Function at 0x40d7f2
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
push edi
test esi, esi
je 0x40da60
cmp dword [0x420390], ebx
je 0x40da60
xor ecx, ecx
lea edx, [ebp - 0x18]
inc ecx
call fcn.0040dafd
test eax, eax
jne 0x40d83a
push 0x4032a0
push 4
call fcn.0040fadc
pop ecx
pop ecx
jmp 0x40da33
push ebx
push 0x2000000
push 3
push ebx
push 7
push 0x100080
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 0x14], ebx
cmp ebx, 0xffffffff
jne 0x40d876
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x403318
push 4
call fcn.0040fadc
add esp, 0xc
jmp 0x40da31
mov eax, 0x400
push eax
push 8
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x40da2a
push 0x2f
push dword [ebp - 4]
lea eax, [ebp - 0x28]
push edi
push eax
push ebx
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jns 0x40d8c4
push eax
push 0x403398
push 4
call fcn.0040fadc
add esp, 0xc
xor edx, edx
jmp 0x40da1b
xor eax, eax
push esi
cmp dword [edi], eax
jbe 0x40d8d2
push 0x403428
jmp 0x40d8d7
push 0x403470
push 4
pop esi
push esi
call fcn.0040fadc
xor edx, edx
add esp, 0xc
mov dword [ebp - 8], edx
mov ebx, edx
mov dword [ebp - 0xc], edx
cmp dword [edi], edx
jbe 0x40da18
lea ecx, [edi + 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], edx
mov eax, dword [ecx]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x18
push eax
push 0x1000
lea eax, [ebp - 8]
mov dword [ebp - 0x3c], edx
push eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
call dword [sym.imp.ntdll.dll_NtOpenProcess]
test eax, eax
jns 0x40d93f
push eax
push 0x4034b0
jmp 0x40d9c9
xor ecx, ecx
lea eax, [ebp - 4]
push eax
push ecx
push ecx
push 0x1b
push dword [ebp - 8]
mov dword [ebp - 4], ecx
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
cmp eax, 0x80000005
je 0x40d972
cmp eax, 0xc0000023
je 0x40d972
cmp eax, 0xc0000004
je 0x40d972
push eax
push 0x403530
jmp 0x40d9c9
push dword [ebp - 4]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
jne 0x40d994
push dword [ebp - 4]
push 0x4035f0
jmp 0x40d9c9
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push 0x1b
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
jns 0x40d9b3
push eax
push 0x403658
jmp 0x40d9c9
xor eax, eax
cmp word [ebx], ax
jbe 0x40d9bf
push dword [ebx + 4]
jmp 0x40d9c4
push 0x403710
push 0x4036ec
push esi
call fcn.0040fadc
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x40d9e8
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtClose]
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x40d9ea
xor edx, edx
test ebx, ebx
je 0x40da01
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor edx, edx
mov ebx, edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
inc eax
add ecx, esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
cmp eax, dword [edi]
jb 0x40d8fb
mov ebx, dword [ebp - 0x14]
push edi
push edx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x40da60
cmp dword [esi], 1
mov eax, ebx
jne 0x40da44
mov eax, dword [esi + 0xc]
test al, 2
jne 0x40da51
xor edx, edx
xor ecx, ecx
call fcn.0040dafd
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret