Function at 0x9244a0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20d4
call fcn.00901340
mov eax, dword [0x98eb88]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x2090], ecx
mov dword [ebp - 0x2084], edx
mov dword [ebp - 0x2094], eax
mov dword [ebp - 0x2080], 0xffffffff
mov dword [ebp - 0x208c], 0xc0000365
mov dword [ebp - 0x2088], 0xffffffd5
push esi
mov esi, dword [ebp + 0x10]
push edi
cmp ebx, 2
je 0x9246ec
mov edi, dword [0x9966b8]
test edi, edi
je 0x9246ec
lea eax, [ebp - 0x207c]
mov dword [ebp - 0x20ac], ecx
push eax
lea eax, [ebp - 0x20b0]
mov dword [ebp - 0x20b0], 0x18
push eax
mov ecx, edi
mov dword [ebp - 0x20a4], 0x40
mov dword [ebp - 0x20a8], edx
mov dword [ebp - 0x20a0], 0
mov dword [ebp - 0x209c], 0
call dword [section..rdata]
call edi
test eax, eax
js 0x92467b
test dword [ebp - 0x204c], 0x400
jne 0x9246e0
mov eax, dword [ebp - 0x2054]
mov ecx, dword [ebp - 0x2050]
push 0
push 0x64
push dword [ebp - 0x2078]
mov dword [esi], eax
mov eax, dword [ebp - 0x205c]
push dword [ebp - 0x207c]
mov dword [esi + 4], ecx
mov ecx, dword [ebp - 0x2058]
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
call fcn.0094c850
push 0
push 0x64
push dword [ebp - 0x2070]
add eax, 0xb3960000
push dword [ebp - 0x2074]
adc edx, 0x5e6684f4
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], edx
call fcn.0094c850
push 0
push 0x64
push dword [ebp - 0x2068]
add eax, 0xb3960000
push dword [ebp - 0x206c]
adc edx, 0x5e6684f4
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
call fcn.0094c850
push 0
push 0x64
push dword [ebp - 0x2060]
add eax, 0xb3960000
push dword [ebp - 0x2064]
adc edx, 0x5e6684f4
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edx
call fcn.0094c850
mov edi, dword [ebp - 0x2094]
add eax, 0xb3960000
push 0
adc edx, 0x5e6684f4
mov dword [esi + 0x20], eax
push 0
push edi
mov dword [esi + 0x24], edx
call fcn.009010a0
add esp, 4
push eax
mov eax, dword [ebp - 0x204c]
and eax, 0x7fff
shl eax, 0x10
push edi
push eax
call fcn.0093b0a0
push ebx
push esi
push 0
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ebx
call fcn.00923ec0
add esp, 0x20
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00901200
mov esp, ebp
pop ebp
ret
cmp eax, 0xc0000024
je 0x9246ab
cmp eax, 0xc0000033
je 0x9246ab
cmp eax, 0xc000000d
je 0x9246ab
cmp eax, 0xc0000022
je 0x9246e0
cmp eax, 0xc0000043
je 0x9246e0
push eax
call fcn.00933560
add esp, 4
mov edi, eax
jmp 0x9246d7
push eax
push 0x2078
lea eax, [ebp - 0x207c]
push eax
mov eax, dword [ebp + 0x18]
push eax
push ebx
lea eax, [ebp - 0x20b0]
push esi
push eax
call fcn.00923f60
mov edi, eax
add esp, 0x1c
test edi, edi
jns 0x924e91
cmp edi, 0x34
jne 0x924e8f
mov edx, dword [ebp - 0x2084]
mov ecx, dword [ebp - 0x2090]
mov eax, dword [0x98eba4]
mov edi, 0x4020
mov dword [ebp - 0x2098], eax
test eax, eax
je 0x92470b
test byte [ebp + 0x18], 2
jne 0x92470b
mov edi, 0x204020
push 0
push 0
push edi
push 1
push 7
push 0x80
push 0
lea eax, [ebp - 0x208c]
mov dword [ebp - 0x20b0], 0x18
push eax
lea eax, [ebp - 0x20b0]
mov dword [ebp - 0x20ac], ecx
push eax
push 0x100080
lea eax, [ebp - 0x2080]
mov dword [ebp - 0x20a4], 0x40
push eax
mov dword [ebp - 0x20a8], edx
mov dword [ebp - 0x20a0], 0
mov dword [ebp - 0x209c], 0
call dword [sym.imp.ntdll.dll_NtCreateFile]
cmp eax, 0xc000000d
je 0x92477d
cmp eax, 0xc00000f7
jne 0x9247d5
cmp dword [ebp - 0x2098], 0xffffffff
jne 0x9247d5
test edi, 0x200000
je 0x9247d5
push 0
push 0
and edi, 0xffdfffff
lea eax, [ebp - 0x208c]
push edi
push 1
push 7
push 0x80
push 0
push eax
lea eax, [ebp - 0x20b0]
push eax
push 0x100080
lea eax, [ebp - 0x2080]
push eax
call dword [sym.imp.ntdll.dll_NtCreateFile]
cmp eax, 0xc000000d
je 0x9247d5
mov dword [0x98eba4], 0
test eax, eax
js 0x924ac2
push 0x23
push 8
lea eax, [ebp - 0x20bc]
push eax
lea eax, [ebp - 0x208c]
push eax
push dword [ebp - 0x2080]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jns 0x924811
xor edi, edi
xor eax, eax
mov dword [ebp - 0x20b8], edi
mov dword [ebp - 0x20bc], eax
jmp 0x92481d
mov edi, dword [ebp - 0x20b8]
mov eax, dword [ebp - 0x20bc]
test eax, 0x400
je 0x9248b5
cmp edi, 0xa000000c
je 0x9248b5
mov eax, dword [ebp + 0x18]
test al, 2
jne 0x9248b5
push 0
push 0
push 0x4020
push 1
push 7
push 0x80
push 0
lea eax, [ebp - 0x208c]
mov dword [ebp - 0x208c], 0xc0000365
push eax
lea eax, [ebp - 0x20b0]
mov dword [ebp - 0x2088], 0xffffffd5
push eax
push 0x100080
lea eax, [ebp - 0x20b4]
push eax
call dword [sym.imp.ntdll.dll_NtCreateFile]
test eax, eax
js 0x9248af
push dword [ebp - 0x2080]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [ebp - 0x20b4]
xor edi, edi
mov dword [ebp - 0x2080], eax
mov dword [ebp - 0x20b8], edi
mov dword [ebp - 0x20bc], edi
jmp 0x9248bb
mov edi, dword [ebp - 0x20b8]
mov eax, dword [ebp - 0x2080]
push 0x12
push 0x68
lea ecx, [ebp - 0x207c]
mov dword [ebp - 0x2098], eax
push ecx
lea ecx, [ebp - 0x20c4]
mov dword [ebp - 0x20c4], 0xc0000365
push ecx
push eax
mov dword [ebp - 0x20c0], 0xffffffd5
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jns 0x924907
cmp eax, 0x80000005
je 0x924907
push eax
call fcn.00933560
add esp, 4
jmp 0x924a99
mov eax, dword [ebp - 0x204c]
mov ecx, dword [ebp - 0x2048]
push 0
push 0x64
push dword [ebp - 0x2078]
mov dword [esi], eax
mov eax, dword [ebp - 0x2054]
push dword [ebp - 0x207c]
mov dword [esi + 4], ecx
mov ecx, dword [ebp - 0x2050]
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
call fcn.0094c850
push 0
push 0x64
push dword [ebp - 0x2070]
add eax, 0xb3960000
push dword [ebp - 0x2074]
adc edx, 0x5e6684f4
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], edx
call fcn.0094c850
push 0
push 0x64
push dword [ebp - 0x2068]
add eax, 0xb3960000
push dword [ebp - 0x206c]
adc edx, 0x5e6684f4
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
call fcn.0094c850
push 0
push 0x64
push dword [ebp - 0x2060]
add eax, 0xb3960000
push dword [ebp - 0x2064]
adc edx, 0x5e6684f4
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edx
call fcn.0094c850
add eax, 0xb3960000
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x2094]
adc edx, 0x5e6684f4
mov dword [esi + 0x24], edx
test eax, eax
je 0x9249d7
push eax
call fcn.009010a0
add esp, 4
jmp 0x9249d9
xor eax, eax
push 0
push edi
push eax
mov eax, dword [ebp - 0x205c]
push dword [ebp - 0x2094]
and eax, 0x7fff
shl eax, 0x10
push eax
call fcn.0093b0a0
add esp, 0x14
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ebx
cmp ebx, 2
jne 0x924a8d
mov eax, dword [ebp - 0x2044]
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
cmp eax, 1
ja 0x924a27
mov eax, 1
mov ecx, dword [ebp - 0x2038]
mov dword [esi + 0x40], eax
mov eax, dword [ebp - 0x203c]
push 1
mov dword [esi + 0x48], eax
lea eax, [ebp - 0x207c]
push 0x800
push eax
lea eax, [ebp - 0x20c4]
mov dword [esi + 0x44], 0
push eax
push dword [ebp - 0x2098]
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
call dword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
test eax, eax
jns 0x924a84
cmp eax, 0x80000005
jne 0x924a8d
mov eax, dword [ebp - 0x2074]
mov dword [esi + 0x44], eax
push ebx
push esi
push 0
call fcn.00923ec0
add esp, 0xc
push dword [ebp - 0x2080]
mov edi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test edi, edi
js 0x924b36
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00901200
mov esp, ebp
pop ebp
ret
cmp eax, 0xc0000024
je 0x924b01
cmp eax, 0xc0000033
je 0x924b01
cmp eax, 0xc0000022
je 0x924aeb
cmp eax, 0xc0000043
je 0x924aeb
push eax
call fcn.00933560
add esp, 4
mov edi, eax
jmp 0x924b2d
mov dword [ebp - 0x208c], 0xc0000365
mov dword [ebp - 0x2088], 0xffffffd5
jmp 0x924b36
push eax
push 0x2078
lea eax, [ebp - 0x207c]
push eax
mov eax, dword [ebp + 0x18]
push eax
push ebx
lea eax, [ebp - 0x20b0]
push esi
push eax
call fcn.00923f60
mov edi, eax
add esp, 0x1c
test edi, edi
jns 0x924e8f
cmp edi, 0x34
jne 0x924e8f
push 0
lea eax, [ebp - 0x20d4]
push eax
lea eax, [ebp - 0x20cc]
push eax
push dword [ebp - 0x2084]
call fcn.00923df0
add esp, 0x10
mov edi, dword [ebp - 0x2090]
lea eax, [ebp - 0x20cc]
mov dword [ebp - 0x20b0], 0x18
mov dword [ebp - 0x20a8], eax
lea eax, [ebp - 0x208c]
mov dword [ebp - 0x20ac], edi
push 0
push 0
push 0x4021
push 1
push 7
push 0x80
push 0
push eax
lea eax, [ebp - 0x20b0]
mov dword [ebp - 0x20a4], 0x40
push eax
push 0x100001
lea eax, [ebp - 0x2080]
mov dword [ebp - 0x20a0], 0
push eax
mov dword [ebp - 0x209c], 0
call dword [sym.imp.ntdll.dll_NtCreateFile]
mov dword [ebp - 0x20b4], eax
test eax, eax
js 0x924e0d
mov eax, dword fs:[0x30]
xor edx, edx
mov ecx, dword [eax + 0xa4]
mov eax, dword fs:[0x30]
or edx, dword [eax + 0xa8]
cmp ecx, 5
jb 0x924c02
ja 0x924bfb
test edx, edx
je 0x924c02
mov edi, 0x25
jmp 0x924c07
mov edi, 3
push 0
lea eax, [ebp - 0x20d4]
push eax
push 1
push edi
push 0x2078
lea eax, [ebp - 0x207c]
push eax
lea eax, [ebp - 0x208c]
push eax
push 0
push 0
push 0
push dword [ebp - 0x2080]
call dword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
test eax, eax
js 0x924de3
mov eax, dword [ebp - 0x2054]
mov ecx, dword [ebp - 0x2050]
push 0
push 0x64
push dword [ebp - 0x2070]
mov dword [esi], eax
mov eax, dword [ebp - 0x204c]
push dword [ebp - 0x2074]
mov dword [esi + 4], ecx
mov ecx, dword [ebp - 0x2048]
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
call fcn.0094c850
push 0
push 0x64
push dword [ebp - 0x2068]
add eax, 0xb3960000
push dword [ebp - 0x206c]
adc edx, 0x5e6684f4
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], edx
call fcn.0094c850
push 0
push 0x64
push dword [ebp - 0x2060]
add eax, 0xb3960000
push dword [ebp - 0x2064]
adc edx, 0x5e6684f4
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
call fcn.0094c850
push 0
push 0x64
push dword [ebp - 0x2058]
add eax, 0xb3960000
push dword [ebp - 0x205c]
adc edx, 0x5e6684f4
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edx
call fcn.0094c850
push 0
push dword [ebp - 0x203c]
add eax, 0xb3960000
push dword [ebp - 0x2094]
adc edx, 0x5e6684f4
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edx
call fcn.009010a0
add esp, 4
push eax
mov eax, dword [ebp - 0x2044]
push dword [ebp - 0x2094]
and eax, 0x7fff
shl eax, 0x10
push eax
call fcn.0093b0a0
add esp, 0x14
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ebx
cmp ebx, 2
jne 0x924db6
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
mov dword [esi + 0x40], 1
mov dword [esi + 0x44], 0
cmp edi, 0x25
jne 0x924d69
mov eax, dword [ebp - 0x201c]
mov ecx, dword [ebp - 0x2018]
jmp 0x924d6d
xor eax, eax
xor ecx, ecx
push 1
mov dword [esi + 0x48], eax
lea eax, [ebp - 0x207c]
push 0x800
push eax
lea eax, [ebp - 0x208c]
mov dword [esi + 0x4c], ecx
push eax
push dword [ebp - 0x2080]
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
call dword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
test eax, eax
js 0x924db6
mov eax, dword [ebp - 0x2074]
mov dword [esi + 0x44], eax
push ebx
push esi
push 0
call fcn.00923ec0
add esp, 0xc
mov edi, eax
push dword [ebp - 0x2080]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00901200
mov esp, ebp
pop ebp
ret
push eax
call fcn.00933560
add esp, 4
mov edi, eax
push dword [ebp - 0x2080]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00901200
mov esp, ebp
pop ebp
ret
cmp eax, 0xc0000033
je 0x924e1e
cmp eax, 0xc0000024
je 0x924e1e
push eax
jmp 0x924e85
mov ecx, dword [ebp - 0x2084]
push eax
push 0x2078
lea eax, [ebp - 0x207c]
mov dword [ebp - 0x20b0], 0x18
push eax
push dword [ebp + 0x18]
lea eax, [ebp - 0x20b0]
mov dword [ebp - 0x20ac], edi
push ebx
push esi
push eax
mov dword [ebp - 0x20a4], 0x40
mov dword [ebp - 0x20a8], ecx
mov dword [ebp - 0x20a0], 0
mov dword [ebp - 0x209c], 0
call fcn.00923f60
mov edi, eax
add esp, 0x1c
test edi, edi
jns 0x924e8f
push dword [ebp - 0x20b4]
call fcn.00933560
mov edi, eax
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00901200
mov esp, ebp
pop ebp
ret