62]
and dword [ebp + 0x69f4e07f], ecx
pop esp
add dword [edx + 0x20], ecx
sbb edx, dword [ebx]
jecxz 0x7c831bf2
and ebp, dword [eax + eax*4 + 0x6d]
xor edi, dword [eax - 0x57]
lodsd eax, dword [esi]
jae 0x7c831c05
pop ds
mov esi, 0xb4854c00
cli
pop ebp
inc eax
jg 0x7c831bb9
cmpsd dword [esi], dword es:[edi]
jl 0x7c831c16
scasd eax, dword es:[edi]
inc ebx
pop es
retf 0x88f1
insd dword es:[edi], dx
insb byte es:[edi], dx
psubusb mm3, qword [eax + eax*8]
cmpsd dword [esi], dword es:[edi]
iretd
xchg ebp, eax
rol dword [edi + 3], cl
cdq
fst qword [ebx - 0x35b48840]
cmp dh, byte [ebp - 0x5477cd59]
push cs
nop
fnstenv [edi - 0xacdb38]
dec eax
mov ah, byte [edx + edi*4 + 0x38]
sbb al, 0x9c
test al, 0x48
les esp, [edi + 0x681fca88]
mov cl, 0x11
aam 0xbb
mov edi, 0x129975e6
inc esp
push 0x81fd6842
popal
push ecx
push ebp
mov eax, 0x26342533
xor bh, byte [ebp + 0x232e3034]
push ecx
call 0xf0735b86
popfd
jne 0x7c836505
imul bh
out dx, eax
jae 0x7c8364af
push ss
pop edi
cmp eax, eax
xchg ebp, eax
dec esp
push ecx
int3
scasb al, byte es:[edi]
lcall 0xf291, 0x65bf3974
mov eax, dword [0x3cfada88]
das
mov dword [0x65e9cef2], eax
xchg esp, eax
dec edi
sub byte [eax - 0x51], bl
jne 0x7c83650e
jecxz 0x7c83650d
pop ds
push ecx
retf
in eax, 0x9f
lodsd eax, dword [esi]
add eax, 0x4e77ca9c
lodsd eax, dword [esi]
mov eax, 0xcd0e6000
jecxz 0x7c83654a
pop esp
mov bh, 0xc4
mov cl, bl
nop
jns 0x7c8365d3
invalid
jle 0x7c836592
and eax, 0x28177032
dec ecx
push es
push esi
pop esp
pushfd
sar byte [esi - 0x760cc51e], 1
mov ch, 0xe2
inc edx
cmp al, 0x41
out 0xe6, al
sbb byte [edx - 0x637f39aa], dl
int 0x9c
pop ebx
cmc
out 0x18, al
xchg edx, eax
push esi
mov byte [eax + 0x5b9ccd9c], 0x65
cmc
retf
jns 0x7c836678
and dword [eax - 0x10d80853], 0xeeb8adb3
out 0xeb, eax
fidiv word [eax + edx*8 + 0x742c4ccd]
xchg edi, eax
jl 0x7c8365d3
or ebx, ebp
sbb eax, 0xf63cb818
jo 0x7c8365ba
div byte [eax - 0x60]
daa
in al, dx
jns 0x7c8365f9
mov ecx, 0xcc4c94c4
invalid
sbb eax, 0xe83a6274
mov ah, 0xe1
mov ax, 0xe63d
push edi
push edx
in al, dx
ret
cmp dword [ecx], ecx
sub esp, edi
cli
push esi
dec ebx
or bh, bh
mov cl, 0xe2
or al, 0xe8
xor dword [eax + edi*8 - 0x18], ecx
inc ebp
test byte [ebx + 0x49817d67], ah
add edx, dword [edx]
mov ebp, 0x149b2bf2
wait
adc al, 0x7e
pop eax
adc al, 0x7e
pop eax
movsb byte es:[edi], byte [esi]
jo 0x7c8366ad
je 0x7c836697
dec esp
push 0xffffffffffffffe8
push edx
xchg ebp, eax
adc byte [esi + 0x4a], 0x20
stosd dword es:[edi], eax
sbb dh, bh
xchg bl, ch
cli
inc ebp
mov eax, 0x5661f175
dec esp
daa
aam 0x68
adc dh, al
jp 0x7c836662
pop esp
push cs
outsb dx, byte [esi]
mov esp, 0xbefd9fa1
sbb ch, byte [ebp + 0x34c5f17b]
in al, 0x81
int1
sub byte [0x1e1754a9], al
dec esp
div dword [esi - 0x5a26d0f]
std
push esp
cwde
jmp dword [ebx - 0x17a8c6c0]
cdq
test dword [ecx + 0x47f29c90], edx
sub ecx, edi
mov eax, 0x99c8ccec
iretd
invalid
dec esi
salc
rol dword [edi + 0x79356efb], cl
outsb dx, byte [esi]
xor eax, 0x4072d79
pop ecx
sub byte [esi - 0x49232fbe], ch
inc edx
sub eax, 0x28590407
scasb al, byte es:[edi]
inc edx
rcr ah, 1
mov dh, 0x42
and byte [esi - 0x2f], dh
jno 0x7c83d60d
retf 0xb125
jl 0x7c83d5e5
fldcw word [eax + edi*8 + 0x20024d27]
daa
dec ebp
add ah, byte [eax]
ljmp 0x98ee:0x8ca58ee8