Function at 0x10112ac
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 0x14], esi
cmp ebx, esi
je 0x1011508
push edi
call fcn.010116ce
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
je 0x10114d8
lea eax, [ebp - 0x14]
push eax
push 1
call fcn.01010fa5
test eax, eax
jne 0x10112fc
push 0x1003f20
push 4
call fcn.01011772
pop ecx
pop ecx
jmp 0x10114d8
push esi
push 0x2000000
push 3
push esi
push 7
push 0x100080
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x18], eax
cmp eax, 0xffffffff
jne 0x1011336
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1003ea0
push 4
call fcn.01011772
add esp, 0xc
jmp 0x10114d8
mov eax, 0x400
push eax
push 8
mov dword [ebp + 8], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 8], eax
cmp eax, esi
je 0x10114cf
push 0x2f
push dword [ebp + 8]
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
cmp eax, esi
jge 0x1011381
push eax
push 0x1003e10
push 4
call fcn.01011772
add esp, 0xc
jmp 0x10114c2
mov eax, dword [ebp - 8]
push ebx
cmp dword [eax], esi
jbe 0x1011390
push 0x1003dc8
jmp 0x1011395
push 0x1003d88
push 4
call fcn.01011772
mov eax, dword [ebp - 8]
add esp, 0xc
mov dword [ebp - 4], esi
xor ebx, ebx
mov dword [ebp - 0x10], esi
cmp dword [eax], esi
jbe 0x10114c2
add eax, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], esi
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x40]
push eax
push 0x1000
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x40], 0x18
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
call dword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, esi
jge 0x10113ff
push eax
push 0x1003d08
jmp 0x1011481
lea eax, [ebp + 8]
push eax
push esi
push esi
push 0x1b
push dword [ebp - 4]
mov dword [ebp + 8], esi
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
cmp eax, 0x80000005
je 0x1011430
cmp eax, 0xc0000023
je 0x1011430
cmp eax, 0xc0000004
je 0x1011430
push eax
push 0x1003c48
jmp 0x1011481
push dword [ebp + 8]
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
cmp ebx, esi
jne 0x101144e
push dword [ebp + 8]
push 0x1003be0
jmp 0x1011481
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push ebx
push 0x1b
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
cmp eax, esi
jge 0x101146d
push eax
push 0x1003b48
jmp 0x1011481
cmp word [ebx], si
jbe 0x1011477
push dword [ebx + 4]
jmp 0x101147c
push 0x1003b38
push 0x1003b14
push 4
call fcn.01011772
add esp, 0xc
cmp dword [ebp - 4], esi
je 0x101149c
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [ebp - 4], esi
cmp ebx, esi
je 0x10114ad
push ebx
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
inc dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
add dword [ebp - 0xc], 4
cmp ecx, dword [eax]
jb 0x10113b8
push dword [ebp - 8]
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
cmp eax, esi
je 0x1011507
xor ecx, ecx
cmp dword [eax], 1
jne 0x10114e9
mov ecx, dword [eax + 0xc]
test cl, 2
jne 0x10114f8
push esi
push esi
call fcn.01010fa5
mov eax, dword [ebp - 0x14]
cmp eax, esi
je 0x1011507
push eax
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
leave
ret 4