Function at 0x7cf755ba
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
and byte [ebp - 2], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
push esi
mov dword [ebp - 0xc], edi
call dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberW]
push eax
call sym.SHELL32.dll_IsNetDrive
test eax, eax
jne 0x7cf758e6
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x7cf75612
test al, 5
je 0x7cf75612
and al, 0xfa
mov dword [ebp - 0xc], 1
push eax
push esi
call ebx
test eax, eax
je 0x7cf758e6
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x28]
push edi
push eax
push esi
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
test al, al
jne 0x7cf75638
cmp dword [ebp - 0xc], edi
je 0x7cf75631
push dword [ebp - 0x10]
push esi
call ebx
push 3
jmp 0x7cf758e0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x3c]
cmp ax, di
je 0x7cf75651
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
jmp 0x7cf75654
mov dword [ebp - 0x34], edi
mov eax, dword [ebp - 0x34]
push 4
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x54], 0x18
mov dword [ebp - 0x48], 0x40
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edi
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
je 0x7cf7580a
push 0x204040
lea eax, [ebp - 0x20]
mov esi, dword [sym.imp.ntdll.dll_NtOpenFile]
push 7
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 8]
push 0x30080
push eax
call esi
cmp eax, edi
mov dword [ebp - 0x14], eax
jge 0x7cf756f9
cmp eax, 0xc000000d
jne 0x7cf756e1
push 0x4040
lea eax, [ebp - 0x20]
push 7
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 8]
push 0x30000
push eax
call esi
mov esi, eax
cmp esi, edi
jge 0x7cf75859
mov eax, dword fs:[0x18]
jmp 0x7cf75834
mov eax, dword fs:[0x18]
push dword [ebp - 0x18]
mov eax, dword [eax + 0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x7cf75746
push 0x23
lea eax, [ebp - 0x30]
push 8
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov ecx, eax
cmp ecx, edi
mov dword [ebp - 0x14], ecx
jge 0x7cf7574e
cmp ecx, 0xc0000002
je 0x7cf7574e
cmp ecx, 0xc000000d
je 0x7cf7574e
mov eax, dword fs:[0x18]
push dword [ebp - 0x18]
mov eax, dword [eax + 0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtClose]
cmp dword [ebp - 0xc], edi
jmp 0x7cf757f8
cmp ecx, edi
mov eax, 0x400
jl 0x7cf75859
test dword [ebp - 0x30], eax
je 0x7cf7576d
cmp dword [ebp - 0x2c], 0xa0000003
jne 0x7cf7576d
mov byte [ebp - 2], 1
cmp ecx, edi
jl 0x7cf75859
test dword [ebp - 0x30], eax
je 0x7cf75859
cmp byte [ebp - 2], 0
jne 0x7cf75859
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtClose]
push 0x4040
lea eax, [ebp - 0x20]
push 7
push eax
lea eax, [ebp - 0x54]
mov edi, 0x30000
push eax
lea eax, [ebp - 8]
push edi
push eax
call esi
test eax, eax
mov dword [ebp - 0x14], eax
jge 0x7cf75857
cmp eax, 0xc0000279
jne 0x7cf757d7
push 0x204040
lea eax, [ebp - 0x20]
push 7
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 8]
push edi
push eax
call esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jge 0x7cf75857
mov eax, dword fs:[0x18]
push dword [ebp - 0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [ebp - 0xc], 0
je 0x7cf75802
push dword [ebp - 0x10]
push dword [ebp + 8]
call ebx
push dword [ebp - 0x14]
jmp 0x7cf758d9
push 0x4040
lea eax, [ebp - 0x20]
push 7
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 8]
push 0x30000
push eax
call dword [sym.imp.ntdll.dll_NtOpenFile]
mov esi, eax
cmp esi, edi
jge 0x7cf75859
mov eax, dword fs:[0x18]
push dword [ebp - 0x18]
mov eax, dword [eax + 0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [ebp - 0xc], edi
je 0x7cf75851
push dword [ebp - 0x10]
push dword [ebp + 8]
call ebx
push esi
jmp 0x7cf758d9
xor edi, edi
mov eax, dword fs:[0x18]
push dword [ebp - 0x18]
mov eax, dword [eax + 0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push 0xd
lea eax, [ebp - 1]
mov esi, dword [sym.imp.ntdll.dll_NtSetInformationFile]
push 1
push eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 1], 1
push dword [ebp - 8]
call esi
mov edi, eax
test edi, edi
jl 0x7cf758c1
push 0xd
lea eax, [ebp - 1]
and byte [ebp - 1], 0
push 1
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 8]
call esi
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtClose]
cmp dword [ebp - 0xc], 0
je 0x7cf758bc
push dword [ebp - 0x10]
push dword [ebp + 8]
call ebx
push 1
pop eax
jmp 0x7cf758e8
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtClose]
cmp dword [ebp - 0xc], 0
je 0x7cf758d8
push dword [ebp - 0x10]
push dword [ebp + 8]
call ebx
push edi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4