Function at 0x434f15
Capabilities:
Get file attributes

Disassembly:
push 0x658
push 0x4744f0
call fcn.00472fb4
mov eax, ecx
mov dword [ebp - 0x650], eax
or dword [ebp - 0x65c], 0xffffffff
xor esi, esi
mov edi, esi
mov dword [ebp - 0x648], edi
mov dword [ebp - 0x644], 8
mov dword [ebp - 0x64c], esi
cmp edx, 0x20
jne 0x43522f
mov dword [ebp - 4], esi
push esi
push 0x2000000
push 3
push esi
push 7
push 0x100080
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 0x65c], ebx
test ebx, ebx
je 0x4351fd
cmp ebx, 0xffffffff
je 0x4351fd
mov eax, dword [ebp - 0x644]
mov dword [ebp - 0x664], esi
mov dword [ebp - 0x660], esi
test edi, edi
je 0x434fc2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
neg eax
sbb eax, eax
not eax
and eax, edi
mov dword [ebp - 0x648], eax
mov eax, dword [ebp - 0x644]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x648], edi
test edi, edi
jne 0x434fed
mov dword [ebp - 0x640], 0xc0000017
jmp 0x435223
push 0x2f
push dword [ebp - 0x644]
push edi
lea eax, [ebp - 0x664]
push eax
push ebx
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov dword [ebp - 0x640], eax
test eax, eax
js 0x4351c9
mov eax, dword [edi]
lea eax, [eax*4 + 4]
cmp eax, dword [ebp - 0x644]
jbe 0x435032
mov dword [ebp - 0x640], 0x80000005
jmp 0x435223
mov eax, esi
mov dword [ebp - 0x658], esi
cmp eax, dword [edi]
jae 0x435223
mov eax, dword [edi + eax*4 + 4]
mov dword [ebp - 0x654], eax
push eax
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x660], eax
test eax, eax
je 0x435177
cmp eax, 0xffffffff
je 0x435177
lea ecx, [ebp - 0x64c]
push ecx
push esi
push esi
push 0x1b
push eax
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov dword [ebp - 0x640], eax
cmp eax, 0xc0000004
jne 0x435147
push dword [ebp - 0x64c]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x644], eax
test eax, eax
jne 0x4350bf
mov eax, 0xc0000023
mov dword [ebp - 0x640], eax
jmp 0x435128
push esi
push dword [ebp - 0x64c]
push eax
push 0x1b
push dword [ebp - 0x660]
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov dword [ebp - 0x640], eax
test eax, eax
js 0x435128
push dword [ebp - 0x650]
mov eax, dword [ebp - 0x644]
push dword [eax + 4]
push 0x407300
push 0x30c
lea eax, [ebp - 0x63c]
push eax
call fcn.0042190c
add esp, 0x14
push 0x7c3
ret
pop es
add byte [eax], al
push 0x407348
push esi
lea eax, [ebp - 0x63c]
push eax
push esi
push esi
push 2
call fcn.00434d80
mov eax, dword [ebp - 0x640]
mov ecx, dword [ebp - 0x644]
test ecx, ecx
je 0x435147
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x640]
test eax, eax
je 0x4351b7
push dword [ebp - 0x650]
push dword [ebp - 0x654]
push 0x407388
push 0x30c
lea eax, [ebp - 0x63c]
push eax
call fcn.0042190c
add esp, 0x14
push 0x7d2
jmp 0x4351a1
push dword [ebp - 0x650]
push dword [ebp - 0x654]
push 0x407388
push 0x30c
lea eax, [ebp - 0x63c]
push eax
call fcn.0042190c
add esp, 0x14
push 0x7d9
push 0x407348
push esi
lea eax, [ebp - 0x63c]
push eax
push esi
push esi
push 2
call fcn.00434d80
mov eax, dword [ebp - 0x658]
inc eax
mov dword [ebp - 0x658], eax
jmp 0x43503a
cmp eax, 0x80000005
je 0x4351de
cmp eax, 0xc0000023
je 0x4351de
cmp eax, 0xc0000004
jne 0x435223
mov eax, dword [ebp - 0x644]
add eax, eax
mov dword [ebp - 0x644], eax
mov dword [ebp - 0x668], eax
mov dword [ebp - 0x640], esi
jmp 0x434f8f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x43520f
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x43521d
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, ax
or eax, 0xc0070000
mov dword [ebp - 0x640], eax
mov dword [ebp - 4], 0xfffffffe
call fcn.0043524f
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret