Function at 0x101139c
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 0x14], esi
cmp ebx, esi
je 0x10115f8
push edi
call fcn.010117be
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
je 0x10115c8
lea eax, [ebp - 0x14]
push eax
push 1
call fcn.01011095
test eax, eax
jne 0x10113ec
push 0x1003f20
push 4
call fcn.01011862
pop ecx
pop ecx
jmp 0x10115c8
push esi
push 0x2000000
push 3
push esi
push 7
push 0x100080
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x18], eax
cmp eax, 0xffffffff
jne 0x1011426
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1003ea0
push 4
call fcn.01011862
add esp, 0xc
jmp 0x10115c8
mov eax, 0x400
push eax
push 8
mov dword [ebp + 8], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 8], eax
cmp eax, esi
je 0x10115bf
push 0x2f
push dword [ebp + 8]
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
cmp eax, esi
jge 0x1011471
push eax
push 0x1003e10
push 4
call fcn.01011862
add esp, 0xc
jmp 0x10115b2
mov eax, dword [ebp - 8]
push ebx
cmp dword [eax], esi
jbe 0x1011480
push 0x1003dc8
jmp 0x1011485
push 0x1003d88
push 4
call fcn.01011862
mov eax, dword [ebp - 8]
add esp, 0xc
mov dword [ebp - 4], esi
xor ebx, ebx
mov dword [ebp - 0x10], esi
cmp dword [eax], esi
jbe 0x10115b2
add eax, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], esi
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x40]
push eax
push 0x1000
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x40], 0x18
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
call dword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, esi
jge 0x10114ef
push eax
push 0x1003d08
jmp 0x1011571
lea eax, [ebp + 8]
push eax
push esi
push esi
push 0x1b
push dword [ebp - 4]
mov dword [ebp + 8], esi
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
cmp eax, 0x80000005
je 0x1011520
cmp eax, 0xc0000023
je 0x1011520
cmp eax, 0xc0000004
je 0x1011520
push eax
push 0x1003c48
jmp 0x1011571
push dword [ebp + 8]
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
cmp ebx, esi
jne 0x101153e
push dword [ebp + 8]
push 0x1003be0
jmp 0x1011571
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push ebx
push 0x1b
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
cmp eax, esi
jge 0x101155d
push eax
push 0x1003b48
jmp 0x1011571
cmp word [ebx], si
jbe 0x1011567
push dword [ebx + 4]
jmp 0x101156c
push 0x1003b38
push 0x1003b14
push 4
call fcn.01011862
add esp, 0xc
cmp dword [ebp - 4], esi
je 0x101158c
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [ebp - 4], esi
cmp ebx, esi
je 0x101159d
push ebx
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
inc dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
add dword [ebp - 0xc], 4
cmp ecx, dword [eax]
jb 0x10114a8
push dword [ebp - 8]
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
cmp eax, esi
je 0x10115f7
xor ecx, ecx
cmp dword [eax], 1
jne 0x10115d9
mov ecx, dword [eax + 0xc]
test cl, 2
jne 0x10115e8
push esi
push esi
call fcn.01011095
mov eax, dword [ebp - 0x14]
cmp eax, esi
je 0x10115f7
push eax
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
leave
ret 4